videobook 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -6,6 +6,51 @@ and the package uses [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-10-20
+
+### Changed
+
+- Upgrade to videobook-engine 5.7.1 with official DoltLite 0.51.1 for
+  concurrency, reopened-catalog allocation, schema-conflict recovery, and
+  ignored AUTOINCREMENT sequence fixes. Existing 0.50.9 books retain their
+  format and engine schema.
+
+## [0.2.0] - 2026-10-19
+
+### Added
+
+- `videobook config` lists where every provider key comes from, with secret
+  values masked; `config get`, `config set` and `config unset` edit the
+  data-home `.env` atomically.
+- 1Password support: `op://` references in the environment or `.env` resolve
+  through the 1Password CLI when a server starts, and
+  `videobook setup 1password --op-vault <vault>` reads every key from a vault
+  whose items are named after the keys. `videobook doctor` reports the setup
+  and which keys 1Password supplied.
+- `VIDEOBOOK_YTDLP_PATH` selects the yt-dlp binary.
+- `list_jobs` accepts `job_keys`, the `job_id` strings other tools return.
+
+### Changed
+
+- ffprobe now comes from `@ffprobe-installer/ffprobe`, which installs one
+  native build for the current platform instead of `ffprobe-static`'s builds
+  for every platform. Apple Silicon and Linux arm64 get a bundled ffprobe, and
+  the install is about 300 MB smaller. When npm skips the package's chmod
+  script, videobook marks the binary executable itself.
+- The npm page no longer links to the private source repository, which
+  anonymous visitors cannot open; its homepage is the npm package page.
+- The README states that Windows is not supported yet, and why, instead of
+  calling it untested.
+
+### Fixed
+
+- Downloading videos from URLs works when npm blocked the yt-dlp download:
+  videobook falls back to `yt-dlp` on `PATH`, passes yt-dlp the resolved
+  ffmpeg so format merges work, and fails with install instructions when no
+  yt-dlp exists. `videobook doctor` shows which yt-dlp is used.
+- `videobook run` waits for queued jobs on an already running server too,
+  instead of returning while the job runs, and reports how the job ended.
+
 ## [0.1.0] - 2026-10-19
 
 ### Added

package/README.md

@@ -12,14 +12,14 @@ graph, and every change is recorded as a revision. This package installs one
 ## Requirements
 
 - Node.js 22 or newer.
-- macOS (Apple Silicon or Intel) or Linux (x64 or arm64). Windows x64 has
-  every native binary but is untested.
-- About 1.2 GB of disk. Installing downloads the ffmpeg and yt-dlp binaries
+- macOS (Apple Silicon or Intel) or Linux (x64 or arm64). Windows is not
+  supported yet; see the platform notes.
+- About 800 MB of disk. Installing downloads the ffmpeg and yt-dlp binaries
   from GitHub, and the first video render downloads Chrome Headless Shell
   (about 150 MB) into `~/.cache/videobook/remotion`.
-- `ffmpeg` and `ffprobe` on `PATH` are recommended. Apple Silicon and Linux
-  arm64 always use the system `ffprobe`, and every platform falls back to the
-  system binaries when the bundled ones are missing.
+- Native ffmpeg, ffprobe and yt-dlp builds come with the package. Every
+  platform falls back to `ffmpeg`, `ffprobe` and `yt-dlp` on `PATH` when a
+  bundled binary is missing.
 
 ## Install
 
@@ -39,10 +39,16 @@ npm config set allow-scripts=ffmpeg-static,ytdlp-nodejs,@dolthub/doltlite,usearc
 
 - `ffmpeg-static` downloads ffmpeg, which every media operation needs.
 - `ytdlp-nodejs` downloads yt-dlp, which downloading videos from URLs needs.
+  Without it, videobook uses `yt-dlp` on `PATH` or `VIDEOBOOK_YTDLP_PATH`.
 - `@dolthub/doltlite`, `usearch` and `onnxruntime-node` use prebuilt native
   binaries and only compile or fetch extras on unusual platforms.
 - `esbuild` checks its platform binary for the Remotion renderer.
 
+npm also reports the install script of `@ffprobe-installer/<platform>`, for
+example `@ffprobe-installer/darwin-arm64`. It only marks ffprobe executable,
+which videobook does itself when it starts, so it can stay unapproved. With
+`--strict-allow-scripts`, approve it too.
+
 `videobook doctor` reports anything missing and prints the fix.
 
 ## Run
@@ -57,13 +63,19 @@ videobook run create_book name=demo
 videobook tools                # list tools and their parameters
 videobook gc-books             # reclaim catalog storage in every book
 videobook doctor               # check Node, binaries, native modules and keys
+videobook config               # show where each provider key comes from
+videobook config set FAL_API_KEY op://Private/FAL_API_KEY/password
+videobook setup 1password --op-vault Private
 videobook --version
 ```
 
 Every command accepts `--port <n>` (default 3001), `--library <dir>`,
 `--home <dir>` and `--log-level <silent|error|warn|info|debug>`. Tool
-arguments are `key=value`; values that parse as JSON are passed as JSON. Exit
-codes are 0 for success, 1 for a failure and 2 for a usage error.
+arguments are `key=value`; values that parse as JSON are passed as JSON. When
+a tool queues a job, `run` waits for it to finish, up to `--timeout <s>`
+(default 600), and exits 1 if the job fails. `--no-wait` returns at once,
+except on a server that `run` started for itself, which stops when `run`
+exits. Exit codes are 0 for success, 1 for a failure and 2 for a usage error.
 
 ## Agent hosts
 
@@ -101,26 +113,76 @@ overrides any of them inherited from your shell. Set `VIDEOBOOK_HOME` and
 `VIDEOBOOK_ENV_PATH` in the environment, not in `.env`, because they decide
 which `.env` is read.
 
-Provider keys: `OPENAI_API_KEY`, `KIE_API_KEY`, `XAI_API_KEY`, `FAL_API_KEY`,
+Caches live in `~/.cache/videobook`. Other settings: `PORT`,
+`VIDEOBOOK_FFMPEG_PATH`, `VIDEOBOOK_FFPROBE_PATH`, `VIDEOBOOK_YTDLP_PATH`,
+`VIDEOBOOK_REMOTION_CACHE_DIR`, `VIDEOBOOK_MODEL_CACHE_DIR`,
+`VIDEOBOOK_DOWNLOADS_DIR` and `VIDEOBOOK_LOG_LEVEL`.
+
+## Provider keys
+
+The keys are `OPENAI_API_KEY`, `KIE_API_KEY`, `XAI_API_KEY`, `FAL_API_KEY`,
 `DASHSCOPE_API_KEY`, `ELEVENLABS_API_KEY`, `KIMI_CODING_API_KEY`,
 `X_CLIENT_ID` and `X_CLIENT_SECRET`, `DROPBOX_CLIENT_ID` and
 `DROPBOX_CLIENT_SECRET`, and the `B2_*` storage settings. The server starts
 without any of them; tools that need one report which.
 
-Caches live in `~/.cache/videobook`. Other settings: `PORT`,
-`VIDEOBOOK_FFMPEG_PATH`, `VIDEOBOOK_FFPROBE_PATH`,
-`VIDEOBOOK_REMOTION_CACHE_DIR`, `VIDEOBOOK_MODEL_CACHE_DIR`,
-`VIDEOBOOK_DOWNLOADS_DIR` and `VIDEOBOOK_LOG_LEVEL`.
+A key can come from four places. The first one that has it wins:
+
+1. The environment of the videobook process.
+2. A value in `.env`, set with `videobook config set <KEY> <value>` or from
+   Settings in the web UI.
+3. A 1Password secret reference in `.env`, such as
+   `op://Private/FAL_API_KEY/password`.
+4. A 1Password vault whose items are named after the keys.
+
+`videobook config` lists every key with its source and masks secret values.
+`config get`, `config set` and `config unset` work on one key and edit
+`.env` atomically. `config set` refuses a key that your shell already
+exports, because the exported value would win.
+
+### 1Password
+
+References and vaults need the [1Password CLI](https://developer.1password.com/docs/cli/)
+(`op`). When a server starts, videobook resolves every `op://` value in the
+environment and `.env`, and every key the vault has, in one `op inject` run.
+`videobook run` and `videobook mcp` skip this when they relay to a running
+server.
+
+```bash
+videobook setup 1password --op-vault Private      # use op's own sign-in
+videobook setup 1password --op-vault Apicity --op-token env:OP_SERVICE_ACCOUNT_TOKEN
+videobook doctor                                  # shows which keys came from 1Password
+videobook setup 1password --remove
+```
+
+`setup 1password` saves `VIDEOBOOK_OP_VAULT` and `VIDEOBOOK_OP_SERVICE_TOKEN`
+in `.env`, then lists the vault to report which keys it holds; `--no-verify`
+skips the listing. A vault item supplies a key when its title is the key name,
+and the value is read from its `password` field, for example
+`op://Apicity/OPENAI_API_KEY/password`.
+
+The token setting takes `env:VAR`, `$VAR` or a literal service-account
+token. Prefer `env:VAR`, which keeps the token out of the file. When
+`OP_SERVICE_ACCOUNT_TOKEN` is exported, setup records
+`env:OP_SERVICE_ACCOUNT_TOKEN`. Without a token, `op` uses its own sign-in.
+The token reaches `op` only through its environment, never its arguments.
+
+A reference that does not resolve is left unset, so it is never sent to a
+provider as a key. The server and `videobook doctor` report it. Keys that
+come from 1Password are read-only in Settings.
 
 ## Platform notes
 
-- macOS on Apple Silicon is the primary platform. The bundled ffprobe is an
-  Intel build, so install `ffprobe` with `brew install ffmpeg`.
+- macOS on Apple Silicon is the primary platform.
 - macOS on Intel works, but ONNX Runtime has no Intel Mac build, so semantic
   search is unavailable there.
-- Linux x64 is supported. Linux arm64 needs `ffprobe` from the system package
-  manager.
-- Windows x64 is untested.
+- Linux x64 and arm64 are supported.
+- Windows is not supported yet. Every native dependency has a Windows x64
+  build, but the release smoke test has not passed on Windows. Windows has no
+  SIGTERM, so stopping `videobook serve` from another process ends it without
+  a clean shutdown, and the next start replaces the lock file it leaves. The
+  Release check workflow runs the smoke test on Windows for every release tag
+  without blocking the release.
 
 ## Security
 

package/dist/cli/args.js

@@ -7,7 +7,9 @@ export class CliUsageError extends Error {
     }
 }
 const LOG_LEVELS = new Set(["silent", "error", "warn", "info", "debug"]);
-const COMMANDS = new Set(["serve", "mcp", "run", "tools", "gc-books", "doctor", "version", "help"]);
+const COMMANDS = new Set(["serve", "mcp", "run", "tools", "gc-books", "doctor", "setup", "config", "version", "help"]);
+const CONFIG_ACTIONS = new Set(["list", "get", "set", "unset"]);
+const POSITIONAL_COMMANDS = new Set(["run", "setup", "config"]);
 const DEFAULT_RUN_TIMEOUT_SECONDS = 600;
 const GLOBAL_OPTIONS = {
     port: { type: "string" },
@@ -24,6 +26,8 @@ const COMMAND_OPTIONS = {
     tools: {},
     "gc-books": {},
     doctor: { json: { type: "boolean" } },
+    setup: { "op-vault": { type: "string" }, "op-token": { type: "string" }, "no-verify": { type: "boolean" }, remove: { type: "boolean" } },
+    config: { json: { type: "boolean" } },
 };
 function splitCommand(argv) {
     const [first, ...rest] = argv;
@@ -98,7 +102,7 @@ function parseCommandArgs(command, rest) {
         const parsed = parseArgs({
             args: rest,
             options: { ...GLOBAL_OPTIONS, ...COMMAND_OPTIONS[command] },
-            allowPositionals: command === "run",
+            allowPositionals: POSITIONAL_COMMANDS.has(command),
             strict: true,
         });
         return { values: parsed.values, positionals: parsed.positionals };
@@ -107,6 +111,42 @@ function parseCommandArgs(command, rest) {
         throw new CliUsageError(error instanceof Error ? error.message : String(error));
     }
 }
+function buildSetup(values, positionals, flags) {
+    const [target, ...extra] = positionals;
+    if (target !== "1password" || extra.length > 0)
+        throw new CliUsageError("setup needs a target: videobook setup 1password --op-vault <vault> [--op-token env:OP_SERVICE_ACCOUNT_TOKEN]");
+    const vault = stringValue(values["op-vault"]);
+    const token = stringValue(values["op-token"]);
+    return {
+        command: "setup",
+        target,
+        flags: {
+            ...flags,
+            ...(vault === undefined ? {} : { vault }),
+            ...(token === undefined ? {} : { token }),
+            verify: values["no-verify"] !== true,
+            remove: values.remove === true,
+        },
+    };
+}
+function buildConfig(values, positionals, flags) {
+    const [action = "list", key, value, ...extra] = positionals;
+    if (!CONFIG_ACTIONS.has(action))
+        throw new CliUsageError(`Unknown config action "${action}". Use list, get, set or unset.`);
+    const needsKey = action !== "list";
+    const needsValue = action === "set";
+    const expected = 1 + (needsKey ? 1 : 0) + (needsValue ? 1 : 0);
+    if (positionals.length > Math.max(expected, 1) || extra.length > 0 || (needsKey && !key) || (needsValue && value === undefined)) {
+        throw new CliUsageError("Usage: videobook config list | get <KEY> | set <KEY> <VALUE> | unset <KEY>");
+    }
+    return {
+        command: "config",
+        action: action,
+        key: key ?? null,
+        value: value ?? null,
+        flags: { ...flags, json: values.json === true },
+    };
+}
 function buildCommand(command, values, positionals) {
     const flags = globalFlags(values);
     switch (command) {
@@ -120,6 +160,10 @@ function buildCommand(command, values, positionals) {
         }
         case "doctor":
             return { command, flags: { ...flags, json: values.json === true } };
+        case "setup":
+            return buildSetup(values, positionals, flags);
+        case "config":
+            return buildConfig(values, positionals, flags);
         default:
             return { command, flags };
     }
@@ -170,6 +214,8 @@ export function helpText() {
         "  tools              List the MCP tools and their parameters",
         "  gc-books           Reclaim catalog storage in every book",
         "  doctor             Check Node, media binaries, native modules and keys",
+        "  config [action]    list | get <KEY> | set <KEY> <VALUE> | unset <KEY> in the data-home .env",
+        "  setup 1password    Read keys from a 1Password vault (--op-vault, --op-token)",
         "  version            Print versions",
         "  help               Print this help",
         "",
@@ -182,7 +228,11 @@ export function helpText() {
         "  --open             serve: open the web UI in a browser",
         "  --no-wait          run: do not wait for queued jobs",
         "  --timeout <s>      run: seconds to wait for jobs (default 600)",
-        "  --json             doctor: print machine-readable results",
+        "  --json             doctor, config: print machine-readable results",
+        "  --op-vault <name>  setup 1password: vault whose items are named after the keys",
+        "  --op-token <tok>   setup 1password: service-account token, best as env:VAR",
+        "  --no-verify        setup 1password: skip the op item list check",
+        "  --remove           setup 1password: remove the saved 1Password settings",
         "  -v, --version      Print versions",
         "  -h, --help         Print this help",
         "",

package/dist/cli/config-command.js

@@ -0,0 +1,103 @@
+import { hasControlCharacters, readEnvValues, updateEnvFile } from "../env-file.js";
+import { MANAGED_ENV_KEYS, getDefaultSecretStore, isSecretEnvKey, maskEnvValue, } from "../env-secrets.js";
+import { OP_TOKEN_SETTING, OP_VAULT_SETTING, isOpReference, vaultReference } from "../one-password.js";
+const SETTING_KEYS = [OP_VAULT_SETTING, OP_TOKEN_SETTING];
+const CONFIG_KEYS = [...MANAGED_ENV_KEYS, ...SETTING_KEYS];
+const TOKEN_VARIABLE_FORM = /^(env:|\$)?[A-Z_][A-Z0-9_]*$/u;
+function isSecret(key) {
+    if (key === OP_VAULT_SETTING)
+        return false;
+    if (key === OP_TOKEN_SETTING)
+        return true;
+    return isSecretEnvKey(key);
+}
+function displayValue(key, value) {
+    if (isOpReference(value))
+        return value.trim();
+    if (key === OP_TOKEN_SETTING && TOKEN_VARIABLE_FORM.test(value))
+        return value;
+    return isSecret(key) ? maskEnvValue(value) : value;
+}
+function configuredVault(file) {
+    return process.env[OP_VAULT_SETTING]?.trim() || file[OP_VAULT_SETTING]?.trim() || null;
+}
+function configRow(key, file) {
+    const shell = process.env[key]?.trim();
+    if (shell)
+        return { key, source: "environment", value: displayValue(key, shell) };
+    const stored = file[key]?.trim();
+    if (stored)
+        return { key, source: isOpReference(stored) ? "1password reference" : ".env", value: displayValue(key, stored) };
+    const vault = configuredVault(file);
+    if (vault && !SETTING_KEYS.includes(key))
+        return { key, source: "1password vault", value: vaultReference(vault, key) };
+    return { key, source: "missing", value: null };
+}
+function vaultNote(rows, vault) {
+    if (!vault || !rows.some((row) => row.source === "1password vault"))
+        return "";
+    return `\nKeys marked "1password vault" come from ${vault} when it has an item with that name; videobook doctor shows which do.\n`;
+}
+function printRows(rows, file, json, envPath) {
+    const vault = configuredVault(file);
+    if (json) {
+        process.stdout.write(`${JSON.stringify({ envPath, vault, keys: rows }, null, 2)}\n`);
+        return;
+    }
+    const lines = rows.map((row) => `${row.key.padEnd(28)} ${row.source.padEnd(20)} ${row.value ?? ""}`.trimEnd());
+    process.stdout.write(`${lines.join("\n")}\n${vaultNote(rows, vault)}`);
+}
+function knownKey(key) {
+    if (CONFIG_KEYS.includes(key))
+        return true;
+    process.stderr.write(`${key} is not a videobook setting. Known keys: ${CONFIG_KEYS.join(", ")}\n`);
+    return false;
+}
+function invalidValue(key, value) {
+    if (!value || hasControlCharacters(value))
+        return `${key} needs a non-empty value without control characters`;
+    if (value.includes("'") && value.includes("\""))
+        return `${key} cannot contain both single and double quotes`;
+    if (process.env[key]?.trim())
+        return `${key} is set in the environment, which overrides the .env file; change it where it is exported instead`;
+    return null;
+}
+async function setKey(key, raw, envPath) {
+    const value = raw.trim();
+    const problem = invalidValue(key, value);
+    if (problem) {
+        process.stderr.write(`${problem}\n`);
+        return 1;
+    }
+    await updateEnvFile(envPath, { [key]: value });
+    process.stdout.write(`Set ${key}=${displayValue(key, value)} in ${envPath}\n`);
+    return 0;
+}
+async function unsetKey(key, envPath) {
+    const present = key in readEnvValues(envPath);
+    if (present)
+        await updateEnvFile(envPath, { [key]: null });
+    process.stdout.write(present ? `Removed ${key} from ${envPath}\n` : `${key} was not set in ${envPath}\n`);
+    if (process.env[key]?.trim())
+        process.stderr.write(`Note: ${key} is still set in the environment.\n`);
+    return 0;
+}
+export async function runConfigCommand(command) {
+    const envPath = getDefaultSecretStore().envPath();
+    if (command.action === "list") {
+        const file = readEnvValues(envPath);
+        printRows(CONFIG_KEYS.map((key) => configRow(key, file)), file, command.flags.json, envPath);
+        return 0;
+    }
+    const key = command.key ?? "";
+    if (!knownKey(key))
+        return 1;
+    if (command.action === "get") {
+        const file = readEnvValues(envPath);
+        printRows([configRow(key, file)], file, command.flags.json, envPath);
+        return 0;
+    }
+    if (command.action === "set")
+        return setKey(key, command.value ?? "", envPath);
+    return unsetKey(key, envPath);
+}

package/dist/cli/doctor-command.js

@@ -7,11 +7,13 @@ import { SCHEMA_VERSION } from "videobook-engine/catalog-metadata";
 import { resolvePort } from "./args.js";
 import { dataLayout } from "../data-home.js";
 import { bookManager } from "../engine.js";
-import { MANAGED_ENV_KEYS, getDefaultSecretStore, isSecretEnvKey, maskEnvValue } from "../env-secrets.js";
+import { MANAGED_ENV_KEYS, getDefaultSecretStore } from "../env-secrets.js";
 import { FFMPEG } from "../ffmpeg-binary.js";
-import { FFPROBE } from "../ffprobe-binary.js";
+import { FFPROBE, bundledFfprobe } from "../ffprobe-binary.js";
 import { inspectServerOwner } from "../server-lock.js";
+import { readOnePasswordSettings } from "../one-password.js";
 import { remotionBrowserDir, remotionCacheRoot } from "../remotion/browser.js";
+import { resolveYtdlp } from "../ytdlp-binary.js";
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const UUID_V7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
@@ -107,21 +109,17 @@ async function binaryCheck(id, label, binary, bundled, envName) {
     }
 }
 function ytdlpCheck() {
-    try {
-        const { helpers } = require("ytdlp-nodejs");
-        const binary = helpers.findYtdlpBinary();
-        if (binary)
-            return check({ id: "yt-dlp", label: "yt-dlp", status: "ok", detail: binary, required: false });
-    }
-    catch (error) {
-        return check({ id: "yt-dlp", label: "yt-dlp", status: "warn", detail: message(error), remedy: INSTALL_REMEDY, required: false });
+    const binary = resolveYtdlp();
+    if (binary) {
+        const origin = binary.source === "PATH" ? "from PATH" : binary.source;
+        return check({ id: "yt-dlp", label: "yt-dlp", status: "ok", detail: `${binary.path} (${origin})`, required: false });
     }
     return check({
         id: "yt-dlp",
         label: "yt-dlp",
         status: "warn",
-        detail: "not downloaded; download_video and archive_clip from URLs will fail",
-        remedy: INSTALL_REMEDY,
+        detail: "not found; download_video and archive_clip from URLs will fail",
+        remedy: `${INSTALL_REMEDY}, install yt-dlp on PATH, or set VIDEOBOOK_YTDLP_PATH.`,
         required: false,
     });
 }
@@ -190,6 +188,43 @@ async function renderBrowserCheck() {
         });
     }
 }
+async function opVersion() {
+    try {
+        return (await execFileAsync("op", ["--version"], { timeout: 10_000 })).stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+function describeResolution(resolution) {
+    const filled = resolution.fromReferences.length + resolution.fromVault.length;
+    const vault = resolution.vault ? `vault ${resolution.vault}` : "op:// references";
+    const token = resolution.tokenSource ? `token ${resolution.tokenSource}` : "op's own sign-in";
+    return `${vault}, ${token}: ${filled} key(s) from 1Password`;
+}
+function unresolvedDetail(resolution) {
+    const failures = resolution.unresolved.map((item) => `${item.key} from ${item.reference} (${item.reason})`);
+    return [resolution.error, ...failures].filter((part) => Boolean(part)).join("; ");
+}
+async function onePasswordCheck() {
+    const resolution = getDefaultSecretStore().onePasswordResolution();
+    const version = await opVersion();
+    const cli = version ? `op ${version}` : "op not on PATH";
+    if (!resolution?.attempted) {
+        const tokenSource = readOnePasswordSettings(process.env).token.source;
+        const token = tokenSource ? `token ${tokenSource}, ` : "";
+        return check({ id: "one-password", label: "1Password", status: "ok", detail: `not used (${token}${cli}); to read keys from a vault: videobook setup 1password --op-vault <vault>`, required: false });
+    }
+    const problems = unresolvedDetail(resolution);
+    return check({
+        id: "one-password",
+        label: "1Password",
+        status: problems ? "warn" : "ok",
+        detail: `${describeResolution(resolution)}${problems ? `; unresolved: ${problems}` : ""} (${cli})`,
+        ...(problems ? { remedy: "Check the references and the service-account token, or run videobook setup 1password again." } : {}),
+        required: false,
+    });
+}
 function providerKeysCheck() {
     const store = getDefaultSecretStore();
     const configured = MANAGED_ENV_KEYS.filter((key) => key.endsWith("_API_KEY") && store.getSource(key) !== "missing");
@@ -203,10 +238,7 @@ function providerKeysCheck() {
             required: false,
         });
     }
-    const shown = configured.map((key) => {
-        const value = store.getValue(key) ?? "";
-        return `${key}=${isSecretEnvKey(key) ? maskEnvValue(value) : value} (${store.getSource(key)})`;
-    });
+    const shown = configured.map((key) => `${key} (${store.getSource(key)})`);
     return check({ id: "provider-keys", label: "Provider keys", status: "ok", detail: shown.join(", "), required: false });
 }
 async function ownerCheck(port) {
@@ -225,11 +257,12 @@ async function collectDoctorChecks() {
         await dataHomeCheck(),
         await libraryCheck(),
         await binaryCheck("ffmpeg", "ffmpeg", FFMPEG, bundledPath("ffmpeg-static"), "VIDEOBOOK_FFMPEG_PATH"),
-        await binaryCheck("ffprobe", "ffprobe", FFPROBE, bundledPath("ffprobe-static"), "VIDEOBOOK_FFPROBE_PATH"),
+        await binaryCheck("ffprobe", "ffprobe", FFPROBE, bundledFfprobe(), "VIDEOBOOK_FFPROBE_PATH"),
         ytdlpCheck(),
         nativeCoreCheck(),
         searchRuntimeCheck(),
         await renderBrowserCheck(),
+        await onePasswordCheck(),
         providerKeysCheck(),
         await ownerCheck(resolvePort(process.env)),
     ];
@@ -248,6 +281,7 @@ function doctorExitCode(checks) {
     return checks.some((item) => item.required && item.status === "fail") ? 1 : 0;
 }
 export async function runDoctorCommand(flags) {
+    getDefaultSecretStore().resolveOnePassword();
     const checks = await collectDoctorChecks();
     const code = doctorExitCode(checks);
     process.stdout.write(flags.json ? `${JSON.stringify({ ok: code === 0, checks }, null, 2)}\n` : renderText(checks));

package/dist/cli/key-report.js

@@ -0,0 +1,16 @@
+import { getDefaultSecretStore } from "../env-secrets.js";
+export function onePasswordSummary() {
+    const resolution = getDefaultSecretStore().onePasswordResolution();
+    if (!resolution?.attempted)
+        return null;
+    const filled = resolution.fromReferences.length + resolution.fromVault.length;
+    const vault = resolution.vault ? ` (vault ${resolution.vault})` : "";
+    return `${filled} key(s) from 1Password${vault}`;
+}
+export function onePasswordWarnings() {
+    const resolution = getDefaultSecretStore().onePasswordResolution();
+    if (!resolution?.attempted)
+        return [];
+    const failures = resolution.unresolved.map((item) => `could not resolve ${item.key} from ${item.reference}: ${item.reason}`);
+    return resolution.error ? [resolution.error, ...failures] : failures;
+}

package/dist/cli/main.js

@@ -46,8 +46,20 @@ async function runCommand(parsed) {
             const { runDoctorCommand } = await import("./doctor-command.js");
             return runDoctorCommand(parsed.flags);
         }
+        case "setup": {
+            const { runSetupCommand } = await import("./setup-command.js");
+            return runSetupCommand(parsed.flags);
+        }
+        case "config": {
+            const { runConfigCommand } = await import("./config-command.js");
+            return runConfigCommand(parsed);
+        }
     }
 }
+async function loadDotenv() {
+    const { getDefaultSecretStore } = await import("../env-secrets.js");
+    getDefaultSecretStore().loadDotenv();
+}
 async function main(argv) {
     const parsed = parseOrReport(argv);
     if (typeof parsed === "number")
@@ -63,7 +75,8 @@ async function main(argv) {
     applyFlagsToEnv(parsed.flags, process.env, process.cwd());
     if (parsed.command !== "serve")
         redirectConsoleToStderr();
-    await import("../load-env.js");
+    if (parsed.command !== "setup" && parsed.command !== "config")
+        await loadDotenv();
     return runCommand(parsed);
 }
 function flushed(stream) {

package/dist/cli/mcp-command.js

@@ -1,5 +1,6 @@
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { resolvePort } from "./args.js";
+import { onePasswordSummary, onePasswordWarnings } from "./key-report.js";
 import { connectUpstream, createRelayServer } from "./mcp-relay.js";
 import { bookManager, scopedEngine } from "../engine.js";
 import { logger } from "../logger.js";
@@ -51,6 +52,11 @@ async function serveInProcess(running) {
     const instructions = serverInstructions(running.url);
     const handle = serveStdio(() => createServer(scopedEngine, bookManager, { instructions }), { onerror: reportStdioError });
     process.stderr.write(`videobook mcp: serving stdio; web UI and HTTP MCP at ${running.url}/ for library ${running.libraryDir}\n`);
+    const keys = onePasswordSummary();
+    if (keys)
+        process.stderr.write(`videobook mcp: ${keys}\n`);
+    for (const warning of onePasswordWarnings())
+        process.stderr.write(`videobook mcp: ${warning}\n`);
     const code = await Promise.race([stdinEnded(), signalled(), hydrationFailure(running)]);
     await handle.close();
     await running.close();