[paulkr]

Why

Eight eMudhra intermediate CAs were issued with 8-bit private keys, so anyone can compute them and sign a valid-looking certificate for any domain, including api.withone.ai. Node.js blocks them inside the TLS handshake from 22.23.4, 24.22.1 and 26.12.1 (nodejs/node#66871, shipped 2026-10-21). Node 18, 20, 23 and 25 are end-of-life and will never get the fix.

The CLI doesn't ship a runtime. It runs on whatever node the user has, so the Node release only protects users who upgrade. This PR makes that upgrade mandatory.

Alternative to #215. That PR filters CA roots in userland. It fails CI on Node 18, and on older Node it matches and removes AAA Certificate Services (the legacy Comodo/Sectigo root) by name. It also can't act on the old Node lines that need it most; there it only warns. Node's fix blocks the eight intermediates by key, which userland can't do, so we require it instead.

What

• Startup check. src/node-check.ts is its own tsup entry, and its shared chunk has no other imports. bin/cli.js runs it before loading the CLI or opening any connection. On an unpatched Node it exits 1.
  • People see the reason and the command that updates Node for how it was installed: nvm, nvm-windows, Volta, fnm or Homebrew, otherwise nodejs.org. A line that got the fix (22, 24, 26) stays on its line; an end-of-life line moves to 24.
  • Agents (--agent) get JSON with code: "NODE_UPGRADE_REQUIRED", currentNode, requiredNode and upgrade.
• Escape hatch. ONE_ALLOW_UNPATCHED_NODE=1 runs anyway, with a security warning on every run. The warning is silent in agent mode, where stderr would corrupt the JSON. It's documented in the README only, not in the agent error or the skill.
• Library consumers are unaffected: the check runs only in the one binary. nodeHasTlsFix is exported so they can check for themselves.
• engines.node: >=18 → ^22.23.4 || ^24.22.1 || >=26.12.1. CI matrix: 18/20/22 → 22/24/26. tsup target: node18 → node22.
• Docs: README, skills/one/SKILL.md, guide-content.ts (show the user the upgrade command instead of retrying), CLAUDE.md, and the run-tests.mjs comment.
• Version 2.9.2. This is a patch release, so ^2 dependents get the check too. Lockfile version fields edited by hand per CLAUDE.md.

Auto-update installs with --force, which ignores engines. So users on old Node still auto-update to 2.9.2, and then get the upgrade instructions instead of running exposed.

Verified

• Homebrew Node 23.1.0:
  • The CLI refuses with To update: brew upgrade node, exit 1.
  • --agent list returns the JSON error with code and upgrade, exit 1.
  • With ONE_ALLOW_UNPATCHED_NODE=1, it prints the warning and then 2.9.2, exit 0. In agent mode, stdout is clean JSON.
• On the official Node 26.12.1 binary (checksum verified) → prints 2.9.2, exit 0.
• npm run build and npm run typecheck pass. The new node-check.test.ts covers version gating, each version manager, Homebrew formulas and the fallback, and it passes.
• npm test locally: 680 passed, 6 failed. All 6 are the resolveConfig tests in config.test.ts (macOS /private/var vs /var tmpdir path), a file this PR doesn't touch; fix(security): stop trusting the compromised eMudhra roots (v2.9.2) #215 reports the same 6 failing on untouched main.

After merge

• Tag the v2.9.2 release.
• Close fix(security): stop trusting the compromised eMudhra roots (v2.9.2) #215.
• Announce the Node requirement. This is the only way to reach cron-scheduled one sync jobs and installs with auto-update off.
• No npm deprecate: the flaw is in Node, not in older CLI versions.

🤖 Generated with Claude Code