@aarmos/cli 0.2.0 → 0.2.2

package/dist/index.js

@@ -5,8 +5,10 @@ import { Command as Command9 } from "commander";
 
 // src/commands/init.ts
 import { Command } from "commander";
-import { mkdirSync, writeFileSync, existsSync } from "fs";
-import { join } from "path";
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, cpSync, mkdtempSync, rmSync } from "fs";
+import { join, dirname, relative } from "path";
+import { tmpdir } from "os";
+import { spawnSync } from "child_process";
 
 // src/lib/keys.ts
 import { generateKeyPairSync } from "crypto";
@@ -53,13 +55,102 @@ var GITIGNORE_TEMPLATE = `# Aarmos local state
 .aarmos/keys/
 .aarmos/avar/
 `;
+var TEMPLATES = {
+  hello: {
+    description: "Minimal \u2014 policy + a single echo playbook. Great first run.",
+    files: {
+      "playbooks/hello.md": '# hello\n\nOne-step playbook. Ask the agent to echo a greeting.\n\n## steps\n\n1. Say: "hello from aarmos"\n',
+      "policy.aarmos.toml": `# hello template \u2014 deny-by-default, no external tools.
+[defaults]
+gates.destructive = "deny"
+rate.per_minute   = 30
+`
+    }
+  },
+  mcp: {
+    description: "MCP starter \u2014 one MCP adapter wired with a read-only scope.",
+    files: {
+      "policy.aarmos.toml": `# mcp template \u2014 one MCP adapter, read-only scope.
+[defaults]
+gates.destructive = "confirm"
+rate.per_minute   = 60
+
+[[adapters.mcp]]
+name   = "example"
+url    = "https://mcp.example.com/server"
+scopes = ["read:*"]
+`,
+      "playbooks/mcp-probe.md": "# mcp-probe\n\nList tools exposed by the configured MCP server and print their schemas. Read-only.\n"
+    }
+  },
+  policy: {
+    description: "ASP starter \u2014 YAML policy-as-code with a golden test.",
+    files: {
+      "asp.yaml": `# ASP \u2014 Agent Security Policy (draft)
+version: asp/1
+defaults:
+  gates:
+    destructive: confirm
+  rate:
+    per_minute: 60
+rules:
+  - id: deny-shell
+    when:
+      tool: "shell.*"
+    decision: deny
+    reason: "Shell tools are not permitted in this workspace."
+`,
+      "policies/tests/deny-shell.yaml": `# golden test \u2014 shell.* must be denied
+input:
+  tool: shell.exec
+  args: { cmd: "ls" }
+expect:
+  decision: deny
+  source: workspace-policy
+`
+    }
+  }
+};
+var IMPORT_ALLOWLIST = [
+  "policy.aarmos.toml",
+  "avar.config.json",
+  "asp.yaml",
+  "asp.yml",
+  "policies",
+  "playbooks",
+  ".aarmos/packs"
+];
 function initCommand() {
-  return new Command("init").description("Scaffold policy.aarmos.toml, avar.config.json, and local signing key").option("--force", "Overwrite existing files", false).action(async (opts) => {
+  return new Command("init").description("Scaffold policy.aarmos.toml, avar.config.json, and local signing key").option("--force", "Overwrite existing files", false).option(
+    "--template <name>",
+    `Embedded starter template: ${Object.keys(TEMPLATES).join(" | ")}. Writes template files before defaults; existing files are preserved unless --force.`
+  ).option(
+    "--from <repo>",
+    "Seed policies/playbooks from a GitHub repo (owner/repo[#ref][/subdir]) or tarball URL. Only Aarmos config files are copied; source code and keys are never imported."
+  ).action(async (opts) => {
     const cwd = process.cwd();
     const keyDir = join(cwd, ".aarmos", "keys");
     const chainDir = join(cwd, ".aarmos", "avar");
     mkdirSync(keyDir, { recursive: true });
     mkdirSync(chainDir, { recursive: true });
+    if (opts.template) {
+      const name = opts.template;
+      const tpl = TEMPLATES[name];
+      if (!tpl) {
+        console.error(
+          `\u2717 unknown template "${opts.template}". Known: ${Object.keys(TEMPLATES).join(", ")}`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      console.log(`\u25B8 template: ${name} \u2014 ${tpl.description}`);
+      for (const [rel, contents] of Object.entries(tpl.files)) {
+        writeIfMissing(join(cwd, rel), contents, opts.force);
+      }
+    }
+    if (opts.from) {
+      await seedFromRepo(opts.from, cwd, opts.force);
+    }
     writeIfMissing(join(cwd, "policy.aarmos.toml"), POLICY_TEMPLATE, opts.force);
     writeIfMissing(join(cwd, "avar.config.json"), AVAR_CONFIG_TEMPLATE, opts.force);
     const gitignorePath = join(cwd, ".aarmos", ".gitignore");
@@ -78,16 +169,111 @@ function writeIfMissing(path, content, force) {
     console.log(`\xB7 skipped (exists): ${path}`);
     return;
   }
+  mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, content);
   console.log(`\u2713 wrote: ${path}`);
 }
+function parseFrom(from) {
+  if (from.startsWith("http://") || from.startsWith("https://")) {
+    return { tarballUrl: from, subdir: "", label: from };
+  }
+  const hashIdx = from.indexOf("#");
+  const [pathPart, refPart] = hashIdx >= 0 ? [from.slice(0, hashIdx), from.slice(hashIdx + 1)] : [from, "main"];
+  const segs = pathPart.split("/").filter(Boolean);
+  if (segs.length < 2) throw new Error(`--from: expected owner/repo, got "${from}"`);
+  const [owner, repo, ...rest] = segs;
+  const subdir = rest.join("/");
+  return {
+    tarballUrl: `https://codeload.github.com/${owner}/${repo}/tar.gz/refs/heads/${refPart}`,
+    subdir,
+    label: `${owner}/${repo}${refPart !== "main" ? `#${refPart}` : ""}${subdir ? `/${subdir}` : ""}`
+  };
+}
+async function seedFromRepo(from, cwd, force) {
+  const parsed = parseFrom(from);
+  console.log(`\u25B8 seeding from ${parsed.label}`);
+  const staging = mkdtempSync(join(tmpdir(), "aarmos-init-"));
+  try {
+    const res = await fetch(parsed.tarballUrl);
+    if (!res.ok) throw new Error(`fetch ${parsed.tarballUrl}: ${res.status}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    const tarPath = join(staging, "src.tar.gz");
+    writeFileSync(tarPath, buf);
+    const extractDir = join(staging, "extract");
+    mkdirSync(extractDir);
+    const tar = spawnSync("tar", ["-xzf", tarPath, "-C", extractDir, "--strip-components=1"], {
+      stdio: ["ignore", "inherit", "inherit"]
+    });
+    if (tar.status !== 0) throw new Error("tar extract failed (is `tar` on PATH?)");
+    const root = parsed.subdir ? join(extractDir, parsed.subdir) : extractDir;
+    if (!existsSync(root)) throw new Error(`subdir not found in repo: ${parsed.subdir}`);
+    let copied = 0;
+    for (const rel of IMPORT_ALLOWLIST) {
+      const src = join(root, rel);
+      if (!existsSync(src)) continue;
+      const dest = join(cwd, rel);
+      if (existsSync(dest) && !force) {
+        console.log(`\xB7 skipped (exists): ${rel}  \u2014 pass --force to overwrite`);
+        continue;
+      }
+      if (statSync(src).isDirectory()) {
+        const violations = findKeyLikeFiles(src);
+        if (violations.length > 0) {
+          console.log(`\u2717 refusing to copy ${rel}: contains key-like files: ${violations.slice(0, 3).join(", ")}`);
+          continue;
+        }
+        mkdirSync(dirname(dest), { recursive: true });
+        cpSync(src, dest, { recursive: true, force });
+      } else {
+        mkdirSync(dirname(dest), { recursive: true });
+        cpSync(src, dest, { force });
+      }
+      console.log(`\u2713 imported: ${rel}`);
+      copied++;
+    }
+    if (copied === 0) {
+      console.log("\xB7 no Aarmos config artifacts found in that repo; falling back to defaults");
+    }
+  } finally {
+    try {
+      rmSync(staging, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function findKeyLikeFiles(dir) {
+  const out = [];
+  const walk = (d) => {
+    for (const name of readdirSync(d)) {
+      const full = join(d, name);
+      const st = statSync(full);
+      if (st.isDirectory()) {
+        walk(full);
+        continue;
+      }
+      if (/\.(key|pem|p12|pfx)$/i.test(name) || /signing\.key$/i.test(name)) {
+        out.push(relative(dir, full));
+        continue;
+      }
+      if (st.size < 32e3) {
+        try {
+          const head = readFileSync(full, "utf8").slice(0, 200);
+          if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(head)) out.push(relative(dir, full));
+        } catch {
+        }
+      }
+    }
+  };
+  walk(dir);
+  return out;
+}
 
 // src/commands/run.ts
 import { Command as Command2 } from "commander";
 import { spawn } from "child_process";
 
 // src/lib/avar.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, readFileSync } from "fs";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
 import { createHash } from "crypto";
 var CHAIN_DIR = ".aarmos/avar";
@@ -131,10 +317,10 @@ function serialize(receipt) {
 }
 
 // src/lib/policy.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { createHash as createHash2 } from "crypto";
 function loadPolicy(path) {
-  const raw = existsSync3(path) ? readFileSync2(path, "utf8") : "";
+  const raw = existsSync3(path) ? readFileSync3(path, "utf8") : "";
   const digest = createHash2("sha256").update(raw).digest("hex");
   return { path, raw, digest };
 }
@@ -242,7 +428,7 @@ function stripHopByHop(headers) {
 
 // src/commands/daemon.ts
 import { Command as Command4 } from "commander";
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
 import { join as join3 } from "path";
 import { spawn as spawn2 } from "child_process";
 var PID_FILE = join3(process.cwd(), ".aarmos", "daemon.pid");
@@ -267,7 +453,7 @@ function daemonCommand() {
       console.log("\xB7 no daemon running");
       return;
     }
-    const pid = Number(readFileSync3(PID_FILE, "utf8"));
+    const pid = Number(readFileSync4(PID_FILE, "utf8"));
     try {
       process.kill(pid);
     } catch {
@@ -280,14 +466,14 @@ function daemonCommand() {
       console.log("stopped");
       return;
     }
-    const pid = Number(readFileSync3(PID_FILE, "utf8"));
+    const pid = Number(readFileSync4(PID_FILE, "utf8"));
     console.log(`running (pid ${pid})`);
   });
   return cmd;
 }
 function isRunning() {
   if (!existsSync4(PID_FILE)) return false;
-  const pid = Number(readFileSync3(PID_FILE, "utf8"));
+  const pid = Number(readFileSync4(PID_FILE, "utf8"));
   try {
     process.kill(pid, 0);
     return true;
@@ -298,7 +484,7 @@ function isRunning() {
 
 // src/commands/verify.ts
 import { Command as Command5 } from "commander";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
 import { unzipSync, strFromU8 } from "fflate";
 
 // ../avar-core/src/canonicalize.ts
@@ -737,7 +923,7 @@ async function runVerify(opts) {
   }
   let bytes;
   try {
-    bytes = readFileSync4(file);
+    bytes = readFileSync5(file);
   } catch (err) {
     return emitError(
       aarmosError("FILE_UNREADABLE", {
@@ -863,7 +1049,7 @@ function verifyCommand() {
 
 // src/commands/lint.ts
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync, readdirSync } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2, readdirSync as readdirSync2 } from "fs";
 import { join as join4, extname } from "path";
 
 // src/lib/asp-compile.ts
@@ -961,12 +1147,12 @@ function keygen() {
 // src/commands/lint.ts
 function collectFiles(target) {
   if (!existsSync6(target)) return [];
-  const st = statSync(target);
+  const st = statSync2(target);
   if (st.isFile()) return [target];
   const out = [];
-  for (const name of readdirSync(target)) {
+  for (const name of readdirSync2(target)) {
     const full = join4(target, name);
-    const s = statSync(full);
+    const s = statSync2(full);
     if (s.isDirectory()) {
       if (name === "tests" || name === "node_modules" || name.startsWith(".")) continue;
       out.push(...collectFiles(full));
@@ -986,7 +1172,7 @@ function lintPath(target) {
     return issues;
   }
   for (const file of files) {
-    const src = readFileSync5(file, "utf8");
+    const src = readFileSync6(file, "utf8");
     const result = compileAspYamlToCanonicalJson(src);
     if (!result.ok) {
       for (const m of result.errors) issues.push({ severity: "error", file, message: m });
@@ -1041,8 +1227,8 @@ function lintCommand() {
 
 // src/commands/test.ts
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join5, extname as extname2, dirname } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { join as join5, extname as extname2, dirname as dirname2 } from "path";
 import { parse as parseYaml2 } from "yaml";
 
 // src/lib/asp-eval.ts
@@ -1086,7 +1272,7 @@ function findAspYaml(startDir) {
       const p = join5(d, cand);
       if (existsSync7(p)) return p;
     }
-    const parent = dirname(d);
+    const parent = dirname2(d);
     if (parent === d) break;
     d = parent;
   }
@@ -1094,12 +1280,12 @@ function findAspYaml(startDir) {
 }
 function collectFixtures(target) {
   if (!existsSync7(target)) return [];
-  const st = statSync2(target);
+  const st = statSync3(target);
   if (st.isFile()) return [target];
   const out = [];
-  for (const name of readdirSync2(target)) {
+  for (const name of readdirSync3(target)) {
     const full = join5(target, name);
-    const s = statSync2(full);
+    const s = statSync3(full);
     if (s.isDirectory()) out.push(...collectFixtures(full));
     else if ((extname2(name) === ".yaml" || extname2(name) === ".yml") && !name.endsWith(".asp.yaml"))
       out.push(full);
@@ -1107,23 +1293,23 @@ function collectFixtures(target) {
   return out;
 }
 function runFixtures(target) {
-  const dir = existsSync7(target) && statSync2(target).isDirectory() ? target : "policies/tests";
+  const dir = existsSync7(target) && statSync3(target).isDirectory() ? target : "policies/tests";
   const fixtures = collectFixtures(existsSync7(dir) ? dir : target);
   const results = [];
   for (const file of fixtures) {
     let fx;
     try {
-      fx = parseYaml2(readFileSync6(file, "utf8"));
+      fx = parseYaml2(readFileSync7(file, "utf8"));
     } catch (err) {
       results.push({ file, name: "<parse>", ok: false, reason: err.message });
       continue;
     }
-    const policyPath = fx.policy ? join5(dirname(file), fx.policy) : findAspYaml(dirname(file));
+    const policyPath = fx.policy ? join5(dirname2(file), fx.policy) : findAspYaml(dirname2(file));
     if (!policyPath || !existsSync7(policyPath)) {
       results.push({ file, name: "<policy>", ok: false, reason: "no asp.yaml found" });
       continue;
     }
-    const compiled = compileAspYamlToCanonicalJson(readFileSync6(policyPath, "utf8"));
+    const compiled = compileAspYamlToCanonicalJson(readFileSync7(policyPath, "utf8"));
     if (!compiled.ok) {
       results.push({ file, name: "<compile>", ok: false, reason: compiled.errors.join("; ") });
       continue;
@@ -1162,14 +1348,44 @@ ${results.length - failed.length}/${results.length} passed.
 
 // src/commands/policy.ts
 import { Command as Command8 } from "commander";
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync4, watch as fsWatch, statSync as statSync4 } from "fs";
+import { dirname as dirname3, resolve } from "path";
 function readAspOrDie(path) {
   if (!existsSync8(path)) {
     process.stderr.write(`\u2717 file not found: ${path}
 `);
     process.exit(1);
   }
-  return readFileSync7(path, "utf8");
+  return readFileSync8(path, "utf8");
+}
+function runPolicyOnce(policyPath, testsDir, opts = {}) {
+  const started = Date.now();
+  let output = `
+\u25B8 ${(/* @__PURE__ */ new Date()).toLocaleTimeString()}  ${opts.label ?? policyPath}
+`;
+  const src = readFileSync8(policyPath, "utf8");
+  const compiled = compileAspYamlToCanonicalJson(src);
+  if (!compiled.ok) {
+    for (const m of compiled.errors) output += `  \u2717 compile: ${m}
+`;
+    return { ok: false, output, passed: 0, total: 0 };
+  }
+  const toolCount = (compiled.body.policy.allowedTools?.length ?? 0) + (compiled.body.policy.deniedTools?.length ?? 0);
+  output += `  \u2713 compiled  (${toolCount} tool rule[s], issuer=${compiled.body.issuer?.pubKey ?? "(unsigned)"})
+`;
+  if (!existsSync8(testsDir)) {
+    output += `  \xB7 no fixtures at ${opts.testsLabel ?? testsDir} \u2014 skipping tests
+`;
+    return { ok: true, output, passed: 0, total: 0 };
+  }
+  const results = runFixtures(testsDir);
+  const failed = results.filter((r) => !r.ok);
+  for (const r of failed) output += `  \u2717 ${r.file} :: ${r.name} \u2014 ${r.reason}
+`;
+  const passed = results.length - failed.length;
+  output += `  ${failed.length === 0 ? "\u2713" : "\u2717"} ${passed}/${results.length} passed  (${Date.now() - started}ms)
+`;
+  return { ok: failed.length === 0, output, passed, total: results.length };
 }
 function policyCommand() {
   const cmd = new Command8("policy").description("Compile / sign ASP YAML policies.");
@@ -1224,6 +1440,46 @@ AARMOS_POLICY_PRIVATE_KEY (keep secret):
 `
     );
   });
+  cmd.command("watch <file>").description(
+    "Recompile ASP YAML on save and re-run fixtures. Zero network, zero side effects \u2014 the tightest feedback loop for authoring policy."
+  ).option("--tests <dir>", "Fixtures directory to re-run on each change", "policies/tests").option("--debounce <ms>", "Debounce interval in ms", "150").action((file, opts) => {
+    const policyPath = resolve(file);
+    if (!existsSync8(policyPath)) {
+      process.stderr.write(`\u2717 file not found: ${policyPath}
+`);
+      process.exit(1);
+    }
+    const testsDir = resolve(opts.tests);
+    const debounceMs = Math.max(0, Number(opts.debounce) || 150);
+    const runOnce = () => {
+      const { output } = runPolicyOnce(policyPath, testsDir, { label: file, testsLabel: opts.tests });
+      process.stdout.write(output);
+    };
+    process.stdout.write(`aarmos policy watch
+  policy : ${policyPath}
+  tests  : ${testsDir}
+`);
+    runOnce();
+    let timer = null;
+    const schedule = () => {
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(runOnce, debounceMs);
+    };
+    const watchTarget = (p) => {
+      try {
+        const st = statSync4(p);
+        const opts2 = st.isDirectory() ? { recursive: true } : void 0;
+        fsWatch(p, opts2, () => schedule());
+      } catch {
+      }
+    };
+    watchTarget(policyPath);
+    watchTarget(dirname3(policyPath));
+    if (existsSync8(testsDir)) watchTarget(testsDir);
+    process.stdout.write("\nwatching for changes \u2014 Ctrl+C to exit\n");
+    setInterval(() => {
+    }, 1 << 30);
+  });
   return cmd;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarmos/cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Aarmos CLI — run any agent locally, across any protocol (MCP, OpenAPI, deep-link), with a signed AVAR receipt on every execution. Sovereign runtime, universal tool gateway, verifiable governance.",
   "keywords": [
     "aarmos",