@aarmos/cli 0.2.1 → 0.3.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 
 // src/commands/init.ts
 import { Command } from "commander";
@@ -55,6 +55,62 @@ var GITIGNORE_TEMPLATE = `# Aarmos local state
 .aarmos/keys/
 .aarmos/avar/
 `;
+var TEMPLATES = {
+  hello: {
+    description: "Minimal \u2014 policy + a single echo playbook. Great first run.",
+    files: {
+      "playbooks/hello.md": '# hello\n\nOne-step playbook. Ask the agent to echo a greeting.\n\n## steps\n\n1. Say: "hello from aarmos"\n',
+      "policy.aarmos.toml": `# hello template \u2014 deny-by-default, no external tools.
+[defaults]
+gates.destructive = "deny"
+rate.per_minute   = 30
+`
+    }
+  },
+  mcp: {
+    description: "MCP starter \u2014 one MCP adapter wired with a read-only scope.",
+    files: {
+      "policy.aarmos.toml": `# mcp template \u2014 one MCP adapter, read-only scope.
+[defaults]
+gates.destructive = "confirm"
+rate.per_minute   = 60
+
+[[adapters.mcp]]
+name   = "example"
+url    = "https://mcp.example.com/server"
+scopes = ["read:*"]
+`,
+      "playbooks/mcp-probe.md": "# mcp-probe\n\nList tools exposed by the configured MCP server and print their schemas. Read-only.\n"
+    }
+  },
+  policy: {
+    description: "ASP starter \u2014 YAML policy-as-code with a golden test.",
+    files: {
+      "asp.yaml": `# ASP \u2014 Agent Security Policy (draft)
+version: asp/1
+defaults:
+  gates:
+    destructive: confirm
+  rate:
+    per_minute: 60
+rules:
+  - id: deny-shell
+    when:
+      tool: "shell.*"
+    decision: deny
+    reason: "Shell tools are not permitted in this workspace."
+`,
+      "policies/tests/deny-shell.yaml": `# golden test \u2014 shell.* must be denied
+input:
+  tool: shell.exec
+  args: { cmd: "ls" }
+expect:
+  decision: deny
+  source: workspace-policy
+`
+    }
+  }
+};
 var IMPORT_ALLOWLIST = [
   "policy.aarmos.toml",
   "avar.config.json",
@@ -66,6 +122,9 @@ var IMPORT_ALLOWLIST = [
 ];
 function initCommand() {
   return new Command("init").description("Scaffold policy.aarmos.toml, avar.config.json, and local signing key").option("--force", "Overwrite existing files", false).option(
+    "--template <name>",
+    `Embedded starter template: ${Object.keys(TEMPLATES).join(" | ")}. Writes template files before defaults; existing files are preserved unless --force.`
+  ).option(
     "--from <repo>",
     "Seed policies/playbooks from a GitHub repo (owner/repo[#ref][/subdir]) or tarball URL. Only Aarmos config files are copied; source code and keys are never imported."
   ).action(async (opts) => {
@@ -74,6 +133,21 @@ function initCommand() {
     const chainDir = join(cwd, ".aarmos", "avar");
     mkdirSync(keyDir, { recursive: true });
     mkdirSync(chainDir, { recursive: true });
+    if (opts.template) {
+      const name = opts.template;
+      const tpl = TEMPLATES[name];
+      if (!tpl) {
+        console.error(
+          `\u2717 unknown template "${opts.template}". Known: ${Object.keys(TEMPLATES).join(", ")}`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      console.log(`\u25B8 template: ${name} \u2014 ${tpl.description}`);
+      for (const [rel, contents] of Object.entries(tpl.files)) {
+        writeIfMissing(join(cwd, rel), contents, opts.force);
+      }
+    }
     if (opts.from) {
       await seedFromRepo(opts.from, cwd, opts.force);
     }
@@ -1409,8 +1483,127 @@ AARMOS_POLICY_PRIVATE_KEY (keep secret):
   return cmd;
 }
 
+// src/commands/backup.ts
+import { Command as Command9 } from "commander";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+function verifyBundle2(bytes) {
+  let parsed;
+  try {
+    parsed = JSON.parse(bytes.toString("utf8"));
+  } catch (e) {
+    return {
+      ok: false,
+      code: "BUNDLE_INVALID_JSON",
+      error: `invalid JSON: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return { ok: false, code: "BUNDLE_INVALID_SHAPE", error: "bundle must be a JSON object" };
+  }
+  if (parsed.kind !== "aarmos-ledger-bundle") {
+    return {
+      ok: false,
+      code: "BUNDLE_WRONG_KIND",
+      error: `expected kind "aarmos-ledger-bundle", got ${JSON.stringify(parsed.kind)}`
+    };
+  }
+  if (parsed.version !== 1) {
+    return {
+      ok: false,
+      code: "BUNDLE_UNSUPPORTED_VERSION",
+      error: `unsupported bundle version ${parsed.version}`
+    };
+  }
+  if (!parsed.workspaceId || typeof parsed.workspaceId !== "string") {
+    return { ok: false, code: "BUNDLE_MISSING_WORKSPACE", error: "workspaceId missing" };
+  }
+  if (!parsed.exportedAt || Number.isNaN(Date.parse(parsed.exportedAt))) {
+    return { ok: false, code: "BUNDLE_BAD_TIMESTAMP", error: "exportedAt is not a valid ISO date" };
+  }
+  const settings = Array.isArray(parsed.settings) ? parsed.settings : null;
+  const traces = Array.isArray(parsed.traces) ? parsed.traces : null;
+  if (!settings || !traces) {
+    return {
+      ok: false,
+      code: "BUNDLE_MISSING_ARRAYS",
+      error: "settings and traces must both be arrays"
+    };
+  }
+  const warnings = [];
+  const declared = parsed.counts ?? {};
+  if (typeof declared.settings === "number" && declared.settings !== settings.length) {
+    warnings.push(
+      `counts.settings=${declared.settings} but bundle contains ${settings.length} entries`
+    );
+  }
+  if (typeof declared.traces === "number" && declared.traces !== traces.length) {
+    warnings.push(
+      `counts.traces=${declared.traces} but bundle contains ${traces.length} entries`
+    );
+  }
+  if (settings.length === 0 && traces.length === 0) {
+    warnings.push("bundle is empty \u2014 nothing to restore from");
+  }
+  return {
+    ok: true,
+    workspaceId: parsed.workspaceId,
+    exportedAt: parsed.exportedAt,
+    counts: { settings: settings.length, traces: traces.length },
+    warnings
+  };
+}
+function runBackupVerify(opts) {
+  const { file, json = false, quiet = false } = opts;
+  if (!existsSync9(file)) {
+    if (json) {
+      process.stdout.write(
+        JSON.stringify({ ok: false, code: "FILE_NOT_FOUND", error: `not found: ${file}` }) + "\n"
+      );
+    } else if (!quiet) {
+      process.stderr.write(`\u2717 file not found: ${file}
+`);
+    }
+    return 2;
+  }
+  const result = verifyBundle2(readFileSync9(file));
+  if (json) {
+    process.stdout.write(JSON.stringify(result) + "\n");
+    return result.ok ? 0 : 1;
+  }
+  if (!result.ok) {
+    if (!quiet) process.stderr.write(`\u2717 [${result.code}] ${result.error}
+`);
+    return 1;
+  }
+  if (!quiet) {
+    process.stdout.write(`\u2713 ledger bundle valid
+`);
+    process.stdout.write(`  workspace:  ${result.workspaceId}
+`);
+    process.stdout.write(`  exported:   ${result.exportedAt}
+`);
+    process.stdout.write(`  settings:   ${result.counts.settings}
+`);
+    process.stdout.write(`  traces:     ${result.counts.traces}
+`);
+    for (const w of result.warnings) process.stdout.write(`  ! ${w}
+`);
+    process.stdout.write("\nverified locally \u2014 no Aarmos service was contacted.\n");
+  }
+  return 0;
+}
+function backupCommand() {
+  const cmd = new Command9("backup").description(
+    "Inspect and verify Aarmos ledger backup bundles exported from the app (Settings \u2192 Ledger backup)."
+  );
+  cmd.command("verify").description("Verify a ledger bundle JSON offline (schema + counts).").argument("<bundle>", "Path to aarmos-ledger-*.json exported from the app").option("--json", "Emit machine-readable JSON on stdout").option("--quiet", "Suppress non-error output; exit code carries the verdict").action((bundle, opts) => {
+    process.exit(runBackupVerify({ file: bundle, json: opts.json, quiet: opts.quiet }));
+  });
+  return cmd;
+}
+
 // src/index.ts
-var program = new Command9();
+var program = new Command10();
 program.name("aarmos").description(
   "Run your agent locally, across any protocol, with a signed receipt \u2014 in 60 seconds."
 ).version("0.1.0");
@@ -1422,6 +1615,7 @@ program.addCommand(verifyCommand());
 program.addCommand(lintCommand());
 program.addCommand(testCommand());
 program.addCommand(policyCommand());
+program.addCommand(backupCommand());
 program.parseAsync(process.argv).catch((err) => {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarmos/cli",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Aarmos CLI — run any agent locally, across any protocol (MCP, OpenAPI, deep-link), with a signed AVAR receipt on every execution. Sovereign runtime, universal tool gateway, verifiable governance.",
   "keywords": [
     "aarmos",