@atbash/cli 0.5.12 → 0.5.14

package/dist/commands/connect.js

@@ -40,10 +40,16 @@ exports.registerConnectCommand = registerConnectCommand;
 exports.discover = discover;
 exports.enumerateSkills = enumerateSkills;
 exports.describeSkill = describeSkill;
+exports.relaySafeServers = relaySafeServers;
+exports.safeDescription = safeDescription;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const chalk_1 = __importDefault(require("chalk"));
+const yaml_1 = require("yaml");
+const TOML = __importStar(require("@iarna/toml"));
+const jsonc = __importStar(require("jsonc-parser"));
+const introspect_mcp_1 = require("./introspect-mcp");
 /**
  * `atbash connect <code>` — the local connector.
  *
@@ -59,7 +65,42 @@ const chalk_1 = __importDefault(require("chalk"));
  * The discovery mirrors the dashboard's src/lib/scan/discover.ts and produces
  * the same relay-safe payload the session endpoint expects.
  */
+/**
+ * Official Atbash deployments that legitimately serve the onboarding flow.
+ *
+ * The pairing screen builds `--host` from the page you opened, so every origin
+ * that can host onboarding must appear here. If production were missing, the real
+ * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
+ * genuine article, which is worse than silence: it teaches people and agents to
+ * wave through the one warning that actually catches a swapped host.
+ *
+ * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
+ * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
+ */
+const KNOWN_HOSTS = new Set([
+    "atbash.ai",
+    "www.atbash.ai",
+    "chromia-verified-ai-dev-two.vercel.app",
+    "chromia-verified-ai-agent-scan.vercel.app",
+]);
+/**
+ * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
+ * because it is the one running the current connector API; switch this to
+ * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
+ */
 const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
+// Discovery is intentionally bounded. A local config is untrusted input even
+// though it lives on the operator's machine: a giant/malformed file must not turn
+// a one-shot connector into a memory or latency sink.
+const MAX_CONFIG_BYTES = 2 * 1024 * 1024;
+const MAX_SKILL_BYTES = 256 * 1024;
+const MAX_RELAY_SERVERS = 200;
+const SECRET_DESCRIPTION = [
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/i,
+    /\b(?:sk|pk|ghp|github_pat|xox[baprs]|AKIA)[-_A-Za-z0-9]{12,}\b/,
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/,
+];
 // ── filesystem helpers (all best-effort; never throw) ────────────────────────
 const exists = (...segs) => {
     try {
@@ -70,16 +111,23 @@ const exists = (...segs) => {
     }
 };
 const readJson = (...segs) => {
-    try {
-        return JSON.parse(fs.readFileSync(path.join(...segs), "utf8"));
-    }
-    catch {
+    // JSONC-tolerant: many editor MCP configs (VS Code, Cursor, Windsurf) allow
+    // comments and trailing commas, which JSON.parse rejects — silently reporting
+    // "nothing found" on a perfectly valid config. jsonc-parser is best-effort and
+    // never throws; it returns the parsed value alongside a (here-ignored) error list.
+    const text = readText(MAX_CONFIG_BYTES, ...segs);
+    if (text === undefined)
         return null;
-    }
+    const errors = [];
+    const val = jsonc.parse(text, errors, { allowTrailingComma: true, disallowComments: false });
+    return val && typeof val === "object" && !Array.isArray(val) ? val : null;
 };
-const readText = (...segs) => {
+const readText = (maxBytes, ...segs) => {
     try {
-        return fs.readFileSync(path.join(...segs), "utf8");
+        const file = path.join(...segs);
+        if (fs.statSync(file).size > maxBytes)
+            return undefined;
+        return fs.readFileSync(file, "utf8");
     }
     catch {
         return undefined;
@@ -95,37 +143,32 @@ const listDirs = (...segs) => {
         return [];
     }
 };
-/** One-line skill description from SKILL.md frontmatter `description:` or first heading. */
+/** One-line skill description from SKILL.md frontmatter `description:` or first heading.
+ *  Frontmatter is parsed with a real YAML parser (handles quotes, block scalars,
+ *  folded/multiline values and nested maps that the previous regex mis-read). */
 function describeSkill(text, fallback) {
     if (!text)
         return fallback;
     const frontmatter = (text.match(/^---\r?\n([\s\S]*?)\r?\n---/) || [])[1];
-    const field = frontmatter ? frontmatter.match(/^[ \t]*description:[ \t]*(.*)$/im) : null;
-    if (frontmatter && field) {
-        const inline = field[1].trim();
-        if (/^[>|][+-]?\d*$/.test(inline)) {
-            const lines = [];
-            for (const line of frontmatter.slice((field.index ?? 0) + field[0].length).split(/\r?\n/)) {
-                if (!line.trim()) {
-                    if (lines.length)
-                        break;
-                    continue;
-                }
-                if (!/^[ \t]/.test(line))
-                    break; // dedent ends the block scalar
-                lines.push(line.trim());
-            }
-            const folded = lines.join(" ").trim();
-            if (folded)
-                return folded;
-        }
-        else if (inline) {
-            return inline.replace(/^["']|["']$/g, "").trim();
+    if (frontmatter) {
+        try {
+            const data = (0, yaml_1.parse)(frontmatter);
+            const desc = data && typeof data.description === "string" ? data.description : "";
+            const oneLine = desc.replace(/\s+/g, " ").trim();
+            if (oneLine)
+                return safeDescription(oneLine) ?? fallback;
         }
+        catch { /* malformed frontmatter — fall through to first heading */ }
     }
     const heading = text.split(/\r?\n/).map((l) => l.trim())
         .find((l) => l && !l.startsWith("---") && !/^(name|description):/i.test(l));
-    return heading ? heading.replace(/^#+\s*/, "").trim() : fallback;
+    return heading ? (safeDescription(heading.replace(/^#+\s*/, "").trim()) ?? fallback) : fallback;
+}
+/** Descriptions are useful capability evidence, but never worth relaying a
+ * credential or binary/control content from an untrusted local skill file. */
+function safeDescription(raw) {
+    const value = raw.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 240);
+    return value && !SECRET_DESCRIPTION.some((pattern) => pattern.test(value)) ? value : undefined;
 }
 /** Walk a skills root (bounded) → declared tools. Mirrors src/lib/scan/adapters/local-skills.ts. */
 function enumerateSkills(root, maxDepth = 3, cap = 400) {
@@ -140,9 +183,10 @@ function enumerateSkills(root, maxDepth = 3, cap = 400) {
         catch {
             return;
         }
-        if (entries.some((e) => e.isFile() && e.name === "SKILL.md")) {
+        const skillFile = entries.find((e) => e.isFile() && e.name.toLowerCase() === "skill.md");
+        if (skillFile) {
             const name = path.basename(dir);
-            tools.push({ name, description: describeSkill(readText(dir, "SKILL.md"), `${category} skill`) });
+            tools.push({ name, description: describeSkill(readText(MAX_SKILL_BYTES, dir, skillFile.name), `${category} skill`) });
             return; // a skill folder is a leaf
         }
         for (const e of entries)
@@ -169,18 +213,105 @@ const MCP_CONFIGS = [
  */
 function parseCodexMcpServers(toml) {
     const servers = {};
-    const re = /\[mcp_servers\.(?:"([^"\]]+)"|([A-Za-z0-9_-]+))\]([\s\S]*?)(?=\n\s*\[|$)/g;
-    let m;
-    while ((m = re.exec(toml))) {
-        const body = m[3];
-        if (/^\s*enabled\s*=\s*false\b/m.test(body))
+    let parsed;
+    try {
+        parsed = TOML.parse(toml);
+    }
+    catch {
+        return servers;
+    }
+    const mcp = parsed.mcp_servers && typeof parsed.mcp_servers === "object"
+        ? parsed.mcp_servers : undefined;
+    if (!mcp)
+        return servers;
+    for (const [name, spec] of Object.entries(mcp)) {
+        if (!spec || typeof spec !== "object")
+            continue;
+        const s = spec;
+        if (s.enabled === false)
             continue; // declared but switched off
-        const url = (body.match(/^\s*url\s*=\s*"([^"]*)"/m) || [])[1];
-        const command = (body.match(/^\s*command\s*=\s*"([^"]*)"/m) || [])[1];
-        servers[m[1] || m[2]] = url ? { url } : command ? { command } : {};
+        const url = typeof s.url === "string" ? s.url : undefined;
+        const command = typeof s.command === "string" ? s.command : undefined;
+        servers[name] = url ? { url } : command ? { command } : {};
     }
     return servers;
 }
+/**
+ * Strip a relayed mcpServers map down to the STRUCTURAL fields the hosted scanner
+ * needs to identify/reach a server (name, url, command, type, transport). Every
+ * other field — env, headers, token, apiKey, args, … — can carry live credentials
+ * or local paths and MUST NOT leave the machine. The connector relays the tool
+ * SURFACE, never secrets. (Auth'd servers simply come back "needs credentials";
+ * the hosted scanner degrades gracefully rather than us exfiltrating a token.)
+ */
+/** Strip credentials/query/fragment from an endpoint URL — keep only scheme, host
+ *  and path. `user:pass@` and `?token=…` are live secrets; the host+path is the
+ *  structural signal the hosted scanner needs. Returns undefined if unparseable. */
+function safeServerUrl(raw) {
+    if (typeof raw !== "string" || !raw.trim())
+        return undefined;
+    try {
+        const u = new URL(raw);
+        u.username = "";
+        u.password = "";
+        u.search = "";
+        u.hash = "";
+        return u.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Reduce a launch command to its executable BASENAME — the capability signal
+ *  ("node", "npx", "uvx", "python") — without the absolute path that would leak
+ *  the local username and directory layout (e.g. /Users/alice/private/agent/run).
+ *  Takes the first whitespace token ("npx -y pkg" → "npx"), then basenames it, and
+ *  rejects multiline / absurdly long values outright. */
+function safeServerCommand(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed || /[\r\n]/.test(trimmed) || trimmed.length > 200)
+        return undefined;
+    const first = trimmed.split(/\s+/)[0];
+    const base = path.basename(first);
+    return base || undefined;
+}
+/**
+ * THE sanitization boundary. Reduce an mcpServers map to the SANITIZED structural
+ * signal the hosted scanner needs — server name, host+path of the endpoint, and
+ * executable basename — and nothing else. Every value that could carry a live
+ * secret or PII (env, headers, token, apiKey, args, url credentials, absolute
+ * command paths) is dropped or reduced. The connector relays the tool SURFACE,
+ * never secrets. Raw specs from `readAllMcpServers()` MUST pass through here before
+ * entering any relayed `Agent`.
+ *
+ * Caps the map at MAX_RELAY_SERVERS. Callers are expected to compare the returned
+ * size against the input size and label the result partial — see `discover()`.
+ */
+function relaySafeServers(servers) {
+    const out = {};
+    for (const [name, spec] of Object.entries(servers).slice(0, MAX_RELAY_SERVERS)) {
+        if (!spec || typeof spec !== "object") {
+            out[name] = {};
+            continue;
+        }
+        const s = spec;
+        const safe = {};
+        const url = safeServerUrl(s.url);
+        if (url)
+            safe.url = url;
+        const command = safeServerCommand(s.command);
+        if (command)
+            safe.command = command;
+        if (typeof s.type === "string")
+            safe.type = s.type.slice(0, 40);
+        if (typeof s.transport === "string")
+            safe.transport = s.transport.slice(0, 40);
+        out[name] = safe;
+    }
+    return out;
+}
 /** Enumerate the agents/MCP tools configured on this machine. Read-only. */
 function discover(home) {
     const agents = [];
@@ -198,17 +329,41 @@ function discover(home) {
             tools.push({ name: `plugin:${name}`, description: "Hermes plugin" });
         agents.push({ type: "declared", label: "Hermes", detail: `${tools.length} skill${tools.length === 1 ? "" : "s"} / plugins`, declaredTools: tools });
     }
-    // MCP-config files → config (mcpServers) blobs.
+    // MCP config sources — collected once as RAW specs, then sanitized for relay.
+    for (const { label, servers } of readAllMcpServers(home)) {
+        const count = Object.keys(servers).length;
+        const safe = relaySafeServers(servers);
+        // Say so when the relay cap truncated the map. A payload listing 200 of 250
+        // servers under a bare "250 MCP servers" label reads as complete coverage.
+        const relayed = Object.keys(safe).length;
+        const detail = relayed < count
+            ? `${relayed} of ${count} MCP servers relayed (capped at ${MAX_RELAY_SERVERS} — list is partial)`
+            : `${count} MCP server${count === 1 ? "" : "s"}`;
+        agents.push({ type: "config", label, detail, config: { mcpServers: safe } });
+    }
+    return agents;
+}
+/**
+ * ⚠️ SECURITY INVARIANT — this returns RAW, UNSANITIZED server specs.
+ * The values here contain live secrets: url credentials, `env`, `headers`,
+ * `token`, `apiKey`, and absolute command paths. They exist ONLY so `--introspect`
+ * can reach a server locally. They MUST NEVER be put into the relay payload
+ * directly. Every path that turns these into an `Agent` MUST route them through
+ * `relaySafeServers()` first (the single sanitization boundary). If you add a new
+ * consumer, sanitize before it leaves this file. Callers today: `discover()`
+ * (sanitizes) and the introspection pass (local only, never relayed).
+ */
+function readAllMcpServers(home) {
+    const out = [];
     const seen = new Set();
     for (const { label, segs } of MCP_CONFIGS) {
         if (seen.has(label))
             continue;
         const cfg = readJson(home, ...segs);
         const servers = cfg && typeof cfg === "object" ? (cfg.mcpServers ?? cfg.servers) : undefined;
-        const count = servers && typeof servers === "object" ? Object.keys(servers).length : 0;
-        if (count > 0 && servers) {
+        if (servers && typeof servers === "object" && Object.keys(servers).length > 0) {
             seen.add(label);
-            agents.push({ type: "config", label, detail: `${count} MCP server${count === 1 ? "" : "s"}`, config: { mcpServers: servers } });
+            out.push({ label, servers });
         }
     }
     // Claude Code (~/.claude.json): servers live globally AND per-project — merge both.
@@ -227,19 +382,17 @@ function discover(home) {
         if (projects && typeof projects === "object")
             for (const p of Object.values(projects))
                 collect(p);
-        const count = Object.keys(merged).length;
-        if (count > 0)
-            agents.push({ type: "config", label: "Claude Code", detail: `${count} MCP server${count === 1 ? "" : "s"}`, config: { mcpServers: merged } });
+        if (Object.keys(merged).length > 0)
+            out.push({ label: "Claude Code", servers: merged });
     }
-    // OpenAI Codex CLI (~/.codex/config.toml) — TOML, parsed separately.
-    const codexToml = readText(home, ".codex", "config.toml");
+    // OpenAI Codex CLI (~/.codex/config.toml) — TOML.
+    const codexToml = readText(MAX_CONFIG_BYTES, home, ".codex", "config.toml");
     if (codexToml) {
         const servers = parseCodexMcpServers(codexToml);
-        const count = Object.keys(servers).length;
-        if (count > 0)
-            agents.push({ type: "config", label: "Codex", detail: `${count} MCP server${count === 1 ? "" : "s"}`, config: { mcpServers: servers } });
+        if (Object.keys(servers).length > 0)
+            out.push({ label: "Codex", servers });
     }
-    return agents;
+    return out;
 }
 function registerConnectCommand(program) {
     program
@@ -248,22 +401,195 @@ function registerConnectCommand(program) {
         .argument("<code>", "The pairing code from the onboarding \"Scan another machine\" screen")
         .option("--host <url>", "Atbash deployment hosting your session")
         .option("--home <dir>", "Home directory to scan (for testing)")
+        .option("--dry-run", "Do the read-only scan and print exactly what WOULD be sent (destination + tool names), then exit WITHOUT sending")
+        .option("--json", "Emit machine-readable JSON instead of formatted text (for agents / automation)")
+        .option("--introspect", "Also START configured MCP servers locally and list their advertised tools/resources (introspection-confirmed surface, not runtime behavior), then stop them. Never calls a tool")
+        .option("--allow-unrecognized-host", "Permit relaying to a --host that is not an official Atbash deployment (otherwise the command refuses to send)")
         .action(async (rawCode, opts) => {
         const home = opts.home || os.homedir();
         const host = (opts.host || process.env.ATBASH_HOST || DEFAULT_HOST).replace(/\/+$/, "");
         const code = rawCode.trim().toUpperCase().replace(/[^A-Z0-9-]/g, "");
-        console.log("\n" + chalk_1.default.bold("  Atbash connector"));
+        const machine = os.hostname();
+        const dryRun = !!opts.dryRun;
+        const asJson = !!opts.json;
+        const introspect = !!opts.introspect;
+        const allowUnrecognizedHost = !!opts.allowUnrecognizedHost;
+        const endpoint = `${host}/api/agent-scan/session/${encodeURIComponent(code)}`;
+        // Parsed up front so the destination verdict is available to every output
+        // path, including the JSON one an agent reads before deciding to proceed.
+        let hostUrl = null;
+        try {
+            hostUrl = new URL(host);
+        }
+        catch {
+            hostUrl = null;
+        }
+        const hostname = hostUrl ? hostUrl.hostname.toLowerCase() : "";
+        const isLoopback = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\]|::1)$/.test(hostname);
+        // "Recognized" = an official Atbash deployment (or your own machine for dev).
+        const recognizedHost = KNOWN_HOSTS.has(hostname) || isLoopback;
+        // Machine-readable summary for the --json path AND for any error, so an agent
+        // gets a stable, parseable description of exactly what this command is/was doing.
+        const emitJson = (extra) => console.log(JSON.stringify({
+            tool: "@atbash/cli connect",
+            transmits: (introspect
+                ? "agent/tool/skill names, MCP endpoint URLs, launch command basenames, and MCP-introspected tool names/descriptions"
+                : "agent/tool/skill names, MCP endpoint URLs and launch command basenames")
+                + " — never tokens, auth headers, env values, tool inputs/outputs, or file contents",
+            // Introspection STARTS local MCP servers, so the run is not purely read-only.
+            readOnly: !introspect,
+            startsLocalServers: introspect,
+            requests: dryRun ? 0 : 1,
+            machine, host, endpoint, code,
+            // An agent should treat `recognizedHost: false` as a reason to stop and
+            // ask, not a detail to skim past.
+            recognizedHost, knownHosts: [...KNOWN_HOSTS],
+            ...extra,
+        }, null, 2));
         if (!code) {
-            console.error(chalk_1.default.red("  Missing pairing code.") + " Open the \"Scan another machine\" screen for one.\n");
+            if (asJson)
+                emitJson({ ok: false, error: "missing pairing code" });
+            else
+                console.error("\n" + chalk_1.default.bold("  Atbash connector") + "\n" + chalk_1.default.red("  Missing pairing code.") + " Open the \"Scan another machine\" screen for one.\n");
+            process.exit(1);
+        }
+        // ── destination safety ───────────────────────────────────────────────────
+        // The only place this flow could be turned against you is a swapped --host
+        // pointing the relay at someone else's server. So: refuse a channel that
+        // isn't encrypted, and make an unrecognized destination impossible to miss.
+        const httpsOk = !!hostUrl && (hostUrl.protocol === "https:" || (hostUrl.protocol === "http:" && isLoopback));
+        if (!httpsOk) {
+            const msg = `refusing to send over a non-HTTPS host (${host}) — the relay must travel encrypted`;
+            if (asJson)
+                emitJson({ ok: false, error: msg });
+            else
+                console.error("\n" + chalk_1.default.red(`  ✗ ${msg}.`) + chalk_1.default.dim(" Use an https:// host (localhost may use http).\n"));
+            process.exit(1);
+        }
+        // An unrecognized destination is the one real attack (a swapped --host). A
+        // warning is not enough for the automation path, which skips prompts — so
+        // refuse to SEND to an unknown host unless the operator explicitly opts in.
+        // (--dry-run never sends, so it may proceed to preview.)
+        if (!recognizedHost && !allowUnrecognizedHost && !dryRun) {
+            const msg = `refusing to relay to an unrecognized host (${hostname || host}) — not an official Atbash deployment. Re-run with --allow-unrecognized-host if you trust it.`;
+            if (asJson)
+                emitJson({ ok: false, error: msg });
+            else
+                console.error("\n" + chalk_1.default.red(`  ✗ ${msg}`) + "\n");
             process.exit(1);
         }
-        console.log(chalk_1.default.dim(`  Machine : ${os.hostname()}`));
-        console.log(chalk_1.default.dim(`  Host    : ${host}`));
-        console.log(chalk_1.default.dim(`  Code    : ${code}\n`));
         const agents = discover(home);
+        // ── optional: MCP introspection (starts servers locally) ──────────────────
+        // Turns name-only MCP entries into an introspection-confirmed ADVERTISED
+        // surface. This does not verify implementation behavior. Additive: each
+        // reachable server contributes a declared-tools agent the scanner classifies
+        // exactly like any other. Only sanitized names/descriptions are relayed.
+        if (introspect) {
+            const sources = readAllMcpServers(home);
+            if (sources.length > 0) {
+                if (!asJson)
+                    console.log(chalk_1.default.dim(`  Introspecting ${sources.reduce((n, s) => n + Object.keys(s.servers).length, 0)} MCP server(s) locally (starting & stopping each)…`));
+                const results = await (0, introspect_mcp_1.introspectServers)(sources, {
+                    onProgress: asJson ? undefined : (label, server, res) => console.log(chalk_1.default.dim(`    ${res.ok ? chalk_1.default.green("✓") : chalk_1.default.yellow("•")} ${label} · ${server}${res.ok ? ` → ${res.tools.length} tool(s)` : ` (${res.error ?? "unreachable"})`}`)),
+                });
+                for (const r of results) {
+                    // The introspection pass is capped. Record the shortfall as an
+                    // explicitly INCOMPLETE surface rather than letting those servers
+                    // vanish from a report that otherwise reads as exhaustive.
+                    if (r.omitted) {
+                        const note = `${r.omitted} server(s) in this source were not introspected — the run hit its per-scan server cap`;
+                        if (!asJson)
+                            console.log(chalk_1.default.yellow(`    ! ${r.label} · ${note}`));
+                        agents.push({
+                            type: "declared",
+                            label: `${r.label} · (not introspected)`,
+                            detail: `${r.omitted} MCP server(s) skipped · introspection incomplete`,
+                            declaredTools: [],
+                            surfaceEvidence: {
+                                source: "mcp-tools-list",
+                                status: "incomplete",
+                                observedAt: new Date().toISOString(),
+                                error: note,
+                            },
+                        });
+                    }
+                    for (const s of r.servers) {
+                        if (!s.ok) {
+                            agents.push({
+                                type: "declared",
+                                label: `${r.label} · ${s.server}`,
+                                detail: `MCP ${s.transport} · introspection incomplete`,
+                                declaredTools: [],
+                                surfaceEvidence: {
+                                    source: "mcp-tools-list",
+                                    status: "incomplete",
+                                    transport: s.transport,
+                                    server: s.server,
+                                    observedAt: new Date().toISOString(),
+                                    error: (s.error ?? "unreachable").slice(0, 300),
+                                },
+                            });
+                            continue;
+                        }
+                        const extras = [s.resourceCount ? `${s.resourceCount} resource${s.resourceCount === 1 ? "" : "s"}` : "", s.promptCount ? `${s.promptCount} prompt${s.promptCount === 1 ? "" : "s"}` : ""].filter(Boolean);
+                        agents.push({
+                            type: "declared",
+                            label: `${r.label} · ${s.server}`,
+                            // "introspection-confirmed" — the server DECLARED these tools when we
+                            // listed them; it is not proof of what the implementation will do.
+                            detail: `${s.tools.length} tool${s.tools.length === 1 ? "" : "s"} (MCP ${s.transport} · introspection-confirmed)${extras.length ? " · " + extras.join(", ") : ""}`,
+                            declaredTools: s.tools,
+                            surfaceEvidence: {
+                                source: "mcp-tools-list",
+                                status: "complete",
+                                transport: s.transport,
+                                server: s.server,
+                                observedAt: new Date().toISOString(),
+                            },
+                        });
+                    }
+                }
+            }
+        }
+        const payload = { agents, machine };
+        // ── machine-readable path (agents / automation) ──────────────────────────
+        if (asJson) {
+            if (dryRun) {
+                emitJson({ ok: true, dryRun: true, sent: false, agentCount: agents.length, payload });
+                return;
+            }
+            try {
+                const res = await fetch(endpoint, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) });
+                const data = (await res.json().catch(() => ({})));
+                emitJson({ ok: res.ok, sent: res.ok, status: res.status, received: data.received, agentCount: agents.length, error: res.ok ? undefined : (data.error || res.statusText) });
+                process.exit(res.ok ? 0 : 1);
+            }
+            catch (err) {
+                emitJson({ ok: false, sent: false, error: err instanceof Error ? err.message : String(err) });
+                process.exit(1);
+            }
+        }
+        // ── human-readable path ──────────────────────────────────────────────────
+        console.log("\n" + chalk_1.default.bold("  Atbash connector") + (dryRun ? chalk_1.default.dim("  (dry run — nothing will be sent)") : ""));
+        // Capability disclosure: state plainly what runs, so a person OR an agent
+        // reviewing this command can confirm nothing hidden is happening.
+        console.log(chalk_1.default.dim("  Reads (read-only): known agent/MCP config files under your home dir — OpenClaw, Hermes,"));
+        console.log(chalk_1.default.dim("    Claude Desktop/Code, Cursor, Windsurf, VS Code, Gemini, Continue, Codex."));
+        console.log(chalk_1.default.dim("    Relays names, MCP URLs and launch-command basenames only — never tokens, headers, env values or file contents."));
+        if (introspect)
+            console.log(chalk_1.default.yellow("  Introspection ON:") + chalk_1.default.dim(" also STARTS your MCP servers locally to list their tools, then stops them. Relays tool names/descriptions only — never inputs, outputs, args or env."));
+        console.log(chalk_1.default.dim(`  Sends: ${dryRun ? "nothing (dry run)" : "one POST to the destination below, then exits"}.`));
+        // Machine identity is stated loudly on purpose: if this ran somewhere other
+        // than the computer you mean to govern (an AI-assistant sandbox, a VM, a
+        // remote box), the results are from THAT machine — not yours.
+        console.log(`  ${chalk_1.default.bold("Machine")}  : ${chalk_1.default.bold.cyan(machine)}  ${chalk_1.default.yellow("← results below come from THIS machine")}`);
+        console.log(`  ${chalk_1.default.bold("Sends to")} : ${chalk_1.default.cyan(endpoint)}${recognizedHost ? chalk_1.default.dim(isLoopback ? "  (local development host)" : "  (recognized Atbash host)") : chalk_1.default.yellow("  ← UNRECOGNIZED host, not an official Atbash deployment — only proceed if you trust it")}`);
+        console.log(chalk_1.default.dim(`  Code     : ${code}\n`));
         if (agents.length === 0) {
             console.log("  No local agents found (looked for OpenClaw, Hermes, and MCP configs).");
-            console.log("  Relaying an empty result so the browser stops waiting.\n");
+            if (!dryRun)
+                console.log("  Relaying an empty result so the browser stops waiting.");
+            console.log("");
         }
         else {
             console.log("  Found:");
@@ -271,11 +597,18 @@ function registerConnectCommand(program) {
                 console.log(`    ${chalk_1.default.green("•")} ${a.label} ${chalk_1.default.dim("— " + a.detail)}`);
             console.log("");
         }
+        console.log(chalk_1.default.yellow(`  ⚠ These results are from ${chalk_1.default.bold(machine)}.`) + chalk_1.default.dim(" If that isn't the computer you want to govern, run this command there instead.\n"));
+        if (dryRun) {
+            console.log(chalk_1.default.bold("  Dry run — the exact JSON that WOULD be sent:"));
+            console.log(chalk_1.default.dim(JSON.stringify(payload, null, 2).split("\n").map((l) => "    " + l).join("\n")));
+            console.log("\n" + chalk_1.default.green("  ✓ Nothing was sent.") + chalk_1.default.dim(" Re-run without --dry-run to relay.\n"));
+            return;
+        }
         try {
-            const res = await fetch(`${host}/api/agent-scan/session/${encodeURIComponent(code)}`, {
+            const res = await fetch(endpoint, {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ agents }),
+                body: JSON.stringify(payload),
             });
             const data = (await res.json().catch(() => ({})));
             if (!res.ok) {
@@ -283,7 +616,7 @@ function registerConnectCommand(program) {
                 console.error(chalk_1.default.dim("  The code may be wrong or expired — re-open the screen for a fresh one.\n"));
                 process.exit(1);
             }
-            console.log(chalk_1.default.green(`  ✓ Relayed ${data.received ?? agents.length} agent(s).`) + " Switch back to the browser — it should update now.\n");
+            console.log(chalk_1.default.green(`  ✓ Relayed ${data.received ?? agents.length} agent(s) from ${chalk_1.default.bold(machine)}.`) + " Switch back to the browser — it should show this machine now.\n");
         }
         catch (err) {
             console.error(chalk_1.default.red(`  Could not reach ${host}: ${err instanceof Error ? err.message : String(err)}\n`));