@atbash/cli 0.5.15-dev.17 → 0.5.15-dev.18

package/dist/commands/mcp-cmd.js

@@ -1,216 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveLauncherKey = resolveLauncherKey;
-exports.registerMcpCommand = registerMcpCommand;
-const fs = __importStar(require("fs"));
-const child_process_1 = require("child_process");
-const sdk_1 = require("@atbash/sdk");
-/**
- * `atbash mcp` — run the Atbash MCP server without putting a private key in a
- * config file.
- *
- * THE PROBLEM THIS SOLVES
- *
- * `@atbash/mcp` reads its agent identity from `ATBASH_AGENT_PRIVKEY` and has no
- * key-file fallback (verified against the published 0.1.3). The documented wiring
- * therefore asks the operator to paste a raw private key into their MCP client's
- * own config:
- *
- *   { "mcpServers": { "atbash": { "command": "npx", "args": ["-y", "@atbash/mcp"],
- *                                 "env": { "ATBASH_AGENT_PRIVKEY": "<the key>" } } } }
- *
- * That file is `claude_desktop_config.json` and its equivalents — files people
- * sync between machines, paste into issues, and screenshot when asking for help.
- * It made "wire up MCP for me" impossible to automate honestly: the automation's
- * whole job would have been to plant a secret somewhere worse than where it
- * already was.
- *
- * This command is the indirection that removes the problem. The client spawns
- * `atbash mcp`, which reads the key from the 0600 file Atbash already manages and
- * passes it to the server through the CHILD PROCESS ENVIRONMENT ONLY. Nothing
- * secret is ever written to a config file, so the client entry is:
- *
- *   { "mcpServers": { "atbash": { "command": "npx", "args": ["-y", "@atbash/cli", "mcp"] } } }
- *
- * — which contains no credential at all, and is safe for `atbash setup` to write.
- *
- * STDOUT IS THE PROTOCOL. MCP speaks JSON-RPC over stdio, so a single stray
- * `console.log` here corrupts the stream and the client reports a broken server.
- * Every diagnostic in this file goes to stderr. Do not change that.
- */
-/**
- * The server this launcher runs, and the SDK it is run WITH.
- *
- * ⚠️ BOTH PINS ARE LOAD-BEARING. DO NOT LOOSEN THEM.
- *
- * `@atbash/mcp` declares `@atbash/sdk: ^0.3.19` and imports `getOrgTierInfo` as a
- * named export. `@atbash/sdk@0.3.24` REMOVED that export, so `^0.3.19` now
- * resolves to 0.3.25 and the server dies at import time:
- *
- *   SyntaxError: The requested module '@atbash/sdk' does not provide an
- *                export named 'getOrgTierInfo'
- *
- * That breaks EVERY published `@atbash/mcp` (0.1.0 through 0.1.3) — a plain
- * `npm install @atbash/mcp` cannot start at all, which is why the documented
- * hand-wiring produces a client reporting a failed server. Naming an SDK version
- * from before the removal is what makes it run; 0.3.23 is the newest that works.
- *
- * ⚠️ AND THE PIN ITSELF IS A STOPGAP. `@atbash/sdk@0.3.23` is DEPRECATED:
- *
- *   npm warn deprecated @atbash/sdk@0.3.23: Old architecture with legacy chain
- *   structure. Please upgrade to stable version @atbash/sdk@^0.5.0
- *
- * So this runs the MCP server on a legacy chain architecture. It is verified to
- * work — a real `atbash_check_agent` tool call round-trips against the live
- * deployment and returns the correct answer — but it is the newest thing that
- * works, not a thing that is right.
- *
- * THE REAL FIX is republishing `@atbash/mcp` against `@atbash/sdk@^0.7`, which
- * moves `getOrgTierInfo` onto the `Atbash` class rather than exporting it. Until
- * that ships, this pin is the only thing between an operator and a dead MCP
- * server, so treat a "dependency update" here as a regression unless the
- * republished package is verified to both START and serve a tool call.
- *
- * Cold start is ~12s while npx populates its cache, ~1s warm. A client with a
- * short startup timeout may fail its very first launch and succeed on retry.
- */
-const MCP_PKG = "@atbash/mcp";
-const MCP_VERSION = "0.1.3";
-const MCP_SDK_VERSION = "0.3.23";
-/** Read `privkey=` out of the agent key file, or null if it is not usable. */
-function privkeyFromKeyFile(keyPath) {
-    let text;
-    try {
-        text = fs.readFileSync(keyPath, "utf8");
-    }
-    catch {
-        return null;
-    }
-    if (text.trim().startsWith("{")) {
-        try {
-            const o = JSON.parse(text);
-            const value = String(o.privKey ?? o.privkey ?? o.privateKey ?? "").replace(/^0x/i, "").trim();
-            return /^[0-9a-fA-F]{64}$/.test(value) ? value.toLowerCase() : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    for (const line of text.split(/\r?\n/)) {
-        const match = line.trim().match(/^privkey\s*[:=]\s*(.+)$/i);
-        if (match) {
-            const value = match[1].replace(/^0x/i, "").trim();
-            if (/^[0-9a-fA-F]{64}$/.test(value))
-                return value.toLowerCase();
-        }
-    }
-    return null;
-}
-/**
- * Where the launcher gets the key, in order.
- *
- * An `ATBASH_AGENT_PRIVKEY` already in the environment wins, so an operator who
- * deliberately injects the key at launch time keeps working exactly as before —
- * this command adds a safer default, it does not take the existing path away.
- */
-function resolveLauncherKey(keyPathOverride) {
-    const fromEnv = process.env.ATBASH_AGENT_PRIVKEY?.replace(/^0x/i, "").trim();
-    if (fromEnv && /^[0-9a-fA-F]{64}$/.test(fromEnv))
-        return { privkey: fromEnv.toLowerCase(), from: "ATBASH_AGENT_PRIVKEY" };
-    const keyPath = (0, sdk_1.resolveKeyPath)(keyPathOverride);
-    const fromFile = privkeyFromKeyFile(keyPath);
-    if (fromFile)
-        return { privkey: fromFile, from: keyPath };
-    const fromConfig = (0, sdk_1.loadUserConfig)().agentKey?.replace(/^0x/i, "").trim();
-    if (fromConfig && /^[0-9a-fA-F]{64}$/.test(fromConfig))
-        return { privkey: fromConfig.toLowerCase(), from: "atbash config" };
-    return null;
-}
-function registerMcpCommand(program) {
-    program
-        .command("mcp")
-        .description("Run the Atbash MCP server, reading the agent key from ~/.config/atbash/guard-client-key instead of a config file (used as the `command` in an MCP client's server list)")
-        .option("--key-file <path>", "Agent key file to read (default: ~/.config/atbash/guard-client-key)")
-        .option("--endpoint <url>", "Atbash endpoint the server should use")
-        .action((opts) => {
-        const resolved = resolveLauncherKey(opts.keyFile);
-        if (!resolved) {
-            // stderr: stdout belongs to the JSON-RPC stream.
-            process.stderr.write("atbash mcp: no agent key found.\n" +
-                `Looked at ATBASH_AGENT_PRIVKEY, ${(0, sdk_1.resolveKeyPath)(opts.keyFile)}, and the atbash config.\n` +
-                "Run `atbash setup` on this machine first, or pass --key-file.\n");
-            process.exit(1);
-        }
-        const endpoint = opts.endpoint || process.env.ATBASH_ENDPOINT;
-        // The key goes to the CHILD ONLY. It is never written to disk here and
-        // never echoed — the parent's own environment is left untouched.
-        const env = {
-            ...process.env,
-            ATBASH_AGENT_PRIVKEY: resolved.privkey,
-            ...(endpoint ? { ATBASH_ENDPOINT: endpoint } : {}),
-        };
-        // Both packages are placed in ONE npx tree so the compatible SDK sits at its
-        // root and satisfies @atbash/mcp's own `^0.3.19` range — which is what stops
-        // npm installing the broken 0.3.25 underneath it. Installing @atbash/mcp
-        // alone (as a dependency of this CLI, or via a bare npx) reintroduces the
-        // crash, so this shape is deliberate, not incidental.
-        const command = "npx";
-        const args = [
-            "--yes",
-            "-p", `${MCP_PKG}@${MCP_VERSION}`,
-            "-p", `@atbash/sdk@${MCP_SDK_VERSION}`,
-            "atbash-mcp",
-        ];
-        process.stderr.write(`atbash mcp: starting ${MCP_PKG}@${MCP_VERSION} with @atbash/sdk@${MCP_SDK_VERSION} (key from ${resolved.from})\n`);
-        // stdio inherit: the server talks JSON-RPC directly to the client that
-        // spawned us. Proxying it through here would add a failure point for no gain.
-        const child = (0, child_process_1.spawn)(command, args, { env, stdio: "inherit", shell: false });
-        child.on("error", (err) => {
-            process.stderr.write(`atbash mcp: could not start ${MCP_PKG}: ${err.message}\n`);
-            process.exit(1);
-        });
-        // Forward termination so the client's own shutdown reaches the server
-        // rather than orphaning it.
-        for (const signal of ["SIGINT", "SIGTERM"]) {
-            process.on(signal, () => { if (!child.killed)
-                child.kill(signal); });
-        }
-        child.on("exit", (code, signal) => {
-            process.exit(signal ? 1 : (code ?? 0));
-        });
-    });
-}
-//# sourceMappingURL=mcp-cmd.js.map

package/dist/commands/mcp-cmd.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-cmd.js","sourceRoot":"","sources":["../../src/commands/mcp-cmd.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2GA,gDAYC;AAED,gDA6DC;AAtLD,uCAAyB;AACzB,iDAAsC;AAEtC,qCAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,OAAO,GAAG,aAAa,CAAC;AAC9B,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC1B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,eAAwB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IAE1H,MAAM,OAAO,GAAG,IAAA,oBAAc,EAAC,eAAe,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAE1D,MAAM,UAAU,GAAG,IAAA,oBAAc,GAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,IAAI,UAAU,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAE5H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,yKAAyK,CAAC;SACtL,MAAM,CAAC,mBAAmB,EAAE,qEAAqE,CAAC;SAClG,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,CAAC,IAA6C,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,iDAAiD;YACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC;gBACjC,mCAAmC,IAAA,oBAAc,EAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B;gBAC3F,iEAAiE,CACpE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC9D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,GAAG,GAAsB;YAC7B,GAAG,OAAO,CAAC,GAAG;YACd,oBAAoB,EAAE,QAAQ,CAAC,OAAO;YACtC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC;QAEF,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG;YACX,OAAO;YACP,IAAI,EAAE,GAAG,OAAO,IAAI,WAAW,EAAE;YACjC,IAAI,EAAE,eAAe,eAAe,EAAE;YACtC,YAAY;SACb,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,OAAO,IAAI,WAAW,qBAAqB,eAAe,cAAc,QAAQ,CAAC,IAAI,KAAK,CACnH,CAAC;QAEF,uEAAuE;QACvE,8EAA8E;QAC9E,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,sEAAsE;QACtE,4BAA4B;QAC5B,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;YACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/shared/atbash-targets.d.ts

@@ -1,49 +0,0 @@
-/**
- * Facts about WHERE Atbash lives — the deployments it trusts, and the on-disk
- * locations it knows about.
- *
- * These are shared by the read-only connector (`atbash connect`) and the
- * write-capable configurator (`atbash setup`). They live here rather than in
- * either command because both must agree:
- *
- *  - A host the connector will relay to must be a host setup will verify
- *    registration against. Two different allowlists would mean a deployment that
- *    can receive a scan but cannot confirm the agent it scanned.
- *  - A config path the scan reports must be a path setup can find. A client that
- *    shows up in the dashboard but not in `setup` reads as a bug in whichever of
- *    the two the operator happened to trust first.
- *
- * When they lived in connect.ts and setup imported them from there, a refactor of
- * the connector could silently change the configurator's behaviour. Adding a
- * client here updates both callers at once, which is the point.
- */
-/**
- * Official Atbash deployments that legitimately serve the onboarding flow.
- *
- * The pairing screen builds `--host` from the page you opened, so every origin
- * that can host onboarding must appear here. If production were missing, the real
- * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
- * genuine article, which is worse than silence: it teaches people and agents to
- * wave through the one warning that actually catches a swapped host.
- *
- * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
- * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
- */
-export declare const KNOWN_HOSTS: Set<string>;
-/**
- * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
- * because it is the one running the current connector API; switch this to
- * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
- */
-export declare const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
-/**
- * MCP client config locations, relative to the user's home directory.
- *
- * Claude Code (`~/.claude.json`) and Codex (`~/.codex/config.toml`) are NOT here
- * on purpose: each needs bespoke handling (per-project server maps, and TOML
- * respectively) and both callers special-case them.
- */
-export declare const MCP_CONFIGS: {
-    label: string;
-    segs: string[];
-}[];

package/dist/shared/atbash-targets.js

@@ -1,63 +0,0 @@
-"use strict";
-/**
- * Facts about WHERE Atbash lives — the deployments it trusts, and the on-disk
- * locations it knows about.
- *
- * These are shared by the read-only connector (`atbash connect`) and the
- * write-capable configurator (`atbash setup`). They live here rather than in
- * either command because both must agree:
- *
- *  - A host the connector will relay to must be a host setup will verify
- *    registration against. Two different allowlists would mean a deployment that
- *    can receive a scan but cannot confirm the agent it scanned.
- *  - A config path the scan reports must be a path setup can find. A client that
- *    shows up in the dashboard but not in `setup` reads as a bug in whichever of
- *    the two the operator happened to trust first.
- *
- * When they lived in connect.ts and setup imported them from there, a refactor of
- * the connector could silently change the configurator's behaviour. Adding a
- * client here updates both callers at once, which is the point.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MCP_CONFIGS = exports.DEFAULT_HOST = exports.KNOWN_HOSTS = void 0;
-/**
- * Official Atbash deployments that legitimately serve the onboarding flow.
- *
- * The pairing screen builds `--host` from the page you opened, so every origin
- * that can host onboarding must appear here. If production were missing, the real
- * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
- * genuine article, which is worse than silence: it teaches people and agents to
- * wave through the one warning that actually catches a swapped host.
- *
- * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
- * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
- */
-exports.KNOWN_HOSTS = new Set([
-    "atbash.ai",
-    "www.atbash.ai",
-    "chromia-verified-ai-dev-two.vercel.app",
-    "chromia-verified-ai-agent-scan.vercel.app",
-]);
-/**
- * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
- * because it is the one running the current connector API; switch this to
- * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
- */
-exports.DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
-/**
- * MCP client config locations, relative to the user's home directory.
- *
- * Claude Code (`~/.claude.json`) and Codex (`~/.codex/config.toml`) are NOT here
- * on purpose: each needs bespoke handling (per-project server maps, and TOML
- * respectively) and both callers special-case them.
- */
-exports.MCP_CONFIGS = [
-    { label: "Claude Desktop", segs: ["Library", "Application Support", "Claude", "claude_desktop_config.json"] },
-    { label: "Claude Desktop", segs: [".config", "Claude", "claude_desktop_config.json"] },
-    { label: "Cursor", segs: [".cursor", "mcp.json"] },
-    { label: "Windsurf", segs: [".codeium", "windsurf", "mcp_config.json"] },
-    { label: "VS Code (MCP)", segs: [".vscode", "mcp.json"] },
-    { label: "Gemini CLI", segs: [".gemini", "settings.json"] },
-    { label: "Continue", segs: [".continue", "config.json"] },
-];
-//# sourceMappingURL=atbash-targets.js.map

package/dist/shared/atbash-targets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"atbash-targets.js","sourceRoot":"","sources":["../../src/shared/atbash-targets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH;;;;;;;;;;;GAWG;AACU,QAAA,WAAW,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,eAAe;IACf,wCAAwC;IACxC,2CAA2C;CAC5C,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,YAAY,GAAG,gDAAgD,CAAC;AAE7E;;;;;;GAMG;AACU,QAAA,WAAW,GAAwC;IAC9D,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,EAAE;IAC7G,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,EAAE;IACtF,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IAClD,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE;IACxE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IACzD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE;IAC3D,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE;CAC1D,CAAC"}

package/dist/shared/openclaw-runtime.d.ts

@@ -1,221 +0,0 @@
-/** How this OpenClaw got onto the machine — decides the UPDATE command. */
-export type OpenclawChannel = "brew-formula" | "brew-cask" | "npm" | "unknown";
-/**
- * Config subcommands this build has.
- *
- * Probed from `openclaw config --help`, because the boundary is not guessable
- * from a version number. Observed: 2026.2.1 has only `get set unset`, while both
- * 2026.6.6 and 2026.7.1 have `file get patch schema set unset validate`.
- */
-export interface OpenclawCaps {
-    /**
-     * `openclaw config patch` — "Patch config from a JSON5 object in one validated
-     * write. Objects merge recursively, arrays/scalars replace, and null deletes a
-     * path", with `--stdin` and `--dry-run`.
-     *
-     * This is EXACTLY the operation setup needs, performed by OpenClaw itself, so
-     * where it exists we stop hand-merging JSON. That hands OpenClaw responsibility
-     * for its own file format, key names, schema, permissions and migrations — all
-     * the things we kept getting wrong from the outside. It also removes the
-     * clobber hazard: a machine in the field had three
-     * `openclaw.json.clobbered.<timestamp>` files, so OpenClaw rewrites that file
-     * on its own and anything we hand-merge can be discarded without warning.
-     */
-    patch: boolean;
-    /** `openclaw config validate` — schema check without starting the gateway. */
-    validate: boolean;
-    /** `openclaw config schema` — the authoritative key list for THIS build. */
-    schema: boolean;
-    /** `openclaw config file` — where the active config actually lives. */
-    configFile: boolean;
-}
-export interface OpenclawRuntime {
-    /** False when there is no OpenClaw on this machine at all. */
-    present: boolean;
-    /** As reported by `openclaw --version`, e.g. "2026.7.1". Undefined if unparseable. */
-    version?: string;
-    /** Build hash when the version line carries one — pins a build exactly. */
-    build?: string;
-    channel: OpenclawChannel;
-    /** Resolved path to the binary, for diagnostics. */
-    binPath?: string;
-    caps: OpenclawCaps;
-}
-/**
- * Where the `openclaw` on PATH came from.
- *
- * Path-based rather than asked of a package manager, because shelling out to
- * brew and npm to answer a question we can read off a path is slow and can hang
- * on a bad network — and this runs before we have written anything, where a
- * hang looks like the command being broken.
- *
- * ⚠️ The npm case is not hypothetical or unusual: the machine that reported the
- * original failure ran `/Users/m4/.nvm/versions/node/v24.13.0/bin/openclaw`,
- * so `brew info openclaw-cli` there said "Not installed" while OpenClaw was
- * plainly running. Telling that user `brew upgrade openclaw-cli` would have been
- * useless, which is the whole reason this returns a channel at all.
- */
-export declare function detectChannel(binPath: string | undefined): OpenclawChannel;
-/**
- * The command that updates THIS install, or undefined when we cannot tell.
- *
- * Returning undefined is deliberate and better than a plausible guess: a user
- * told to run `brew upgrade openclaw-cli` on an npm install gets "No available
- * formula", concludes our instructions are wrong, and is no closer to an
- * upgrade. `openclaw update` is the honest fallback where the channel is
- * unknown — it is OpenClaw's own self-updater, and 2026.6.6's `doctor` already
- * recommends exactly that ("Run `openclaw update` to update via your package
- * manager (npm/pnpm)").
- */
-export declare function updateCommand(channel: OpenclawChannel): string;
-/**
- * Inspect the OpenClaw on this machine. Read-only: probes `--version` and
- * `config --help`, writes nothing, and never throws.
- */
-export declare function detectOpenclaw(binary?: string): OpenclawRuntime;
-/** How setup should write config on this machine. */
-export type WriteStrategy = 
-/** `openclaw config patch --stdin` — OpenClaw merges and validates its own file. */
-"openclaw-patch"
-/** Hand-merge the JSON ourselves. The only option on 2026.2.x. */
- | "hand-merge";
-export declare function writeStrategy(rt: OpenclawRuntime): WriteStrategy;
-/**
- * Whether this OpenClaw is one we can wire at all, and what to say if not.
- *
- * DELIBERATELY PERMISSIVE. The floor is "there is an OpenClaw here", not "it has
- * the newest config commands", because 2026.2.x installs are real — the box every
- * CLI attestation was verified on is one — and the minimal entry-only config we
- * now write was confirmed to load there with the plugin reporting
- * `[atbash] plugin loaded` and `guard manager ready`. Narrowing support to the
- * versions we happen to run is the mistake that produced this whole module.
- *
- * So an older build is a DEGRADED path with an offer, never a refusal: it gets
- * the hand-merge, and the reason to upgrade is stated once, with the command for
- * its own channel. Refusal is reserved for "no OpenClaw at all", where there is
- * genuinely nothing to configure.
- */
-export declare function supportStatus(rt: OpenclawRuntime): {
-    supported: boolean;
-    degraded: boolean;
-    /** Plain-language line for a non-technical operator. */
-    message: string;
-    /** The channel-correct upgrade command, when upgrading would help. */
-    upgrade?: string;
-};
-/**
- * What OpenClaw says about the Atbash plugin after we have wired it.
- *
- * `state` is deliberately not a boolean. "Is this agent governed?" has more than
- * two answers, and collapsing them is how setup came to print a green summary
- * over an ungoverned machine.
- */
-export interface PluginVerdict {
-    state: 
-    /** Present, switched on, and loaded. The only state that means governed. */
-    "loaded"
-    /** On disk but switched off — governs nothing, and is a deliberate act. */
-     | "disabled"
-    /** OpenClaw tried and failed to load it. Worse than missing: it looks wired. */
-     | "load-error"
-    /** OpenClaw does not know about it at all. */
-     | "missing"
-    /** We could not ask. Must never be reported as success. */
-     | "unknown";
-    entry?: string;
-    version?: string;
-    /** Required runtime dependencies OpenClaw reports as absent. */
-    missingDeps?: string[];
-    /** Raw explanation for the operator, in OpenClaw's terms where possible. */
-    detail?: string;
-}
-/**
- * Ask OpenClaw whether the plugin actually loaded — the check setup never had.
- *
- * ⚠️ WHY THIS IS NOT OPTIONAL. Setup used to declare success on the strength of
- * having written what it meant to write. That is not the same claim: on the
- * machine that reported the original failure, the config entry existed and the
- * plugin did not, and OpenClaw said so plainly —
- *
- *   plugins.entries.atbash-openclaw: plugin not found: atbash-openclaw
- *   (stale config entry ignored; remove it from plugins config)
- *
- * — while setup reported the run as done. An owner reading that summary believes
- * their agent is governed. Nothing is more expensive than a false green on a
- * control boundary, so the last word belongs to OpenClaw, not to us.
- *
- * ⚠️ DO NOT check `hookCount` or `hookNames` here. They are 0 and empty for a
- * perfectly healthy plugin: hooks register when the GATEWAY starts, not when
- * `plugins list` runs. Verified against a plugin that was demonstrably loaded and
- * enforcing — it reports `hookCount: 0`. Treating that as a fault would fail
- * every correct install.
- */
-export declare function verifyOpenclawPlugin(rt: OpenclawRuntime, opts: {
-    /** Entry ids that count as Atbash, current first. */
-    entryIds: readonly string[];
-    /** Pin the config being inspected, so this cannot read a different one. */
-    configPath?: string;
-    /**
-     * The package spec that was installed, e.g. `@atbash/atbash-openclaw@dev`.
-     * Used to catch the environment mismatch that loads cleanly and then fails
-     * every judge call: the plugin's endpoint and chain ids are compiled in, so a
-     * production build on a dev-onboarded agent is silently useless.
-     */
-    expectedSpec?: string;
-    /**
-     * The home directory being configured, when it is not the process's own.
-     *
-     * ⚠️ REQUIRED FOR A `--home` RUN, AND OMITTING IT PRODUCED A FALSE GREEN.
-     * Pinning `OPENCLAW_CONFIG_PATH` aims OpenClaw at the right CONFIG, but
-     * plugin discovery still walks `$HOME/.openclaw`, so the child process
-     * happily reported the plugin from the operator's real machine while we were
-     * asking about a different one. It printed "OpenClaw loads the plugin" about
-     * a home directory that contained no plugin at all — precisely the false
-     * green this whole check exists to prevent, produced by the check itself.
-     */
-    home?: string;
-    binary?: string;
-}): PluginVerdict;
-/**
- * Ask OpenClaw whether a config is valid, when it can answer.
- *
- * This is the PREFLIGHT the command never had. Setup merged into
- * `~/.openclaw/openclaw.json` without ever checking whether that file currently
- * loads — so on a machine whose config was already broken it added its own entry
- * to an unloadable file, and then its `openclaw plugins install` step died on the
- * pre-existing breakage. Reported as an Atbash failure; it was not one.
- *
- * `undefined` means "cannot tell" (no `validate` on this build) and must be
- * treated as such — not as a pass and not as a failure.
- */
-/**
- * Does THIS build accept `hooks` on a plugin entry?
- *
- * Asked of `openclaw config schema`, never inferred from a version number or
- * correlated with other capabilities — the whole point of this module.
- *
- * ⚠️ WHY THIS QUESTION EXISTS. `hooks` was ADDED, not removed: it is unknown on
- * 2026.2.1 and valid, optional and undeprecated on 2026.6.6 and 2026.7.1, where
- * an entry accepts `enabled | hooks | subagent | llm | config`. Because the entry
- * schema is `additionalProperties: false`, the same key is FATAL on the old build
- * and legitimate on the new one.
- *
- * Setup never writes `hooks` — nothing under it is required, and it gates hook
- * families this plugin does not use (it registers only `before_tool_call`). But
- * it also used to DELETE an operator's `hooks` block unconditionally, and on a
- * build that accepts the key that is destroying their configuration:
- * `hooks.timeoutMs` bounds this plugin's hook latency "without changing plugin
- * code", which is a deliberate operator choice, not damage to repair.
- *
- * `undefined` means "cannot tell" (no `config schema` on this build). The caller
- * must treat that as NOT supported and strip: keeping an unrecognized key makes
- * OpenClaw refuse the entire config, and losing a timeout knob is a far smaller
- * harm than a machine whose config will not load at all.
- */
-export declare function pluginEntryAcceptsHooks(rt: OpenclawRuntime, binary?: string): boolean | undefined;
-export declare function validateConfig(rt: OpenclawRuntime, configPath: string, binary?: string, 
-/** The home being configured, when not the process's own — see verifyOpenclawPlugin. */
-home?: string): {
-    valid: boolean;
-    problems: string;
-} | undefined;