@atbash/cli 0.5.15-dev.8 → 0.6.0-dev.1

package/README.md

@@ -139,6 +139,168 @@ atbash judge 'grant admin access to CI service account'
 The agent cannot retry or self-unjail. An operator must review and release at [https://atbash.ai/](https://atbash.ai/).
 
 
+## Local scan
+
+`atbash scan` reports what is installed on this machine. It needs no account, no pairing code and no dashboard. The report is printed in your terminal and is never uploaded.
+
+```bash
+# What is installed here
+atbash scan
+
+# Ask each MCP server what tools it actually has
+atbash scan --introspect
+
+# Add a draft boundary: red lines and actions that need approval
+atbash scan --introspect --policy
+
+# Machine-readable output
+atbash scan --introspect --json
+```
+
+Output:
+
+```
+  Atbash local scan
+  ────────────────────────────
+  Machine : my-laptop
+  Found   : 1 runtime
+
+  OpenClaw — 5 skills / plugins
+    • delete-customer-records
+    • export-crm-contacts
+    • issue-refund
+    • list-tickets
+    • send-email
+
+  Risk
+  ────────────────────────────
+  Level   : High (92/100)
+  Method  : deterministic
+  5 authorized action paths (3 high-severity).
+
+    high   delete-customer-records — destructive action
+           irreversible data/infrastructure loss
+    high   export-crm-contacts — data access / egress
+           data leakage / privacy breach
+    high   issue-refund — financial
+           direct financial loss
+    medium send-email — external communication
+           external message sent on the owner's behalf (monitored)
+    low    list-tickets — read / research
+           low-consequence information access
+```
+
+With `--policy` it also prints a draft boundary you can edit and enforce:
+
+```
+  Recommended boundary
+  ────────────────────────────
+  Red lines (auto-deny)
+    • Never perform destructive action autonomously (e.g. delete-customer-records).
+    • Never perform data access / egress autonomously (e.g. export-crm-contacts).
+    • Never modify its own mandate, red lines, or authority.
+
+  Needs approval
+    • Require human approval before financial (e.g. issue-refund).
+```
+
+### What leaves your machine
+
+Nothing, unless you ask for it.
+
+| Command | Requests sent |
+| --- | --- |
+| `atbash scan` | none |
+| `--introspect` | one per MCP server configured with an `http` URL, sent to that URL |
+| `--api-key` | one, to your LLM provider |
+| `--threats` | one, to your LLM provider |
+
+Nothing is ever sent to Atbash. `--json` reports the actual count as `networkRequests`, so you can check it.
+
+Credentials found in your config files are removed before anything is printed or sent. That covers `env` values, `headers`, tokens, and secrets embedded in command paths.
+
+### Using your own LLM key
+
+The built-in rules classify tools by name and description. Some tools match no rule. Supply your own [OpenRouter](https://openrouter.ai) key and the CLI will grade those as well. With `--threats` it also looks for risks that only appear when tools are combined, such as reading customer data and sending mail.
+
+The key is read from the first of these that is set:
+
+1. `--api-key <key>`
+2. `ATBASH_SCAN_API_KEY`
+3. `OPENROUTER_API_KEY`
+
+On a shared machine, use an environment variable rather than `--api-key`. Command arguments are visible to other users through `ps`.
+
+First get a key from [openrouter.ai/settings/keys](https://openrouter.ai/settings/keys). It looks like `sk-or-v1-` followed by 64 hex characters.
+
+**macOS keychain.** The keychain stores every secret under the name "password", so the prompt says `password data for new item:`. That is where the API key goes. Do not type a login password.
+
+```bash
+security add-generic-password -a "$USER" -s atbash-openrouter -U -w
+```
+
+It prompts twice:
+
+```
+password data for new item:        <- paste the sk-or-v1-... key
+retype password for new item:      <- paste it again
+```
+
+Nothing is echoed as you paste, and the two entries must match or it fails with `passwords don't match`. Check what actually got stored:
+
+```bash
+v=$(security find-generic-password -a "$USER" -s atbash-openrouter -w); echo "${#v} chars, starts ${v:0:9}"
+# expect: 73 chars, starts sk-or-v1-
+```
+
+If that prints anything else, the wrong value was stored. Run the `add` command again; `-U` overwrites it.
+
+Then use it:
+
+```bash
+export ATBASH_SCAN_API_KEY="$(security find-generic-password -a "$USER" -s atbash-openrouter -w)"
+atbash scan --introspect --threats --policy
+```
+
+**Linux, or anywhere without a keychain.** Use a file only you can read:
+
+```bash
+mkdir -p ~/.config/atbash && chmod 700 ~/.config/atbash
+(umask 077; touch ~/.config/atbash/openrouter.key)
+$EDITOR ~/.config/atbash/openrouter.key      # paste the key, save
+
+export ATBASH_SCAN_API_KEY="$(cat ~/.config/atbash/openrouter.key)"
+```
+
+**CI.** Store the key as a repository secret and map it to the environment variable. Never put it in a file in the repo.
+
+```yaml
+- run: atbash scan --introspect --fail-on high
+  env:
+    ATBASH_SCAN_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+```
+
+Pick a different model with `--model <id>`. The default is `z-ai/glm-5.3-flash`.
+
+If the key is missing, wrong, or the provider is down, the scan still finishes using the built-in grading and tells you what failed. You never lose the report.
+
+### Use in CI
+
+`--fail-on` turns the risk level into an exit code.
+
+```bash
+atbash scan --introspect --fail-on high
+```
+
+| Exit code | Meaning |
+| --- | --- |
+| 0 | risk level is below the threshold |
+| 1 | risk level reached the threshold |
+| 2 | the `--fail-on` value was not `low`, `elevated` or `high` |
+
+Run the gate without an API key. Built-in grading returns the same answer every time. Model grading varies between runs, which would make the gate flaky.
+
+
 ## End-to-end example: guarding a production deploy
 
 A CI agent is about to apply a database migration to production. The operator policy holds all production applies for review before execution.
@@ -331,6 +493,29 @@ If any check fails — an integrity value that does not match the deployment's m
 
 ## Command reference
 
+### `atbash scan`
+
+Scan this machine and print the report here. No account and no pairing code. See [Local scan](#local-scan) for the full walkthrough.
+
+```bash
+npx --yes @atbash/cli scan --introspect --policy
+```
+
+| Flag | Description |
+|------|-------------|
+| `--introspect` | Ask each configured MCP server what tools it advertises. Starts stdio servers locally and contacts `http` servers at their own URL. No tool is ever called |
+| `--policy` | Also print a draft boundary: red lines and actions that need approval |
+| `--threats` | Also list risks that come from tools used in combination. Needs an API key |
+| `--api-key <key>` | Your own LLM provider key. Also read from `ATBASH_SCAN_API_KEY` or `OPENROUTER_API_KEY` |
+| `--model <id>` | Model used for grading. Default `z-ai/glm-5.3-flash` |
+| `--fail-on <level>` | Exit 1 when the risk level reaches `low`, `elevated` or `high` |
+| `--json` | Machine-readable output |
+| `--home <dir>` | Home directory to scan (for testing) |
+
+Without a key the report is produced entirely on this machine. `--threats` and
+`--api-key` send tool names and descriptions to the provider you chose, never to
+Atbash.
+
 ### `atbash connect <code>`
 
 Link a machine to a hosted Atbash onboarding session. A browser can't read your disk and the Atbash server only sees its own, so this runs on the machine you want to govern, enumerates the agents / MCP tools configured there (read-only), and relays their *surface* to your onboarding session via the one-time pairing code shown in the browser.
@@ -397,11 +582,11 @@ Wherever it comes from, the key is written once to
 
 - It never transmits the private key. The only network call is a registration
   check, and that sends the **public** key.
-- It never writes the private key into an MCP client config. The entry it writes
-  points at `atbash mcp`, which reads the key from `guard-client-key` and hands it
-  to the server through the child process environment — so the config file carries
-  no credential, and an entry you previously hand-wired with one has the key
-  removed.
+- It never writes the private key into an MCP client config. The documented
+  `@atbash/mcp` wiring carries the key as an `ATBASH_AGENT_PRIVKEY` value inside
+  files like `claude_desktop_config.json`, and that package has no key-file
+  fallback today. MCP clients are detected and the snippet is printed for you to
+  add by hand.
 - It never edits your application source. Code-level integrations (LangChain,
   LangGraph, AutoGen, Eliza, the SDK boundary) stay yours to write.
 - It never rewrites a config that uses comments or trailing commas — reserializing
@@ -413,27 +598,6 @@ Wherever it comes from, the key is written once to
 Every file it changes is copied to a `.atbash-bak` alongside it first, and repeat
 runs are idempotent.
 
-### `atbash mcp`
-
-Runs the Atbash MCP server, reading the agent key from `~/.config/atbash/guard-client-key` instead of from a config file. You do not normally run this by hand — it is what `atbash setup` puts in your MCP client's server list:
-
-```json
-{ "mcpServers": { "atbash": { "command": "npx", "args": ["--yes", "@atbash/cli", "mcp"] } } }
-```
-
-| Flag | Description |
-|------|-------------|
-| `--key-file <path>` | Agent key file to read (default: `~/.config/atbash/guard-client-key`) |
-| `--endpoint <url>` | Atbash endpoint the server should use |
-
-**Why this exists.** `@atbash/mcp` reads its identity from `ATBASH_AGENT_PRIVKEY` and has no key-file fallback, so the wiring in its own docs puts a raw private key inside `claude_desktop_config.json` — a file people sync between machines and paste into help requests. This launcher keeps the key in the 0600 file and passes it to the server through the child process environment, so nothing secret is written to a config file.
-
-An `ATBASH_AGENT_PRIVKEY` already present in the environment still wins, so if you deliberately inject the key at launch time nothing changes for you.
-
-**Known issue it works around.** Every published `@atbash/mcp` (0.1.0–0.1.3) fails to start: they import `getOrgTierInfo` as a named export from `@atbash/sdk`, and `@atbash/sdk@0.3.24` removed it, so their `^0.3.19` range resolves to a version that cannot satisfy the import. This launcher installs the compatible pair together (`@atbash/mcp@0.1.3` with `@atbash/sdk@0.3.23`). That pinned SDK is itself deprecated — the real fix is republishing `@atbash/mcp` against `@atbash/sdk@^0.7`.
-
-First launch takes ~10–15s while npx caches the packages, then about a second. A client with a short startup timeout may fail once and succeed on retry.
-
 ### `atbash judge <action>`
 
 Submit a pending action for judgment. The action string is the exact operation the agent is about to execute — a transfer, a command, a mutation.
@@ -553,6 +717,97 @@ Tool Call Details
   Latency:      2340ms
 ```
 
+### `atbash github-scan`
+
+Read-only GitHub inventory and change-risk triage. The scanner calls GitHub's REST
+API directly; it does not invoke the `gh` CLI and it never makes a mutating API
+request.
+
+```bash
+# Use a classic/fine-grained user token or GitHub App installation token with
+# read access to every repository and organization that should be inventoried.
+# Set GITHUB_TOKEN or GH_TOKEN in the process environment; tokens are never
+# accepted as command-line arguments.
+
+atbash github-scan --owner Atbash-Ai --expect-repos 13 --since 2026-08-01 --json
+atbash github-scan --repo Atbash-Ai/atbash-cli --branch main
+```
+
+`--owner` and `--repo` are repeatable. `--branch` limits branch inventory,
+commits, and merged-PR base branch. `--since` accepts an ISO-8601 date or
+timestamp and defaults to 30 days. Bots are excluded unless `--include-bots` is
+set. Use `--owner` for scheduled organization audits: without it, `/user/repos`
+intentionally inventories every owner visible to the token, which may include
+private personal or unrelated organization repositories. `--expect-repos`
+makes a known inventory size an exact fail-closed assertion.
+
+The command verifies the authenticated user or GitHub App installation, records
+OAuth scopes when GitHub supplies the `X-OAuth-Scopes` header, verifies
+repository metadata permissions and organization visibility, and validates REST
+pagination. A full page without a `Link` header is not accepted as terminal:
+the scanner probes explicit sequential page numbers until a short/empty page or
+a terminal `Link` relation is verified. Duplicate pages/items, changed filters,
+cycles, non-sequential links, and the 1,000-page hard ceiling fail the scan.
+This establishes completeness for the authenticated API view and selected
+filters; it cannot prove that the token was granted access to repositories
+GitHub never exposes to it. GitHub REST pagination is not snapshot-isolated:
+concurrent repository changes can move items between pages. Duplicate/cycle
+checks fail on detectable drift, but the `completeness.snapshotConsistency`
+field explicitly records that snapshot consistency is not guaranteed; rerun a
+scheduled audit if the organization changed during collection.
+
+The network contract is GET-only: identity (`/user` or `/installation`),
+repository inventory (`/user/repos` or `/installation/repositories`),
+organization metadata, branches, closed pull requests, PR file metadata,
+commits, commit file metadata, and commit-to-PR associations. Tests reject any
+non-GET request across these paths.
+
+JSON output is sorted and schema-versioned. It includes a `completeness` object,
+rate-limit status, public/private counts, branches, recent merged PR metadata,
+commit metadata, changed filenames, and deterministic risk flags.
+
+Bound controls fail rather than truncate:
+
+- `--max-repos` (default 1,000)
+- `--max-branches` per repository (default 1,000)
+- `--max-prs` recent closed PRs inspected per repository (default 1,000)
+- `--max-commits` per branch (default 1,000)
+- `--max-files` per PR or commit (default 3,000)
+
+Lower these for tightly bounded scheduled jobs. Raise them deliberately for a
+larger organization; exceeding any bound exits nonzero without output or state
+advancement.
+
+Security and limits:
+
+- Set exactly one of `GITHUB_TOKEN` or `GH_TOKEN`; if both differ, the command
+  fails. Tokens are held in memory, sent only in the GitHub authorization
+  header, and redacted from errors.
+- The scanner never fetches blobs, trees, patches, diffs, or private file
+  contents. It reads repository/change metadata and changed filenames. Private
+  repository names and filenames still remain sensitive; protect JSON output.
+- Human output exposes authenticated identity, repository names/visibility,
+  aggregate counts, and risk-category names. JSON additionally exposes branch
+  names, PR titles/authors/timestamps, commit subjects/authors/timestamps, URLs,
+  changed filenames, and permission metadata. Treat either output as sensitive;
+  redirect JSON only to an access-controlled destination.
+- The complete result is buffered before anything is printed. Authentication,
+  permission, malformed response, pagination, REST, or rate-limit failure exits
+  nonzero and emits no partial scan. The scanner writes no cursor or checkpoint,
+  so a failed run cannot advance state.
+- Risk flags are deterministic path-based triage for Rell/contracts,
+  encryption/keys/auth, decision semantics, SDK/plugin APIs,
+  workflows/releases/dependencies, and direct commits detected on protected
+  branches. They are not semantic code analysis and are explicitly **not a full
+  SAST assessment**.
+- Direct-commit detection asks GitHub whether a protected-branch commit belongs
+  to a merged PR. Branch rules, merge queues, force pushes, and GitHub's
+  commit-to-PR association can limit that inference.
+- Fine-grained tokens and GitHub App installations should receive read-only
+  metadata, contents, pull-request, and organization access as applicable.
+  GitHub may not report named scopes for these token types; successful endpoint
+  access is the permission check.
+
 ### `atbash whoami` / `atbash policy show` / `atbash tier`
 
 Inspect the current agent's identity, assigned policy, and org tier.
@@ -638,7 +893,13 @@ atbash unset endpoint
 | Agent key | `--agent-key` | `ATBASH_AGENT_KEY` | `atbash set agent-key <hex>` |
 | Org name | `--org` | `ATBASH_ORG_NAME` | `atbash set org-name <name>` |
 | API endpoint | `--endpoint` | `ATBASH_ENDPOINT` | `atbash set endpoint <url>` |
+| Self-hosted judge signing key | `--verify-pubkey` (judge) | `ATBASH_JUDGE_VERIFY_PUBKEY` | config key `judgeVerifyPubKey` |
 | Blockchain RID | — | `ATBASH_BLOCKCHAIN_RID` | `atbash set rid <hex>` |
+
+> **Self-hosted judge:** the SDK only accepts an endpoint outside the trusted allowlist
+> when the judge's 66-hex response-signing pubkey is supplied too, so every verdict can be
+> verified. Set `ATBASH_JUDGE_VERIFY_PUBKEY` (or `--verify-pubkey` on `judge`) together with
+> `--endpoint`; without it a non-default endpoint is refused.
 | Inference provider | `--provider` | `ATBASH_PROVIDER` | `atbash set provider <name>` |
 | Model | `--model` | `ATBASH_PROVIDER_MODEL` | `atbash set model <model>` |
 

package/dist/bin/atbash.js

@@ -19,22 +19,46 @@ const tier_1 = require("../commands/tier");
 const tools_1 = require("../commands/tools");
 const held_1 = require("../commands/held");
 const connect_1 = require("../commands/connect");
+const scan_1 = require("../commands/scan");
 const setup_1 = require("../commands/setup");
-const mcp_cmd_1 = require("../commands/mcp-cmd");
+const github_scan_1 = require("../commands/github-scan");
 // ── Autocomplete ────────────────────────────────────────────────
 const commands = [
     "judge", "whoami", "policy", "tier", "tools", "held",
     "history", "stats", "status", "keygen", "set", "unset",
-    "wipe", "config", "connect", "setup", "mcp", "help",
+    "wipe", "config", "connect", "scan", "setup", "github-scan", "help",
 ];
 const subcommands = {
-    judge: ["--context", "--agent-key", "--provider", "--model", "--org", "--endpoint", "--timeout", "--json"],
+    judge: [
+        "--context",
+        "--agent-key",
+        "--provider",
+        "--model",
+        "--org",
+        "--endpoint",
+        "--timeout",
+        "--json",
+    ],
     policy: ["show"],
     tools: ["--agent", "--org", "--count", "--json", "inspect", "count"],
     held: ["--org", "--count", "--json", "reviews"],
     connect: ["--host", "--home"],
-    mcp: ["--key-file", "--endpoint"],
+    scan: ["--home", "--introspect", "--api-key", "--model", "--threats", "--policy", "--fail-on", "--json"],
     setup: ["--key", "--key-file", "--keys-dir", "--host", "--runtime", "--dry-run", "--yes", "--no-install", "--skip-verify", "--home"],
+    "github-scan": [
+        "--owner",
+        "--repo",
+        "--branch",
+        "--since",
+        "--expect-repos",
+        "--max-repos",
+        "--max-branches",
+        "--max-prs",
+        "--max-commits",
+        "--max-files",
+        "--include-bots",
+        "--json",
+    ],
     set: ["agent-key", "org-name", "endpoint", "rid", "provider", "model"],
     unset: ["agent-key", "org-name", "endpoint", "rid", "provider", "model"],
     show: ["--agent-key", "--endpoint", "--json"],
@@ -89,8 +113,10 @@ program
 (0, config_cmd_1.registerConfigCommand)(program);
 // Onboarding
 (0, connect_1.registerConnectCommand)(program);
+(0, scan_1.registerScanCommand)(program);
 (0, setup_1.registerSetupCommand)(program);
-(0, mcp_cmd_1.registerMcpCommand)(program);
+// External scanning
+(0, github_scan_1.registerGithubScanCommand)(program);
 async function main() {
     await program.parseAsync(process.argv);
     await (0, sdk_1.shutdownTelemetry)();

package/dist/bin/atbash.js.map

@@ -1 +1 @@
-{"version":3,"file":"atbash.js","sourceRoot":"","sources":["../../src/bin/atbash.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,wDAAgC;AAChC,qCAAgE;AAChE,6CAAyD;AACzD,+CAA2D;AAC3D,+CAA2D;AAC3D,iDAA6D;AAC7D,6CAAyD;AACzD,uDAA+D;AAC/D,+CAA2D;AAC3D,+CAA2D;AAC3D,2CAAuD;AACvD,6CAAyD;AACzD,2CAAuD;AACvD,iDAA6D;AAC7D,6CAAyD;AACzD,iDAAyD;AAEzD,mEAAmE;AACnE,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACpD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;IACtD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM;CACpD,CAAC;AAEF,MAAM,WAAW,GAA6B;IAC5C,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC;IAC1G,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IACpE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7B,GAAG,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IACjC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,CAAC;IACpI,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACtE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACxE,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;IAC7C,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;IACvC,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC;CAC1D,CAAC;AAEF,MAAM,UAAU,GAAG,IAAA,kBAAQ,EAAC,wCAAwC,CAAC,CAAC;AACtE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAChD,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,IAAA,oBAAc,EAAC;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,6EAA6E,CAAC;KAC1F,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEnE,OAAO;AACP,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,aAAa;AACb,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,OAAO;AACP,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,QAAQ;AACR,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,kCAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,aAAa;AACb,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,4BAAkB,EAAC,OAAO,CAAC,CAAC;AAE5B,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAA,uBAAiB,GAAE,CAAC;AAC5B,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"atbash.js","sourceRoot":"","sources":["../../src/bin/atbash.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,wDAAgC;AAChC,qCAAgE;AAChE,6CAAyD;AACzD,+CAA2D;AAC3D,+CAA2D;AAC3D,iDAA6D;AAC7D,6CAAyD;AACzD,uDAA+D;AAC/D,+CAA2D;AAC3D,+CAA2D;AAC3D,2CAAuD;AACvD,6CAAyD;AACzD,2CAAuD;AACvD,iDAA6D;AAC7D,2CAAuD;AACvD,6CAAyD;AACzD,yDAAoE;AAEpE,mEAAmE;AACnE,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACpD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;IACtD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM;CACpE,CAAC;AAEF,MAAM,WAAW,GAA6B;IAC5C,KAAK,EAAE;QACL,WAAW;QACX,aAAa;QACb,YAAY;QACZ,SAAS;QACT,OAAO;QACP,YAAY;QACZ,WAAW;QACX,QAAQ;KACT;IACD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IACpE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;IACxG,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,CAAC;IACpI,aAAa,EAAE;QACb,SAAS;QACT,QAAQ;QACR,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,WAAW;QACX,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,QAAQ;KACT;IACD,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACtE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACxE,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;IAC7C,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;IACvC,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC;CAC1D,CAAC;AAEF,MAAM,UAAU,GAAG,IAAA,kBAAQ,EAAC,wCAAwC,CAAC,CAAC;AACtE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAChD,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,IAAA,oBAAc,EAAC;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CACV,6EAA6E,CAC9E;KACA,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEnE,OAAO;AACP,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,aAAa;AACb,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,OAAO;AACP,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,QAAQ;AACR,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,kCAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,aAAa;AACb,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAC7B,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,uCAAyB,EAAC,OAAO,CAAC,CAAC;AAEnC,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAA,uBAAiB,GAAE,CAAC;AAC5B,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/commands/connect.d.ts

@@ -14,6 +14,25 @@ import { Command } from "commander";
  * The discovery mirrors the dashboard's src/lib/scan/discover.ts and produces
  * the same relay-safe payload the session endpoint expects.
  */
+/**
+ * Official Atbash deployments that legitimately serve the onboarding flow.
+ *
+ * The pairing screen builds `--host` from the page you opened, so every origin
+ * that can host onboarding must appear here. If production were missing, the real
+ * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
+ * genuine article, which is worse than silence: it teaches people and agents to
+ * wave through the one warning that actually catches a swapped host.
+ *
+ * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
+ * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
+ */
+export declare const KNOWN_HOSTS: Set<string>;
+/**
+ * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
+ * because it is the one running the current connector API; switch this to
+ * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
+ */
+export declare const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
 interface DeclaredTool {
     name: string;
     description?: string;
@@ -34,7 +53,6 @@ type Agent = {
     detail: string;
     declaredTools: DeclaredTool[];
     surfaceEvidence?: SurfaceEvidence;
-    governance?: Governance;
 } | {
     type: "config";
     label: string;
@@ -52,6 +70,10 @@ declare function describeSkill(text: string | undefined, fallback: string): stri
 declare function safeDescription(raw: string): string | undefined;
 /** Walk a skills root (bounded) → declared tools. Mirrors src/lib/scan/adapters/local-skills.ts. */
 declare function enumerateSkills(root: string, maxDepth?: number, cap?: number): DeclaredTool[];
+export declare const MCP_CONFIGS: {
+    label: string;
+    segs: string[];
+}[];
 /**
  * THE sanitization boundary. Reduce an mcpServers map to the SANITIZED structural
  * signal the hosted scanner needs — server name, host+path of the endpoint, and
@@ -65,55 +87,23 @@ declare function enumerateSkills(root: string, maxDepth?: number, cap?: number):
  * size against the input size and label the result partial — see `discover()`.
  */
 declare function relaySafeServers(servers: Record<string, unknown>): Record<string, unknown>;
-/**
- * Atbash's own wiring on this machine — is the boundary actually in place?
- *
- * The relay reported an agent's TOOL SURFACE and nothing about whether Atbash
- * governs it, so the dashboard's "re-scan to confirm it reports as enforcing"
- * had nothing to read. Worse, the two failures that matter most are invisible in
- * a file listing: a plugin installed but never enabled, and a plugin enabled but
- * pointed at no key. Both leave a machine that looks wired and enforces nothing.
- *
- * FILE READS ONLY. No processes are spawned, so this stays inside the read-only
- * promise the onboarding page makes about this command. Everything below is a
- * documented location:
- *
- *  - OpenClaw: the plugin entry in `~/.openclaw/openclaw.json`. Both the current
- *    `openclaw` key and the legacy `atbash-plugin` key count, since the dashboard
- *    recognizes either.
- *  - Hermes: plugins are OPT-IN via a `plugins.enabled` allow-list in
- *    `~/.hermes/config.yaml` (hermes_cli/plugins.py:_get_enabled_plugins — a
- *    missing key means nothing loads), and the plugin reads its key path from
- *    `~/.hermes/.env`.
- *
- * `enforcing` is only ever true when BOTH the hook is switched on and a key path
- * is configured. Reporting enforcement on the strength of an installed package
- * would recreate the exact false green this is meant to catch.
- */
-interface Governance {
-    installed: boolean;
-    enforcing: boolean;
-    entry?: string;
-    keyPathConfigured: boolean;
-    agentPubkey?: string;
-    /**
-     * Every agent this machine has been wired to, newest-known last.
-     *
-     * A machine governs exactly ONE agent at a time: the plugin config names one
-     * key path and that file holds one identity, so each `atbash setup` run
-     * displaces the previous agent and archives its key under
-     * `~/.config/atbash/keys/<pubkey>.key`. On a real box that had quietly rotated
-     * five times, nothing anywhere said so — the browser could not tell "already
-     * protected" from "protected, but for a different agent than the one you are
-     * onboarding".
-     *
-     * Only PUBLIC keys leave the machine, and only from filenames — the archived
-     * files are never opened. The current agent's key is included so the caller can
-     * mark which of the list is live without a second lookup.
-     */
-    knownAgents?: string[];
-}
 /** Enumerate the agents/MCP tools configured on this machine. Read-only. */
 declare function discover(home: string): Agent[];
+/**
+ * ⚠️ SECURITY INVARIANT — this returns RAW, UNSANITIZED server specs.
+ * The values here contain live secrets: url credentials, `env`, `headers`,
+ * `token`, `apiKey`, and absolute command paths. They exist ONLY so `--introspect`
+ * can reach a server locally. They MUST NEVER be put into the relay payload
+ * directly. Every path that turns these into an `Agent` MUST route them through
+ * `relaySafeServers()` first (the single sanitization boundary). If you add a new
+ * consumer, sanitize before it leaves this file. Callers today: `discover()`
+ * (sanitizes), `connect --introspect` and `atbash scan --introspect` (both local
+ * only, never relayed — scan has no relay path at all).
+ */
+declare function readAllMcpServers(home: string): {
+    label: string;
+    servers: Record<string, unknown>;
+}[];
 export declare function registerConnectCommand(program: Command): void;
-export { discover, enumerateSkills, describeSkill, relaySafeServers, safeDescription };
+export { discover, enumerateSkills, describeSkill, relaySafeServers, safeDescription, readAllMcpServers };
+export type { Agent, DeclaredTool };