@atbash/cli 0.5.15 → 0.6.0-dev.1

package/README.md

@@ -139,6 +139,168 @@ atbash judge 'grant admin access to CI service account'
 The agent cannot retry or self-unjail. An operator must review and release at [https://atbash.ai/](https://atbash.ai/).
 
 
+## Local scan
+
+`atbash scan` reports what is installed on this machine. It needs no account, no pairing code and no dashboard. The report is printed in your terminal and is never uploaded.
+
+```bash
+# What is installed here
+atbash scan
+
+# Ask each MCP server what tools it actually has
+atbash scan --introspect
+
+# Add a draft boundary: red lines and actions that need approval
+atbash scan --introspect --policy
+
+# Machine-readable output
+atbash scan --introspect --json
+```
+
+Output:
+
+```
+  Atbash local scan
+  ────────────────────────────
+  Machine : my-laptop
+  Found   : 1 runtime
+
+  OpenClaw — 5 skills / plugins
+    • delete-customer-records
+    • export-crm-contacts
+    • issue-refund
+    • list-tickets
+    • send-email
+
+  Risk
+  ────────────────────────────
+  Level   : High (92/100)
+  Method  : deterministic
+  5 authorized action paths (3 high-severity).
+
+    high   delete-customer-records — destructive action
+           irreversible data/infrastructure loss
+    high   export-crm-contacts — data access / egress
+           data leakage / privacy breach
+    high   issue-refund — financial
+           direct financial loss
+    medium send-email — external communication
+           external message sent on the owner's behalf (monitored)
+    low    list-tickets — read / research
+           low-consequence information access
+```
+
+With `--policy` it also prints a draft boundary you can edit and enforce:
+
+```
+  Recommended boundary
+  ────────────────────────────
+  Red lines (auto-deny)
+    • Never perform destructive action autonomously (e.g. delete-customer-records).
+    • Never perform data access / egress autonomously (e.g. export-crm-contacts).
+    • Never modify its own mandate, red lines, or authority.
+
+  Needs approval
+    • Require human approval before financial (e.g. issue-refund).
+```
+
+### What leaves your machine
+
+Nothing, unless you ask for it.
+
+| Command | Requests sent |
+| --- | --- |
+| `atbash scan` | none |
+| `--introspect` | one per MCP server configured with an `http` URL, sent to that URL |
+| `--api-key` | one, to your LLM provider |
+| `--threats` | one, to your LLM provider |
+
+Nothing is ever sent to Atbash. `--json` reports the actual count as `networkRequests`, so you can check it.
+
+Credentials found in your config files are removed before anything is printed or sent. That covers `env` values, `headers`, tokens, and secrets embedded in command paths.
+
+### Using your own LLM key
+
+The built-in rules classify tools by name and description. Some tools match no rule. Supply your own [OpenRouter](https://openrouter.ai) key and the CLI will grade those as well. With `--threats` it also looks for risks that only appear when tools are combined, such as reading customer data and sending mail.
+
+The key is read from the first of these that is set:
+
+1. `--api-key <key>`
+2. `ATBASH_SCAN_API_KEY`
+3. `OPENROUTER_API_KEY`
+
+On a shared machine, use an environment variable rather than `--api-key`. Command arguments are visible to other users through `ps`.
+
+First get a key from [openrouter.ai/settings/keys](https://openrouter.ai/settings/keys). It looks like `sk-or-v1-` followed by 64 hex characters.
+
+**macOS keychain.** The keychain stores every secret under the name "password", so the prompt says `password data for new item:`. That is where the API key goes. Do not type a login password.
+
+```bash
+security add-generic-password -a "$USER" -s atbash-openrouter -U -w
+```
+
+It prompts twice:
+
+```
+password data for new item:        <- paste the sk-or-v1-... key
+retype password for new item:      <- paste it again
+```
+
+Nothing is echoed as you paste, and the two entries must match or it fails with `passwords don't match`. Check what actually got stored:
+
+```bash
+v=$(security find-generic-password -a "$USER" -s atbash-openrouter -w); echo "${#v} chars, starts ${v:0:9}"
+# expect: 73 chars, starts sk-or-v1-
+```
+
+If that prints anything else, the wrong value was stored. Run the `add` command again; `-U` overwrites it.
+
+Then use it:
+
+```bash
+export ATBASH_SCAN_API_KEY="$(security find-generic-password -a "$USER" -s atbash-openrouter -w)"
+atbash scan --introspect --threats --policy
+```
+
+**Linux, or anywhere without a keychain.** Use a file only you can read:
+
+```bash
+mkdir -p ~/.config/atbash && chmod 700 ~/.config/atbash
+(umask 077; touch ~/.config/atbash/openrouter.key)
+$EDITOR ~/.config/atbash/openrouter.key      # paste the key, save
+
+export ATBASH_SCAN_API_KEY="$(cat ~/.config/atbash/openrouter.key)"
+```
+
+**CI.** Store the key as a repository secret and map it to the environment variable. Never put it in a file in the repo.
+
+```yaml
+- run: atbash scan --introspect --fail-on high
+  env:
+    ATBASH_SCAN_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+```
+
+Pick a different model with `--model <id>`. The default is `z-ai/glm-5.3-flash`.
+
+If the key is missing, wrong, or the provider is down, the scan still finishes using the built-in grading and tells you what failed. You never lose the report.
+
+### Use in CI
+
+`--fail-on` turns the risk level into an exit code.
+
+```bash
+atbash scan --introspect --fail-on high
+```
+
+| Exit code | Meaning |
+| --- | --- |
+| 0 | risk level is below the threshold |
+| 1 | risk level reached the threshold |
+| 2 | the `--fail-on` value was not `low`, `elevated` or `high` |
+
+Run the gate without an API key. Built-in grading returns the same answer every time. Model grading varies between runs, which would make the gate flaky.
+
+
 ## End-to-end example: guarding a production deploy
 
 A CI agent is about to apply a database migration to production. The operator policy holds all production applies for review before execution.
@@ -331,6 +493,29 @@ If any check fails — an integrity value that does not match the deployment's m
 
 ## Command reference
 
+### `atbash scan`
+
+Scan this machine and print the report here. No account and no pairing code. See [Local scan](#local-scan) for the full walkthrough.
+
+```bash
+npx --yes @atbash/cli scan --introspect --policy
+```
+
+| Flag | Description |
+|------|-------------|
+| `--introspect` | Ask each configured MCP server what tools it advertises. Starts stdio servers locally and contacts `http` servers at their own URL. No tool is ever called |
+| `--policy` | Also print a draft boundary: red lines and actions that need approval |
+| `--threats` | Also list risks that come from tools used in combination. Needs an API key |
+| `--api-key <key>` | Your own LLM provider key. Also read from `ATBASH_SCAN_API_KEY` or `OPENROUTER_API_KEY` |
+| `--model <id>` | Model used for grading. Default `z-ai/glm-5.3-flash` |
+| `--fail-on <level>` | Exit 1 when the risk level reaches `low`, `elevated` or `high` |
+| `--json` | Machine-readable output |
+| `--home <dir>` | Home directory to scan (for testing) |
+
+Without a key the report is produced entirely on this machine. `--threats` and
+`--api-key` send tool names and descriptions to the provider you chose, never to
+Atbash.
+
 ### `atbash connect <code>`
 
 Link a machine to a hosted Atbash onboarding session. A browser can't read your disk and the Atbash server only sees its own, so this runs on the machine you want to govern, enumerates the agents / MCP tools configured there (read-only), and relays their *surface* to your onboarding session via the one-time pairing code shown in the browser.
@@ -357,6 +542,62 @@ configured MCP server processes, so it is not purely read-only even though Atbas
 never invokes their tools. See [Verifying this CLI](#verifying-this-cli-before-you-run-it-humans--ai-agents)
 and the [release checklist](RELEASE_CHECKLIST.md).
 
+### `atbash setup`
+
+Wire this machine's runtime to an agent you already onboarded. `connect` is the read-only half of onboarding; this is the half that **writes**. It places the agent key where every integration looks for it, installs the OpenClaw plugin, and *merges* the plugin block into your existing `~/.openclaw/openclaw.json` — the step that is easy to get wrong by hand, and whose failure mode is an agent that looks governed while enforcing nothing.
+
+```bash
+# Preview everything first — prints the exact file diffs, writes nothing:
+npx --yes @atbash/cli setup --dry-run
+
+# Point it at the key file onboarding downloaded for you:
+npx --yes @atbash/cli setup --keys-dir ~/Downloads
+
+# Or paste the key at a hidden prompt (nothing lands in your shell history):
+npx --yes @atbash/cli setup
+```
+
+| Flag | Description |
+|------|-------------|
+| `-k, --key <privkey>` | Agent private key inline. Convenient, but it lands in your shell history — prefer the prompt or `--key-file` |
+| `--key-file <path>` | Read the key from a file (`agent-keys-*.txt` from onboarding, or an existing `guard-client-key`) |
+| `--keys-dir <dir>` | Directory holding the key file, e.g. `~/Downloads` |
+| `--host <url>` | Deployment to check the agent's registration against |
+| `--runtime <ids...>` | Only configure these runtimes (currently: `openclaw`) |
+| `--dry-run` | Show which files would change, and the diffs, then exit WITHOUT writing |
+| `-y, --yes` | Do not ask for confirmation before writing |
+| `--no-install` | Write the key file and configs only; install no packages |
+| `--skip-verify` | Make no network calls at all |
+| `--allow-unrecognized-host` | Permit a `--host` outside the built-in Atbash allowlist |
+| `--home <dir>` | Home directory to configure (for testing) |
+
+If no key is supplied, setup looks in order at `--key`, `--key-file`, `--keys-dir`,
+`ATBASH_AGENT_KEY`, the existing `~/.config/atbash/guard-client-key`, your
+`atbash config`, and finally a hidden prompt that accepts **either** a key or a path.
+Wherever it comes from, the key is written once to
+`~/.config/atbash/guard-client-key` at `0600`, and every config setup writes
+*references that path* rather than embedding the secret again.
+
+**What it will not do.**
+
+- It never transmits the private key. The only network call is a registration
+  check, and that sends the **public** key.
+- It never writes the private key into an MCP client config. The documented
+  `@atbash/mcp` wiring carries the key as an `ATBASH_AGENT_PRIVKEY` value inside
+  files like `claude_desktop_config.json`, and that package has no key-file
+  fallback today. MCP clients are detected and the snippet is printed for you to
+  add by hand.
+- It never edits your application source. Code-level integrations (LangChain,
+  LangGraph, AutoGen, Eliza, the SDK boundary) stay yours to write.
+- It never rewrites a config that uses comments or trailing commas — reserializing
+  JSONC as JSON would delete your comments, so those become a printed snippet.
+- It refuses to wire a runtime to an agent that is not registered. A machine that
+  looks governed with a plugin that can never get a verdict is the worst available
+  outcome.
+
+Every file it changes is copied to a `.atbash-bak` alongside it first, and repeat
+runs are idempotent.
+
 ### `atbash judge <action>`
 
 Submit a pending action for judgment. The action string is the exact operation the agent is about to execute — a transfer, a command, a mutation.
@@ -476,6 +717,97 @@ Tool Call Details
   Latency:      2340ms
 ```
 
+### `atbash github-scan`
+
+Read-only GitHub inventory and change-risk triage. The scanner calls GitHub's REST
+API directly; it does not invoke the `gh` CLI and it never makes a mutating API
+request.
+
+```bash
+# Use a classic/fine-grained user token or GitHub App installation token with
+# read access to every repository and organization that should be inventoried.
+# Set GITHUB_TOKEN or GH_TOKEN in the process environment; tokens are never
+# accepted as command-line arguments.
+
+atbash github-scan --owner Atbash-Ai --expect-repos 13 --since 2026-08-01 --json
+atbash github-scan --repo Atbash-Ai/atbash-cli --branch main
+```
+
+`--owner` and `--repo` are repeatable. `--branch` limits branch inventory,
+commits, and merged-PR base branch. `--since` accepts an ISO-8601 date or
+timestamp and defaults to 30 days. Bots are excluded unless `--include-bots` is
+set. Use `--owner` for scheduled organization audits: without it, `/user/repos`
+intentionally inventories every owner visible to the token, which may include
+private personal or unrelated organization repositories. `--expect-repos`
+makes a known inventory size an exact fail-closed assertion.
+
+The command verifies the authenticated user or GitHub App installation, records
+OAuth scopes when GitHub supplies the `X-OAuth-Scopes` header, verifies
+repository metadata permissions and organization visibility, and validates REST
+pagination. A full page without a `Link` header is not accepted as terminal:
+the scanner probes explicit sequential page numbers until a short/empty page or
+a terminal `Link` relation is verified. Duplicate pages/items, changed filters,
+cycles, non-sequential links, and the 1,000-page hard ceiling fail the scan.
+This establishes completeness for the authenticated API view and selected
+filters; it cannot prove that the token was granted access to repositories
+GitHub never exposes to it. GitHub REST pagination is not snapshot-isolated:
+concurrent repository changes can move items between pages. Duplicate/cycle
+checks fail on detectable drift, but the `completeness.snapshotConsistency`
+field explicitly records that snapshot consistency is not guaranteed; rerun a
+scheduled audit if the organization changed during collection.
+
+The network contract is GET-only: identity (`/user` or `/installation`),
+repository inventory (`/user/repos` or `/installation/repositories`),
+organization metadata, branches, closed pull requests, PR file metadata,
+commits, commit file metadata, and commit-to-PR associations. Tests reject any
+non-GET request across these paths.
+
+JSON output is sorted and schema-versioned. It includes a `completeness` object,
+rate-limit status, public/private counts, branches, recent merged PR metadata,
+commit metadata, changed filenames, and deterministic risk flags.
+
+Bound controls fail rather than truncate:
+
+- `--max-repos` (default 1,000)
+- `--max-branches` per repository (default 1,000)
+- `--max-prs` recent closed PRs inspected per repository (default 1,000)
+- `--max-commits` per branch (default 1,000)
+- `--max-files` per PR or commit (default 3,000)
+
+Lower these for tightly bounded scheduled jobs. Raise them deliberately for a
+larger organization; exceeding any bound exits nonzero without output or state
+advancement.
+
+Security and limits:
+
+- Set exactly one of `GITHUB_TOKEN` or `GH_TOKEN`; if both differ, the command
+  fails. Tokens are held in memory, sent only in the GitHub authorization
+  header, and redacted from errors.
+- The scanner never fetches blobs, trees, patches, diffs, or private file
+  contents. It reads repository/change metadata and changed filenames. Private
+  repository names and filenames still remain sensitive; protect JSON output.
+- Human output exposes authenticated identity, repository names/visibility,
+  aggregate counts, and risk-category names. JSON additionally exposes branch
+  names, PR titles/authors/timestamps, commit subjects/authors/timestamps, URLs,
+  changed filenames, and permission metadata. Treat either output as sensitive;
+  redirect JSON only to an access-controlled destination.
+- The complete result is buffered before anything is printed. Authentication,
+  permission, malformed response, pagination, REST, or rate-limit failure exits
+  nonzero and emits no partial scan. The scanner writes no cursor or checkpoint,
+  so a failed run cannot advance state.
+- Risk flags are deterministic path-based triage for Rell/contracts,
+  encryption/keys/auth, decision semantics, SDK/plugin APIs,
+  workflows/releases/dependencies, and direct commits detected on protected
+  branches. They are not semantic code analysis and are explicitly **not a full
+  SAST assessment**.
+- Direct-commit detection asks GitHub whether a protected-branch commit belongs
+  to a merged PR. Branch rules, merge queues, force pushes, and GitHub's
+  commit-to-PR association can limit that inference.
+- Fine-grained tokens and GitHub App installations should receive read-only
+  metadata, contents, pull-request, and organization access as applicable.
+  GitHub may not report named scopes for these token types; successful endpoint
+  access is the permission check.
+
 ### `atbash whoami` / `atbash policy show` / `atbash tier`
 
 Inspect the current agent's identity, assigned policy, and org tier.
@@ -561,7 +893,13 @@ atbash unset endpoint
 | Agent key | `--agent-key` | `ATBASH_AGENT_KEY` | `atbash set agent-key <hex>` |
 | Org name | `--org` | `ATBASH_ORG_NAME` | `atbash set org-name <name>` |
 | API endpoint | `--endpoint` | `ATBASH_ENDPOINT` | `atbash set endpoint <url>` |
+| Self-hosted judge signing key | `--verify-pubkey` (judge) | `ATBASH_JUDGE_VERIFY_PUBKEY` | config key `judgeVerifyPubKey` |
 | Blockchain RID | — | `ATBASH_BLOCKCHAIN_RID` | `atbash set rid <hex>` |
+
+> **Self-hosted judge:** the SDK only accepts an endpoint outside the trusted allowlist
+> when the judge's 66-hex response-signing pubkey is supplied too, so every verdict can be
+> verified. Set `ATBASH_JUDGE_VERIFY_PUBKEY` (or `--verify-pubkey` on `judge`) together with
+> `--endpoint`; without it a non-default endpoint is refused.
 | Inference provider | `--provider` | `ATBASH_PROVIDER` | `atbash set provider <name>` |
 | Model | `--model` | `ATBASH_PROVIDER_MODEL` | `atbash set model <model>` |
 

package/dist/bin/atbash.js

@@ -19,18 +19,46 @@ const tier_1 = require("../commands/tier");
 const tools_1 = require("../commands/tools");
 const held_1 = require("../commands/held");
 const connect_1 = require("../commands/connect");
+const scan_1 = require("../commands/scan");
+const setup_1 = require("../commands/setup");
+const github_scan_1 = require("../commands/github-scan");
 // ── Autocomplete ────────────────────────────────────────────────
 const commands = [
     "judge", "whoami", "policy", "tier", "tools", "held",
     "history", "stats", "status", "keygen", "set", "unset",
-    "wipe", "config", "connect", "help",
+    "wipe", "config", "connect", "scan", "setup", "github-scan", "help",
 ];
 const subcommands = {
-    judge: ["--context", "--agent-key", "--provider", "--model", "--org", "--endpoint", "--timeout", "--json"],
+    judge: [
+        "--context",
+        "--agent-key",
+        "--provider",
+        "--model",
+        "--org",
+        "--endpoint",
+        "--timeout",
+        "--json",
+    ],
     policy: ["show"],
     tools: ["--agent", "--org", "--count", "--json", "inspect", "count"],
     held: ["--org", "--count", "--json", "reviews"],
     connect: ["--host", "--home"],
+    scan: ["--home", "--introspect", "--api-key", "--model", "--threats", "--policy", "--fail-on", "--json"],
+    setup: ["--key", "--key-file", "--keys-dir", "--host", "--runtime", "--dry-run", "--yes", "--no-install", "--skip-verify", "--home"],
+    "github-scan": [
+        "--owner",
+        "--repo",
+        "--branch",
+        "--since",
+        "--expect-repos",
+        "--max-repos",
+        "--max-branches",
+        "--max-prs",
+        "--max-commits",
+        "--max-files",
+        "--include-bots",
+        "--json",
+    ],
     set: ["agent-key", "org-name", "endpoint", "rid", "provider", "model"],
     unset: ["agent-key", "org-name", "endpoint", "rid", "provider", "model"],
     show: ["--agent-key", "--endpoint", "--json"],
@@ -85,6 +113,10 @@ program
 (0, config_cmd_1.registerConfigCommand)(program);
 // Onboarding
 (0, connect_1.registerConnectCommand)(program);
+(0, scan_1.registerScanCommand)(program);
+(0, setup_1.registerSetupCommand)(program);
+// External scanning
+(0, github_scan_1.registerGithubScanCommand)(program);
 async function main() {
     await program.parseAsync(process.argv);
     await (0, sdk_1.shutdownTelemetry)();

package/dist/bin/atbash.js.map

@@ -1 +1 @@
-{"version":3,"file":"atbash.js","sourceRoot":"","sources":["../../src/bin/atbash.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,wDAAgC;AAChC,qCAAgE;AAChE,6CAAyD;AACzD,+CAA2D;AAC3D,+CAA2D;AAC3D,iDAA6D;AAC7D,6CAAyD;AACzD,uDAA+D;AAC/D,+CAA2D;AAC3D,+CAA2D;AAC3D,2CAAuD;AACvD,6CAAyD;AACzD,2CAAuD;AACvD,iDAA6D;AAE7D,mEAAmE;AACnE,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACpD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;IACtD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;CACpC,CAAC;AAEF,MAAM,WAAW,GAA6B;IAC5C,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC;IAC1G,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IACpE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7B,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACtE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACxE,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;IAC7C,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;IACvC,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC;CAC1D,CAAC;AAEF,MAAM,UAAU,GAAG,IAAA,kBAAQ,EAAC,wCAAwC,CAAC,CAAC;AACtE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAChD,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,IAAA,oBAAc,EAAC;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,6EAA6E,CAAC;KAC1F,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEnE,OAAO;AACP,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,aAAa;AACb,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,OAAO;AACP,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,QAAQ;AACR,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,kCAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,aAAa;AACb,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAEhC,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAA,uBAAiB,GAAE,CAAC;AAC5B,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"atbash.js","sourceRoot":"","sources":["../../src/bin/atbash.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,wDAAgC;AAChC,qCAAgE;AAChE,6CAAyD;AACzD,+CAA2D;AAC3D,+CAA2D;AAC3D,iDAA6D;AAC7D,6CAAyD;AACzD,uDAA+D;AAC/D,+CAA2D;AAC3D,+CAA2D;AAC3D,2CAAuD;AACvD,6CAAyD;AACzD,2CAAuD;AACvD,iDAA6D;AAC7D,2CAAuD;AACvD,6CAAyD;AACzD,yDAAoE;AAEpE,mEAAmE;AACnE,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACpD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;IACtD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM;CACpE,CAAC;AAEF,MAAM,WAAW,GAA6B;IAC5C,KAAK,EAAE;QACL,WAAW;QACX,aAAa;QACb,YAAY;QACZ,SAAS;QACT,OAAO;QACP,YAAY;QACZ,WAAW;QACX,QAAQ;KACT;IACD,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IACpE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;IACxG,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,CAAC;IACpI,aAAa,EAAE;QACb,SAAS;QACT,QAAQ;QACR,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,WAAW;QACX,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,QAAQ;KACT;IACD,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACtE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACxE,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;IAC7C,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;IACvC,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC;CAC1D,CAAC;AAEF,MAAM,UAAU,GAAG,IAAA,kBAAQ,EAAC,wCAAwC,CAAC,CAAC;AACtE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAChD,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,IAAA,oBAAc,EAAC;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CACV,6EAA6E,CAC9E;KACA,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEnE,OAAO;AACP,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,aAAa;AACb,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,OAAO;AACP,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,QAAQ;AACR,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,kCAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,aAAa;AACb,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAC7B,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,uCAAyB,EAAC,OAAO,CAAC,CAAC;AAEnC,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAA,uBAAiB,GAAE,CAAC;AAC5B,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/commands/connect.d.ts

@@ -1,4 +1,38 @@
 import { Command } from "commander";
+/**
+ * `atbash connect <code>` — the local connector.
+ *
+ * A hosted Atbash onboarding page can't read your machine's filesystem, and the
+ * Atbash server only sees its own disk. This command runs on YOUR machine,
+ * enumerates the agents/MCP tools configured locally, and relays them to your
+ * onboarding session via a one-time pairing code shown in the browser.
+ *
+ * Read-only: it reads a fixed set of known agent config paths and reports the
+ * declared tool surface (server/skill NAMES) — never the secret values inside.
+ * It makes ONE outbound POST (the relay) and exits.
+ *
+ * The discovery mirrors the dashboard's src/lib/scan/discover.ts and produces
+ * the same relay-safe payload the session endpoint expects.
+ */
+/**
+ * Official Atbash deployments that legitimately serve the onboarding flow.
+ *
+ * The pairing screen builds `--host` from the page you opened, so every origin
+ * that can host onboarding must appear here. If production were missing, the real
+ * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
+ * genuine article, which is worse than silence: it teaches people and agents to
+ * wave through the one warning that actually catches a swapped host.
+ *
+ * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
+ * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
+ */
+export declare const KNOWN_HOSTS: Set<string>;
+/**
+ * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
+ * because it is the one running the current connector API; switch this to
+ * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
+ */
+export declare const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
 interface DeclaredTool {
     name: string;
     description?: string;
@@ -36,6 +70,10 @@ declare function describeSkill(text: string | undefined, fallback: string): stri
 declare function safeDescription(raw: string): string | undefined;
 /** Walk a skills root (bounded) → declared tools. Mirrors src/lib/scan/adapters/local-skills.ts. */
 declare function enumerateSkills(root: string, maxDepth?: number, cap?: number): DeclaredTool[];
+export declare const MCP_CONFIGS: {
+    label: string;
+    segs: string[];
+}[];
 /**
  * THE sanitization boundary. Reduce an mcpServers map to the SANITIZED structural
  * signal the hosted scanner needs — server name, host+path of the endpoint, and
@@ -51,5 +89,21 @@ declare function enumerateSkills(root: string, maxDepth?: number, cap?: number):
 declare function relaySafeServers(servers: Record<string, unknown>): Record<string, unknown>;
 /** Enumerate the agents/MCP tools configured on this machine. Read-only. */
 declare function discover(home: string): Agent[];
+/**
+ * ⚠️ SECURITY INVARIANT — this returns RAW, UNSANITIZED server specs.
+ * The values here contain live secrets: url credentials, `env`, `headers`,
+ * `token`, `apiKey`, and absolute command paths. They exist ONLY so `--introspect`
+ * can reach a server locally. They MUST NEVER be put into the relay payload
+ * directly. Every path that turns these into an `Agent` MUST route them through
+ * `relaySafeServers()` first (the single sanitization boundary). If you add a new
+ * consumer, sanitize before it leaves this file. Callers today: `discover()`
+ * (sanitizes), `connect --introspect` and `atbash scan --introspect` (both local
+ * only, never relayed — scan has no relay path at all).
+ */
+declare function readAllMcpServers(home: string): {
+    label: string;
+    servers: Record<string, unknown>;
+}[];
 export declare function registerConnectCommand(program: Command): void;
-export { discover, enumerateSkills, describeSkill, relaySafeServers, safeDescription };
+export { discover, enumerateSkills, describeSkill, relaySafeServers, safeDescription, readAllMcpServers };
+export type { Agent, DeclaredTool };

package/dist/commands/connect.js

@@ -36,12 +36,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_CONFIGS = exports.DEFAULT_HOST = exports.KNOWN_HOSTS = void 0;
 exports.registerConnectCommand = registerConnectCommand;
 exports.discover = discover;
 exports.enumerateSkills = enumerateSkills;
 exports.describeSkill = describeSkill;
 exports.relaySafeServers = relaySafeServers;
 exports.safeDescription = safeDescription;
+exports.readAllMcpServers = readAllMcpServers;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -77,7 +79,7 @@ const introspect_mcp_1 = require("./introspect-mcp");
  * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
  * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
  */
-const KNOWN_HOSTS = new Set([
+exports.KNOWN_HOSTS = new Set([
     "atbash.ai",
     "www.atbash.ai",
     "chromia-verified-ai-dev-two.vercel.app",
@@ -88,7 +90,7 @@ const KNOWN_HOSTS = new Set([
  * because it is the one running the current connector API; switch this to
  * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
  */
-const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
+exports.DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
 // Discovery is intentionally bounded. A local config is untrusted input even
 // though it lives on the operator's machine: a giant/malformed file must not turn
 // a one-shot connector into a memory or latency sink.
@@ -196,7 +198,7 @@ function enumerateSkills(root, maxDepth = 3, cap = 400) {
     walk(root, 0, path.basename(root));
     return tools;
 }
-const MCP_CONFIGS = [
+exports.MCP_CONFIGS = [
     { label: "Claude Desktop", segs: ["Library", "Application Support", "Claude", "claude_desktop_config.json"] },
     { label: "Claude Desktop", segs: [".config", "Claude", "claude_desktop_config.json"] },
     { label: "Cursor", segs: [".cursor", "mcp.json"] },
@@ -351,12 +353,13 @@ function discover(home) {
  * directly. Every path that turns these into an `Agent` MUST route them through
  * `relaySafeServers()` first (the single sanitization boundary). If you add a new
  * consumer, sanitize before it leaves this file. Callers today: `discover()`
- * (sanitizes) and the introspection pass (local only, never relayed).
+ * (sanitizes), `connect --introspect` and `atbash scan --introspect` (both local
+ * only, never relayed — scan has no relay path at all).
  */
 function readAllMcpServers(home) {
     const out = [];
     const seen = new Set();
-    for (const { label, segs } of MCP_CONFIGS) {
+    for (const { label, segs } of exports.MCP_CONFIGS) {
         if (seen.has(label))
             continue;
         const cfg = readJson(home, ...segs);
@@ -407,7 +410,7 @@ function registerConnectCommand(program) {
         .option("--allow-unrecognized-host", "Permit relaying to a --host that is not an official Atbash deployment (otherwise the command refuses to send)")
         .action(async (rawCode, opts) => {
         const home = opts.home || os.homedir();
-        const host = (opts.host || process.env.ATBASH_HOST || DEFAULT_HOST).replace(/\/+$/, "");
+        const host = (opts.host || process.env.ATBASH_HOST || exports.DEFAULT_HOST).replace(/\/+$/, "");
         const code = rawCode.trim().toUpperCase().replace(/[^A-Z0-9-]/g, "");
         const machine = os.hostname();
         const dryRun = !!opts.dryRun;
@@ -427,7 +430,7 @@ function registerConnectCommand(program) {
         const hostname = hostUrl ? hostUrl.hostname.toLowerCase() : "";
         const isLoopback = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\]|::1)$/.test(hostname);
         // "Recognized" = an official Atbash deployment (or your own machine for dev).
-        const recognizedHost = KNOWN_HOSTS.has(hostname) || isLoopback;
+        const recognizedHost = exports.KNOWN_HOSTS.has(hostname) || isLoopback;
         // Machine-readable summary for the --json path AND for any error, so an agent
         // gets a stable, parseable description of exactly what this command is/was doing.
         const emitJson = (extra) => console.log(JSON.stringify({
@@ -443,7 +446,7 @@ function registerConnectCommand(program) {
             machine, host, endpoint, code,
             // An agent should treat `recognizedHost: false` as a reason to stop and
             // ask, not a detail to skim past.
-            recognizedHost, knownHosts: [...KNOWN_HOSTS],
+            recognizedHost, knownHosts: [...exports.KNOWN_HOSTS],
             ...extra,
         }, null, 2));
         if (!code) {