@atbash/cli 0.5.15 → 0.6.1-dev.2

package/dist/lib/risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../src/lib/risk.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAmBH,0BAEC;AAoID,gDAEC;AAqED,wCAiBC;AAGD,gCAOC;AAmBD,wDA4BC;AAhSD;;;;;;;;GAQG;AACH,SAAgB,OAAO,CAAC,MAA0B,EAAE,IAAY;IAC9D,OAAO,GAAG,MAAM,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;AACpC,CAAC;AAmCD,oEAAoE;AACpE,gEAAgE;AAChE,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,6EAA6E;AAC7E,oFAAoF;AACpF,MAAM,KAAK,GAAW;IACpB;QACE,IAAI,EAAE,4HAA4H;QAClI,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,IAAI,EAAE,mFAAmF;QACzF,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,IAAI,EAAE,sGAAsG;QAC5G,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,IAAI,EAAE,yGAAyG;QAC/G,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,wDAAwD;KACtE;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,qFAAqF;IACrF;QACE,IAAI,EAAE,yHAAyH;QAC/H,QAAQ,EAAE,sBAAsB;QAChC,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,4IAA4I;QAClJ,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,qCAAqC;KACnD;IACD,iFAAiF;IACjF,4EAA4E;IAC5E,qEAAqE;IACrE,gFAAgF;IAChF,iFAAiF;IACjF;QACE,IAAI,EAAE,qIAAqI;QAC3I,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,yDAAyD;KACvE;IACD;QACE,IAAI,EAAE,6HAA6H;QACnI,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,kEAAkE;KAChF;IACD;QACE,IAAI,EAAE,mIAAmI;QACzI,QAAQ,EAAE,iBAAiB;QAC3B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,oCAAoC;KAClD;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEhC,QAAA,qBAAqB,GAAG,gBAAgB,CAAC;AACzC,QAAA,wBAAwB,GAAG,6DAA6D,CAAC;AAEtG;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAiD;IAClF,OAAO,IAAI,CAAC,QAAQ,KAAK,6BAAqB,IAAI,IAAI,CAAC,WAAW,KAAK,gCAAwB,CAAC;AAClG,CAAC;AAED,MAAM,YAAY,GAAuB;IACvC,QAAQ,EAAE,6BAAqB;IAC/B,6EAA6E;IAC7E,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,gCAAwB;CACtC,CAAC;AAEF,MAAM,UAAU,GAA6B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAE7E,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,kFAAkF;AAClF,uDAAuD;AACvD,MAAM,QAAQ,GAAuC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;AAEzG,SAAS,YAAY,CAAC,IAAc,EAAE,IAAwB,EAAE,SAAmB;IACjF,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,kBAAkB,EAAE,IAAI,CAAC,OAAO;QAChC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,IAAc;IAC9B,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC;IACtG,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,uCAAuC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtC,+EAA+E;QAC/E,6EAA6E;QAC7E,2BAA2B;QAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,kBAAkB;YAAE,SAAS;QACnD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,SAAgB,cAAc,CAAC,KAAiB;IAC9C,8EAA8E;IAC9E,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAwB,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,CAAC,uHAAuH;QACzH,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,0BAA0B,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,oHAAoH,CAAC;IAC7M,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,kFAAkF;AAClF,SAAgB,UAAU,CAAC,KAAiB;IAC1C,MAAM,KAAK,GAAG,KAAK;SAChB,OAAO,CAAC,QAAQ,CAAC;QAClB,0EAA0E;QAC1E,+DAA+D;SAC9D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,sBAAsB,CACpC,MAAkB,EAClB,MAAoF;IAEpF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,QAAQ,GACZ,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM;YACxC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACnB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,MAAM,KAAK,KAAK;oBAChB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,EAAE,CAAC;QACT,OAAO;YACL,GAAG,IAAI;YACP,QAAQ;YACR,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ;YACpD,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW;SACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC"}

package/dist/lib/threats-llm.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Optional LLM pass enumerating CROSS-TOOL threat chains.
+ *
+ * The deterministic engine grades one tool at a time, which is exactly what it
+ * can defend: a rule sees a name and a description. It cannot see that "read CRM"
+ * plus "send email" is an exfiltration path, because neither tool is dangerous
+ * alone. That combination is what this pass is for, and it is the analysis Koray
+ * described the hosted backend as doing.
+ *
+ * ADDITIVE ONLY. Threats never replace the deterministic paths and never move the
+ * risk score: the score gates CI through --fail-on, and a number that moved
+ * because a model phrased things differently this run would make that gate flaky.
+ * The dashboard rescores on threats; a terminal that exits non-zero must not.
+ *
+ * Spends the user's own key. One request, bounded, hard timeout; any failure
+ * returns no threats and the scan keeps its deterministic report.
+ */
+import type { ScanTool, Severity, Verdict } from "./risk";
+export interface Threat {
+    /** The bad OUTCOME in plain English, not a tool name. */
+    title: string;
+    /** Which capabilities combine to enable it, e.g. "CRM read + browser". */
+    enabledBy?: string;
+    category: string;
+    severity: Severity;
+    recommendedVerdict: Verdict;
+    consequence: string;
+}
+export interface ThreatOutcome {
+    threats: Threat[];
+    requests: number;
+    skipped: number;
+    error?: string;
+}
+export declare function deriveThreats(tools: ScanTool[], options: {
+    apiKey: string;
+    model?: string;
+    timeoutMs?: number;
+}): Promise<ThreatOutcome>;

package/dist/lib/threats-llm.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveThreats = deriveThreats;
+const llm_1 = require("./llm");
+/** Matches the dashboard's ceiling, so the two passes see the same surface. */
+const MAX_TOOLS = 200;
+const DESC_CAP = 240;
+const SYSTEM_PROMPT = `You are an AI-agent security analyst. Given an agent's tools, enumerate the most consequential risk paths — including CROSS-TOOL chains (e.g. read sensitive data + external send = exfiltration).
+
+Frame each as a THREAT a non-technical manager understands — the bad OUTCOME, not the tool name. Good titles: "Infer sensitive personal characteristics", "Leak CRM data into external tools", "Issue unauthorized or excessive refunds", "Weaken its own policy or authority". Bad titles: raw tool names like "deletePet".
+
+Return ONLY a JSON object of the form {"threats":[ ... ]}, no prose. Each entry:
+{"title":"<the threat, plain English>","enabledBy":"<which capabilities enable it, e.g. 'CRM read + browser'>","category":"<one category from the list below>","severity":"low|medium|high","recommendedVerdict":"allow|hold|block|jail","consequence":"<concrete harm in plain words>"}
+
+"category" MUST be EXACTLY one of these protection categories (pick the closest):
+Financial, Communication, File system, Code execution, Network & web, Accounts & identity, Calendar, Self-modification, Cross-agent, Behavioral anomaly.
+
+Rules:
+- recommendedVerdict: block = must never run; jail = attempts to weaken its own authority; hold = needs human approval; allow = low-consequence.
+- Judge the exposure the tools ALLOW, not intent. Never invent capabilities not implied by the tools.
+- Return AT MOST 6 entries, the most consequential ones. Fewer is better than padding with near-duplicates.
+- Keep every field short: "title" at most 8 words, "consequence" at most 15 words, "enabledBy" at most 8 words. Do not restate the title in the consequence.`;
+const SEVERITIES = ["low", "medium", "high"];
+const VERDICTS = ["allow", "hold", "block", "jail"];
+async function deriveThreats(tools, options) {
+    const batch = tools.slice(0, MAX_TOOLS);
+    const skipped = Math.max(0, tools.length - batch.length);
+    if (batch.length === 0)
+        return { threats: [], requests: 0, skipped: 0 };
+    const catalog = batch.map((t) => ({ name: t.name, description: (t.description ?? "").slice(0, DESC_CAP) }));
+    const res = await (0, llm_1.chatJson)({
+        apiKey: options.apiKey,
+        model: options.model,
+        timeoutMs: options.timeoutMs,
+        system: SYSTEM_PROMPT,
+        user: JSON.stringify(catalog),
+        maxTokens: 2000,
+    });
+    if (!res.data)
+        return { threats: [], requests: res.requests, skipped, error: res.error };
+    // Accept the {"threats":[...]} wrapper or a bare array, since models drop the
+    // wrapper often enough that rejecting it would lose whole runs.
+    const raw = Array.isArray(res.data)
+        ? res.data
+        : Array.isArray(res.data.threats)
+            ? (res.data.threats)
+            : [];
+    const threats = [];
+    const seen = new Set();
+    for (const entry of raw) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const p = entry;
+        const title = (0, llm_1.coerceStr)(p.title, 140).trim();
+        if (!title || seen.has(title.toLowerCase()))
+            continue;
+        seen.add(title.toLowerCase());
+        const severity = SEVERITIES.find((s) => s === (0, llm_1.coerceStr)(p.severity, 12).trim().toLowerCase()) ?? "medium";
+        const verdict = VERDICTS.find((v) => v === (0, llm_1.coerceStr)(p.recommendedVerdict, 12).trim().toLowerCase()) ?? "hold";
+        const enabledBy = (0, llm_1.coerceStr)(p.enabledBy, 140).trim();
+        threats.push({
+            title,
+            ...(enabledBy ? { enabledBy } : {}),
+            category: (0, llm_1.coerceStr)(p.category, 60).trim() || "Behavioral anomaly",
+            severity,
+            recommendedVerdict: verdict,
+            consequence: (0, llm_1.coerceStr)(p.consequence, 200).trim(),
+        });
+    }
+    return { threats, requests: res.requests, skipped };
+}
+//# sourceMappingURL=threats-llm.js.map

package/dist/lib/threats-llm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threats-llm.js","sourceRoot":"","sources":["../../src/lib/threats-llm.ts"],"names":[],"mappings":";;AA6DA,sCAgDC;AA3FD,+BAA4C;AAE5C,+EAA+E;AAC/E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,QAAQ,GAAG,GAAG,CAAC;AAoBrB,MAAM,aAAa,GAAG;;;;;;;;;;;;;;6JAcuI,CAAC;AAE9J,MAAM,UAAU,GAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACzD,MAAM,QAAQ,GAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAExD,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,OAA+D;IAE/D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAExE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,MAAM,IAAA,cAAQ,EAAC;QACzB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAEzF,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,CAAC,CAAE,GAAG,CAAC,IAAkB;QACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,GAAG,CAAC,IAA8B,CAAC,OAAO,CAAC;YAC1D,CAAC,CAAC,CAAE,GAAG,CAAC,IAA+B,CAAC,OAAO,CAAC;YAChD,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAA,eAAS,EAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAA,eAAS,EAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,QAAQ,CAAC;QAC1G,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAA,eAAS,EAAC,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,CAAC;QAC/G,MAAM,SAAS,GAAG,IAAA,eAAS,EAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC;YACX,KAAK;YACL,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,QAAQ,EAAE,IAAA,eAAS,EAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,oBAAoB;YAClE,QAAQ;YACR,kBAAkB,EAAE,OAAO;YAC3B,WAAW,EAAE,IAAA,eAAS,EAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC"}

package/dist/shared/atbash-targets.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Facts about WHERE Atbash lives — the deployments it trusts, and the on-disk
+ * locations it knows about.
+ *
+ * These are shared by the read-only connector (`atbash connect`) and the
+ * write-capable configurator (`atbash setup`). They live here rather than in
+ * either command because both must agree:
+ *
+ *  - A host the connector will relay to must be a host setup will verify
+ *    registration against. Two different allowlists would mean a deployment that
+ *    can receive a scan but cannot confirm the agent it scanned.
+ *  - A config path the scan reports must be a path setup can find. A client that
+ *    shows up in the dashboard but not in `setup` reads as a bug in whichever of
+ *    the two the operator happened to trust first.
+ *
+ * When they lived in connect.ts and setup imported them from there, a refactor of
+ * the connector could silently change the configurator's behaviour. Adding a
+ * client here updates both callers at once, which is the point.
+ */
+/**
+ * Official Atbash deployments that legitimately serve the onboarding flow.
+ *
+ * The pairing screen builds `--host` from the page you opened, so every origin
+ * that can host onboarding must appear here. If production were missing, the real
+ * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
+ * genuine article, which is worse than silence: it teaches people and agents to
+ * wave through the one warning that actually catches a swapped host.
+ *
+ * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
+ * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
+ */
+export declare const KNOWN_HOSTS: Set<string>;
+/**
+ * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
+ * because it is the one running the current connector API; switch this to
+ * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
+ */
+export declare const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
+/**
+ * MCP client config locations, relative to the user's home directory.
+ *
+ * Claude Code (`~/.claude.json`) and Codex (`~/.codex/config.toml`) are NOT here
+ * on purpose: each needs bespoke handling (per-project server maps, and TOML
+ * respectively) and both callers special-case them.
+ */
+export declare const MCP_CONFIGS: {
+    label: string;
+    segs: string[];
+}[];

package/dist/shared/atbash-targets.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * Facts about WHERE Atbash lives — the deployments it trusts, and the on-disk
+ * locations it knows about.
+ *
+ * These are shared by the read-only connector (`atbash connect`) and the
+ * write-capable configurator (`atbash setup`). They live here rather than in
+ * either command because both must agree:
+ *
+ *  - A host the connector will relay to must be a host setup will verify
+ *    registration against. Two different allowlists would mean a deployment that
+ *    can receive a scan but cannot confirm the agent it scanned.
+ *  - A config path the scan reports must be a path setup can find. A client that
+ *    shows up in the dashboard but not in `setup` reads as a bug in whichever of
+ *    the two the operator happened to trust first.
+ *
+ * When they lived in connect.ts and setup imported them from there, a refactor of
+ * the connector could silently change the configurator's behaviour. Adding a
+ * client here updates both callers at once, which is the point.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_CONFIGS = exports.DEFAULT_HOST = exports.KNOWN_HOSTS = void 0;
+/**
+ * Official Atbash deployments that legitimately serve the onboarding flow.
+ *
+ * The pairing screen builds `--host` from the page you opened, so every origin
+ * that can host onboarding must appear here. If production were missing, the real
+ * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
+ * genuine article, which is worse than silence: it teaches people and agents to
+ * wave through the one warning that actually catches a swapped host.
+ *
+ * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
+ * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
+ */
+exports.KNOWN_HOSTS = new Set([
+    "atbash.ai",
+    "www.atbash.ai",
+    "chromia-verified-ai-dev-two.vercel.app",
+    "chromia-verified-ai-agent-scan.vercel.app",
+]);
+/**
+ * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
+ * because it is the one running the current connector API; switch this to
+ * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
+ */
+exports.DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
+/**
+ * MCP client config locations, relative to the user's home directory.
+ *
+ * Claude Code (`~/.claude.json`) and Codex (`~/.codex/config.toml`) are NOT here
+ * on purpose: each needs bespoke handling (per-project server maps, and TOML
+ * respectively) and both callers special-case them.
+ */
+exports.MCP_CONFIGS = [
+    { label: "Claude Desktop", segs: ["Library", "Application Support", "Claude", "claude_desktop_config.json"] },
+    { label: "Claude Desktop", segs: [".config", "Claude", "claude_desktop_config.json"] },
+    { label: "Cursor", segs: [".cursor", "mcp.json"] },
+    { label: "Windsurf", segs: [".codeium", "windsurf", "mcp_config.json"] },
+    { label: "VS Code (MCP)", segs: [".vscode", "mcp.json"] },
+    { label: "Gemini CLI", segs: [".gemini", "settings.json"] },
+    { label: "Continue", segs: [".continue", "config.json"] },
+];
+//# sourceMappingURL=atbash-targets.js.map

package/dist/shared/atbash-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atbash-targets.js","sourceRoot":"","sources":["../../src/shared/atbash-targets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH;;;;;;;;;;;GAWG;AACU,QAAA,WAAW,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,eAAe;IACf,wCAAwC;IACxC,2CAA2C;CAC5C,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,YAAY,GAAG,gDAAgD,CAAC;AAE7E;;;;;;GAMG;AACU,QAAA,WAAW,GAAwC;IAC9D,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,EAAE;IAC7G,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,EAAE;IACtF,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IAClD,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE;IACxE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IACzD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE;IAC3D,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE;CAC1D,CAAC"}

package/dist/shared/openclaw-runtime.d.ts

@@ -0,0 +1,221 @@
+/** How this OpenClaw got onto the machine — decides the UPDATE command. */
+export type OpenclawChannel = "brew-formula" | "brew-cask" | "npm" | "unknown";
+/**
+ * Config subcommands this build has.
+ *
+ * Probed from `openclaw config --help`, because the boundary is not guessable
+ * from a version number. Observed: 2026.2.1 has only `get set unset`, while both
+ * 2026.6.6 and 2026.7.1 have `file get patch schema set unset validate`.
+ */
+export interface OpenclawCaps {
+    /**
+     * `openclaw config patch` — "Patch config from a JSON5 object in one validated
+     * write. Objects merge recursively, arrays/scalars replace, and null deletes a
+     * path", with `--stdin` and `--dry-run`.
+     *
+     * This is EXACTLY the operation setup needs, performed by OpenClaw itself, so
+     * where it exists we stop hand-merging JSON. That hands OpenClaw responsibility
+     * for its own file format, key names, schema, permissions and migrations — all
+     * the things we kept getting wrong from the outside. It also removes the
+     * clobber hazard: a machine in the field had three
+     * `openclaw.json.clobbered.<timestamp>` files, so OpenClaw rewrites that file
+     * on its own and anything we hand-merge can be discarded without warning.
+     */
+    patch: boolean;
+    /** `openclaw config validate` — schema check without starting the gateway. */
+    validate: boolean;
+    /** `openclaw config schema` — the authoritative key list for THIS build. */
+    schema: boolean;
+    /** `openclaw config file` — where the active config actually lives. */
+    configFile: boolean;
+}
+export interface OpenclawRuntime {
+    /** False when there is no OpenClaw on this machine at all. */
+    present: boolean;
+    /** As reported by `openclaw --version`, e.g. "2026.7.1". Undefined if unparseable. */
+    version?: string;
+    /** Build hash when the version line carries one — pins a build exactly. */
+    build?: string;
+    channel: OpenclawChannel;
+    /** Resolved path to the binary, for diagnostics. */
+    binPath?: string;
+    caps: OpenclawCaps;
+}
+/**
+ * Where the `openclaw` on PATH came from.
+ *
+ * Path-based rather than asked of a package manager, because shelling out to
+ * brew and npm to answer a question we can read off a path is slow and can hang
+ * on a bad network — and this runs before we have written anything, where a
+ * hang looks like the command being broken.
+ *
+ * ⚠️ The npm case is not hypothetical or unusual: the machine that reported the
+ * original failure ran `/Users/m4/.nvm/versions/node/v24.13.0/bin/openclaw`,
+ * so `brew info openclaw-cli` there said "Not installed" while OpenClaw was
+ * plainly running. Telling that user `brew upgrade openclaw-cli` would have been
+ * useless, which is the whole reason this returns a channel at all.
+ */
+export declare function detectChannel(binPath: string | undefined): OpenclawChannel;
+/**
+ * The command that updates THIS install, or undefined when we cannot tell.
+ *
+ * Returning undefined is deliberate and better than a plausible guess: a user
+ * told to run `brew upgrade openclaw-cli` on an npm install gets "No available
+ * formula", concludes our instructions are wrong, and is no closer to an
+ * upgrade. `openclaw update` is the honest fallback where the channel is
+ * unknown — it is OpenClaw's own self-updater, and 2026.6.6's `doctor` already
+ * recommends exactly that ("Run `openclaw update` to update via your package
+ * manager (npm/pnpm)").
+ */
+export declare function updateCommand(channel: OpenclawChannel): string;
+/**
+ * Inspect the OpenClaw on this machine. Read-only: probes `--version` and
+ * `config --help`, writes nothing, and never throws.
+ */
+export declare function detectOpenclaw(binary?: string): OpenclawRuntime;
+/** How setup should write config on this machine. */
+export type WriteStrategy = 
+/** `openclaw config patch --stdin` — OpenClaw merges and validates its own file. */
+"openclaw-patch"
+/** Hand-merge the JSON ourselves. The only option on 2026.2.x. */
+ | "hand-merge";
+export declare function writeStrategy(rt: OpenclawRuntime): WriteStrategy;
+/**
+ * Whether this OpenClaw is one we can wire at all, and what to say if not.
+ *
+ * DELIBERATELY PERMISSIVE. The floor is "there is an OpenClaw here", not "it has
+ * the newest config commands", because 2026.2.x installs are real — the box every
+ * CLI attestation was verified on is one — and the minimal entry-only config we
+ * now write was confirmed to load there with the plugin reporting
+ * `[atbash] plugin loaded` and `guard manager ready`. Narrowing support to the
+ * versions we happen to run is the mistake that produced this whole module.
+ *
+ * So an older build is a DEGRADED path with an offer, never a refusal: it gets
+ * the hand-merge, and the reason to upgrade is stated once, with the command for
+ * its own channel. Refusal is reserved for "no OpenClaw at all", where there is
+ * genuinely nothing to configure.
+ */
+export declare function supportStatus(rt: OpenclawRuntime): {
+    supported: boolean;
+    degraded: boolean;
+    /** Plain-language line for a non-technical operator. */
+    message: string;
+    /** The channel-correct upgrade command, when upgrading would help. */
+    upgrade?: string;
+};
+/**
+ * What OpenClaw says about the Atbash plugin after we have wired it.
+ *
+ * `state` is deliberately not a boolean. "Is this agent governed?" has more than
+ * two answers, and collapsing them is how setup came to print a green summary
+ * over an ungoverned machine.
+ */
+export interface PluginVerdict {
+    state: 
+    /** Present, switched on, and loaded. The only state that means governed. */
+    "loaded"
+    /** On disk but switched off — governs nothing, and is a deliberate act. */
+     | "disabled"
+    /** OpenClaw tried and failed to load it. Worse than missing: it looks wired. */
+     | "load-error"
+    /** OpenClaw does not know about it at all. */
+     | "missing"
+    /** We could not ask. Must never be reported as success. */
+     | "unknown";
+    entry?: string;
+    version?: string;
+    /** Required runtime dependencies OpenClaw reports as absent. */
+    missingDeps?: string[];
+    /** Raw explanation for the operator, in OpenClaw's terms where possible. */
+    detail?: string;
+}
+/**
+ * Ask OpenClaw whether the plugin actually loaded — the check setup never had.
+ *
+ * ⚠️ WHY THIS IS NOT OPTIONAL. Setup used to declare success on the strength of
+ * having written what it meant to write. That is not the same claim: on the
+ * machine that reported the original failure, the config entry existed and the
+ * plugin did not, and OpenClaw said so plainly —
+ *
+ *   plugins.entries.atbash-openclaw: plugin not found: atbash-openclaw
+ *   (stale config entry ignored; remove it from plugins config)
+ *
+ * — while setup reported the run as done. An owner reading that summary believes
+ * their agent is governed. Nothing is more expensive than a false green on a
+ * control boundary, so the last word belongs to OpenClaw, not to us.
+ *
+ * ⚠️ DO NOT check `hookCount` or `hookNames` here. They are 0 and empty for a
+ * perfectly healthy plugin: hooks register when the GATEWAY starts, not when
+ * `plugins list` runs. Verified against a plugin that was demonstrably loaded and
+ * enforcing — it reports `hookCount: 0`. Treating that as a fault would fail
+ * every correct install.
+ */
+export declare function verifyOpenclawPlugin(rt: OpenclawRuntime, opts: {
+    /** Entry ids that count as Atbash, current first. */
+    entryIds: readonly string[];
+    /** Pin the config being inspected, so this cannot read a different one. */
+    configPath?: string;
+    /**
+     * The package spec that was installed, e.g. `@atbash/atbash-openclaw@dev`.
+     * Used to catch the environment mismatch that loads cleanly and then fails
+     * every judge call: the plugin's endpoint and chain ids are compiled in, so a
+     * production build on a dev-onboarded agent is silently useless.
+     */
+    expectedSpec?: string;
+    /**
+     * The home directory being configured, when it is not the process's own.
+     *
+     * ⚠️ REQUIRED FOR A `--home` RUN, AND OMITTING IT PRODUCED A FALSE GREEN.
+     * Pinning `OPENCLAW_CONFIG_PATH` aims OpenClaw at the right CONFIG, but
+     * plugin discovery still walks `$HOME/.openclaw`, so the child process
+     * happily reported the plugin from the operator's real machine while we were
+     * asking about a different one. It printed "OpenClaw loads the plugin" about
+     * a home directory that contained no plugin at all — precisely the false
+     * green this whole check exists to prevent, produced by the check itself.
+     */
+    home?: string;
+    binary?: string;
+}): PluginVerdict;
+/**
+ * Ask OpenClaw whether a config is valid, when it can answer.
+ *
+ * This is the PREFLIGHT the command never had. Setup merged into
+ * `~/.openclaw/openclaw.json` without ever checking whether that file currently
+ * loads — so on a machine whose config was already broken it added its own entry
+ * to an unloadable file, and then its `openclaw plugins install` step died on the
+ * pre-existing breakage. Reported as an Atbash failure; it was not one.
+ *
+ * `undefined` means "cannot tell" (no `validate` on this build) and must be
+ * treated as such — not as a pass and not as a failure.
+ */
+/**
+ * Does THIS build accept `hooks` on a plugin entry?
+ *
+ * Asked of `openclaw config schema`, never inferred from a version number or
+ * correlated with other capabilities — the whole point of this module.
+ *
+ * ⚠️ WHY THIS QUESTION EXISTS. `hooks` was ADDED, not removed: it is unknown on
+ * 2026.2.1 and valid, optional and undeprecated on 2026.6.6 and 2026.7.1, where
+ * an entry accepts `enabled | hooks | subagent | llm | config`. Because the entry
+ * schema is `additionalProperties: false`, the same key is FATAL on the old build
+ * and legitimate on the new one.
+ *
+ * Setup never writes `hooks` — nothing under it is required, and it gates hook
+ * families this plugin does not use (it registers only `before_tool_call`). But
+ * it also used to DELETE an operator's `hooks` block unconditionally, and on a
+ * build that accepts the key that is destroying their configuration:
+ * `hooks.timeoutMs` bounds this plugin's hook latency "without changing plugin
+ * code", which is a deliberate operator choice, not damage to repair.
+ *
+ * `undefined` means "cannot tell" (no `config schema` on this build). The caller
+ * must treat that as NOT supported and strip: keeping an unrecognized key makes
+ * OpenClaw refuse the entire config, and losing a timeout knob is a far smaller
+ * harm than a machine whose config will not load at all.
+ */
+export declare function pluginEntryAcceptsHooks(rt: OpenclawRuntime, binary?: string): boolean | undefined;
+export declare function validateConfig(rt: OpenclawRuntime, configPath: string, binary?: string, 
+/** The home being configured, when not the process's own — see verifyOpenclawPlugin. */
+home?: string): {
+    valid: boolean;
+    problems: string;
+} | undefined;