@atbash/cli 0.5.15 → 0.6.1-dev.2

package/dist/commands/connect.d.ts

@@ -1,4 +1,19 @@
 import { Command } from "commander";
+/**
+ * `atbash connect <code>` — the local connector.
+ *
+ * A hosted Atbash onboarding page can't read your machine's filesystem, and the
+ * Atbash server only sees its own disk. This command runs on YOUR machine,
+ * enumerates the agents/MCP tools configured locally, and relays them to your
+ * onboarding session via a one-time pairing code shown in the browser.
+ *
+ * Read-only: it reads a fixed set of known agent config paths and reports the
+ * declared tool surface (server/skill NAMES) — never the secret values inside.
+ * It makes ONE outbound POST (the relay) and exits.
+ *
+ * The discovery mirrors the dashboard's src/lib/scan/discover.ts and produces
+ * the same relay-safe payload the session endpoint expects.
+ */
 interface DeclaredTool {
     name: string;
     description?: string;
@@ -19,6 +34,7 @@ type Agent = {
     detail: string;
     declaredTools: DeclaredTool[];
     surfaceEvidence?: SurfaceEvidence;
+    governance?: Governance;
 } | {
     type: "config";
     label: string;
@@ -27,6 +43,7 @@ type Agent = {
         mcpServers: Record<string, unknown>;
     };
 };
+declare const MAX_RELAY_SERVERS = 200;
 /** One-line skill description from SKILL.md frontmatter `description:` or first heading.
  *  Frontmatter is parsed with a real YAML parser (handles quotes, block scalars,
  *  folded/multiline values and nested maps that the previous regex mis-read). */
@@ -49,7 +66,104 @@ declare function enumerateSkills(root: string, maxDepth?: number, cap?: number):
  * size against the input size and label the result partial — see `discover()`.
  */
 declare function relaySafeServers(servers: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Atbash's own wiring on this machine — is the boundary actually in place?
+ *
+ * The relay reported an agent's TOOL SURFACE and nothing about whether Atbash
+ * governs it, so the dashboard's "re-scan to confirm it reports as enforcing"
+ * had nothing to read. Worse, the two failures that matter most are invisible in
+ * a file listing: a plugin installed but never enabled, and a plugin enabled but
+ * pointed at no key. Both leave a machine that looks wired and enforces nothing.
+ *
+ * FILE READS ONLY. No processes are spawned, so this stays inside the read-only
+ * promise the onboarding page makes about this command. Everything below is a
+ * documented location:
+ *
+ *  - OpenClaw: the plugin entry in `~/.openclaw/openclaw.json`. Both the current
+ *    `openclaw` key and the legacy `atbash-plugin` key count, since the dashboard
+ *    recognizes either.
+ *  - Hermes: plugins are OPT-IN via a `plugins.enabled` allow-list in
+ *    `~/.hermes/config.yaml` (hermes_cli/plugins.py:_get_enabled_plugins — a
+ *    missing key means nothing loads), and the plugin reads its key path from
+ *    `~/.hermes/.env`.
+ *
+ * `enforcing` is only ever true when BOTH the hook is switched on and a key path
+ * is configured. Reporting enforcement on the strength of an installed package
+ * would recreate the exact false green this is meant to catch.
+ */
+interface Governance {
+    installed: boolean;
+    enforcing: boolean;
+    entry?: string;
+    keyPathConfigured: boolean;
+    agentPubkey?: string;
+    /**
+     * Every agent this machine has been wired to, newest-known last.
+     *
+     * A machine governs exactly ONE agent at a time: the plugin config names one
+     * key path and that file holds one identity, so each `atbash setup` run
+     * displaces the previous agent and archives its key under
+     * `~/.config/atbash/keys/<pubkey>.key`. On a real box that had quietly rotated
+     * five times, nothing anywhere said so — the browser could not tell "already
+     * protected" from "protected, but for a different agent than the one you are
+     * onboarding".
+     *
+     * Only PUBLIC keys leave the machine, and only from filenames — the archived
+     * files are never opened. The current agent's key is included so the caller can
+     * mark which of the list is live without a second lookup.
+     */
+    knownAgents?: string[];
+}
 /** Enumerate the agents/MCP tools configured on this machine. Read-only. */
 declare function discover(home: string): Agent[];
+/**
+ * ⚠️ SECURITY INVARIANT — this returns RAW, UNSANITIZED server specs.
+ * The values here contain live secrets: url credentials, `env`, `headers`,
+ * `token`, `apiKey`, and absolute command paths. They exist ONLY so `--introspect`
+ * can reach a server locally. They MUST NEVER be put into the relay payload
+ * directly. Every path that turns these into an `Agent` MUST route them through
+ * `relaySafeServers()` first (the single sanitization boundary). If you add a new
+ * consumer, sanitize before it leaves this file. Callers today: `discover()`
+ * (sanitizes), `connect --introspect` and `atbash scan --introspect` (both local
+ * only, never relayed — scan has no relay path at all).
+ */
+declare function readAllMcpServers(home: string): {
+    label: string;
+    servers: Record<string, unknown>;
+}[];
+/**
+ * Vet the SHAPE of a relay destination — a separate, earlier question than
+ * whether the host is one of ours.
+ *
+ * `--host` is copied off a web page and everything `discover()` finds is POSTed
+ * to it, so the string itself is attacker-influenced. Four refusals:
+ *
+ *  - **Unparseable.** Anything unrecognized is refused rather than tried.
+ *  - **Credentials** (`user:pass@`). They have no use here, and they are how a
+ *    lookalike URL hides its real host from someone skimming a pasted command.
+ *  - **A query string or fragment.** The endpoint path is APPENDED to this
+ *    value, so a `?` or `#` swallows it and sends the payload somewhere nobody
+ *    reviewed: `https://h/?x=` + `/api/agent-scan/...` requests `/` instead.
+ *  - **Plain HTTP**, except to loopback so a local dev server still works.
+ *
+ * The KNOWN_HOSTS allowlist is the SEPARATE gate applied after this one, and it
+ * is what makes a swapped host non-exfiltrating; this is the shape check that
+ * keeps a well-formed-looking URL from quietly redirecting the request. Both
+ * must pass before anything is sent.
+ */
+export interface HostVerdict {
+    /** Normalized `scheme://host[/path]`; the raw trimmed input if unparseable. */
+    host: string;
+    hostname: string;
+    isLoopback: boolean;
+    /** An official Atbash deployment, or this machine for local development. */
+    recognized: boolean;
+    /** Non-null means refuse to send. User-facing text. */
+    problem: string | null;
+    /** Optional remediation line shown after `problem`. */
+    hint?: string;
+}
+export declare function checkRelayHost(raw: string): HostVerdict;
 export declare function registerConnectCommand(program: Command): void;
-export { discover, enumerateSkills, describeSkill, relaySafeServers, safeDescription };
+export { discover, enumerateSkills, describeSkill, relaySafeServers, safeDescription, readAllMcpServers, MAX_RELAY_SERVERS };
+export type { Agent, DeclaredTool };

package/dist/commands/connect.js

@@ -36,12 +36,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RELAY_SERVERS = void 0;
+exports.checkRelayHost = checkRelayHost;
 exports.registerConnectCommand = registerConnectCommand;
 exports.discover = discover;
 exports.enumerateSkills = enumerateSkills;
 exports.describeSkill = describeSkill;
 exports.relaySafeServers = relaySafeServers;
 exports.safeDescription = safeDescription;
+exports.readAllMcpServers = readAllMcpServers;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -50,51 +53,14 @@ const yaml_1 = require("yaml");
 const TOML = __importStar(require("@iarna/toml"));
 const jsonc = __importStar(require("jsonc-parser"));
 const introspect_mcp_1 = require("./introspect-mcp");
-/**
- * `atbash connect <code>` — the local connector.
- *
- * A hosted Atbash onboarding page can't read your machine's filesystem, and the
- * Atbash server only sees its own disk. This command runs on YOUR machine,
- * enumerates the agents/MCP tools configured locally, and relays them to your
- * onboarding session via a one-time pairing code shown in the browser.
- *
- * Read-only: it reads a fixed set of known agent config paths and reports the
- * declared tool surface (server/skill NAMES) — never the secret values inside.
- * It makes ONE outbound POST (the relay) and exits.
- *
- * The discovery mirrors the dashboard's src/lib/scan/discover.ts and produces
- * the same relay-safe payload the session endpoint expects.
- */
-/**
- * Official Atbash deployments that legitimately serve the onboarding flow.
- *
- * The pairing screen builds `--host` from the page you opened, so every origin
- * that can host onboarding must appear here. If production were missing, the real
- * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
- * genuine article, which is worse than silence: it teaches people and agents to
- * wave through the one warning that actually catches a swapped host.
- *
- * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
- * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
- */
-const KNOWN_HOSTS = new Set([
-    "atbash.ai",
-    "www.atbash.ai",
-    "chromia-verified-ai-dev-two.vercel.app",
-    "chromia-verified-ai-agent-scan.vercel.app",
-]);
-/**
- * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
- * because it is the one running the current connector API; switch this to
- * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
- */
-const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
+const atbash_targets_1 = require("../shared/atbash-targets");
 // Discovery is intentionally bounded. A local config is untrusted input even
 // though it lives on the operator's machine: a giant/malformed file must not turn
 // a one-shot connector into a memory or latency sink.
 const MAX_CONFIG_BYTES = 2 * 1024 * 1024;
 const MAX_SKILL_BYTES = 256 * 1024;
 const MAX_RELAY_SERVERS = 200;
+exports.MAX_RELAY_SERVERS = MAX_RELAY_SERVERS;
 const SECRET_DESCRIPTION = [
     /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/i,
@@ -196,15 +162,8 @@ function enumerateSkills(root, maxDepth = 3, cap = 400) {
     walk(root, 0, path.basename(root));
     return tools;
 }
-const MCP_CONFIGS = [
-    { label: "Claude Desktop", segs: ["Library", "Application Support", "Claude", "claude_desktop_config.json"] },
-    { label: "Claude Desktop", segs: [".config", "Claude", "claude_desktop_config.json"] },
-    { label: "Cursor", segs: [".cursor", "mcp.json"] },
-    { label: "Windsurf", segs: [".codeium", "windsurf", "mcp_config.json"] },
-    { label: "VS Code (MCP)", segs: [".vscode", "mcp.json"] },
-    { label: "Gemini CLI", segs: [".gemini", "settings.json"] },
-    { label: "Continue", segs: [".continue", "config.json"] },
-];
+// MCP_CONFIGS lives in ../shared/atbash-targets — shared with `atbash setup`, so a
+// client this scan reports is a client the configurator can also find.
 /**
  * OpenAI Codex CLI stores config as TOML with [mcp_servers.<name>] tables. The
  * header must be ONE key (bare or quoted); a dotted tail is a SUB-TABLE of that
@@ -312,22 +271,241 @@ function relaySafeServers(servers) {
     }
     return out;
 }
+/** Public keys of agents previously wired here, from the archive filenames. */
+function archivedAgentPubkeys(home) {
+    let names;
+    try {
+        names = fs.readdirSync(path.join(home, ".config", "atbash", "keys"));
+    }
+    catch {
+        return [];
+    }
+    return names
+        .map((n) => n.match(/^((?:02|03)[0-9a-fA-F]{64})\.key$/)?.[1])
+        .filter((k) => !!k);
+}
+/** The public half of the agent key, if one is in the canonical place. */
+function agentPubkeyOnDisk(home) {
+    const text = readText(MAX_CONFIG_BYTES, home, ".config", "atbash", "guard-client-key");
+    const match = text?.match(/^[ \t]*"?pub_?[kK]ey"?[ \t]*[:=][ \t]*"?((?:02|03)[0-9a-fA-F]{64})"?/m);
+    return match?.[1];
+}
+/**
+ * Every directory an OpenClaw release has used as its plugin store, relative to
+ * `~/.openclaw`.
+ *
+ * ⚠️ THIS FILE READ ONLY `extensions/`, WHICH IS THE BUG THE SCAN REPORTED AS
+ * "no tools". `extensions/` is the 2026.2.x store; 2026.6.x installs plugins as
+ * npm dependencies of `~/.openclaw` — into `~/.openclaw/node_modules` — and
+ * leaves `extensions/` EMPTY. So a fully wired 2026.6.6 machine relayed zero
+ * plugins and no governance, and the dashboard rendered that as every certified
+ * capability removed with the agent's risk score falling to zero.
+ *
+ * Keep in sync with OPENCLAW_PLUGIN_ROOTS in the dashboard
+ * (src/lib/scan/adapters/local-skills.ts) and in public/c.mjs. Three copies of
+ * this list exist because three different programs read the same machine; all
+ * three had the same single-layout assumption.
+ */
+const OPENCLAW_PLUGIN_ROOTS = [["extensions"], ["node_modules"], ["npm", "node_modules"]];
+/**
+ * The 2026.7.x layout, a WILDCARD so it cannot be a fixed root above.
+ *
+ * Found by running a real `openclaw plugins install`, not by reading a listing:
+ * it creates a per-plugin npm PROJECT at `~/.openclaw/npm/projects/<mangled>/`
+ * whose directory name is NOT the plugin id
+ * ("atbash-atbash-openclaw-eada1196a5"). The identity is in that project's
+ * package.json dependencies and its node_modules. On those builds the install
+ * ledger also leaves disk entirely for `~/.openclaw/state/openclaw.sqlite`, so a
+ * file scan is a best-effort inventory and never proof of absence — which is why
+ * `atbash setup` asks `openclaw plugins list --json` for the governance verdict.
+ */
+const OPENCLAW_NPM_PROJECTS = ["npm", "projects"];
+/**
+ * Plugins installed as npm PROJECTS on 2026.7.x.
+ *
+ * ⚠️ DO NOT enumerate `npm/projects/*./node_modules` wholesale — it is a full npm
+ * install tree, so listing it reported every TRANSITIVE DEPENDENCY as a plugin
+ * the agent holds (one real plugin became 14 capabilities, `@opentelemetry/core`
+ * among them). Junk in the capability surface inflates the count, dilutes real
+ * findings, and a re-scan reports it as "+14 added" drift nobody can explain.
+ *
+ * OpenClaw derives the project directory name from the package name, so
+ * `@atbash/atbash-openclaw` becomes `atbash-atbash-openclaw-eada1196a5`. The
+ * plugin is the declared dependency whose mangled name PREFIXES the project
+ * directory — which excludes `@opentelemetry/api`, added to every such project.
+ */
+function openclawNpmProjectPlugins(home) {
+    const out = [];
+    const mangle = (name) => name.replace(/^@/, "").replace(/[/]/g, "-");
+    for (const project of listDirs(home, ".openclaw", ...OPENCLAW_NPM_PROJECTS)) {
+        const pkg = readJson(home, ".openclaw", ...OPENCLAW_NPM_PROJECTS, project, "package.json");
+        const deps = pkg && typeof pkg.dependencies === "object" && pkg.dependencies ? Object.keys(pkg.dependencies) : [];
+        for (const dep of deps) {
+            if (!project.startsWith(mangle(dep)))
+                continue;
+            out.push({ name: dep, dir: path.join(home, ".openclaw", ...OPENCLAW_NPM_PROJECTS, project, "node_modules", dep) });
+        }
+    }
+    return out;
+}
+/** Installed plugin names across every known layout, scoped packages expanded. */
+function openclawPluginNames(home) {
+    const names = new Set();
+    for (const { name } of openclawNpmProjectPlugins(home))
+        names.add(name);
+    for (const root of OPENCLAW_PLUGIN_ROOTS) {
+        for (const name of listDirs(home, ".openclaw", ...root)) {
+            // `@atbash` is a scope DIRECTORY, not a plugin — the package is inside it.
+            if (name.startsWith("@")) {
+                for (const scoped of listDirs(home, ".openclaw", ...root, name))
+                    names.add(`${name}/${scoped}`);
+                continue;
+            }
+            names.add(name);
+        }
+    }
+    return names;
+}
+/**
+ * Plugin ids OpenClaw has RECORDED as installed, wherever this release keeps
+ * that record.
+ *
+ * 2026.2.x keeps it inside openclaw.json as `plugins.installs`; newer builds
+ * moved it to `plugins/installs.json`, and that migration is destructive — a
+ * machine in the field had its original consumed and left as
+ * `installs.json.migrated`, which is then the only surviving record of what was
+ * installed before the upgrade.
+ */
+function openclawLedgerNames(home) {
+    const names = new Set();
+    const cfg = readJson(home, ".openclaw", "openclaw.json");
+    const plugins = cfg && typeof cfg.plugins === "object" ? cfg.plugins : undefined;
+    const inline = plugins && typeof plugins.installs === "object" ? plugins.installs : undefined;
+    if (inline)
+        Object.keys(inline).forEach((k) => names.add(k));
+    for (const file of ["installs.json", "installs.json.migrated"]) {
+        const led = readJson(home, ".openclaw", "plugins", file);
+        if (!led || typeof led !== "object")
+            continue;
+        const inner = led.plugins;
+        const map = inner && typeof inner === "object" ? inner : led;
+        Object.keys(map).forEach((k) => names.add(k));
+    }
+    // ~/.openclaw/package.json on the npm-channel layout, plus one per npm project
+    // on 2026.7.x — the authoritative name when the project dir name is mangled.
+    const prefixes = [[], ...listDirs(home, ".openclaw", ...OPENCLAW_NPM_PROJECTS).map((p) => [...OPENCLAW_NPM_PROJECTS, p])];
+    for (const prefix of prefixes) {
+        const pkg = readJson(home, ".openclaw", ...prefix, "package.json");
+        const deps = pkg && typeof pkg.dependencies === "object" ? pkg.dependencies : undefined;
+        if (deps)
+            Object.keys(deps).forEach((k) => names.add(k));
+    }
+    return names;
+}
+function openclawGovernance(home) {
+    const cfg = readJson(home, ".openclaw", "openclaw.json");
+    const plugins = cfg && typeof cfg.plugins === "object" ? cfg.plugins : undefined;
+    const entries = plugins && typeof plugins.entries === "object" ? plugins.entries : undefined;
+    // All THREE ids a machine can legitimately carry, newest first.
+    //
+    // `atbash-openclaw` is what the current `@atbash/atbash-openclaw` registers as.
+    // `atbash-plugin` is the earlier `@atbash/atbash-plugin`. `openclaw` is the
+    // RETIRED `@atbash-plugin/openclaw` id — kept here for DETECTION only, because
+    // a machine can still have one and the honest answer is "this is what is
+    // there", not silence. Setup never writes it: the docs are explicit that a
+    // leftover `openclaw` entry configures nothing.
+    const ENTRY_IDS = ["atbash-openclaw", "atbash-plugin", "openclaw"];
+    // Prefer the entry that is actually SWITCHED ON, not merely the first id in the
+    // list. `atbash setup` deliberately leaves a machine carrying two entries — the
+    // legacy one stood down to `{enabled:false}` and the real config on
+    // `atbash-openclaw` — so a plain `find` can pick the disabled one and report a
+    // freshly wired machine as ungoverned.
+    const presentIds = ENTRY_IDS.filter((k) => entries && k in entries);
+    const switchedOnId = (k) => {
+        const e = entries?.[k];
+        if (!e || typeof e !== "object")
+            return true;
+        const c = typeof e.config === "object" && e.config ? e.config : undefined;
+        return e.enabled !== false && c?.enabled !== false;
+    };
+    const entryName = presentIds.find(switchedOnId) ?? presentIds[0];
+    const extension = ENTRY_IDS.find((k) => openclawPluginNames(home).has(k));
+    if (!entryName && !extension)
+        return undefined;
+    const entry = entryName && entries ? entries[entryName] : undefined;
+    const entryConfig = entry && typeof entry.config === "object" ? entry.config : undefined;
+    const keyPathConfigured = typeof entryConfig?.chromiaSecretPath === "string" && !!entryConfig.chromiaSecretPath.trim();
+    // Absent `enabled` means on — the plugin's own default. Only an explicit false is off.
+    const switchedOn = entry?.enabled !== false && entryConfig?.enabled !== false;
+    const current = agentPubkeyOnDisk(home);
+    const knownAgents = [...new Set([...archivedAgentPubkeys(home), ...(current ? [current] : [])])];
+    // An entry under the retired id is present but inert — the plugin reads a
+    // different key, so it can never be enforcing however complete it looks.
+    const inertId = entryName === "openclaw";
+    return {
+        // The install LEDGER counts as evidence too: a plugin can be recorded as
+        // installed on a machine whose plugin directory we do not recognise, and
+        // "not in a directory I know" is not the same as "not installed".
+        installed: !!(entryName || extension || ENTRY_IDS.some((k) => openclawLedgerNames(home).has(k))),
+        enforcing: !!entryName && !inertId && switchedOn && keyPathConfigured,
+        entry: entryName ?? extension,
+        keyPathConfigured,
+        agentPubkey: current,
+        ...(knownAgents.length ? { knownAgents } : {}),
+    };
+}
+function hermesGovernance(home) {
+    if (!exists(home, ".hermes", "hermes-agent"))
+        return undefined;
+    // The package lands in the venv that runs Hermes, not in a plugins directory.
+    const venvBase = path.join(home, ".hermes", "hermes-agent", "venv", "lib");
+    const installed = listDirs(venvBase).some((py) => exists(venvBase, py, "site-packages", "atbash_hermes_plugin"));
+    // Opt-in allow-list: a missing `plugins.enabled` key means NOTHING loads.
+    let enabled = false;
+    const configYaml = readText(MAX_CONFIG_BYTES, home, ".hermes", "config.yaml");
+    if (configYaml) {
+        try {
+            const parsed = (0, yaml_1.parse)(configYaml);
+            const list = parsed?.plugins?.enabled;
+            enabled = Array.isArray(list) && list.some((n) => String(n).trim() === HERMES_PLUGIN_NAME);
+        }
+        catch { /* malformed config — treat as not enabled rather than guess */ }
+    }
+    const env = readText(MAX_CONFIG_BYTES, home, ".hermes", ".env") ?? "";
+    const keyPathConfigured = /^\s*(?:export\s+)?ATBASH_(?:KEY_PATH|AGENT_PRIVKEY)\s*=\s*\S/m.test(env);
+    const current = agentPubkeyOnDisk(home);
+    const knownAgents = [...new Set([...archivedAgentPubkeys(home), ...(current ? [current] : [])])];
+    return {
+        installed,
+        enforcing: installed && enabled && keyPathConfigured,
+        entry: HERMES_PLUGIN_NAME,
+        keyPathConfigured,
+        agentPubkey: current,
+        ...(knownAgents.length ? { knownAgents } : {}),
+    };
+}
+const HERMES_PLUGIN_NAME = "atbash-hermes-plugin";
 /** Enumerate the agents/MCP tools configured on this machine. Read-only. */
 function discover(home) {
     const agents = [];
     // OpenClaw → declared tools (skills live under ~/.hermes/skills; plus extensions).
     if (exists(home, ".openclaw", "openclaw.json")) {
         const tools = enumerateSkills(path.join(home, ".hermes", "skills"));
-        for (const name of listDirs(home, ".openclaw", "extensions"))
+        // Across EVERY layout, not just `extensions/` — see OPENCLAW_PLUGIN_ROOTS.
+        // Reading one store reported ZERO plugins on a machine whose plugins were all
+        // installed and loading.
+        for (const name of openclawPluginNames(home))
             tools.push({ name: `plugin:${name}`, description: "OpenClaw plugin / extension" });
-        agents.push({ type: "declared", label: "OpenClaw", detail: `${tools.length} skill${tools.length === 1 ? "" : "s"} / plugins`, declaredTools: tools });
+        const governance = openclawGovernance(home);
+        agents.push({ type: "declared", label: "OpenClaw", detail: `${tools.length} skill${tools.length === 1 ? "" : "s"} / plugins`, declaredTools: tools, ...(governance ? { governance } : {}) });
     }
     // Hermes → declared tools (skills + agent plugins).
     if (exists(home, ".hermes", "hermes-agent")) {
         const tools = enumerateSkills(path.join(home, ".hermes", "skills"));
         for (const name of listDirs(home, ".hermes", "hermes-agent", "plugins"))
             tools.push({ name: `plugin:${name}`, description: "Hermes plugin" });
-        agents.push({ type: "declared", label: "Hermes", detail: `${tools.length} skill${tools.length === 1 ? "" : "s"} / plugins`, declaredTools: tools });
+        const governance = hermesGovernance(home);
+        agents.push({ type: "declared", label: "Hermes", detail: `${tools.length} skill${tools.length === 1 ? "" : "s"} / plugins`, declaredTools: tools, ...(governance ? { governance } : {}) });
     }
     // MCP config sources — collected once as RAW specs, then sanitized for relay.
     for (const { label, servers } of readAllMcpServers(home)) {
@@ -351,12 +529,13 @@ function discover(home) {
  * directly. Every path that turns these into an `Agent` MUST route them through
  * `relaySafeServers()` first (the single sanitization boundary). If you add a new
  * consumer, sanitize before it leaves this file. Callers today: `discover()`
- * (sanitizes) and the introspection pass (local only, never relayed).
+ * (sanitizes), `connect --introspect` and `atbash scan --introspect` (both local
+ * only, never relayed — scan has no relay path at all).
  */
 function readAllMcpServers(home) {
     const out = [];
     const seen = new Set();
-    for (const { label, segs } of MCP_CONFIGS) {
+    for (const { label, segs } of atbash_targets_1.MCP_CONFIGS) {
         if (seen.has(label))
             continue;
         const cfg = readJson(home, ...segs);
@@ -394,6 +573,35 @@ function readAllMcpServers(home) {
     }
     return out;
 }
+const LOOPBACK_RE = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\]|::1)$/;
+function checkRelayHost(raw) {
+    const trimmed = String(raw ?? "").trim().replace(/\/+$/, "");
+    let url = null;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        url = null;
+    }
+    if (!url) {
+        return { host: trimmed, hostname: "", isLoopback: false, recognized: false,
+            problem: `refusing to relay: --host is not a valid URL (${trimmed || "empty"})` };
+    }
+    const hostname = url.hostname.toLowerCase();
+    const isLoopback = LOOPBACK_RE.test(hostname);
+    const recognized = atbash_targets_1.KNOWN_HOSTS.has(hostname) || isLoopback;
+    // Normalized to scheme + host + path. Whatever the checks below reject is also
+    // dropped here, so nothing unvetted can survive into `endpoint`.
+    const host = `${url.protocol}//${url.host}${url.pathname.replace(/\/+$/, "")}`;
+    const v = (problem, hint) => ({ host, hostname, isLoopback, recognized, problem, hint });
+    if (url.username || url.password)
+        return v(`refusing to relay to a --host carrying credentials (${hostname})`, "Drop the user:pass@ prefix — the relay never authenticates this way.");
+    if (url.search || url.hash)
+        return v(`refusing to relay to a --host carrying a query string or fragment (${trimmed})`, "The session path is appended to --host, so a ? or # would redirect the request.");
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback))
+        return v(`refusing to send over a non-HTTPS host (${host}) — the relay must travel encrypted`, "Use an https:// host (localhost may use http).");
+    return v(null);
+}
 function registerConnectCommand(program) {
     program
         .command("connect")
@@ -407,7 +615,8 @@ function registerConnectCommand(program) {
         .option("--allow-unrecognized-host", "Permit relaying to a --host that is not an official Atbash deployment (otherwise the command refuses to send)")
         .action(async (rawCode, opts) => {
         const home = opts.home || os.homedir();
-        const host = (opts.host || process.env.ATBASH_HOST || DEFAULT_HOST).replace(/\/+$/, "");
+        const hostCheck = checkRelayHost(opts.host || process.env.ATBASH_HOST || atbash_targets_1.DEFAULT_HOST);
+        const host = hostCheck.host;
         const code = rawCode.trim().toUpperCase().replace(/[^A-Z0-9-]/g, "");
         const machine = os.hostname();
         const dryRun = !!opts.dryRun;
@@ -415,19 +624,11 @@ function registerConnectCommand(program) {
         const introspect = !!opts.introspect;
         const allowUnrecognizedHost = !!opts.allowUnrecognizedHost;
         const endpoint = `${host}/api/agent-scan/session/${encodeURIComponent(code)}`;
-        // Parsed up front so the destination verdict is available to every output
+        // Vetted up front so the destination verdict is available to every output
         // path, including the JSON one an agent reads before deciding to proceed.
-        let hostUrl = null;
-        try {
-            hostUrl = new URL(host);
-        }
-        catch {
-            hostUrl = null;
-        }
-        const hostname = hostUrl ? hostUrl.hostname.toLowerCase() : "";
-        const isLoopback = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\]|::1)$/.test(hostname);
+        const { hostname, isLoopback } = hostCheck;
         // "Recognized" = an official Atbash deployment (or your own machine for dev).
-        const recognizedHost = KNOWN_HOSTS.has(hostname) || isLoopback;
+        const recognizedHost = hostCheck.recognized;
         // Machine-readable summary for the --json path AND for any error, so an agent
         // gets a stable, parseable description of exactly what this command is/was doing.
         const emitJson = (extra) => console.log(JSON.stringify({
@@ -443,7 +644,7 @@ function registerConnectCommand(program) {
             machine, host, endpoint, code,
             // An agent should treat `recognizedHost: false` as a reason to stop and
             // ask, not a detail to skim past.
-            recognizedHost, knownHosts: [...KNOWN_HOSTS],
+            recognizedHost, knownHosts: [...atbash_targets_1.KNOWN_HOSTS],
             ...extra,
         }, null, 2));
         if (!code) {
@@ -457,13 +658,11 @@ function registerConnectCommand(program) {
         // The only place this flow could be turned against you is a swapped --host
         // pointing the relay at someone else's server. So: refuse a channel that
         // isn't encrypted, and make an unrecognized destination impossible to miss.
-        const httpsOk = !!hostUrl && (hostUrl.protocol === "https:" || (hostUrl.protocol === "http:" && isLoopback));
-        if (!httpsOk) {
-            const msg = `refusing to send over a non-HTTPS host (${host}) — the relay must travel encrypted`;
+        if (hostCheck.problem) {
             if (asJson)
-                emitJson({ ok: false, error: msg });
+                emitJson({ ok: false, error: hostCheck.problem });
             else
-                console.error("\n" + chalk_1.default.red(`  ✗ ${msg}.`) + chalk_1.default.dim(" Use an https:// host (localhost may use http).\n"));
+                console.error("\n" + chalk_1.default.red(`  ✗ ${hostCheck.problem}.`) + (hostCheck.hint ? chalk_1.default.dim(` ${hostCheck.hint}`) : "") + "\n");
             process.exit(1);
         }
         // An unrecognized destination is the one real attack (a swapped --host). A
@@ -593,10 +792,30 @@ function registerConnectCommand(program) {
         }
         else {
             console.log("  Found:");
-            for (const a of agents)
-                console.log(`    ${chalk_1.default.green("•")} ${a.label} ${chalk_1.default.dim("— " + a.detail)}`);
+            for (const a of agents) {
+                // Show whether Atbash is actually wired into this runtime, not just
+                // what it can do. The relay has carried this since 0.5.15-dev.5, but it
+                // was invisible here AND in the browser, so "did the scan detect
+                // governance?" had no answer anywhere — which defeats the point of
+                // detecting it. Silent for MCP-client configs and framework exports,
+                // where the question does not apply.
+                const g = "governance" in a ? a.governance : undefined;
+                const badge = !g
+                    ? ""
+                    : g.enforcing
+                        ? " " + chalk_1.default.green("✓ Atbash enforcing")
+                        : g.installed
+                            ? " " + chalk_1.default.yellow("⚠ Atbash installed, NOT enforcing")
+                            : " " + chalk_1.default.dim("· Atbash not installed");
+                console.log(`    ${chalk_1.default.green("•")} ${a.label} ${chalk_1.default.dim("— " + a.detail)}${badge}`);
+            }
             console.log("");
         }
+        const halfWired = agents.filter((a) => "governance" in a && a.governance && !a.governance.enforcing && a.governance.installed);
+        if (halfWired.length) {
+            console.log(chalk_1.default.yellow(`  ⚠ ${halfWired.map((a) => a.label).join(", ")}: Atbash is installed but not enforcing.`) +
+                chalk_1.default.dim("\n    Actions through that runtime are NOT judged. Run `atbash setup` there, or check the\n    plugin is enabled and pointed at a key.\n"));
+        }
         console.log(chalk_1.default.yellow(`  ⚠ These results are from ${chalk_1.default.bold(machine)}.`) + chalk_1.default.dim(" If that isn't the computer you want to govern, run this command there instead.\n"));
         if (dryRun) {
             console.log(chalk_1.default.bold("  Dry run — the exact JSON that WOULD be sent:"));