@contextecf/guardian-cli 0.1.5 → 0.1.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +19 -14
- package/dist/packages/guardian-cli/src/bin.js +2448 -128
- package/dist/packages/guardian-cli/src/index.js +665 -86
- package/dist/packages/guardian-cli/src/runtime.d.ts +49 -4
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -15,7 +15,6 @@ guardian setup
|
|
|
15
15
|
Then open the Control Tower in your default browser:
|
|
16
16
|
|
|
17
17
|
```bash
|
|
18
|
-
guardian launch
|
|
19
18
|
guardian open
|
|
20
19
|
```
|
|
21
20
|
|
|
@@ -44,7 +43,6 @@ tested against the same Node floor expected for public npm users.
|
|
|
44
43
|
guardian setup
|
|
45
44
|
guardian doctor
|
|
46
45
|
guardian readiness
|
|
47
|
-
guardian launch
|
|
48
46
|
guardian open
|
|
49
47
|
guardian status
|
|
50
48
|
guardian policy list
|
|
@@ -53,7 +51,7 @@ guardian posture list
|
|
|
53
51
|
guardian preferences show
|
|
54
52
|
guardian privacy show
|
|
55
53
|
guardian mcp install
|
|
56
|
-
guardian
|
|
54
|
+
guardian extension connect
|
|
57
55
|
guardian desktop execute --input=/path/to/approved-action.json --yes
|
|
58
56
|
```
|
|
59
57
|
|
|
@@ -62,11 +60,17 @@ through `npx`. It creates or reuses the local profile, keeps local-first privacy
|
|
|
62
60
|
defaults, runs doctor/data checks, writes Guardian-owned MCP snippets under the
|
|
63
61
|
Guardian profile directory, starts or reuses the local daemon, and returns
|
|
64
62
|
browser-extension setup guidance without printing the runtime token. It opens
|
|
65
|
-
the Control Tower only when `--open` is supplied. It
|
|
66
|
-
|
|
67
|
-
|
|
63
|
+
the Control Tower only when `--open` is supplied. It also prepares the local
|
|
64
|
+
browser connection for the published ContextECF Halo extension so most users can
|
|
65
|
+
open Halo and click **Connect** without pasting a setup code.
|
|
68
66
|
|
|
69
|
-
`guardian
|
|
67
|
+
`guardian connect` is the friendly repair command when the browser
|
|
68
|
+
extension says Local Guardian is not connected. It refreshes the local browser
|
|
69
|
+
connection, keeps tokens out of terminal output, and tells the user to open Halo
|
|
70
|
+
and click **Connect**.
|
|
71
|
+
|
|
72
|
+
Advanced support and packaging flows can still use
|
|
73
|
+
`guardian extension native-host install --extension-id=<id>` to write the
|
|
70
74
|
Guardian browser native messaging helper and manifest. On macOS/Linux it writes
|
|
71
75
|
the browser manifest path directly. On Windows it writes the helper, `.cmd`
|
|
72
76
|
launcher, and manifest under `GUARDIAN_HOME/native-host`, then prints exact HKCU
|
|
@@ -155,10 +159,11 @@ Learning Graph is enabled. Guardian persists these choices in `profile.json`
|
|
|
155
159
|
and `preferences.json`; Prompt Coach opt-out is honored by the local daemon
|
|
156
160
|
without disabling policy checks.
|
|
157
161
|
|
|
158
|
-
`guardian install`, `guardian
|
|
159
|
-
|
|
162
|
+
`guardian install`, `guardian setup`, `guardian doctor`,
|
|
163
|
+
`guardian extension connect`, and `guardian mcp install` do not print the local
|
|
164
|
+
runtime token. The token is emitted only by the explicit support fallback
|
|
160
165
|
`guardian daemon pair --json` handoff command so the browser extension can be
|
|
161
|
-
paired deliberately.
|
|
166
|
+
paired deliberately when automatic local discovery is unavailable.
|
|
162
167
|
|
|
163
168
|
`guardian desktop execute --input=/path/to/approved-action.json --yes` is the
|
|
164
169
|
first conservative desktop adapter. It consumes an approved MCP local-action
|
|
@@ -200,8 +205,9 @@ including a stale-daemon-version hint.
|
|
|
200
205
|
| `guardian status` reports daemon status `unauthorized`, or any Guardian admin request returns `401 unauthorized` | The runtime token on disk (`GUARDIAN_HOME/runtime-token`) doesn't match the token the running daemon expects — usually a leftover daemon from before a `guardian install`/profile reset | Run `guardian stop`, then `guardian launch --port=4322` (or another free port), then `guardian status` to confirm it's reachable and authorized again. |
|
|
201
206
|
| `guardian status` shows a `daemonVersionMismatch` block (or, in text output, "Daemon version: ... (this CLI is ... — versions differ, ...)") | Usually the CLI was upgraded (`npm install -g @contextecf/guardian-cli@latest`) while a daemon started by the previous version was still running — the same applies in reverse after a downgrade | Run `guardian stop && guardian launch` to restart the daemon under the current version. This is informational only — Guardian never auto-restarts a running daemon or auto-trusts a stale token on your behalf. |
|
|
202
207
|
| `npm publish`/release automation fails with an OTP or auth prompt maintainers don't recognize | This is a release-maintainer concern, not an end-user CLI issue — it's about the npm account publishing `@contextecf/guardian-cli`, not the installed CLI | See `scripts/collect-guardian-npm-auth-preflight.mjs` (repo root) and the Release Owner Commands section below. Never paste an OTP or npm token into `guardian` CLI commands or Guardian issues/logs. |
|
|
203
|
-
| The browser extension
|
|
204
|
-
|
|
|
208
|
+
| The browser extension says Local Guardian is not connected | The local browser connection is missing, stale, or not registered for this Chrome profile | Run `guardian extension connect`, then open ContextECF Halo and click **Connect**. No setup code should be needed for the normal path. |
|
|
209
|
+
| Support asks for a setup code | Automatic local discovery is unavailable on this machine or support is diagnosing a custom browser profile | Run `guardian daemon pair --json` only when support asks for it, then paste the output into Halo's support-assisted setup box. The token is only ever printed by this explicit command. |
|
|
210
|
+
| Native messaging fails, or the extension can't complete the browser connection | The browser connection file isn't installed for your browser (and on Windows, isn't registered in HKCU) | First run `guardian connect`. Advanced support can run `guardian extension native-host install --extension-id=<id>`. On Windows, add `--write-registry --yes` to also perform the HKCU registration. Verify with `guardian extension native-host status --json`. |
|
|
205
211
|
| The daemon doesn't survive a reboot, or you want it to run without keeping a terminal open | Guardian isn't registered with your OS's service supervisor | Run `guardian service install` to register a `launchd` (macOS), `systemd` (Linux), or Windows Task Scheduler entry. `guardian doctor`'s `service-supervision` check confirms it's registered. |
|
|
206
212
|
| `guardian doctor`'s `os-key-storage` check reports `warn` or `fail` | No local-data encryption key has been stored via the OS credential vault yet | Run `guardian key-store install --yes` and supply the secret via stdin (never as a CLI argument). Check with `guardian key-store status`. |
|
|
207
213
|
|
|
@@ -254,9 +260,8 @@ npm install -g @contextecf/guardian-cli@0.1.4
|
|
|
254
260
|
guardian --version
|
|
255
261
|
guardian stop
|
|
256
262
|
guardian setup
|
|
257
|
-
guardian launch
|
|
258
|
-
guardian open
|
|
259
263
|
guardian status
|
|
264
|
+
guardian open
|
|
260
265
|
```
|
|
261
266
|
|
|
262
267
|
That paste block proves public npm visibility and first-run usability for the
|