@contextecf/guardian-cli 0.1.5 → 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -15,7 +15,6 @@ guardian setup
15
15
  Then open the Control Tower in your default browser:
16
16
 
17
17
  ```bash
18
- guardian launch
19
18
  guardian open
20
19
  ```
21
20
 
@@ -44,7 +43,6 @@ tested against the same Node floor expected for public npm users.
44
43
  guardian setup
45
44
  guardian doctor
46
45
  guardian readiness
47
- guardian launch
48
46
  guardian open
49
47
  guardian status
50
48
  guardian policy list
@@ -53,7 +51,7 @@ guardian posture list
53
51
  guardian preferences show
54
52
  guardian privacy show
55
53
  guardian mcp install
56
- guardian daemon pair --json
54
+ guardian extension connect
57
55
  guardian desktop execute --input=/path/to/approved-action.json --yes
58
56
  ```
59
57
 
@@ -62,11 +60,17 @@ through `npx`. It creates or reuses the local profile, keeps local-first privacy
62
60
  defaults, runs doctor/data checks, writes Guardian-owned MCP snippets under the
63
61
  Guardian profile directory, starts or reuses the local daemon, and returns
64
62
  browser-extension setup guidance without printing the runtime token. It opens
65
- the Control Tower only when `--open` is supplied. It does not install the native
66
- host manifest or write external AI tool config unless the user runs the explicit
67
- follow-up commands.
63
+ the Control Tower only when `--open` is supplied. It also prepares the local
64
+ browser connection for the published ContextECF Halo extension so most users can
65
+ open Halo and click **Connect** without pasting a setup code.
68
66
 
69
- `guardian extension native-host install --extension-id=<id>` writes the
67
+ `guardian connect` is the friendly repair command when the browser
68
+ extension says Local Guardian is not connected. It refreshes the local browser
69
+ connection, keeps tokens out of terminal output, and tells the user to open Halo
70
+ and click **Connect**.
71
+
72
+ Advanced support and packaging flows can still use
73
+ `guardian extension native-host install --extension-id=<id>` to write the
70
74
  Guardian browser native messaging helper and manifest. On macOS/Linux it writes
71
75
  the browser manifest path directly. On Windows it writes the helper, `.cmd`
72
76
  launcher, and manifest under `GUARDIAN_HOME/native-host`, then prints exact HKCU
@@ -155,10 +159,11 @@ Learning Graph is enabled. Guardian persists these choices in `profile.json`
155
159
  and `preferences.json`; Prompt Coach opt-out is honored by the local daemon
156
160
  without disabling policy checks.
157
161
 
158
- `guardian install`, `guardian doctor`, and `guardian mcp install` do not print
159
- the local runtime token. The token is emitted only by the explicit
162
+ `guardian install`, `guardian setup`, `guardian doctor`,
163
+ `guardian extension connect`, and `guardian mcp install` do not print the local
164
+ runtime token. The token is emitted only by the explicit support fallback
160
165
  `guardian daemon pair --json` handoff command so the browser extension can be
161
- paired deliberately.
166
+ paired deliberately when automatic local discovery is unavailable.
162
167
 
163
168
  `guardian desktop execute --input=/path/to/approved-action.json --yes` is the
164
169
  first conservative desktop adapter. It consumes an approved MCP local-action
@@ -200,8 +205,9 @@ including a stale-daemon-version hint.
200
205
  | `guardian status` reports daemon status `unauthorized`, or any Guardian admin request returns `401 unauthorized` | The runtime token on disk (`GUARDIAN_HOME/runtime-token`) doesn't match the token the running daemon expects — usually a leftover daemon from before a `guardian install`/profile reset | Run `guardian stop`, then `guardian launch --port=4322` (or another free port), then `guardian status` to confirm it's reachable and authorized again. |
201
206
  | `guardian status` shows a `daemonVersionMismatch` block (or, in text output, "Daemon version: ... (this CLI is ... — versions differ, ...)") | Usually the CLI was upgraded (`npm install -g @contextecf/guardian-cli@latest`) while a daemon started by the previous version was still running — the same applies in reverse after a downgrade | Run `guardian stop && guardian launch` to restart the daemon under the current version. This is informational only — Guardian never auto-restarts a running daemon or auto-trusts a stale token on your behalf. |
202
207
  | `npm publish`/release automation fails with an OTP or auth prompt maintainers don't recognize | This is a release-maintainer concern, not an end-user CLI issue — it's about the npm account publishing `@contextecf/guardian-cli`, not the installed CLI | See `scripts/collect-guardian-npm-auth-preflight.mjs` (repo root) and the Release Owner Commands section below. Never paste an OTP or npm token into `guardian` CLI commands or Guardian issues/logs. |
203
- | The browser extension shows "not paired" or can't reach the daemon | The extension doesn't have the local runtime token yet | Run `guardian daemon pair --json` to print a one-time pairing payload, then `guardian extension open-setup` to walk through connecting it. The token is only ever printed by this explicit command. |
204
- | Native messaging fails, or the extension can't launch the native host | The native messaging manifest isn't installed for your browser (and on Windows, isn't registered in HKCU) | Run `guardian extension native-host install --extension-id=<id>`. On Windows, add `--write-registry --yes` to also perform the HKCU registration. Verify with `guardian extension native-host status --json`. |
208
+ | The browser extension says Local Guardian is not connected | The local browser connection is missing, stale, or not registered for this Chrome profile | Run `guardian extension connect`, then open ContextECF Halo and click **Connect**. No setup code should be needed for the normal path. |
209
+ | Support asks for a setup code | Automatic local discovery is unavailable on this machine or support is diagnosing a custom browser profile | Run `guardian daemon pair --json` only when support asks for it, then paste the output into Halo's support-assisted setup box. The token is only ever printed by this explicit command. |
210
+ | Native messaging fails, or the extension can't complete the browser connection | The browser connection file isn't installed for your browser (and on Windows, isn't registered in HKCU) | First run `guardian connect`. Advanced support can run `guardian extension native-host install --extension-id=<id>`. On Windows, add `--write-registry --yes` to also perform the HKCU registration. Verify with `guardian extension native-host status --json`. |
205
211
  | The daemon doesn't survive a reboot, or you want it to run without keeping a terminal open | Guardian isn't registered with your OS's service supervisor | Run `guardian service install` to register a `launchd` (macOS), `systemd` (Linux), or Windows Task Scheduler entry. `guardian doctor`'s `service-supervision` check confirms it's registered. |
206
212
  | `guardian doctor`'s `os-key-storage` check reports `warn` or `fail` | No local-data encryption key has been stored via the OS credential vault yet | Run `guardian key-store install --yes` and supply the secret via stdin (never as a CLI argument). Check with `guardian key-store status`. |
207
213
 
@@ -254,9 +260,8 @@ npm install -g @contextecf/guardian-cli@0.1.4
254
260
  guardian --version
255
261
  guardian stop
256
262
  guardian setup
257
- guardian launch
258
- guardian open
259
263
  guardian status
264
+ guardian open
260
265
  ```
261
266
 
262
267
  That paste block proves public npm visibility and first-run usability for the