@dashclaw/cli 0.2.0 → 0.3.2

package/lib/config.js

@@ -0,0 +1,160 @@
+// cli/lib/config.js
+// Config resolution: env vars -> ~/.dashclaw/config.json -> interactive prompt.
+import readline from 'node:readline';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { bold, dim, green, red, yellow } from './render.js';
+
+const CONFIG_DIR = resolve(homedir(), '.dashclaw');
+const CONFIG_PATH = resolve(CONFIG_DIR, 'config.json');
+
+export function configPath() {
+  return CONFIG_PATH;
+}
+
+export function readConfigFile() {
+  if (!existsSync(CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync(CONFIG_PATH, 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+export function writeConfigFile(config) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+}
+
+export function clearConfigFile() {
+  if (existsSync(CONFIG_PATH)) {
+    unlinkSync(CONFIG_PATH);
+    return true;
+  }
+  return false;
+}
+
+export function ask(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((res) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      res(answer.trim());
+    });
+  });
+}
+
+export function askSecret(question) {
+  return new Promise((res) => {
+    const stdin = process.stdin;
+    process.stdout.write(question);
+    const wasRaw = stdin.isRaw;
+    if (stdin.setRawMode) stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding('utf8');
+
+    let input = '';
+    const onData = (char) => {
+      const str = String(char);
+      for (const c of str) {
+        if (c === '\n' || c === '\r' || c === '\u0004') {
+          if (stdin.setRawMode) stdin.setRawMode(wasRaw);
+          stdin.pause();
+          stdin.removeListener('data', onData);
+          process.stdout.write('\n');
+          res(input.trim());
+          return;
+        }
+        if (c === '\u0003') {
+          if (stdin.setRawMode) stdin.setRawMode(wasRaw);
+          stdin.pause();
+          process.stdout.write('\n');
+          process.exit(130);
+        }
+        if (c === '\u007f' || c === '\b') {
+          if (input.length > 0) {
+            input = input.slice(0, -1);
+            process.stdout.write('\b \b');
+          }
+        } else if (c >= ' ') {
+          input += c;
+          process.stdout.write('*');
+        }
+      }
+    };
+    stdin.on('data', onData);
+  });
+}
+
+/**
+ * Resolve config from env, then file, then interactive prompt.
+ * @returns {Promise<{ baseUrl, apiKey, agentId, source } | null>}
+ *   Returns null if missing and stdin is not a TTY (so caller can error out).
+ */
+export async function resolveConfig({ env = process.env, interactive = true } = {}) {
+  let baseUrl = env.DASHCLAW_BASE_URL;
+  let apiKey = env.DASHCLAW_API_KEY;
+  let agentId = env.DASHCLAW_AGENT_ID;
+  let source = 'env';
+
+  if (!baseUrl || !apiKey) {
+    const file = readConfigFile();
+    if (!baseUrl && file.baseUrl) {
+      baseUrl = file.baseUrl;
+      source = 'file';
+    }
+    if (!apiKey && file.apiKey) {
+      apiKey = file.apiKey;
+      source = 'file';
+    }
+    if (!agentId && file.agentId) agentId = file.agentId;
+  }
+
+  if (baseUrl && apiKey) {
+    return { baseUrl, apiKey, agentId: agentId || 'cli-operator', source };
+  }
+
+  if (!interactive || !process.stdin.isTTY) {
+    return null;
+  }
+
+  console.log();
+  console.log(bold('DashClaw CLI — first-time setup'));
+  console.log(dim(`Saved values go to ${CONFIG_PATH} (mode 600). Env vars always override.`));
+  console.log();
+
+  if (!baseUrl) {
+    baseUrl = await ask('DashClaw instance URL (e.g. https://your-dashclaw.vercel.app): ');
+    if (!baseUrl) {
+      console.error(red('Aborted — baseUrl is required.'));
+      process.exit(1);
+    }
+    baseUrl = baseUrl.replace(/\/+$/, '');
+  }
+
+  if (!apiKey) {
+    apiKey = await askSecret('API key (oc_live_...): ');
+    if (!apiKey) {
+      console.error(red('Aborted — API key is required.'));
+      process.exit(1);
+    }
+  }
+
+  agentId = agentId || 'cli-operator';
+
+  const saveAnswer = await ask(`Save to ${CONFIG_PATH}? [Y/n] `);
+  if (saveAnswer.toLowerCase() !== 'n' && saveAnswer.toLowerCase() !== 'no') {
+    try {
+      writeConfigFile({ baseUrl, apiKey, agentId });
+      console.log(green(`  \u2192 Saved. Remove with: dashclaw logout`));
+    } catch (err) {
+      console.error(yellow(`  Warning: could not write config file: ${err.message}`));
+    }
+  } else {
+    console.log(dim('  Not saved. Values apply to this invocation only.'));
+  }
+  console.log();
+
+  return { baseUrl, apiKey, agentId, source: 'prompted' };
+}

package/lib/cost.js

@@ -0,0 +1,108 @@
+// cli/lib/cost.js
+//
+// `dashclaw cost [--lens fleet|claude-code] [--period 7d|30d|90d]` — terminal
+// readback over GET /api/finops/spend (the finops rollups). Defaults:
+// lens=claude-code, period=7d — the wedge user's own Claude Code spend.
+
+import { apiRequest } from './api.js';
+
+export const VALID_LENSES = ['fleet', 'claude-code'];
+export const VALID_PERIODS = ['7d', '30d', '90d'];
+export const USAGE =
+  'Usage: dashclaw cost [--lens fleet|claude-code] [--period 7d|30d|90d]\n' +
+  '  Defaults: --lens claude-code --period 7d';
+
+/** Validate flag values. Returns null when fine, or a usage-bearing message. */
+export function validateCostFlags({ lens, period }) {
+  if (!VALID_LENSES.includes(lens)) {
+    return `Invalid --lens "${lens}". Valid: ${VALID_LENSES.join(', ')}.\n${USAGE}`;
+  }
+  if (!VALID_PERIODS.includes(period)) {
+    return `Invalid --period "${period}". Valid: ${VALID_PERIODS.join(', ')}.\n${USAGE}`;
+  }
+  return null;
+}
+
+export async function fetchSpend(config, { lens, period }) {
+  return apiRequest(config, 'GET', '/api/finops/spend', { query: { lens, period } });
+}
+
+const money = (n) => '$' + Number(n || 0).toFixed(2);
+
+function table(rows) {
+  // rows: [label, value][] — right-pad labels so values align.
+  const width = Math.max(...rows.map(([label]) => label.length));
+  return rows.map(([label, value]) => `  ${label.padEnd(width + 2)}${value}`).join('\n');
+}
+
+function formatClaudeCode(data, period) {
+  const cs = data.code_sessions || {};
+  const total = Number(data.code_total_usd || 0);
+  const sessions = Number(cs.session_count || 0);
+  if (total === 0 && sessions === 0) {
+    return (
+      `No Claude Code spend recorded yet for ${period}.\n` +
+      'Sessions are captured by the Stop hook (on by default, metadata-only;\n' +
+      'opt-out: DASHCLAW_CODE_SESSIONS_ENABLED=0). Run a Claude Code session and check back.'
+    );
+  }
+  const lines = [
+    `Claude Code spend — last ${period}`,
+    '',
+    table([
+      ['Total', money(total)],
+      ['Sessions', String(sessions)],
+      ['Cache saved', money(cs.total_cache_savings_usd)],
+    ]),
+  ];
+  const projects = Array.isArray(cs.by_project) ? cs.by_project.filter((p) => Number(p.cost_usd || 0) > 0) : [];
+  if (projects.length > 0) {
+    lines.push('', '  By project:');
+    lines.push(table(projects.map((p) => [`  ${p.project_name || p.project_id || 'unknown'}`, money(p.cost_usd)])));
+  }
+  lines.push('', `Summary: ${money(total)} across ${sessions} session(s) in the last ${period}.`);
+  return lines.join('\n');
+}
+
+function formatFleet(data, period) {
+  const agent = Number(data.agent?.total_cost_usd || 0);
+  const x402 = Number(data.x402?.total_spend_usd || 0);
+  const total = Number(data.fleet_total_usd || 0);
+  if (total === 0) {
+    return (
+      `No fleet spend recorded yet for ${period}.\n` +
+      'Agent spend lands when governed actions report tokens_in/tokens_out + model.'
+    );
+  }
+  const lines = [
+    `Fleet spend — last ${period}`,
+    '',
+    table([
+      ['Agent LLM', money(agent)],
+      ['x402 purchases', money(x402)],
+      ['Total', money(total)],
+    ]),
+    '',
+    `Summary: ${money(total)} fleet spend in the last ${period} (LLM ${money(agent)} + x402 ${money(x402)}).`,
+  ];
+  return lines.join('\n');
+}
+
+export function formatSpend(data, { lens, period }) {
+  return lens === 'claude-code' ? formatClaudeCode(data, period) : formatFleet(data, period);
+}
+
+/**
+ * Validate, fetch, format. Throws a usage-tagged Error on bad flags so the
+ * caller prints usage and exits non-zero without a stack trace.
+ */
+export async function runCost(config, { lens = 'claude-code', period = '7d' } = {}, { fetcher = fetchSpend } = {}) {
+  const invalid = validateCostFlags({ lens, period });
+  if (invalid) {
+    const err = new Error(invalid);
+    err.usage = true;
+    throw err;
+  }
+  const data = await fetcher(config, { lens, period });
+  return formatSpend(data, { lens, period });
+}

package/lib/doctor.js

@@ -0,0 +1,270 @@
+// cli/lib/doctor.js
+import { bold, dim, green, yellow, red } from './render.js';
+
+// Brand orange (256-color ANSI). Used sparingly — header + key accents only.
+const BRAND = (s) => `\x1b[38;5;208m${s}\x1b[0m`;
+
+const ICONS = {
+  pass: green('\u2713'),
+  warn: yellow('\u26a0'),
+  fail: red('\u2717'),
+};
+
+const CATEGORY_LABELS = {
+  database: 'Database',
+  config: 'Configuration',
+  auth: 'Authentication',
+  deployment: 'Deployment',
+  sdk: 'SDK Connectivity',
+  governance: 'Governance',
+  shape: 'Shape (generated)',
+  drift: 'Drift',
+};
+
+const CATEGORY_ORDER = ['database', 'config', 'auth', 'deployment', 'sdk', 'governance', 'shape', 'drift'];
+
+// Next-step guidance by check ID, used when the check has no auto-fix.
+// Keep each line short and actionable.
+const GUIDANCE = {
+  db_connection: 'Check DATABASE_URL and that Postgres is reachable from your deployment.',
+  env_NEXTAUTH_URL: 'Set NEXTAUTH_URL to your deployment URL (e.g. https://your.vercel.app).',
+  env_CRON_SECRET: 'Set CRON_SECRET to protect /api/cron/* endpoints.',
+  auth_signin: 'Configure an OAuth provider (GitHub/Google) or set DASHCLAW_LOCAL_ADMIN_PASSWORD.',
+  deploy_nextauth_url: 'Set NEXTAUTH_URL to match your deployment domain.',
+  deploy_cors: 'Set ALLOWED_ORIGIN if your agents run from a different domain.',
+  sdk_reachable: 'Check DASHCLAW_BASE_URL and confirm your instance is deployed and awake.',
+  sdk_auth: 'API key rejected — verify DASHCLAW_API_KEY matches the key on your instance.',
+  gov_actions: 'Send your first governed action with claw.guard() via the SDK.',
+  gov_stale: "Agents haven't reported in 7 days — check your agent pairings.",
+};
+
+function hr(width = 72) {
+  return dim('\u2500'.repeat(width));
+}
+
+/**
+ * Return an actionable next-step string for a non-passing check, or null.
+ */
+function nextStepFor(check, { noFix }) {
+  if (!check || check.status === 'pass') return null;
+
+  // Auto-fixable check: direct the user to the fix.
+  if (check.fix?.type === 'auto') {
+    if (noFix) {
+      return `${check.fix.description}. Re-run without ${bold('--no-fix')} to apply.`;
+    }
+    // Fix was attempted (or will run in this invocation); describe what it does.
+    return check.fix.description + '.';
+  }
+
+  // Fall back to the guidance table for warn/fail without an auto-fix.
+  return GUIDANCE[check.id] || null;
+}
+
+function doctorUrl(base, category) {
+  let url = `${base}/api/doctor?include_fixes=true`;
+  if (category) url += `&category=${encodeURIComponent(category)}`;
+  return url;
+}
+
+function doctorHeaders(apiKey) {
+  return { 'Content-Type': 'application/json', 'x-api-key': apiKey };
+}
+
+function exitFetchError(base, err) {
+  console.error(red(`\nError: Could not reach DashClaw at ${base}`));
+  console.error(dim(`  ${err.cause?.code || err.message}`));
+  console.error(dim(`  Check DASHCLAW_BASE_URL and confirm your instance is running.\n`));
+  process.exit(1);
+}
+
+async function fetchDoctorResult({ base, apiKey, category }) {
+  const headers = doctorHeaders(apiKey);
+  let res;
+  try {
+    res = await fetch(doctorUrl(base, category), { headers });
+  } catch (err) {
+    exitFetchError(base, err);
+  }
+  await handleDoctorResponse(base, res);
+  return { result: await res.json(), headers };
+}
+
+async function handleDoctorResponse(base, res) {
+  if (res.status === 401 || res.status === 403) {
+    console.error(red(`\nError: API key rejected by ${base} (${res.status}).`));
+    console.error(dim(`  Check DASHCLAW_API_KEY matches the key on your instance.\n`));
+    process.exit(1);
+  }
+
+  if (!res.ok && res.status !== 503) {
+    const errText = await res.text().catch(() => '');
+    console.error(red(`Doctor check failed (${res.status}): ${errText}`));
+    process.exit(1);
+  }
+}
+
+function exitJson(result) {
+  console.log(JSON.stringify(result, null, 2));
+  process.exit(result.status === 'healthy' ? 0 : 1);
+}
+
+function renderHeader(base) {
+  const hostLabel = base.replace(/^https?:\/\//, '');
+  console.log();
+  console.log(`  ${BRAND('[DashClaw]')} ${bold('Doctor')}   ${dim(hostLabel)}`);
+  console.log();
+}
+
+function groupChecks(checks) {
+  const grouped = {};
+  for (const check of checks) {
+    if (!grouped[check.category]) grouped[check.category] = [];
+    grouped[check.category].push(check);
+  }
+  return grouped;
+}
+
+function renderCheck(check, noFix) {
+  const icon = ICONS[check.status] || '?';
+  const titleStyled = check.status === 'pass' ? check.title : bold(check.title);
+  console.log(`  ${icon} ${titleStyled}`);
+
+  if (check.status !== 'pass') {
+    console.log(`    ${dim(check.message)}`);
+    const tip = nextStepFor(check, { noFix });
+    if (tip) {
+      console.log(`    ${dim('\u2192')} ${tip}`);
+    }
+  }
+}
+
+function renderGroupedChecks(checks, noFix) {
+  const grouped = groupChecks(checks);
+  for (const cat of CATEGORY_ORDER) {
+    const categoryChecks = grouped[cat];
+    if (!categoryChecks || categoryChecks.length === 0) continue;
+
+    console.log(`  ${bold(CATEGORY_LABELS[cat] || cat)}`);
+    for (const check of categoryChecks) {
+      renderCheck(check, noFix);
+    }
+    console.log();
+  }
+}
+
+function autoFixableChecks(result) {
+  return result.checks.filter((c) => c.status === 'fail' && c.fix?.type === 'auto');
+}
+
+async function applyDoctorFix({ base, headers, check }) {
+  try {
+    const fixRes = await fetch(`${base}/api/doctor/fix`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ action: check.fix.action }),
+    });
+    const fixResult = await fixRes.json();
+    if (fixResult.applied) {
+      console.log(`  ${green('\u2192')} Fixed: ${fixResult.description}`);
+      return { fixed: 1, recheck: fixResult.recheck || null };
+    }
+    console.log(`  ${dim('\u2192')} Skipped: ${fixResult.description}`);
+  } catch (err) {
+    console.log(`  ${red('\u2717')} Fix "${check.fix.action}" failed: ${err.cause?.code || err.message}`);
+  }
+  return { fixed: 0, recheck: null };
+}
+
+async function applyAutoFixes({ base, headers, result, noFix }) {
+  let fixCount = 0;
+  let latestRecheck = null;
+  if (noFix) return { fixCount, latestRecheck };
+
+  const fixable = autoFixableChecks(result);
+  if (fixable.length === 0) return { fixCount, latestRecheck };
+
+  console.log(`  ${bold('Applying auto-fixes...')}`);
+  for (const check of fixable) {
+    const outcome = await applyDoctorFix({ base, headers, check });
+    fixCount += outcome.fixed;
+    latestRecheck = outcome.recheck || latestRecheck;
+  }
+  console.log();
+  return { fixCount, latestRecheck };
+}
+
+function renderSummary(reporting) {
+  const { pass, warn, fail } = reporting.summary;
+  console.log(hr());
+  console.log();
+
+  const segments = [
+    green(`${pass} passed`),
+    warn > 0 ? yellow(`${warn} warning${warn !== 1 ? 's' : ''}`) : dim('0 warnings'),
+    fail > 0 ? red(`${fail} failed`) : dim('0 failed'),
+  ];
+  console.log(`  ${segments.join('   ' + dim('\u00b7') + '   ')}`);
+  console.log();
+}
+
+function renderFixCount(fixCount) {
+  if (fixCount > 0) {
+    console.log(`  ${green('\u2713')} ${fixCount} issue${fixCount !== 1 ? 's' : ''} auto-fixed this run.`);
+  }
+}
+
+function renderNoFixHint(result, noFix) {
+  if (!noFix) return;
+  const autoFixable = result.checks.filter(
+    (c) => c.status !== 'pass' && c.fix?.type === 'auto',
+  ).length;
+  if (autoFixable > 0) {
+    console.log(
+      `  ${BRAND('\u2192')} ${autoFixable} issue${autoFixable !== 1 ? 's' : ''} can be auto-fixed. Run: ${bold('dashclaw doctor')}`,
+    );
+  }
+}
+
+function renderHealthFooter(base, healthy) {
+  if (!healthy) {
+    console.log(`  ${dim('Docs:')} ${base}/setup`);
+  } else {
+    console.log(`  ${green('\u2713')} ${bold('All systems healthy')} — ${dim('ready to govern actions')}`);
+  }
+  console.log();
+}
+
+/**
+ * Run doctor via the API and render results.
+ * @param {{ baseUrl: string, apiKey: string, json?: boolean, noFix?: boolean, category?: string }} options
+ */
+export async function runDoctor({ baseUrl, apiKey, json, noFix, category }) {
+  const base = baseUrl.replace(/\/+$/, '');
+  const { result, headers } = await fetchDoctorResult({ base, apiKey, category });
+
+  if (json) {
+    exitJson(result);
+  }
+
+  // --- Header ----------------------------------------------------------------
+  renderHeader(base);
+
+  // --- Grouped checks --------------------------------------------------------
+  renderGroupedChecks(result.checks, noFix);
+
+  // --- Auto-fix (remote fixes only; local-only fixes blocked by API) --------
+  const { fixCount, latestRecheck } = await applyAutoFixes({ base, headers, result, noFix });
+
+  // --- Summary ---------------------------------------------------------------
+  const reporting = latestRecheck || result;
+  renderSummary(reporting);
+
+  // --- Contextual footer -----------------------------------------------------
+  const healthy = reporting.status === 'healthy';
+  renderFixCount(fixCount);
+  renderNoFixHint(result, noFix);
+  renderHealthFooter(base, healthy);
+
+  process.exit(healthy ? 0 : 1);
+}

package/lib/env.js

@@ -0,0 +1,69 @@
+// cli/lib/env.js
+//
+// `dashclaw env [--agent <id>] [-- <command...>]` — fetch the delivery-enabled
+// managed-secret bundle from GET /api/secrets/env and inject it into a child
+// process environment MEMORY-ONLY. Secret VALUES are never written to disk,
+// never printed, and never echoed in error paths — only NAMES are ever shown.
+// Fail-closed: if the bundle fetch fails, the child command is NOT run.
+
+import { spawn } from 'node:child_process';
+import { apiRequest } from './api.js';
+import { dim } from './render.js';
+
+/** GET /api/secrets/env for one agent. Returns { env, count, delivered }. */
+export async function fetchAgentEnv(config, agentId) {
+  return apiRequest(config, 'GET', '/api/secrets/env', { query: { agent_id: agentId } });
+}
+
+/**
+ * Split the CLI argv at the `--` separator.
+ * Tokens before `--` are flags for `dashclaw env`; tokens after are the
+ * child command + its args (left untouched, including any `--print`).
+ */
+export function splitEnvArgv(argv) {
+  const sep = argv.indexOf('--');
+  if (sep === -1) return { flags: argv, command: [] };
+  return { flags: argv.slice(0, sep), command: argv.slice(sep + 1) };
+}
+
+/** Names-only listing — never values. */
+export function formatEnvNames(bundle) {
+  const names = Array.isArray(bundle.delivered) ? bundle.delivered : Object.keys(bundle.env || {});
+  const lines = [];
+  if (names.length === 0) {
+    lines.push(dim('  No delivery-enabled secrets for this agent.'));
+  } else {
+    for (const name of names) lines.push(`  ${name}`);
+  }
+  lines.push('');
+  lines.push(dim(`  ${names.length} secret(s). Values are never printed — run: dashclaw env -- <command>`));
+  return lines.join('\n');
+}
+
+/**
+ * Spawn the child command with the secret bundle merged into its environment.
+ * Memory-only: the merged env object lives only in this process and the
+ * child's process table — nothing is written anywhere. Resolves with the
+ * exit code to assign to process.exitCode (never calls process.exit — a hard
+ * exit can trip a libuv teardown assert on Windows).
+ */
+export function runWithEnv(bundle, commandArgv) {
+  const [cmd, ...cmdArgs] = commandArgv;
+  // No shell: args pass through verbatim (shell:true concatenates them
+  // unescaped — mangles quoted args and is deprecated, DEP0190).
+  const child = spawn(cmd, cmdArgs, {
+    stdio: 'inherit',
+    env: { ...process.env, ...(bundle.env || {}) },
+  });
+  return new Promise((resolve) => {
+    child.on('error', (err) => {
+      // err.message is a spawn error (ENOENT/EINVAL etc.) — never contains values.
+      console.error(`Error: could not start "${cmd}": ${err.message}`);
+      if (process.platform === 'win32' && (err.code === 'EINVAL' || err.code === 'ENOENT')) {
+        console.error(`Hint: Windows .cmd shims (npm, npx) cannot be spawned directly — try: dashclaw env -- cmd /c ${cmd} ...`);
+      }
+      resolve(1);
+    });
+    child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 1));
+  });
+}

package/lib/posture.js

@@ -0,0 +1,45 @@
+// cli/lib/posture.js
+//
+// Direct-API helpers for the `dashclaw posture` / `dashclaw next` commands.
+// Like the other CLI command groups, these call the live endpoints via
+// apiRequest (fetch + x-api-key) rather than the published SDK, so the CLI never
+// depends on a possibly-stale `dashclaw` package for newly-added routes.
+//
+// Resolve is DRAFT-ONLY: the CLI can create an inactive policy draft, snooze, or
+// accept risk — it can NEVER activate enforcement. An operator (or agent) can
+// prepare a fix; only a human activates it at /policies. Mirrors the API + MCP
+// ceiling so agents can never self-escalate their own governance.
+
+import { apiRequest } from './api.js';
+
+/** GET /api/posture — score + dimensions + findings + summary + trend. */
+export async function fetchPosture(config) {
+  return apiRequest(config, 'GET', '/api/posture');
+}
+
+/** GET /api/posture/findings — the prioritized queue (+ optional filters). */
+export async function fetchFindings(config, { status, dimension } = {}) {
+  return apiRequest(config, 'GET', '/api/posture/findings', { query: { status, dimension } });
+}
+
+/** The single top open finding (the `next` gap), or null when the queue is clear. */
+export async function fetchNext(config) {
+  const data = await fetchFindings(config);
+  return (data && Array.isArray(data.findings) && data.findings[0]) || null;
+}
+
+const RESOLVE_ACTIONS = new Set(['create_draft', 'snooze', 'accept_risk']);
+
+/**
+ * POST /api/posture/findings/<key>/resolve — DRAFT-ONLY actions.
+ * `create_draft` (default) inserts an inactive policy draft; snooze/accept_risk
+ * record state. None of these activate enforcement.
+ */
+export async function resolveFinding(config, key, action = 'create_draft', note) {
+  if (!RESOLVE_ACTIONS.has(action)) {
+    throw new Error(`Invalid resolve action "${action}". Draft-only: ${[...RESOLVE_ACTIONS].join(', ')}.`);
+  }
+  return apiRequest(config, 'POST', `/api/posture/findings/${encodeURIComponent(key)}/resolve`, {
+    body: { action, note },
+  });
+}

package/package.json

@@ -1,13 +1,29 @@
 {
   "name": "@dashclaw/cli",
-  "version": "0.2.0",
-  "description": "DashClaw terminal approval client",
+  "version": "0.3.2",
+  "description": "DashClaw terminal client — approve agent actions and diagnose your instance",
   "type": "module",
+  "keywords": [
+    "dashclaw",
+    "cli",
+    "claude-code",
+    "ai-governance",
+    "agent-governance"
+  ],
   "bin": {
     "dashclaw": "./bin/dashclaw.js"
   },
-  "files": ["bin/", "lib/"],
-  "engines": { "node": ">=18.0.0" },
+  "files": [
+    "bin/",
+    "lib/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "test": "node --test test/**/*.test.js"
+  },
   "dependencies": {
     "dashclaw": "^2.2.1"
   },