@hynaweb/kavlr 1.0.0 → 1.0.1

package/README.md

@@ -0,0 +1,30 @@
+# 🛡️ KAVLR: The Agent Leash
+**Runtime security for AI coding agents. Built on a $150 phone.**
+
+KAVLR is a fail-closed Bash hook that intercepts dangerous terminal commands (like `rm -rf`, `cat .env`, `sudo`) executed by AI agents (Claude Code, Cursor, Devin) *before* the OS runs them. 
+
+If the API is unreachable, it defaults to **BLOCKED**. Safety first. Always.
+
+### ⚡ Install in 30 Seconds
+```bash
+npm install -g @hynaweb/kavlr
+javlr init
+```
+*(Paste your API key from [kavlr.netlify.app](https://kavlr.netlify.app) when prompted)*
+
+### 🧪 Test It
+Try to read your environment variables:
+```bash
+cat .env
+```
+**Expected Output:** `🛠 [BLOCKED] THREAT DETECTED`
+
+*(Pro Tip: Need to bypass it for debugging? Just use a backslash: `\cat .env`)*
+
+### 🥖 Why I Built This
+I’m a 12-year-old developer building entirely on a $150 Android phone. I realized AI agents can halucinate and destroy production environments with zero "Are you sure?" prompts. Enterprise tools cost thousands. KAVLR is free, lightweight, and fail-closed. 
+
+[Read the full story of how my own code locked me out for 48 hours →](https://kavlr.netlify.app) *(Link to your Dev.to post later, or a Notion doc for now)*
+
+---
+**Tech Stack:** Vanilla JS, Supabase Edge Functions (Deno), PostgreSQL (RLS), Bash.

package/bin/cli.js

@@ -1,106 +1,193 @@
 #!/usr/bin/env node
-const axios = require('axios');
+
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { execSync } = require('child_process');
-const readline = require('readline');
-
-const API_URL = 'https://yasllkvdrgnqtjesdyfz.supabase.co/functions/v1/intercept';
-const args = process.argv.slice(2);
-const command = args[0];
-
-if (command === 'init') {
-  console.log('\x1b[36m%s\x1b[0m', '🛡️ Initializing KAVLR...');
-  const shell = process.env.SHELL || '';
-  const rcFile = shell.includes('zsh') ? '.zshrc' : '.bashrc';
-  const rcPath = path.join(os.homedir(), rcFile);
-  
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-
-  rl.question('\n\x1b[33mPlease enter your KAVLR API Key: \x1b[0m', (apiKey) => {
-    if (!apiKey) {
-      console.log('\x1b[31m%s\x1b[0m', '❌ API Key is required. Setup aborted.');
-      rl.close();
-      return;
-    }
+const { execSync, spawn } = require('child_process');
+const chalk = require('chalk');
+const { program } = require('commander');
 
-    const configStr = `\n# KAVLR Agent Leash\nexport KAVLR_API_KEY="${apiKey}"\nalias rm="kavlr hook rm"\nalias cat="kavlr hook cat"\nalias cp="kavlr hook cp"\nalias mv="kavlr hook mv"\n`;
+const CONFIG_FILE = path.join(os.homedir(), '.kavlr_config');
+const SUPABASE_URL = "https://yasllkvdrgnqtjesdyfz.supabase.co";
+const SUPABASE_ANON = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Inlhc2xsa3ZkcmducXRqZXNkeWZ6Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3OTIyODQwNjgsImV4cCI6MjEwNzg2MDA2OH0.1bD80IRX7agRAK7luYzdsUvFO3uSbfaK1OSo58l4-N4";
 
-    if (fs.existsSync(rcPath)) {
-      const content = fs.readFileSync(rcPath, 'utf8');
-      if (content.includes('KAVLR Agent Leash') === false) {
-        fs.appendFileSync(rcPath, configStr);
-        console.log('\n\x1b[32m%s\x1b[0m', '✅ API Key and Hook installed in ~/' + rcFile);
-        console.log('\x1b[36m%s\x1b[0m', '👉 Run: source ~/' + rcFile + ' to activate.');
-      } else {
-        console.log('\n\x1b[32m%s\x1b[0m', '✅ KAVLR is already configured. (If you need to change your key, edit ~/' + rcFile + ')');
-      }
+function loadKey() {
+    if (process.env.KAVLR_API_KEY) return process.env.KAVLR_API_KEY;
+    if (fs.existsSync(CONFIG_FILE)) {
+        try {
+            const data = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
+            return data.api_key;
+        } catch (e) {}
     }
-    rl.close();
-  });
-  
-  return;
+    return null;
 }
 
-if (command === 'hook') {
-  const originalCmd = args[1];
-  const originalArgs = args.slice(2).join(' ');
-  const payload = originalCmd + ' ' + originalArgs;
-  
-  analyzeCommand(payload, true, originalCmd, originalArgs, true);
-  return;
+function saveKey(key) {
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify({ api_key: key }), { mode: 0o600 });
+    console.log(chalk.green(`✅ API Key saved securely to ${CONFIG_FILE}`));
 }
 
-if (command === 'run') {
-  const payload = args.slice(1).join(' ');
-  analyzeCommand(payload, false, null, null, false);
-  return;
+function printLogo() {
+    console.log(chalk.cyan.bold(`
+ ██╗  ██╗ █████╗ ██╗   ██╗██╗     ██████╗ 
+ ██║ ██╔╝██╔══██╗██║   ██║██║     ██╔══██╗
+ █████╔╝ ███████║██║   ██║██║     ██████╔╝
+ ██╔═██╗ ██╔══██║╚██╗ ██╔╝██║     ██╔══██╗
+ ██║  ██╗██║  ██║ ╚████╔╝ ███████╗██║  ██║
+ ╚═╝  ╚═╝╚═╝  ╚═╝  ╚═══╝  ╚══════╝╚═╝  ╚═╝
+ `) + chalk.gray(` The AI Agent Action Gate v1.0.0\n`));
 }
 
-async function analyzeCommand(payload, executeAfter, cmd, cmdArgs, isHook) {
-  const API_KEY = process.env.KAVLR_API_KEY;
-  
-  if (API_KEY === undefined) {
-    console.error('\x1b[31m%s\x1b[0m', '❌ KAVLR_API_KEY is missing. Run "kavlr init" or export it manually.');
-    process.exit(1);
-  }
-
-  if (isHook === false) {
-    console.log('\n\x1b[36m%s\x1b[0m', '🔍 KAVLR analyzing: "' + payload + '"...');
-  }
-
-  try {
-    const response = await axios.post(API_URL, {
-      agent_id: isHook ? 'shell-hook' : 'cli-user',
-      action_type: cmd || 'run',
-      payload: payload
-    }, {
-      headers: { 'Authorization': 'Bearer ' + API_KEY }
+async function cmdSetup() {
+    printLogo();
+    const readline = require('readline').createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+    readline.question(chalk.cyan('Enter your KAVLR API Key (kavlr_...): '), (key) => {
+        if (key.startsWith('kavlr_')) {
+            saveKey(key.trim());
+        } else {
+            console.log(chalk.red('Invalid key format. It must start with "kavlr_"'));
+        }
+        readline.close();
     });
+}
 
-    if (isHook === false) {
-      console.log('\x1b[32m%s\x1b[0m', '✅ [ALLOWED] Action permitted.');
+async function cmdStatus() {
+    const key = loadKey();
+    if (!key) return console.log(chalk.red('No API key found. Run: kavlr setup'));
+    console.log(chalk.gray('Fetching system status...'));
+    try {
+        const res = await fetch(`${SUPABASE_URL}/rest/v1/settings?id=eq.1&select=kill_switch_active`, {
+            headers: { 'apikey': SUPABASE_ANON, 'Authorization': `Bearer ${SUPABASE_ANON}` }
+        });
+        const data = await res.json();
+        const isKilled = data[0] ? data[0].kill_switch_active : false;
+        
+        console.log(chalk.bold('\nSYSTEM STATUS'));
+        console.log('──────────────────────────────');
+        console.log(`API Key:      ${chalk.green('CONFIGURED')}`);
+        console.log(`Kill Switch:  ${isKilled ? chalk.red.bold('HALTED (LOCKDOWN)') : chalk.green.bold('SECURE (ACTIVE)')}`);
+        console.log(`Gate:         ${chalk.cyan('ONLINE')}`);
+        console.log('──────────────────────────────\n');
+    } catch (e) {
+        console.log(chalk.red(`Error: ${e.message}`));
     }
-    
-    if (executeAfter) {
-      try {
-        execSync(cmd + ' ' + cmdArgs, { stdio: 'inherit' });
-      } catch (err) {
-        process.exit(err.status || 1);
-      }
+}
+
+async function cmdLogs() {
+    const key = loadKey();
+    if (!key) return;
+    console.log(chalk.gray('Fetching recent telemetry...'));
+    try {
+        const userRes = await fetch(`${SUPABASE_URL}/rest/v1/api_keys?key=eq.${key}&select=user_id`, {
+            headers: { 'apikey': SUPABASE_ANON, 'Authorization': `Bearer ${SUPABASE_ANON}` }
+        });
+        const users = await userRes.json();
+        if (!users.length) return console.log(chalk.red('Invalid API key.'));
+        
+        const logsRes = await fetch(`${SUPABASE_URL}/rest/v1/agent_logs?user_id=eq.${users[0].user_id}&order=created_at.desc&limit=5`, {
+            headers: { 'apikey': SUPABASE_ANON, 'Authorization': `Bearer ${SUPABASE_ANON}` }
+        });
+        const logs = await logsRes.json();
+        
+        console.log(chalk.bold('\nRECENT TELEMETRY'));
+        console.log('────────────────────────────────────────────────────────');
+        logs.forEach(log => {
+            const color = log.status === 'BLOCKED' ? chalk.red : chalk.green;
+            console.log(`${color(`[${log.status}]`)} ${log.payload}`);
+            console.log(chalk.gray(`       ID: ${log.agent_id} | Time: ${log.created_at.substring(11, 19)}`));
+        });
+        console.log('────────────────────────────────────────────────────────\n');
+    } catch (e) {
+        console.log(chalk.red(`Error: ${e.message}`));
     }
+}
+
+function cmdDashboard() {
+    const url = "https://kavlr.netlify.app";
+    console.log(chalk.green(`Opening ${url}...`));
+    const start = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    execSync(`${start} ${url}`);
+}
+
+async function runGate(args) {
+    const key = loadKey();
+    if (!key) return console.log(chalk.red('No API key found. Run: kavlr setup'));
+
+    const binary = args[0];
+    const cmdArgs = args.slice(1);
     
-  } catch (error) {
-    if (error.response && error.response.status === 403) {
-      console.error('\x1b[41m\x1b[37m%s\x1b[0m', ' 🛑 [BLOCKED] THREAT DETECTED ');
-      console.error('\x1b[31m%s\x1b[0m', 'Reason: ' + error.response.data.message);
-    } else {
-      console.error('\x1b[31m%s\x1b[0m', '❌ KAVLR API Error. Blocking command for safety.');
+    console.log(chalk.gray(`[KAVLR GATE] Parsing action: ${chalk.bold(binary)} with args [${cmdArgs.join(', ')}]`));
+
+    try {
+        const res = await fetch(`${SUPABASE_URL}/rest/v1/rpc/evaluate_kavlr_action_v2`, {
+            method: 'POST',
+            headers: { 'apikey': SUPABASE_ANON, 'Authorization': `Bearer ${SUPABASE_ANON}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                p_api_key: key, p_binary: binary, p_args: cmdArgs, p_cwd: process.cwd()
+            })
+        });
+        const verdict = await res.json();
+
+        if (verdict.reason === 'NEEDS_AI') {
+            console.log(chalk.yellow('[KAVLR AI] Unknown command. Requesting Constitutional AI review...'));
+            const aiRes = await fetch(`${SUPABASE_URL}/functions/v1/llm-judge`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ binary: binary, args: cmdArgs })
+            });
+            const aiData = await aiRes.json();
+            
+            if (aiData.score >= 90) {
+                console.log(chalk.green.bold(`✅ [ALLOWED] AI Score: ${aiData.score}/100`));
+            } else {
+                console.log(chalk.red.bold(`🛑 [BLOCKED] AI Score: ${aiData.score}/100`));
+                console.log(chalk.red(`   Reason: ${aiData.reason}`));
+                process.exit(403);
+            }
+        } else if (!verdict.allowed) {
+            console.log(chalk.red.bold(`🛑 [BLOCKED] ${verdict.reason}`));
+            process.exit(403);
+        } else {
+            console.log(chalk.green.bold(`✅ [ALLOWED] ${verdict.reason}`));
+        }
+
+        console.log(chalk.gray('──────────────────────────────────────────────────'));
+        const child = spawn(binary, cmdArgs, { stdio: 'inherit' });
+        child.on('exit', (code) => {
+            console.log(chalk.gray('──────────────────────────────────────────────────'));
+            process.exit(code);
+        });
+
+    } catch (e) {
+        console.log(chalk.red(`[KAVLR ERROR] ${e.message}`));
+        process.exit(1);
     }
-    process.exit(1);
-  }
 }
+
+program
+  .name('kavlr')
+  .description('The AI Agent Action Gate')
+  .version('1.0.0')
+  .allowExcessArguments(true)
+  .allowUnknownOption(true)
+  .argument('[args...]', 'Command and arguments')
+  .action(async (args) => {
+      if (args.length === 0) {
+          printLogo();
+          console.log(`Usage:\n  kavlr setup\n  kavlr status\n  kavlr logs\n  kavlr dashboard\n  kavlr <command> [args...]`);
+          return;
+      }
+      
+      const cmd = args[0];
+      if (cmd === 'setup') return cmdSetup();
+      if (cmd === 'status') return cmdStatus();
+      if (cmd === 'logs') return cmdLogs();
+      if (cmd === 'dashboard') return cmdDashboard();
+      
+      await runGate(args);
+  });
+
+program.parse(process.argv);

package/package.json

@@ -1,17 +1,13 @@
 {
   "name": "@hynaweb/kavlr",
-  "version": "1.0.0",
-  "description": "The Agent Leash. Runtime security for AI coding agents.",
+  "version": "1.0.1",
+  "description": "The AI Agent Action Gate. Grade the action, not the text.",
   "main": "bin/cli.js",
   "bin": {
     "kavlr": "bin/cli.js"
   },
-  "scripts": {
-    "start": "node bin/cli.js"
-  },
   "dependencies": {
-    "axios": "^1.6.0"
-  },
-  "author": "Harun (HYNAWEB)",
-  "license": "MIT"
+    "chalk": "^4.1.2",
+    "commander": "^11.1.0"
+  }
 }