@knowttl/artium-axi 0.0.9 → 0.0.11

package/README.md

@@ -35,17 +35,18 @@ Agents keep a command-line interface with TOON discovery rather than implementin
 - **Limits:** reviewed command inventories, write switches, bounded runtime, output and concurrency.
 
 ### Supported pinned tools
-| Tool | Version | Managed access |
-| --- | --- | --- |
-| Falcon | 0.5.0 | Read-only API client |
-| Vectra | 0.1.7 | Token or OAuth; optional allow-listed writes |
-| Azure | 0.1.10 | Application identity and resource-token broker |
-| Microsoft Graph | 0.1.10 | Application identity; optional allow-listed writes |
-| LDAP | 0.2.0 | Verified TLS simple bind; read-only |
-| Azure DevOps | 0.4.6 | PAT or application identity |
-| AWX | 0.1.7 | Pasted token or one-time password sign-in; optional operational writes |
-
-[Package pins](tools/package.json), [Falcon source pin](tools/falcon-source.json) and [reviewed inventories](tools/inventories) define the supported boundary.
+| Tool | Managed access |
+| --- | --- |
+| Falcon | API client; optional guarded RTR read-only commands |
+| Vectra | Token or OAuth; optional allow-listed writes |
+| Azure | Application identity and resource-token broker |
+| Microsoft Graph | Application identity; optional allow-listed writes |
+| LDAP | Verified TLS simple bind; read-only |
+| Azure DevOps | PAT or application identity |
+| AWX | Pasted token or one-time password sign-in; optional operational writes |
+| Tenable One | Access and secret API keys; optional allow-listed business writes and export jobs |
+
+[Package pins](tools/package.json) and the [Falcon source pin](tools/falcon-source.json) own bundled versions; [reviewed inventories](tools/inventories) define the supported command boundary.
 
 ## Quickstart
 
@@ -95,6 +96,10 @@ artium-axi falcon-axi detection list
 Replace the synthetic username with your account; login uses a hidden terminal password prompt.
 For `PASSWORD_CHANGE_REQUIRED`, run `artium-axi passwd`, then log in again.
 For SSO, use `artium-axi login --sso` and approve only the browser code matching your own terminal.
+After ordinary login, later commands, installed hooks and skills use [saved connection settings](docs/client-reference.md#client-settings).
+After a server upgrade, run `artium-axi update`, then `artium-axi --version`.
+The updater uses those connection settings, verifies the server download’s SHA-256, replaces the running client file and keeps the previous client beside it as `<client-file>.bak`.
+The client file and its directory must be writable.
 The Falcon read requires an enabled tool, a role grant and API permissions; choose the example from an available tool's detail view.
 
 With no enabled tools granted, `artium-axi tools` succeeds with:
@@ -117,6 +122,7 @@ artium-axi login --username synthetic-user
 ```
 
 Login warns about version differences; minimum server API requirements still apply.
+`artium-axi update` refuses npm installations; update them with `npm install -g @knowttl/artium-axi@latest`.
 Install `@knowttl/artium-axi@<server-version>` or download from the server to match it.
 
 ### Build from source
@@ -156,11 +162,13 @@ Administrator capability alone grants no tool access; upstream permissions remai
 
 | Tool | Write capability and unlock |
 | --- | --- |
-| Falcon, LDAP | Read-only inventories; Falcon's NG-SIEM search-job start/stop effects remain available regardless of its ineffective write switch. LDAP has no writes. |
+| Falcon | Optional guarded RTR execution from the standard read-only command allowlist, with profile narrowing. Host changes, scripts and file transfers remain unavailable. See [Falcon execution setup](docs/runbook.md#falcon-rtr-execution). |
+| LDAP | Fixed read-only. |
 | Azure | Reviewed resource mutations; administrator `allowWrites: true` plus native command gates. |
 | Graph, Vectra | Native mutations only with administrator `writes.allowWrites: true` and an explicit operations allow-list, plus native gates. |
 | Azure DevOps | Reviewed mutations with administrator `allowWrites: true`; raw `api` remains GET-only. |
 | AWX | Launch/cancel/relaunch, workflow approval/denial, project/inventory-source sync and notification tests with `allowWrites: true` and upstream `--confirm`; configuration, deletion and security writes stay blocked. |
+| Tenable One | Business writes and export-job creation with administrator `writes.allowWrites: true`, an explicit operations allow-list, native preview, `--execute`, exact `--confirm` and durable journaling; downloads and local configuration stay blocked. |
 
 There is no universal Artium confirmation flag.
 Use authenticated tool help and the [write-access runbook](docs/runbook.md#roles-credentials-and-health) for operation-specific gates.
@@ -175,6 +183,7 @@ After an unknown write outcome, inspect state using returned guidance before ret
 | LDAP | Bind identity with directory read access |
 | Azure DevOps project list | Identity permitted to view the organization/project |
 | AWX job list | Token identity with job read access |
+| Tenable One card list | See [Tenable One credential permissions](docs/tool-credentials.md#tenable-one). |
 
 See [tool credentials](docs/tool-credentials.md) for dedicated identities, permissions and safe credential entry.
 Artium stores shared service credentials encrypted with AES-256-GCM and never returns saved secrets to clients.
@@ -191,8 +200,7 @@ Its restricted environment, private directories and process limits are not a com
 
 | Setting or flag | Purpose |
 | --- | --- |
-| `ARTIUM_AXI_URL` | Required trusted HTTPS origin |
-| `ARTIUM_AXI_CA_FILE` | Additional readable PEM trust bundle for the client |
+| `ARTIUM_AXI_URL`, `ARTIUM_AXI_CA_FILE` | Connection overrides; see [client settings](docs/client-reference.md#client-settings) |
 | `XDG_CONFIG_HOME` | Linux session-storage base, default `~/.config` |
 | `--password-stdin` | Login/new password via protected stdin |
 | `--host`, `--hook`, `--force` | Setup host, optional Claude hook, explicit skill replacement |
@@ -212,11 +220,12 @@ This summary follows the [CLI help registry](src/cli/help.ts); `artium-axi --hel
 | `artium-axi` | Identity, roles and available tools |
 | `login --username <username>` / `login --sso` | Local password / browser approval |
 | `passwd` / `logout` | Change password / remove local tokens and attempt revocation |
-| `whoami` | Identity, roles, expiry and server |
+| `whoami` | Identity, roles, [session and access-token expiry](docs/client-reference.md#toon-output-behavior) and server |
 | `tools` / `tools show <tool>` | Granted enabled tools / pinned help and first call |
 | `doctor` | Server, TLS, token, version and cached health; five-second request deadlines |
+| `update` | Update the [server-downloaded client](#verified-client) |
 | `setup --host <host>` | Install managed skills and optional Claude hook |
-| `<tool> <args>` | Run any of the seven managed tools above |
+| `<tool> <args>` | Run any of the eight managed tools above |
 | `--managed-session --help` | Private-pipe session protocol |
 
 `artium-axi --help falcon-axi` is local help; `artium-axi falcon-axi --help` authenticates and calls upstream.