@lllanyard/cli 0.1.0 → 0.1.1

package/README.md

@@ -34,9 +34,9 @@ export OPENAI_BASE_URL=http://127.0.0.1:3000/openai/v1
 export OPENAI_API_KEY=lly_...
 ```
 
-Compatibility notes (verify against each tool's own docs):
-- Claude Code reads its base URL and key from these environment variables; if `ANTHROPIC_AUTH_TOKEN` is also set it may take precedence, so unset it. Only API-key mode is proxied, not subscription logins. The Claude Desktop app reportedly ignores these variables; for Desktop (and subscription use generally) see [Claude Desktop](#3-claude-desktop-and-subscription-chat-apps) below.
-- Cursor makes some model calls from its own servers, so a localhost base URL may not work there. Test before promising support.
+Compatibility notes:
+- Claude Code reads its base URL and key from these environment variables; if `ANTHROPIC_AUTH_TOKEN` is also set it may take precedence, so unset it. Only API-key mode is proxied, not subscription logins. The Claude Desktop app ignores these variables; for Desktop (and subscription use generally) see [Claude Desktop](#3-claude-desktop-and-subscription-chat-apps) below.
+- Cursor makes some model calls from its own servers, so a localhost base URL may not work there.
 
 ## Commands
 
@@ -47,7 +47,7 @@ Compatibility notes (verify against each tool's own docs):
 | `exec <command> [args…]` | Run a script with the keys it uses: `lllanyard exec pwsh -File ./Onboard-Client.ps1 -DryRun`. LLLanyard reads the script, and the helper files it loads (quoted paths, `source`/`.` lines, Python imports), for your keys' variable names and passes only those, for that run only. Keys in the output are redacted; each run is logged and shown by `usage`. `exec --keys trmm,itflow -- <command>` names the keys yourself (needed for programs that aren't scripts). Run from a terminal, the script gets a real terminal of its own (prompts like `Read-Host`, colours and window size work) on macOS, Linux and Windows, and its output is still redacted. |
 | `list`, `remove`, `rotate`, `status` | Manage keys; `status` shows rotation due dates and exits 1 if anything is overdue (cron/CI friendly). |
 | `agent create <name> [--client N] [--providers a,b]` / `list` / `revoke` | Placeholder tokens. `--client acme` pins an agent to the `acme` key; `--providers` limits which APIs it may reach (least privilege). |
-| `provider add <id> --upstream https://… [--auth bearer\|header --header NAME --prefix TXT]` / `list` / `remove` | Teach the proxy a new API host (GitHub, Slack, your own service). Built-ins: openai, anthropic, gemini, openrouter, github, slack, stripe, notion (confirm each against the vendor's docs). |
+| `provider add <id> --upstream https://… [--auth bearer\|header --header NAME --prefix TXT]` / `list` / `remove` | Teach the proxy a new API host (GitHub, Slack, your own service). Built-ins: openai, anthropic, gemini, openrouter, github, slack, stripe, notion. |
 | `tool add <name> --env VAR=provider[:label] [--allow-host H] [--kill-on-leak] [--pass-env V] [--inherit-env] [--no-scrub] -- <command> [args…]` / `list` / `remove` | Approve a command (e.g. an MCP server) to receive keys as environment variables, with the safeguards below. |
 | `run <name> [-- args…]` | Run an approved tool with its keys injected and scrubbed from its output. Extra args are appended only if the tool was approved with `--allow-args`. For script tools (python, node, sh, pwsh…) the script file is pinned by hash at approval and `run` refuses if it has changed since; `--allow-args` is refused for bare interpreters (`python3 -c`, `-m`) and launchers (`env`, `xargs`, `sudo`, `npx`). `run --env … -- <cmd>` is a one-off that needs a human to confirm at a terminal. |
 | `scan [paths] [--import --apply [--redact]]` | Find plaintext keys in `.env` files, MCP/IDE configs and shell profiles, then move them into the keychain. Dry run unless `--apply`. |
@@ -155,11 +155,9 @@ lllanyard doctor        # reports whether a sandbox works on this machine
 - Run it from the project folder: only the current directory is writable, and running from your home directory is refused.
   Credential folders (`~/.ssh`, `~/.aws`, `~/.gnupg`, ...) cannot be shared even with `--share-ro/--share-rw`.
 - Linux needs `sudo apt install bubblewrap`. Ubuntu 24.04+ restricts unprivileged user namespaces; `doctor` explains the fix.
-- **Windows:** no sandbox yet. Use WSL2 (Debian/Ubuntu) to get the Linux one. Docker mode is on the roadmap.
-- **Verification status:** the argument/profile generation, mount safety, fail-closed behaviour and the egress bridge are
-  unit-tested, and a test proves in a real Linux network namespace that a process has no route to the host or internet and
-  can reach only allowlisted hosts through the bridge. **Not yet run against a real `bwrap` or on macOS** (neither was
-  available where this was built). Treat the first release as beta on those paths and run `lllanyard doctor` first.
+- **Windows:** no sandbox. Use WSL2 (Debian/Ubuntu) to get the Linux one.
+- **Beta.** The sandbox is tested in CI on Linux and macOS, but it is the newest part of LLLanyard. Run `lllanyard doctor`
+  first.
 
 Honest limits:
 
@@ -183,7 +181,7 @@ git; prompt-injected agents echoing their "key" (it is only a placeholder); runa
 
 **Does NOT protect against:** malicious code running *as your OS user*. A fully compromised agent that can run shell
 commands can ask the OS keychain for the key directly (macOS prompts; Windows and Linux generally do not). For
-untrusted agents, run the proxy under a separate OS user or on another machine (the planned self-hosted shared proxy).
+untrusted agents, run the proxy under a separate OS user or on another machine (see [Sharing with a team](#sharing-with-a-team-pro)).
 
 Built-in hardening:
 - Zero runtime dependencies in the proxy (Node built-ins only); the only native dependency is `@napi-rs/keyring`.
@@ -211,10 +209,10 @@ Keys that sat in plaintext should be treated as exposed: after `scan --import`,
 - **Debian/Ubuntu:** needs a Secret Service: `sudo apt install gnome-keyring libsecret-1-0`, inside a desktop/D-Bus session.
   Headless servers are not supported yet.
 
-## Tiers (planned)
+## Tiers
 
-Free: up to 10 keys, local only. Pro: shared directories via a self-hosted shared proxy (keys stay on the host's keychain)
-and later an end-to-end-encrypted cloud option, plus dashboard, rotation assistant and local-LLM helper.
+Free: up to 10 keys and 5 agent tokens, local only. Pro and Team ([pricing](https://lllanyard.app/pricing)) raise the key
+limit and add the shared proxy for a team and the usage dashboard.
 
 ### Desktop app and rotation assistant
 
@@ -231,7 +229,6 @@ tokens, usage, proxy start/stop, license, and the **rotation assistant**.
   nonce. All text is inserted with `textContent`, never as HTML.
 - Honest limits: any program running as your user could still read the session secret from the process list or the printed
   link, as it could read your keychain; this protects against web pages and other websites, not against local malware.
-  The Tauri shell has not been compiled yet (see `apps/desktop/README.md`).
 
 ### MCP server for agents
 
@@ -267,7 +264,7 @@ Teammates point their tools at `https://keys.example.com:3443/openai/v1` and use
 | Per-person scope | Each token is limited to a client (`--client`), optionally to providers, and can expire (`--expires`) |
 | Audit trail | Every request is logged with agent name and caller address; `lllanyard usage` breaks it down by agent and client |
 | Rate limits + kill switch | Per token, as before |
-| Seats | Free: 5 agent tokens. Licensed: 3 tokens per seat (`AGENTS_PER_SEAT`, a pricing hypothesis) |
+| Seats | Free: 5 agent tokens. Licensed: 3 tokens per seat |
 
 Put it behind a VPN (Tailscale, WireGuard) or a firewall if you can; the lockout and TLS are a second layer, not a reason to
 expose it to the whole internet. `X-Forwarded-For` is deliberately ignored, so a reverse proxy in front shows as one address.
@@ -285,8 +282,8 @@ lllanyard add openai --stdin < key.txt && lllanyard serve --host 0.0.0.0 ...
 
 On a terminal with no passphrase file you are prompted instead (hidden). Under systemd use `LoadCredential=` and point
 `LLLANYARD_VAULT_PASSPHRASE_FILE` at `$CREDENTIALS_DIRECTORY/pass`. Honest limit: it protects the vault at rest (backups,
-disk images, other users); someone who can read both the vault and the passphrase file as your user can open it. For
-stronger custody use a cloud KMS or a hardware token, a later step. Changing the passphrase is not implemented yet.
+disk images, other users); someone who can read both the vault and the passphrase file as your user can open it. The
+passphrase can't be changed once the vault is created.
 
 ### Usage and dashboard
 
@@ -316,13 +313,8 @@ this off; each renewed key is also emailed.
 Pro lifts the key cap to 250, Team to 500 (`TIER_LIMITS` in `packages/core/src/license.ts`). An expired license drops
 back to free: existing keys keep working, you just can't add past the free cap.
 
-**Vendor setup (once):** `node tools/issue-license.mjs gen-keys ~/lly-keys` creates a keypair; paste the public key into
-`LICENSE_PUBLIC_KEY`, keep the private key offline. Issue a customer license with
-`node tools/issue-license.mjs issue --key ~/lly-keys/license-private.pem --tier pro --days 365 --sub order-123`.
-Until `LICENSE_PUBLIC_KEY` is set, no license validates.
-
-**Honest limit:** a local check can be patched in private. The BSL license (see License) forbids it and makes such use
-unlicensed, but the features worth paying for (shared proxy, cloud sync) should also live where a local patch can't reach.
+**Honest limit:** a local check can be patched in private. The license (see License) forbids it and makes such use
+unlicensed.
 
 ## License
 
@@ -337,42 +329,16 @@ In plain words (the license text is what counts):
 - You may not resell it as a hosted/embedded competing product.
 - Each version converts to Apache 2.0 four years after its release.
 
-The Business Source License is a *licence*, not technical protection: it makes patching out the checks a breach (a legal and
-commercial remedy), but cannot physically stop someone doing it in private. Keep the genuinely valuable features (shared
-proxy operations, cloud sync, support, updates) where only you can provide them.
-
-Before publishing: fill in the licensing contact email in `LICENSE.md`, and have a lawyer review the **Additional Use Grant**
-(it is my drafting, not boilerplate) and the Change License choice. The BSL body text was taken from a published BSL 1.1 copy
-(HashiCorp's) because the official page was unreachable; compare it with mariadb.com/bsl11, which also includes a
-"Covenants of Licensor" section you should keep if you use the name "Business Source License". PolyForm Shield and
-Noncommercial texts remain in `docs/license-options/` as alternatives; note Shield does **not** forbid patching out checks.
+Licensing questions: sales@lllanyard.co.uk.
 
 ## Verifying on your machine
 
 `node tools/smoke.mjs` (add `--keychain` to also test your real OS keychain once) runs the real CLI, proxy, UI and MCP server
-against a throwaway vault and prints PASS/FAIL plus a one-line report for bug reports. See `RELEASING.md` for the full
-pre-launch checklist.
+against a throwaway vault and prints PASS/FAIL plus a one-line report for bug reports.
 
 ## Tests
 
-`npm test` (tsx + node:test, 109 tests): storage, tokens, scanner/redaction, rotation, provider and tool validation, the output
-scrubber (split chunks, base64/hex/URL forms), the `run` engine with real child processes (minimal environment, leak warning
-and kill, egress wiring), the egress proxy (allow/deny, auth, private-address blocking), and 15 proxy integration tests
-against a fake upstream (key injection, SSE streaming, redirects, Host/Origin checks, path tricks, rate limit, SSRF guard,
-agent scoping, log hygiene). A manual end-to-end pass of the CLI, a custom provider and the live proxy also succeeded using
-a file-backed stand-in for the keychain.
-CI (`.github/workflows/ci.yml`) runs the suite on Linux, macOS and Windows with Node 22 and 24, installs bubblewrap on Linux so
-the real-sandbox test runs, and does a full type-check and `npm audit`. Not covered locally: real keychains on each OS, real provider endpoints, and the Windows shell path for `npx` (logic is unit-tested
-with a simulated platform, not on Windows).
-
-## Roadmap
-
-1. Compile and sign the Tauri app; bundle Node as a sidecar so no separate install is needed.
-2. E2E-encrypted cloud sync; vault passphrase change; KMS/hardware-token vault backends.
-3. Docker sandbox mode (Windows).
-4. Auto-rotation via provider admin APIs. Honeytoken keys need a hosted callback service, so they belong in a paid cloud tier.
-
-## Naming
-
-The name is a placeholder pending a trademark check. To rename: edit `packages/core/src/constants.ts` and the `@lllanyard`
-package scope. Changing `SERVICE` orphans keys already stored under the old name.
+`npm test` runs the suite (tsx + node:test): storage, tokens, scanner and redaction, rotation, provider and tool validation,
+the output scrubber, the `run` engine with real child processes, the egress proxy, the sandbox, and proxy integration tests
+against a fake upstream. CI (`.github/workflows/ci.yml`) runs it on Linux, macOS and Windows with Node 22 and 24, with a full
+type-check and `npm audit`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lllanyard/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Keep API keys out of AI agents: keys live in your OS keychain and agents only see placeholder tokens.",
   "type": "module",
   "bin": {
@@ -10,9 +10,9 @@
     "dist"
   ],
   "dependencies": {
-    "@lllanyard/core": "^0.1.0",
-    "@lllanyard/proxy": "^0.1.0",
-    "@lllanyard/ui": "^0.1.0"
+    "@lllanyard/core": "^0.1.1",
+    "@lllanyard/proxy": "^0.1.1",
+    "@lllanyard/ui": "^0.1.1"
   },
   "license": "BUSL-1.1",
   "engines": {