@mnemom/mnemom 0.10.0 → 0.12.0

package/dist/index.js

@@ -10,10 +10,13 @@ import { protectionShowCommand, protectionPublishCommand, protectionValidateComm
 import { agentsListCommand } from "./commands/agents.js";
 import { orgListCommand, orgShowCommand } from "./commands/org.js";
 import { teamListCommand, teamShowCommand, teamTemplateCommand, teamPreviewComposeCommand, teamAdminGrantCommand, teamAdminRevokeCommand, teamAdminListCommand, teamCoverageCommand, } from "./commands/team.js";
-import { advisoriesListCommand, advisoriesShowCommand, } from "./commands/advisories.js";
+import { advisoriesListCommand, advisoriesShowCommand } from "./commands/advisories.js";
 import { postureListCommand, postureShowCommand, postureCreateCommand, postureUpdateCommand, postureCloneCommand, postureRevisionsCommand, postureDiffCommand, postureAssignCommand, postureUnassignCommand, posturePreviewComposeCommand, postureDeleteCommand, } from "./commands/posture.js";
 import { loginCommand, logoutCommand, whoamiCommand } from "./commands/auth.js";
 import { validateSafeHouseCommand } from "./commands/validate.js";
+import { apiKeyListCommand, apiKeyCreateCommand, apiKeyRotateCommand, apiKeyRevokeCommand, } from "./commands/api-key.js";
+import { webhooksListCommand, webhooksGetCommand, webhooksCreateCommand, webhooksUpdateCommand, webhooksDeleteCommand, webhooksRotateSecretCommand, webhooksTriggerCommand, webhooksListDeliveriesCommand, webhooksRedeliverCommand, webhooksReplayCommand, } from "./commands/webhooks.js";
+import { listenCommand } from "./commands/listen.js";
 program
     .name("mnemom")
     .description("Transparent AI agent tracing")
@@ -521,6 +524,212 @@ advisoriesCmd
     }
 });
 // ============================================================================
+// Governance signals (ADR-048) — operator-actionable observation surface
+//
+// Distinct from `mnemom advisories list` (which now narrows to runtime.* /
+// manual.* per ADR-048 §1). Surfaces sideband.* + future protection.* /
+// posture.* signals from governance_signals: ack/resolve/dismiss workflow,
+// notification destinations (slack/email/pagerduty/webhook), escalation
+// rules.
+// ============================================================================
+import { governanceSignalsListCommand, governanceSignalsShowCommand, governanceSignalsAckCommand, governanceSignalsResolveCommand, governanceSignalsDismissCommand, governanceDestinationsListCommand, governanceDestinationsAddCommand, governanceDestinationsRemoveCommand, governanceDestinationsTestCommand, governanceRulesListCommand, governanceRulesAddCommand, governanceRulesRemoveCommand, } from "./commands/governance.js";
+const governanceCmd = program
+    .command("governance")
+    .description("Operator workflow for governance_signals (ADR-048)");
+const govSignalsCmd = governanceCmd
+    .command("signals")
+    .description("List, inspect, and transition governance_signals");
+govSignalsCmd
+    .command("list")
+    .description("List governance signals at platform/org/team/agent scope")
+    .option("--org <id>", "Org scope")
+    .option("--team <id>", "Team scope")
+    .option("--agent <id>", "Per-agent slice (signals affecting this agent)")
+    .option("--source <s>", "Filter by source (sideband.{drift,coherence,fault_line,fleet})")
+    .option("--severity <s>", "Filter by severity (info|warn|high|critical)")
+    .option("--status <s>", "Filter by status (open|acknowledged|resolved|dismissed|expired)")
+    .option("--scope <s>", "Filter by scope (platform|org|team|agent)")
+    .option("--pattern-type <s>", "Filter by pattern_type")
+    .option("--since <iso>", "Detected since (ISO timestamp)")
+    .option("--limit <n>", "Max rows (default 100, max 500)")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceSignalsListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("show <signal_id>")
+    .description("Show one signal in detail")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsShowCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("ack <signal_id>")
+    .description("Acknowledge an open signal (org_admin / org_owner)")
+    .option("--action <text>", "Operator-authored action note")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsAckCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("resolve <signal_id>")
+    .description("Resolve a signal with a resolution status")
+    .requiredOption("--status <s>", "Resolution status (action_taken|wont_fix|duplicate|false_positive|self_resolved)")
+    .option("--action <text>", "Operator-authored action note")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsResolveCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("dismiss <signal_id>")
+    .description("Dismiss a signal as not actionable")
+    .option("--reason <text>", "Operator-authored dismissal reason")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsDismissCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+const govDestCmd = governanceCmd
+    .command("destinations")
+    .description("Manage notification destinations (slack/email/pagerduty/webhook)");
+govDestCmd
+    .command("list")
+    .description("List destinations for an org")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceDestinationsListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govDestCmd
+    .command("add")
+    .description("Add a destination (channel + JSON config)")
+    .requiredOption("--org <id>", "Org ID")
+    .requiredOption("--channel <c>", "webhook|slack|email|pagerduty")
+    .requiredOption("--config <json>", 'Channel config (e.g., \'{"url":"...","signing_secret":"..."}\')')
+    .option("--name <n>", "Display name")
+    .option("--filter <json>", "Filter narrowing (sources/severities/etc)")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceDestinationsAddCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govDestCmd
+    .command("remove <destination_id>")
+    .description("Remove a destination")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (id, options) => {
+    try {
+        await governanceDestinationsRemoveCommand(id, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govDestCmd
+    .command("test <destination_id>")
+    .description("Send a synthetic test signal through this destination")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (id, options) => {
+    try {
+        await governanceDestinationsTestCommand(id, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+const govRulesCmd = governanceCmd
+    .command("rules")
+    .description("Manage escalation rules (predicate → destinations)");
+govRulesCmd
+    .command("list")
+    .description("List escalation rules for an org")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceRulesListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govRulesCmd
+    .command("add")
+    .description("Add an escalation rule (predicate JSON + destination IDs)")
+    .requiredOption("--org <id>", "Org ID")
+    .requiredOption("--name <n>", "Rule name")
+    .requiredOption("--predicate <json>", 'Predicate JSON (e.g., \'{"source":"sideband.fleet","severity_min":"high"}\')')
+    .requiredOption("--destinations <ids>", "Comma-separated destination IDs")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceRulesAddCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govRulesCmd
+    .command("remove <rule_id>")
+    .description("Remove an escalation rule")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (id, options) => {
+    try {
+        await governanceRulesRemoveCommand(id, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
 // Trust Posture (Piece 3 of T1-3.1, ADR-045)
 //
 // Postures are team-scoped policy input that drives the observer's sideband
@@ -764,4 +973,283 @@ validateCmd
         process.exit(1);
     }
 });
+// ── api-key (ADR-049 capability-based scopes) ────────────────────────────
+const apiKeyCmd = program
+    .command("api-key")
+    .description("Manage personal API keys (capability-based scopes — ADR-049)");
+apiKeyCmd
+    .command("list")
+    .description("List your active personal API keys with their scope sets")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (options) => {
+    try {
+        await apiKeyListCommand({ json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+apiKeyCmd
+    .command("create")
+    .description("Mint a new personal API key. Default scopes: gateway, api:read, api:write. " +
+    "Admin scopes (admin:org, admin:platform) are role-gated at mint time.")
+    .requiredOption("--name <name>", "Friendly name for the key (e.g. 'ci-prod')")
+    .option("--scopes <list>", "Comma-separated capability scopes. Valid: " +
+    "gateway, api:read, api:write, admin:org, admin:platform. " +
+    "Default: gateway,api:read,api:write")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (options) => {
+    try {
+        await apiKeyCreateCommand({
+            name: options.name,
+            scopes: options.scopes,
+            json: options.json,
+        });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+apiKeyCmd
+    .command("rotate <key_id>")
+    .description("Atomic mint-new + revoke-old. Returns the new cleartext once.")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (keyId, options) => {
+    try {
+        await apiKeyRotateCommand(keyId, { json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+apiKeyCmd
+    .command("revoke <key_id>")
+    .description("Soft-revoke an active key. Action is immediate and irreversible.")
+    .action(async (keyId) => {
+    try {
+        await apiKeyRevokeCommand(keyId);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Webhook lifecycle commands (Track 2 W3.5)
+// ============================================================================
+const webhooksCmd = program
+    .command("webhooks")
+    .description("Manage webhook endpoints, deliveries, and event replay");
+webhooksCmd
+    .command("list <org_id>")
+    .description("List webhook endpoints for an org")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, options) => {
+    try {
+        await webhooksListCommand(orgId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("get <org_id> <endpoint_id>")
+    .description("Show details for a single webhook endpoint")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, endpointId, options) => {
+    try {
+        await webhooksGetCommand(orgId, endpointId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("create <org_id>")
+    .description("Create a new webhook endpoint (signing secret returned ONCE)")
+    .requiredOption("--url <url>", "HTTPS URL to deliver events to (private/internal IPs blocked)")
+    .option("--events <list>", "Comma-separated list of event types to subscribe to (default: none — explicit per-event opt-in)")
+    .option("--description <text>", "Human-readable description")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, options) => {
+    try {
+        await webhooksCreateCommand(orgId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("update <org_id> <endpoint_id>")
+    .description("Update fields on an existing webhook endpoint")
+    .option("--url <url>", "Replace the delivery URL")
+    .option("--events <list>", "Replace the event-type subscription list (comma-separated)")
+    .option("--description <text>", "Replace the description")
+    .option("--active <bool>", "Set is_active to 'true' or 'false' (re-enabling resets failure counter)")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, endpointId, options) => {
+    try {
+        await webhooksUpdateCommand(orgId, endpointId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("delete <org_id> <endpoint_id>")
+    .description("Permanently delete a webhook endpoint")
+    .action(async (orgId, endpointId) => {
+    try {
+        await webhooksDeleteCommand(orgId, endpointId);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("rotate-secret <org_id> <endpoint_id>")
+    .description("Mint a new signing secret (shown ONCE; immediately invalidates the previous secret)")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, endpointId, options) => {
+    try {
+        await webhooksRotateSecretCommand(orgId, endpointId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("trigger <org_id> <endpoint_id>")
+    .description("Fire a synthetic test event through the full delivery pipeline (Stripe-equivalent ergonomics)")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, endpointId, options) => {
+    try {
+        await webhooksTriggerCommand(orgId, endpointId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("list-deliveries <org_id>")
+    .description("List recent webhook deliveries (optionally scoped to one endpoint)")
+    .option("--endpoint <endpoint_id>", "Scope to a single endpoint")
+    .option("--limit <n>", "Maximum entries to return (default 50, max 100)")
+    .option("--offset <n>", "Skip the first N entries (pagination)")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, options) => {
+    try {
+        await webhooksListDeliveriesCommand(orgId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("redeliver <org_id> <delivery_id>")
+    .description("Retry a single previous delivery (re-fires that one delivery row)")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, deliveryId, options) => {
+    try {
+        await webhooksRedeliverCommand(orgId, deliveryId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+webhooksCmd
+    .command("replay <org_id> <event_id>")
+    .description("Re-fan-out a historical event to all currently-subscribed endpoints (or to a specified subset)")
+    .option("--endpoint <endpoint_id>", "Only replay to the specified endpoint (repeatable)", (value, prev) => (prev ? [...prev, value] : [value]))
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (orgId, eventId, options) => {
+    try {
+        await webhooksReplayCommand(orgId, eventId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// mnemom listen — live webhook event stream (Track 2 W3.4)
+// ============================================================================
+program
+    .command("listen <org_id>")
+    .description("Stream live webhook events for an org (Stripe-equivalent ergonomics)")
+    .option("--forward-to <url>", "POST each event to this local URL (requires --secret for HMAC re-signing)")
+    .option("--secret <hex>", "Local signing secret used to re-sign forwarded deliveries")
+    .option("--filter <list>", "Comma-separated event types to surface (default: all)")
+    .option("--since <event_id>", "Resume from this cursor on first connect")
+    .option("--json", "Emit raw JSON lines instead of a formatted summary")
+    .action(async (orgId, options) => {
+    try {
+        await listenCommand(orgId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// AEGIS-6b — Customer FN/FP recipe report commands.
+//
+// `mnemom recipes report-fn <recipe-id>` / `mnemom recipes report-fp <id>`
+// POST to /v1/recipes/:id/report (AEGIS-6a; mnemom-api#508). The endpoint
+// requires customer-session auth (JWT cookie/bearer or API key) and a
+// non-empty summary; the CLI accepts the summary as `--summary` or via
+// stdin. Idempotency-Key is generated per call by postApi(); the body
+// fingerprint is folded server-side so a retry with corrected text returns
+// 422 rather than silently replaying.
+// ============================================================================
+import { recipesReportFnCommand, recipesReportFpCommand, } from "./commands/recipes.js";
+const recipesCmd = program
+    .command("recipes")
+    .description("Customer-side recipe reporting (false-negatives, false-positives)");
+recipesCmd
+    .command("report-fn <recipe-id>")
+    .description("File a false-negative report against an existing recipe (something got through that the recipe should have caught)")
+    .option("--summary <text>", "Human-readable description of what happened (required; pipe via stdin alternatively)")
+    .option("--evidence <text>", "Optional raw payload / log excerpt")
+    .option("--agent <id>", "Optional. Your agent id when the report concerns a specific agent")
+    .option("--checkpoint <id>", "Optional. Related integrity_checkpoints id (helps the reviewer correlate)")
+    .option("--json", "Output JSON")
+    .action(async (recipeId, options) => {
+    try {
+        await recipesReportFnCommand(recipeId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+recipesCmd
+    .command("report-fp <recipe-id>")
+    .description("File a false-positive report against an existing recipe (the recipe fired on legitimate behaviour)")
+    .option("--summary <text>", "Human-readable description of what happened (required; pipe via stdin alternatively)")
+    .option("--evidence <text>", "Optional raw payload / log excerpt")
+    .option("--agent <id>", "Optional. Your agent id when the report concerns a specific agent")
+    .option("--checkpoint <id>", "Optional. Related integrity_checkpoints id (helps the reviewer correlate)")
+    .option("--json", "Output JSON")
+    .action(async (recipeId, options) => {
+    try {
+        await recipesReportFpCommand(recipeId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
 program.parse();