@rafter-security/cli 0.7.0 → 0.7.1

package/README.md

@@ -59,20 +59,39 @@ rafter usage
 ```bash
 # Initialize local security
 rafter agent init
+rafter agent init --local              # write config to ./.rafter (ephemeral/benchmark)
+
+# Granular per-component control
+rafter agent list
+rafter agent enable claude-code
+rafter agent disable gemini
 
 # Scan files for secrets
 rafter agent scan .
+rafter agent scan --history            # full git history (gitleaks engine)
 
 # Execute commands safely
 rafter agent exec "git commit -m 'Add feature'"
 
-# View audit logs
+# View audit logs (tamper-evident hash chain)
 rafter agent audit
+rafter agent audit --verify            # verify chain; exit 1 if tampered
 
 # Manage configuration
 rafter agent config show
 ```
 
+### Skills
+
+Four first-party skills ship with the CLI: `rafter` (CYOA router), `rafter-code-review`, `rafter-secure-design`, `rafter-skill-review`.
+
+```bash
+rafter skill list                              # installed + available
+rafter skill install --all                     # install all four
+rafter skill review github:owner/repo          # audit a third-party skill before install
+rafter skill review --installed                # audit every skill already on disk
+```
+
 ## Global Options
 
 | Flag | Description |

package/dist/commands/agent/audit-skill.js

@@ -7,11 +7,12 @@ import { SkillManager } from "../../utils/skill-manager.js";
 import { fmt } from "../../utils/formatter.js";
 export function createAuditSkillCommand() {
     return new Command("audit-skill")
-        .description("Security audit of a Claude Code skill file")
+        .description("[deprecated] Security audit of a Claude Code skill file — use `rafter skill review` instead")
         .argument("<skill-path>", "Path to skill file to audit")
         .option("--skip-openclaw", "Skip OpenClaw integration, show manual review prompt")
         .option("--json", "Output results as JSON")
         .action(async (skillPath, opts) => {
+        process.stderr.write("[deprecated] `rafter agent audit-skill` is deprecated; use `rafter skill review <path-or-url>` instead.\n");
         await auditSkill(skillPath, opts);
     });
 }

package/dist/commands/agent/audit.js

@@ -13,13 +13,28 @@ export function createAuditCommand() {
         .option("--event <type>", "Filter by event type")
         .option("--agent <type>", "Filter by agent type (openclaw, claude-code)")
         .option("--since <date>", "Show entries since date (YYYY-MM-DD)")
+        .option("--repo <pattern>", "Filter by git repo path (substring match)")
+        .option("--cwd <pattern>", "Filter by working directory (substring match)")
         .option("--share", "Generate a redacted excerpt for issue reports")
+        .option("--verify", "Verify the audit log hash chain and report tampering")
         .action((opts) => {
         if (opts.share) {
             generateShareExcerpt();
             return;
         }
         const logger = new AuditLogger();
+        if (opts.verify) {
+            const breaks = logger.verify();
+            if (breaks.length === 0) {
+                console.log("✓ Audit log hash chain intact");
+                return;
+            }
+            console.error(`✗ Audit log hash chain broken (${breaks.length} break${breaks.length === 1 ? "" : "s"}):`);
+            for (const b of breaks) {
+                console.error(`  line ${b.line}: ${b.reason}`);
+            }
+            process.exit(1);
+        }
         const filter = {
             limit: parseInt(opts.last, 10)
         };
@@ -32,6 +47,12 @@ export function createAuditCommand() {
         if (opts.since) {
             filter.since = new Date(opts.since);
         }
+        if (opts.repo) {
+            filter.gitRepo = opts.repo;
+        }
+        if (opts.cwd) {
+            filter.cwd = opts.cwd;
+        }
         const entries = logger.read(filter);
         if (entries.length === 0) {
             console.log("No audit log entries found");
@@ -46,6 +67,12 @@ export function createAuditCommand() {
             if (entry.agentType) {
                 console.log(`   Agent: ${entry.agentType}`);
             }
+            if (entry.gitRepo) {
+                console.log(`   Repo: ${entry.gitRepo}`);
+            }
+            else if (entry.cwd) {
+                console.log(`   Cwd: ${entry.cwd}`);
+            }
             if (entry.action?.command) {
                 console.log(`   Command: ${entry.action.command}`);
             }