@shomra/agent 0.3.17 → 0.3.18

package/src/commands/plan.mjs

@@ -0,0 +1,87 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { gateMachine } from '../core/api-client.mjs';
+import { loadConfig, resolveSettings } from '../core/config.mjs';
+import { EXIT_USAGE } from '../core/exit-codes.mjs';
+import { bold, dim, red, yellow } from '../core/terminal.mjs';
+import { CAP_LABEL, analyzeDesign } from '../detect/design.mjs';
+import { detectEnv } from '../gate/environment.mjs';
+import { emitGuardAsk } from '../guard/emit.mjs';
+import { envFlag, resolveAgentFlag } from '../guard/options.mjs';
+import { reportGuardDecision } from '../guard/report.mjs';
+
+function planAdvice(r, { maxControls = 5 } = {}) {
+  if (r.verdict !== 'OPEN_PATH') return null;
+  const worst = r.paths.filter((p) => p.severity === r.worst).slice(0, 3);
+  const lines = [
+    `[Shomra] This plan closes ${r.paths.length} attack path${r.paths.length === 1 ? '' : 's'}. Build the guarded version now - it is far cheaper than retrofitting it:`,
+  ];
+  for (const p of worst) lines.push(`- ${p.severity}: ${CAP_LABEL[p.source]} reaches ${CAP_LABEL[p.sink]}. ${p.story}`);
+  lines.push('Satisfy these as you implement:');
+  for (const c of r.controls.slice(0, maxControls)) lines.push(`- ${c.text}`);
+  lines.push('If the plan does not actually involve one of these, say so and continue - this reads your plan text, not your intent.');
+  return lines.join('\n');
+}
+
+export async function cmdPlan(flags, positional) {
+  const target = positional[0] || flags.path;
+  if (!target) {
+    console.error(red('✗') + ' Usage: ' + bold('shomra plan <file|->') + dim('  (use - to pipe the plan on stdin)'));
+    process.exit(EXIT_USAGE);
+  }
+  let text;
+  if (target === '-' || flags.stdin) text = fs.readFileSync(0, 'utf8');
+  else {
+    const abs = path.resolve(String(target));
+    if (!fs.existsSync(abs)) { console.error(red('✗') + ` Not found: ${target}`); process.exit(EXIT_USAGE); }
+    text = fs.readFileSync(abs, 'utf8');
+  }
+
+  const r = analyzeDesign(text, { name: typeof target === 'string' ? String(target) : 'plan' });
+  const advice = planAdvice(r);
+
+  if (flags.json) console.log(JSON.stringify({ verdict: r.verdict, worst: r.worst, paths: r.paths, controls: r.controls, advice }, null, 2));
+  else if (advice) console.log('\n' + advice + '\n');
+  else console.log('\n  ' + yellow('• No closed attack path in this plan text.') + dim(' Not a clearance - it reads the plan, not the code you will write.\n'));
+
+  if (r.worst === 'CRITICAL') process.exitCode = 1;
+  else if (r.verdict === 'OPEN_PATH' && flags.strict) process.exitCode = 2;
+}
+
+export async function cmdPlanGuard(flags) {
+  const agent = resolveAgentFlag(flags);
+  if (envFlag('SHOMRA_PLAN_GUARD_OFF')) process.exit(0);
+
+  let payload = {};
+  try { payload = JSON.parse(fs.readFileSync(0, 'utf8') || '{}'); } catch { process.exit(0); }
+
+  const input = payload.tool_input ?? payload.input ?? payload.arguments ?? payload;
+  const text = [input.plan, input.content, input.text, input.message, payload.plan]
+    .find((v) => typeof v === 'string' && v.trim().length > 40);
+  if (!text) process.exit(0);
+
+  const r = analyzeDesign(text, { name: 'plan' });
+  const advice = planAdvice(r);
+  if (!advice) process.exit(0);
+
+  const { apiKey, url } = resolveSettings(loadConfig());
+  await reportGuardDecision(url, apiKey, null, {
+    tool_name: 'PlanSubmit',
+    tool_input: { plan: text.slice(0, 4000) },
+    cwd: payload.cwd,
+    session_id: payload.session_id,
+    machine: gateMachine(),
+    env: detectEnv(),
+    agent,
+    client_decision: 'FLAG',
+    client_reason: `plan closes ${r.paths.length} attack path(s); worst ${r.worst}`,
+  });
+
+  if (r.worst === 'CRITICAL' && envFlag('SHOMRA_GUARD_STRICT')) {
+    emitGuardAsk(agent, advice);
+  }
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: advice },
+  }));
+  process.exit(0);
+}

package/src/commands/pr.mjs

@@ -0,0 +1,249 @@
+import { execSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { ARTIFACT_MATCHERS, walkArtifacts } from '../artifacts/matchers.mjs';
+import { loadConfig, resolveSettings } from '../core/config.mjs';
+import { EXIT_USAGE } from '../core/exit-codes.mjs';
+import { bold, cyan, dim, green, red, yellow } from '../core/terminal.mjs';
+import { gateArtifactList } from '../gate/batch.mjs';
+import { detectEnv } from '../gate/environment.mjs';
+import { toSarif } from '../gate/sarif.mjs';
+
+const PR_WORKFLOW = `name: Shomra AI Security
+on: pull_request
+permissions:
+  contents: read
+  checks: write
+jobs:
+  shomra:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }   # full history so the PR diff resolves
+      - uses: actions/setup-node@v4
+        with: { node-version: 20 }
+      - run: npx @shomra/agent pr
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          SHOMRA_API_KEY: \${{ secrets.SHOMRA_API_KEY }}   # optional - applies org policy
+          SHOMRA_URL: \${{ secrets.SHOMRA_URL }}           # optional - your backend
+`;
+
+function readGithubEvent() {
+  try { return JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8')); } catch { return {}; }
+}
+
+async function githubApi(token, method, apiPath, body) {
+  const res = await fetch(`https://api.github.com${apiPath}`, {
+    method,
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28', 'Content-Type': 'application/json', 'User-Agent': 'shomra-agent' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!res.ok) throw new Error(`GitHub ${method} ${apiPath} → ${res.status} ${(await res.text()).slice(0, 200)}`);
+  return res.json();
+}
+
+function gitChangedVsBase(root, base) {
+  const run = (args) => { try { return execSync(`git ${args}`, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString(); } catch { return null; } };
+  let out = null;
+  for (const b of [`origin/${base}`, base]) {
+    out = run(`diff --name-only --relative --diff-filter=ACM ${b}...HEAD`);
+    if (out !== null) break;
+  }
+  if (out === null) out = run('diff HEAD~1 --name-only --relative --diff-filter=ACM');
+  if (out === null) return null;
+  const files = out.split('\n').map((s) => s.trim()).filter(Boolean);
+  return files.filter((rel) => ARTIFACT_MATCHERS.some((m) => m.re.test(rel)));
+}
+
+const GH_LEVEL = { CRITICAL: 'failure', HIGH: 'failure', MEDIUM: 'warning', LOW: 'notice', INFO: 'notice' };
+
+const CHECK_RUN_NAME = 'Shomra AI Security';
+const MAX_ANNOTATIONS = 50;
+
+function writeWorkflow(flags) {
+  const workflow = path.resolve('.github/workflows/shomra.yml');
+  if (fs.existsSync(workflow) && !flags.force) {
+    console.error(`${red('✗')} ${path.relative(process.cwd(), workflow)} exists. Use ${bold('--force')}.`);
+    process.exit(EXIT_USAGE);
+  }
+  fs.mkdirSync(path.dirname(workflow), { recursive: true });
+  fs.writeFileSync(workflow, PR_WORKFLOW);
+  console.log(`\n  ${green('✓ Wrote')} ${bold('.github/workflows/shomra.yml')} ${dim('- commit it; PRs will get an inline Shomra review.')}`);
+  console.log(`${dim('  Optional: add ') + bold('SHOMRA_API_KEY') + dim(' as a repo secret to also apply org policy.')}\n`);
+}
+
+function headShaFromGit() {
+  try {
+    return execSync('git rev-parse HEAD', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+  } catch {
+    return null;
+  }
+}
+
+function resolvePrContext(flags) {
+  const event = readGithubEvent();
+  const context = {
+    repo: flags.repo || process.env.GITHUB_REPOSITORY,
+    token: flags.token || process.env.SHOMRA_GH_TOKEN || process.env.GITHUB_TOKEN,
+    base: flags.base || process.env.GITHUB_BASE_REF || event.pull_request?.base?.ref || 'main',
+    headSha: flags.sha || event.pull_request?.head?.sha || process.env.GITHUB_SHA || headShaFromGit(),
+    prNumber: flags.pr || event.pull_request?.number || (String(process.env.GITHUB_REF || '').match(/refs\/pull\/(\d+)\//) || [])[1],
+    root: path.resolve(flags.path || '.'),
+    dryRun: !!flags['dry-run'],
+  };
+
+  if (!context.repo || !context.headSha) {
+    console.error(`${red('✗')} Not in a GitHub PR context (need GITHUB_REPOSITORY + a head sha). Pass --repo / --sha, or use --dry-run.`);
+    process.exit(EXIT_USAGE);
+  }
+  if (!context.token && !context.dryRun) {
+    console.error(`${red('✗')} No GitHub token. Set GITHUB_TOKEN (CI) or --token, or preview with --dry-run.`);
+    process.exit(EXIT_USAGE);
+  }
+  return context;
+}
+
+function emitSarif(flags, results) {
+  if (!flags.sarif) return;
+  const sarif = JSON.stringify(toSarif(results), null, 2);
+  if (typeof flags.sarif === 'string') {
+    fs.writeFileSync(path.resolve(String(flags.sarif)), sarif);
+    if (!flags.json) console.error(dim(`  SARIF written → ${flags.sarif}`));
+    return;
+  }
+  console.log(sarif);
+}
+
+function buildAnnotations(results) {
+  const annotations = [];
+  for (const result of results) {
+    for (const finding of result.findings || []) {
+      annotations.push({
+        path: finding.file || result.path,
+        start_line: finding.line || 1,
+        end_line: finding.line || 1,
+        annotation_level: GH_LEVEL[finding.severity] || 'warning',
+        title: `${finding.severity}: ${result.kind}`,
+        message: [
+          finding.title,
+          finding.remediationText ? `Fix: ${finding.remediationText}` : '',
+          `Run \`shomra fix ${result.path}\` to remediate.`,
+        ].filter(Boolean).join('\n'),
+      });
+    }
+  }
+  return annotations;
+}
+
+function checkRunConclusion(blocked, flagged, strict) {
+  if (blocked) return 'failure';
+  if (flagged) return strict ? 'failure' : 'neutral';
+  return 'success';
+}
+
+function checkRunSummary({ results, annotations, blocked, flagged, suppressed }) {
+  const headline = blocked ? `**${blocked} blocked**` : flagged ? `**${flagged} flagged**` : '**All clear**';
+  const suppressedNote = suppressed ? ` · ${suppressed} suppressed` : '';
+  return [
+    headline,
+    `· ${results.length} artifact(s) changed · ${annotations.length} finding(s)${suppressedNote}`,
+    '',
+    '| Artifact | Kind | Verdict | Findings |',
+    '| --- | --- | --- | --- |',
+    ...results.map((r) => `| \`${r.path}\` | ${r.kind} | ${r.decision} | ${(r.findings || []).length} |`),
+    annotations.length > MAX_ANNOTATIONS ? `\n_Showing first ${MAX_ANNOTATIONS} of ${annotations.length} annotations._` : '',
+  ].join('\n');
+}
+
+function buildCheckRun({ headSha, results, annotations, blocked, flagged, suppressed, strict }) {
+  const verdict = blocked ? `${blocked} blocked` : flagged ? `${flagged} flagged` : 'Clean';
+  return {
+    name: CHECK_RUN_NAME,
+    head_sha: headSha,
+    status: 'completed',
+    conclusion: checkRunConclusion(blocked, flagged, strict),
+    output: {
+      title: `${verdict} - ${results.length} changed artifact(s)`,
+      summary: checkRunSummary({ results, annotations, blocked, flagged, suppressed }),
+      annotations: annotations.slice(0, MAX_ANNOTATIONS),
+    },
+  };
+}
+
+async function postCheckRun(token, repo, checkRun, flags) {
+  try {
+    const run = await githubApi(token, 'POST', `/repos/${repo}/check-runs`, checkRun);
+    if (flags.json) return;
+    const mark = checkRun.conclusion === 'failure' ? red('✗') : checkRun.conclusion === 'neutral' ? yellow('⚠') : green('✓');
+    console.log(`  ${mark} Check run posted → ${dim(run.html_url || '')}`);
+  } catch (error) {
+    console.error(`  ${yellow('⚠')} ${dim(`could not post check-run: ${error.message}`)}`);
+  }
+}
+
+async function reportNothingChanged({ flags, token, dryRun, repo, headSha }) {
+  emitSarif(flags, []);
+  if (!flags.json && flags.sarif !== true) console.log(green('\n  ✓ No AI artifacts changed in this PR.\n'));
+  if (!token || dryRun) return;
+
+  await githubApi(token, 'POST', `/repos/${repo}/check-runs`, {
+    name: CHECK_RUN_NAME,
+    head_sha: headSha,
+    status: 'completed',
+    conclusion: 'success',
+    output: {
+      title: 'No AI artifacts changed',
+      summary: 'No MCP configs, skills, rules, hooks or agent cards changed in this PR.',
+    },
+  }).catch((error) => console.error(dim(`  check-run: ${error.message}`)));
+}
+
+export async function cmdPr(flags, positional) {
+  if (flags.init) {
+    writeWorkflow(flags);
+    return;
+  }
+
+  const { apiKey, url } = resolveSettings(loadConfig());
+  const { repo, token, base, headSha, prNumber, root, dryRun } = resolvePrContext(flags);
+
+  const changed = gitChangedVsBase(root, base);
+  const allArtifacts = walkArtifacts(root);
+  const artifacts = changed === null
+    ? allArtifacts
+    : allArtifacts.filter((artifact) => new Set(changed).has(artifact.rel));
+
+  if (!artifacts.length) {
+    await reportNothingChanged({ flags, token, dryRun, repo, headSha });
+    return;
+  }
+
+  const { results, blocked, flagged, suppressed } = await gateArtifactList(artifacts, {
+    apiKey, url, root, env: detectEnv(), flags: { ...flags, json: true },
+  });
+  emitSarif(flags, results);
+
+  const annotations = buildAnnotations(results);
+  const checkRun = buildCheckRun({ headSha, results, annotations, blocked, flagged, suppressed, strict: flags.strict });
+
+  if (dryRun || flags.json) {
+    console.log(JSON.stringify({
+      repo,
+      prNumber: prNumber ?? null,
+      headSha,
+      base,
+      conclusion: checkRun.conclusion,
+      artifacts: results.length,
+      findings: annotations.length,
+      checkRun: dryRun ? checkRun : undefined,
+    }, null, 2));
+  } else if (flags.sarif !== true) {
+    console.log(bold(cyan('\n  Shomra pr')) + dim(` - ${repo} #${prNumber ?? '?'} · ${results.length} changed artifact(s) · ${annotations.length} finding(s)`));
+  }
+
+  if (token && !dryRun) await postCheckRun(token, repo, checkRun, flags);
+
+  if (blocked) process.exitCode = 1;
+  else if (flagged && flags.strict) process.exitCode = 2;
+}

package/src/commands/protect.mjs

@@ -0,0 +1,38 @@
+import { AGENT_INSTALLERS, AGENT_LABELS } from '../agents/installers.mjs';
+import { bold, cyan, dim, green, red, yellow } from '../core/terminal.mjs';
+import { discoverAll } from '../inventory/discovery.mjs';
+
+export function cmdProtect(flags) {
+  const assets = discoverAll();
+  const labelToKey = Object.fromEntries(Object.entries(AGENT_LABELS).map(([k, v]) => [v, k]));
+  const detected = assets
+    .filter((a) => a.type === 'AI_AGENT')
+    .map((a) => ({ label: a.name, key: labelToKey[a.name], guarded: !!a.metadata?.guarded }))
+    .filter((a) => a.key && AGENT_INSTALLERS[a.key]);
+
+  if (!detected.length) {
+    console.log(dim('\n  No supported coding agents detected on this machine.'));
+    console.log(dim('  Install one (Claude Code, Cursor, Gemini/Codex/Copilot CLI, Cline, Aider…) and re-run, or force all: ') + bold('shomra install-hook --agent all') + '\n');
+    return;
+  }
+
+  const global = !flags.local;
+  console.log(bold(cyan('\n  Shomra protect')) + dim(` - wiring the runtime firewall for ${detected.length} coding agent${detected.length > 1 ? 's' : ''} (${global ? 'machine-wide' : 'this repo'})`));
+  let wired = 0, already = 0;
+  for (const a of detected) {
+
+    try {
+      const { file, changed } = AGENT_INSTALLERS[a.key](global);
+      if (changed) { wired++; console.log(`  ${green('✓')} Protected ${bold(AGENT_LABELS[a.key])} ${dim('→ ' + file)}`); }
+      else { already++; console.log(`  ${yellow('•')} ${AGENT_LABELS[a.key]} ${dim('already protected (' + file + ')')}`); }
+      if (a.key === 'aider') console.log(dim('      Aider has no tool hook - routes model calls through the LLM Guard proxy. Start ') + bold('shomra llm-proxy') + dim('.'));
+    } catch (e) {
+      console.log(`  ${red('✗')} ${AGENT_LABELS[a.key]} ${dim('- ' + e.message)}`);
+    }
+  }
+  console.log(`\n  ${wired ? green(`✓ ${wired} newly protected`) : green('✓ Already protected')}${already ? dim(` · ${already} already wired`) : ''}${dim(' - tool calls, results and prompts now screened on-machine.')}`);
+
+  console.log(dim('\n  Get in front of the model too - both write into this repo, so run them where you mean to:'));
+  console.log(`    ${bold('shomra rules --write')}   ${dim('teach the agent what gets blocked, so it never writes it')}`);
+  console.log(`    ${bold('shomra mcp install')}     ${dim('let the agent gate its own proposed content before writing')}\n`);
+}

package/src/commands/provenance.mjs

@@ -0,0 +1,91 @@
+import { execSync } from 'node:child_process';
+import path from 'node:path';
+import { api } from '../core/api-client.mjs';
+import { loadConfig, resolveSettings } from '../core/config.mjs';
+import { EXIT_USAGE } from '../core/exit-codes.mjs';
+import { bold, cyan, dim, green, red, yellow } from '../core/terminal.mjs';
+
+function gitChangedPaths(root, { staged, base }) {
+  const run = (args) => {
+    try {
+      return execSync(`git ${args}`, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString();
+    } catch {
+      return null;
+    }
+  };
+  let out = null;
+  if (staged) {
+    out = run('diff --cached --name-only --relative --diff-filter=ACM');
+  } else if (base) {
+    for (const b of [`origin/${base}`, base]) {
+      out = run(`diff --name-only --relative --diff-filter=ACM ${b}...HEAD`);
+      if (out !== null) break;
+    }
+  }
+  if (out === null) out = run('diff HEAD~1 --name-only --relative --diff-filter=ACM');
+  if (out === null) return null;
+  return out.split('\n').map((s) => s.trim()).filter(Boolean);
+}
+
+export async function cmdProvenance(flags, positional) {
+  const root = path.resolve(flags.path || positional[0] || '.');
+  const staged = !!flags.staged;
+  const base = flags.base || (staged ? null : process.env.GITHUB_BASE_REF || 'main');
+
+  const paths = gitChangedPaths(root, { staged, base });
+  if (paths === null) {
+    console.error(red('✗') + ' Not a git repository (or no diff available). Run inside a repo, or pass --base <ref>.');
+    process.exit(EXIT_USAGE);
+  }
+  if (!paths.length) {
+    if (flags.json) console.log(JSON.stringify({ files: [], agentAuthored: 0, coverage: 'NO_TELEMETRY', summary: 'no changed files' }, null, 2));
+    else console.log(green('\n  ✓ No changed files to attribute.\n'));
+    return;
+  }
+
+  const cfg = loadConfig();
+  const { apiKey, url } = resolveSettings(cfg);
+  let res;
+  try {
+    res = await api(url, apiKey, '/gate/provenance', {
+      paths,
+      repo: flags.repo || process.env.GITHUB_REPOSITORY || undefined,
+      sessionId: flags.session || undefined,
+      sinceHours: flags.since ? Number(flags.since) : undefined,
+    });
+  } catch (e) {
+
+    console.error(yellow('!') + ` Provenance unavailable (${e.message}). Authorship not established.`);
+    process.exit(flags['fail-on-blocked'] ? 1 : EXIT_USAGE);
+  }
+
+  if (flags.json) {
+    console.log(JSON.stringify(res, null, 2));
+  } else if (flags.trailer) {
+    for (const t of res.trailers || []) console.log(t);
+  } else {
+    const noTel = res.coverage === 'NO_TELEMETRY';
+    console.log('');
+    console.log(`  ${bold('Commit provenance')} ${dim(`· ${res.files.length} changed file(s)`)}`);
+    console.log(`  ${noTel ? yellow('⚠ ' + res.summary) : res.summary}`);
+    if (noTel) {
+      console.log(dim('    No firewall telemetry for this range - this is NOT a claim that a human wrote them.'));
+      console.log(dim('    Install the runtime hook with ') + bold('shomra protect') + dim(' to attribute future work.'));
+    }
+    console.log('');
+    for (const f of res.files.slice(0, 40)) {
+      const tag =
+        f.authorship === 'AGENT' ? cyan('agent') : f.authorship === 'BLOCKED_ATTEMPT' ? red('blocked') : dim('unattributed');
+      const who = f.agents?.length ? dim(` ${f.agents.join(', ')}`) : '';
+      const amb = f.ambiguous ? yellow(' ~ambiguous') : '';
+      console.log(`    ${tag.padEnd(22)} ${f.path}${who}${amb}`);
+    }
+    if (res.files.length > 40) console.log(dim(`    …and ${res.files.length - 40} more`));
+    console.log('');
+  }
+
+  if (flags['fail-on-blocked'] && res.blockedAttempts > 0) {
+    console.error(red('✗') + ` ${res.blockedAttempts} file(s) the firewall blocked were modified anyway.`);
+    process.exit(1);
+  }
+}

package/src/commands/redteam.mjs

@@ -0,0 +1,166 @@
+import os from 'node:os';
+import { api } from '../core/api-client.mjs';
+import { loadConfig, resolveSettings } from '../core/config.mjs';
+import { exitNotConfigured } from '../core/exit-codes.mjs';
+import { bold, cyan, dim, green, red, yellow } from '../core/terminal.mjs';
+
+export async function cmdRedteam(flags) {
+  const cfg = loadConfig();
+  const { apiKey, url } = resolveSettings(cfg);
+  if (!apiKey) {
+    exitNotConfigured();
+  }
+  const targetKind = flags.target === 'model' ? 'model' : 'llm-guard';
+  const scenarioKeys = typeof flags.scenarios === 'string' ? flags.scenarios.split(',').map((s) => s.trim()).filter(Boolean) : undefined;
+
+  if (!flags.json) process.stdout.write(dim(`\n  Red-teaming your ${targetKind === 'model' ? 'model' : 'LLM Guard'}… `));
+  let run;
+  try {
+    run = await api(url, apiKey, '/redteam/agent-run', {
+      targetKind,
+      ...(scenarioKeys ? { scenarioKeys } : {}),
+      ...(flags.project ? { projectId: String(flags.project) } : {}),
+      ...(flags.evolve ? { evolutionary: true } : flags.adaptive ? { adaptive: true } : {}),
+      actor: `${os.hostname()}/${os.userInfo().username}`,
+    });
+  } catch (e) {
+    if (!flags.json) console.log(red('failed'));
+    console.error(`  ${red('✗')} ${e.message}\n`);
+    process.exit(1);
+  }
+  if (!flags.json) console.log(green('done'));
+
+  if (flags.json) {
+    console.log(JSON.stringify(run, null, 2));
+  } else {
+    const rc = run.resilience >= 80 ? green : run.resilience >= 60 ? yellow : red;
+    console.log(`\n  ${bold(run.label)} ${dim(`· ${run.targetKind} · ${run.scenarioCount} scenarios · ${run.attemptCount} attempts`)}`);
+    console.log(`  ${rc('●')} Resilience ${rc(bold(run.resilience + '/100'))} ${dim(`· ${run.breachedCount} breached · ${run.blockedCount} blocked${run.regressedCount ? ' · ' : ''}`)}${run.regressedCount ? red(run.regressedCount + ' regressed') : ''}`);
+    for (const r of (run.results || []).filter((x) => x.breached)) {
+      console.log(`     ${red('✗')} ${bold(r.title)} ${dim(r.technique)} ${r.regressed ? red('· REGRESSED') : ''}`);
+    }
+    const held = (run.results || []).filter((x) => !x.breached).length;
+    if (held) console.log(`     ${green('✓')} ${dim(`${held} scenario(s) held`)}`);
+    console.log(
+      '\n  ' +
+        (run.breachedCount === 0
+          ? green('✓ All scenarios defended.')
+          : yellow(`⚠ ${run.breachedCount} scenario(s) breached your defenses.`)) +
+        dim(' Full report in the Shomra dashboard → Red Team.\n'),
+    );
+  }
+
+  const min = flags.min != null ? parseInt(flags.min, 10) : null;
+  const belowFloor = Number.isFinite(min) && run.resilience < min;
+  const regressed = flags['fail-on-regression'] && run.regressedCount > 0;
+  if (belowFloor) console.error(red(`  ✗ Resilience ${run.resilience} is below the required ${min}.`));
+  if (regressed) console.error(red(`  ✗ ${run.regressedCount} scenario(s) regressed since the last run.`));
+  if (belowFloor || regressed) process.exitCode = 1;
+}
+
+export async function cmdCampaign(flags) {
+  const cfg = loadConfig();
+  const { apiKey, url } = resolveSettings(cfg);
+  if (!apiKey) {
+    exitNotConfigured();
+  }
+  const objectiveKeys = typeof flags.objectives === 'string' ? flags.objectives.split(',').map((s) => s.trim()).filter(Boolean) : undefined;
+  const turns = flags.turns != null ? parseInt(flags.turns, 10) : undefined;
+
+  if (!flags.json) process.stdout.write(dim('\n  Running an autonomous adversary campaign against your assistant… '));
+  let run;
+  try {
+    run = await api(url, apiKey, '/redteam/agent-campaign', {
+      ...(objectiveKeys ? { objectiveKeys } : {}),
+      ...(Number.isFinite(turns) ? { turns } : {}),
+      ...(flags.project ? { projectId: String(flags.project) } : {}),
+      actor: `${os.hostname()}/${os.userInfo().username}`,
+    });
+  } catch (e) {
+    if (!flags.json) console.log(red('failed'));
+    console.error(`  ${red('✗')} ${e.message}\n`);
+    process.exit(1);
+  }
+  if (!flags.json) console.log(green('done'));
+
+  if (flags.json) {
+    console.log(JSON.stringify(run, null, 2));
+  } else {
+    const rc = run.resilience >= 80 ? green : run.resilience >= 60 ? yellow : red;
+    console.log(`\n  ${bold(run.label)} ${dim(`· ${run.scenarioCount} objective(s) · ${run.attemptCount} turns fired`)}`);
+    console.log(`  ${rc('●')} Resilience ${rc(bold(run.resilience + '/100'))} ${dim(`· ${run.breachedCount} objective(s) achieved · ${run.blockedCount} turn(s) blocked by the guard`)}`);
+    for (const r of (run.results || []).filter((x) => x.breached)) {
+      const bt = (r.evidenceJson?.outcomes || []).filter((o) => o.breached).map((o) => o.index + 1);
+      const inTurns = bt.length ? Math.min(...bt) : r.attempts;
+      console.log(`     ${red('✗')} ${bold(r.title)} ${dim(`${r.technique} · achieved in ${inTurns} turn(s)`)}`);
+    }
+    const held = (run.results || []).filter((x) => !x.breached).length;
+    if (held) console.log(`     ${green('✓')} ${dim(`${held} objective(s) defended`)}`);
+    console.log(
+      '\n  ' +
+        (run.breachedCount === 0
+          ? green('✓ Every objective was defended.')
+          : yellow(`⚠ ${run.breachedCount} objective(s) achieved by the autonomous attacker.`)) +
+        dim(' Full transcript in the Shomra dashboard → Red Team. Harden the guard against the winning turns.\n'),
+    );
+  }
+
+  const min = flags.min != null ? parseInt(flags.min, 10) : null;
+  if (Number.isFinite(min) && run.resilience < min) {
+    console.error(red(`  ✗ Resilience ${run.resilience} is below the required ${min}.`));
+    process.exitCode = 1;
+  }
+}
+
+export async function cmdHarden(flags) {
+  const cfg = loadConfig();
+  const { apiKey, url } = resolveSettings(cfg);
+  if (!apiKey) {
+    exitNotConfigured();
+  }
+  const targetKind = flags.target === 'model' ? 'model' : 'llm-guard';
+  const apply = !!flags.apply;
+  const runId = flags.run ? String(flags.run) : undefined;
+
+  if (!flags.json) process.stdout.write(
+    dim(`\n  ${runId ? 'Hardening from run ' + runId : 'Red-teaming your ' + (targetKind === 'model' ? 'model' : 'LLM Guard') + ', then hardening'}… `),
+  );
+  let res;
+  try {
+    res = await api(url, apiKey, '/flywheel/agent-harden', {
+      ...(runId ? { runId } : {}),
+      targetKind,
+      apply,
+      actor: `${os.hostname()}/${os.userInfo().username}`,
+    });
+  } catch (e) {
+    if (!flags.json) console.log(red('failed'));
+    console.error(`  ${red('✗')} ${e.message}\n`);
+    process.exit(1);
+  }
+  if (!flags.json) console.log(green('done'));
+
+  if (flags.json) {
+    console.log(JSON.stringify(res, null, 2));
+    return;
+  }
+
+  const sc = res.status === 'APPLIED' ? green : res.status === 'VERIFIED' ? cyan : res.status === 'REJECTED' ? yellow : red;
+  console.log(`\n  ${sc('●')} ${bold(res.status)} ${dim('· ' + (res.origin === 'ai' ? 'AI-generated' : 'mined') + ((res.techniques || []).length ? ' · ' + res.techniques.join(', ') : ''))}`);
+  if (res.gapTotal) {
+    console.log(`  ${res.gapClosed === res.gapTotal ? green('✓') : yellow('◑')} Closes ${bold(res.gapClosed + '/' + res.gapTotal)} breaching attempts`);
+  }
+  console.log(
+    `  ${green('✓')} ${bold(String(res.signatures))} signature(s) passed the FP-gate ` +
+      dim(`· ${res.falsePositives} false positives across ${res.benignTested} benign samples`),
+  );
+  if (res.applied) {
+    const lift = res.resilienceBefore != null && res.resilienceAfter != null ? `${res.resilienceBefore} → ${res.resilienceAfter}/100` : 'live';
+    console.log(`  ${green('✓')} Applied - signatures are ${bold('live')} with no redeploy. Resilience ${bold(lift)}`);
+  } else if (res.status === 'VERIFIED') {
+    console.log(`  ${cyan('→')} Ready. Re-run with ${bold('--apply')} to push them live, or review in the dashboard → Self-Hardening.`);
+  } else if (res.status === 'REJECTED') {
+    console.log(`  ${yellow('⚠')} No candidate was both effective and false-positive-free - nothing applied.`);
+  }
+  console.log(dim('\n  Full detail in the Shomra dashboard → Self-Hardening.\n'));
+}