attesso 0.8.0 → 0.9.0

package/README.md

@@ -45,6 +45,21 @@ npx attesso sync
 npx attesso sync --watch
 ```
 
+## Hosted policy
+
+A hosted workspace can publish its portable rule set from the dashboard. The
+local engine fetches the signed bundle, verifies it against Attesso's published
+JWKS and only then writes `.attesso/rules.json`; path scope stays local.
+
+```sh
+export ATTESSO_SYNC_URL=https://api.attesso.com
+export ATTESSO_API_KEY=att_live_...
+npx attesso policy pull --apply
+```
+
+Without `--apply` the command verifies and previews the version and digest. A
+tampered signature, an unknown key or an invalid rule set writes nothing.
+
 The API key must belong to an entitled live workspace. A retry after a failed
 request is safe: the server deduplicates by device and sequence, and the local
 cursor does not move until the batch is accepted. `--watch` repeats every five

package/bin/attesso.mjs

@@ -30,6 +30,7 @@ import { CAPABILITIES, TRUST_LEVELS, validateRules } from './../src/rules.mjs';
 import { validatePathsConfig } from './../src/fs-paths.mjs';
 import { startUi } from './../src/ui/server.mjs';
 import { sync, watchSync } from './../src/sync.mjs';
+import { pullPolicy } from './../src/remote-policy.mjs';
 
 const argv = process.argv.slice(2);
 const dirAt = argv.indexOf('--dir');
@@ -71,12 +72,15 @@ const USAGE = `attesso: a local, signed ledger of what your agents attempted
   attesso hook [--observe]           harness hook: one tool call on stdin, native refusal on stdout
   attesso setup [--write] [--enforce] [--dry-run]
                                      detect a harness, wire the hook, write the agent block
-  attesso connect [--write] [--mode observe|enforce|off] [--json]
+  attesso connect [--write] [--mode observe|enforce|off] [--harness KEY] [--json]
                                      self-service: init, mode, hook and AGENTS.md
   attesso status [--json]           connection, mode and wired harnesses
   attesso mode [observe|enforce|off]  read or set the active hook mode
   attesso paths [--json|--set FILE]   read or replace the filesystem scope
   attesso ui [--port N] [--no-open]    local control surface for the signed ledger
+  attesso policy pull [--url URL] [--apply] [--json]
+                                     verify the hosted rule bundle and optionally
+                                     write rules.json (key from ATTESSO_API_KEY)
   attesso sync [--url URL] [--limit N] [--json] [--dry-run] [--watch]
                                      send the next decisions to the hosted mirror
                                      --watch keeps it current every 5 seconds
@@ -625,6 +629,34 @@ switch (command) {
     }
     break;
   }
+  case 'policy': {
+    try {
+      const options = flags(rest);
+      const subcommand = rest.find((value) => !value.startsWith('--'));
+      if (subcommand !== 'pull') throw new Error('policy takes pull');
+      requireLedger();
+      const url = typeof options.url === 'string' ? options.url : process.env.ATTESSO_SYNC_URL;
+      const key = typeof options.key === 'string' ? options.key : process.env.ATTESSO_API_KEY;
+      const result = await pullPolicy({
+        dir: DIR,
+        url,
+        key,
+        apply: rest.includes('--apply'),
+      });
+      if (options.json) {
+        console.log(JSON.stringify(result, null, 2));
+      } else {
+        console.log(`policy: v${result.version} verified with ${result.kid}`);
+        console.log(`digest: ${result.digest}`);
+        if (result.applied) console.log(`rules: ${result.changed ? 'written' : 'already current'} (${paths(DIR).rules})`);
+        else console.log('preview only; re-run with --apply to write rules.json');
+      }
+    } catch (error) {
+      console.error(`policy: ${error.message}`);
+      process.exit(2);
+    }
+    break;
+  }
   case 'sync': {
     try {
       const options = flags(rest);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "attesso",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Bounds: decide an AI agent's next tool call before it runs, with a signed record. Free and unlimited locally, $0.00085 per synced decision.",
   "license": "Apache-2.0",
   "type": "module",

package/src/connect.mjs

@@ -3,7 +3,7 @@
 // harness hook, and report a machine-readable result on stdout.
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { detectHarnesses, writeAgentContext } from './setup.mjs';
 import { wireHarness } from './install.mjs';
 import { init, isInitialised, paths } from './store.mjs';
@@ -57,20 +57,24 @@ function legacyModeDirs(home) {
   }
 }
 
-function hasAttessoHook(path) {
-  if (!existsSync(path)) return false;
-  try {
-    const text = readFileSync(path, 'utf8');
-    return /attesso[^\n"]*hook/.test(text);
-  } catch {
-    return false;
-  }
-}
-
-function wiredHarnesses(harnesses) {
+function wiredHarnesses(harnesses, { dir, cwd }) {
+  const ledger = resolve(dir);
   return harnesses.map((harness) => {
     const candidate = harness.key === 'cline' ? join(harness.path, 'PreToolUse') : harness.path;
-    return { ...harness, wired: hasAttessoHook(candidate) };
+    let wired = false;
+    if (existsSync(candidate)) {
+      try {
+        const text = readFileSync(candidate, 'utf8');
+        // A hook for a different ledger is not this project's connection. The
+        // legacy wrapper has no --dir, so it keeps counting as wired.
+        const match = text.match(/--dir\s+(?:'([^']+)'|"([^"]+)"|(\S+))/);
+        const target = match ? match[1] || match[2] || match[3] : null;
+        wired = target ? resolve(cwd, target) === ledger : /attesso[^\n"]*hook/.test(text);
+      } catch {
+        wired = false;
+      }
+    }
+    return { ...harness, wired };
   });
 }
 
@@ -86,7 +90,7 @@ function instructions({ mode, wired, manual }) {
 export function status({ dir, cwd = process.cwd(), home = homedir() } = {}) {
   const initialized = isInitialised(dir);
   const mode = readMode(dir);
-  const detected = wiredHarnesses(detectHarnesses({ home, cwd }));
+  const detected = wiredHarnesses(detectHarnesses({ home, cwd }), { dir, cwd });
   const wired = detected.filter((harness) => harness.wired);
   const manual = detected.filter((harness) => !['hermes', 'claude-code', 'codex', 'gemini', 'cline'].includes(harness.key));
   return {
@@ -113,8 +117,12 @@ export function connect({
   if (!CONNECT_MODES.includes(mode)) {
     throw new Error(`invalid mode '${mode}'; expected ${CONNECT_MODES.join(', ')}`);
   }
-  const initialized = isInitialised(dir);
-  if (write && !initialized) init(dir);
+  // Harness configs are global. A relative --dir becomes a hook that points at
+  // whatever .attesso happens to be in the agent's current directory, so the
+  // ledger path must be absolute before it is written anywhere.
+  const ledgerDir = resolve(dir);
+  const initialized = isInitialised(ledgerDir);
+  if (write && !initialized) init(ledgerDir);
   const detected = detectHarnesses({ home, cwd }).filter((harness) => !only || harness.key === only);
   const agentContext = writeAgentContext(cwd, { dryRun: !write });
   const results = [];
@@ -130,7 +138,7 @@ export function connect({
       continue;
     }
     try {
-      const result = wireHarness(harness.key, cli, dir, {
+      const result = wireHarness(harness.key, cli, ledgerDir, {
         dryRun: !write,
         enforce: mode === 'enforce',
         modeFile: true,
@@ -143,14 +151,14 @@ export function connect({
       results.push({ key: harness.key, path: harness.path, wired: false, error: error.message });
     }
   }
-  if (write) setModeAll(dir, mode, { home });
+  if (write) setModeAll(ledgerDir, mode, { home });
   const wired = results.filter((result) => result.applied || result.reason === 'already wired');
-  const effectiveMode = write ? mode : readMode(dir);
+  const effectiveMode = write ? mode : readMode(ledgerDir);
   return {
-    initialized: isInitialised(dir),
+    initialized: isInitialised(ledgerDir),
     mode: effectiveMode,
-    connected: isInitialised(dir) && effectiveMode !== null && effectiveMode !== 'off' && wired.length > 0,
-    ledger: paths(dir).dir,
+    connected: isInitialised(ledgerDir) && effectiveMode !== null && effectiveMode !== 'off' && wired.length > 0,
+    ledger: paths(ledgerDir).dir,
     harnesses: results,
     wired: wired.map((result) => result.key),
     manual: results.filter((result) => result.manual || result.error || result.reason?.includes('merge by hand')).map((result) => result.key),

package/src/remote-policy.mjs

@@ -0,0 +1,142 @@
+// Hosted policy distribution: fetch a signed rule bundle, verify it against the
+// published Attesso JWKS, and only then let the local engine write rules.json.
+import { createHash, createPublicKey, verify as verifySignature } from 'node:crypto';
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { paths } from './store.mjs';
+import { validateRules } from './rules.mjs';
+
+export const POLICY_FORMAT = 'attesso.bounds.policy.v1';
+
+const fromB64url = (value) => {
+  const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
+  return Buffer.from(normalized + '='.repeat((4 - (normalized.length % 4)) % 4), 'base64');
+};
+
+export function policyEndpoint(base) {
+  const parsed = new URL(base);
+  if (parsed.protocol !== 'https:' && parsed.hostname !== '127.0.0.1' && parsed.hostname !== 'localhost') {
+    throw new Error('policy url must use HTTPS, except on localhost');
+  }
+  const path = parsed.pathname.replace(/\/+$/, '').replace(/\/v1\/bounds\/(sync|policy)$/, '');
+  parsed.pathname = `${path}/v1/bounds/policy`;
+  parsed.search = '';
+  parsed.hash = '';
+  return parsed.toString();
+}
+
+export function jwksEndpoint(base) {
+  return new URL('/.well-known/jwks.json', new URL(base)).toString();
+}
+
+export async function pullPolicy({
+  dir,
+  url,
+  key,
+  apply = false,
+  fetchImpl = fetch,
+} = {}) {
+  if (!url) throw new Error('policy url is required');
+  if (!key) throw new Error('policy API key is required');
+  const response = await fetchImpl(policyEndpoint(url), {
+    headers: { Authorization: `Bearer ${key}` },
+    signal: AbortSignal.timeout(20_000),
+  });
+  if (response.status === 404) throw new Error('no hosted policy is published');
+  if (!response.ok) throw new Error(`policy fetch failed with status ${response.status}`);
+  let bundle;
+  try {
+    bundle = await response.json();
+  } catch {
+    throw new Error('policy response is invalid');
+  }
+  if (!bundle || typeof bundle !== 'object' || !bundle.envelope || typeof bundle.envelope !== 'object') {
+    throw new Error('policy response is missing its signature');
+  }
+  if (bundle.envelope.format !== POLICY_FORMAT) {
+    throw new Error('policy response has an unexpected format');
+  }
+
+  const jwksResponse = await fetchImpl(jwksEndpoint(url), { signal: AbortSignal.timeout(20_000) });
+  if (!jwksResponse.ok) throw new Error(`policy key fetch failed with status ${jwksResponse.status}`);
+  let jwks;
+  try {
+    jwks = await jwksResponse.json();
+  } catch {
+    throw new Error('policy key response is invalid');
+  }
+
+  const verified = verifyPolicyEnvelope(bundle.envelope, jwks);
+  const changed = !existsSync(paths(dir).rules) ||
+    JSON.stringify(JSON.parse(readFileSync(paths(dir).rules, 'utf8'))) !== JSON.stringify(verified.rules);
+  if (apply) writeRules(dir, verified.rules);
+  return {
+    version: verified.version,
+    kid: verified.kid,
+    digest: verified.digest,
+    applied: apply,
+    changed,
+    rules: verified.rules,
+  };
+}
+
+export function verifyPolicyEnvelope(envelope, jwks) {
+  if (!envelope || typeof envelope !== 'object') throw new Error('policy envelope is invalid');
+  if (envelope.format !== POLICY_FORMAT) throw new Error('policy envelope has an unexpected format');
+  for (const field of ['protected', 'payload', 'signature']) {
+    if (typeof envelope[field] !== 'string' || envelope[field] === '') {
+      throw new Error('policy envelope is incomplete');
+    }
+  }
+  let header;
+  try {
+    header = JSON.parse(fromB64url(envelope.protected).toString('utf8'));
+  } catch {
+    throw new Error('policy envelope header is invalid');
+  }
+  if (header.alg !== 'ES256' || typeof header.kid !== 'string') {
+    throw new Error('policy envelope must use an ES256 key');
+  }
+  const key = Array.isArray(jwks?.keys) ? jwks.keys.find((item) => item.kid === header.kid) : undefined;
+  if (!key || key.kty !== 'EC' || key.crv !== 'P-256' || key.alg !== 'ES256') {
+    throw new Error(`no ES256 verification key for ${header.kid}`);
+  }
+  let publicKey;
+  try {
+    publicKey = createPublicKey({ key: { kty: key.kty, crv: key.crv, x: key.x, y: key.y }, format: 'jwk' });
+  } catch {
+    throw new Error(`verification key ${header.kid} is invalid`);
+  }
+  const valid = verifySignature(
+    'sha256',
+    Buffer.from(`${envelope.protected}.${envelope.payload}`, 'utf8'),
+    { key: publicKey, dsaEncoding: 'ieee-p1363' },
+    fromB64url(envelope.signature),
+  );
+  if (!valid) throw new Error('policy signature did not verify');
+
+  let payload;
+  try {
+    payload = JSON.parse(fromB64url(envelope.payload).toString('utf8'));
+  } catch {
+    throw new Error('policy payload is invalid');
+  }
+  if (payload.schema !== POLICY_FORMAT ||
+      !Number.isSafeInteger(payload.version) || payload.version < 1 ||
+      typeof payload.rules !== 'object' || payload.rules === null) {
+    throw new Error('policy payload is invalid');
+  }
+  const rules = validateRules(payload.rules);
+  return {
+    version: payload.version,
+    rules,
+    kid: header.kid,
+    digest: `sha256:${createHash('sha256').update(envelope.payload).digest('hex')}`,
+  };
+}
+
+function writeRules(dir, rules) {
+  const file = paths(dir).rules;
+  const temporary = `${file}.${process.pid}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(rules, null, 2)}\n`, { mode: 0o600 });
+  renameSync(temporary, file);
+}

package/src/setup.mjs

@@ -10,10 +10,12 @@ import { join, resolve } from 'node:path';
 import { argsHashOf } from './rules.mjs';
 
 const AGENT_BLOCK = `<!-- attesso:start -->
-A veto is active on your tool calls. When a call is refused you get a tool error naming
-the rule and the step that tainted the task. Do not retry a refused call unchanged:
-read \`attesso explain <seq>\`, take another path, or ask the user whether the rule is
-wrong. To see rules the ledger supports, run \`attesso suggest\`.
+Bounds evaluates your tool calls locally and records every decision. In observe mode
+a refusal is recorded but not blocked; in enforce mode it blocks. When a call is
+refused you get a tool error naming the rule and the step that tainted the task.
+Do not retry a refused call unchanged: read \`attesso explain <seq>\`, take another
+path, or ask the user whether the rule is wrong. To see rules the ledger supports,
+run \`attesso suggest\`.
 <!-- attesso:end -->`;
 
 function stripAgentBlock(text) {

package/src/ui/static/index.html

@@ -686,7 +686,10 @@
       el('agent-sub').textContent = 'Hook active' + seq;
       el('agent-action').textContent = 'Manage agent';
     } else {
-      el('agent-sub').textContent = 'Hook is ' + (agentData.mode || 'not configured') + ' - connect any agent to start observing';
+      const wired = Array.isArray(agentData.wired) ? agentData.wired.length : 0;
+      el('agent-sub').textContent = wired
+        ? 'Hook is ' + (agentData.mode || 'not configured') + ' - connect any agent to start observing'
+        : 'No harness wired - connect an agent to start observing';
       el('agent-action').textContent = 'Connect agent';
     }
     renderAgentPanel();
@@ -903,7 +906,11 @@
       renderAgentStatus();
       if (body.status?.paths) pathState = body.status.paths;
       renderPaths();
-      status.textContent = agentData.connected ? 'Agent connected.' : 'Hook is ' + mode + '.';
+      status.textContent = agentData.connected
+        ? 'Agent connected.'
+        : mode === 'off'
+          ? 'Bounds is off; choose Observe and connect again.'
+          : 'No agent harness detected; copy the setup command below.';
     } catch (error) {
       status.textContent = 'Connect failed: ' + error.message;
     }
@@ -943,6 +950,7 @@
   function renderFlow(day, preserveCenter = null) {
     if (v1) return renderV1Flow(day, preserveCenter);
     const summary = summarize(day);
+    const empty = summary.calls === 0;
     const width = flowWidth();
     const inner = width - GUTTER;
     el('flow-track').style.width = width + 'px';
@@ -953,13 +961,15 @@
     el('flow-count').textContent = fmt(summary.calls) + ' calls';
     const hours = el('flow-hours');
     hours.replaceChildren();
-    for (let hour = 0; hour <= 24; hour += 1) {
-      const line = document.createElement('div');
-      line.className = 'flow-hour' + (hour % 3 === 0 ? ' major' : '');
-      line.style.left = (GUTTER + (hour / 24) * inner) + 'px';
-      const labelEvery = zoom >= 2 ? 1 : 3;
-      if (hour % labelEvery === 0) line.textContent = String(hour).padStart(2, '0') + ':00';
-      hours.append(line);
+    if (!empty) {
+      for (let hour = 0; hour <= 24; hour += 1) {
+        const line = document.createElement('div');
+        line.className = 'flow-hour' + (hour % 3 === 0 ? ' major' : '');
+        line.style.left = (GUTTER + (hour / 24) * inner) + 'px';
+        const labelEvery = zoom >= 2 ? 1 : 3;
+        if (hour % labelEvery === 0) line.textContent = String(hour).padStart(2, '0') + ':00';
+        hours.append(line);
+      }
     }
     const lanes = el('flow-lanes');
     lanes.replaceChildren();
@@ -1008,18 +1018,20 @@
       for (const row of rows) markerBySeq.set(String(row[0]), marker);
       fragments.get(cap).append(marker);
     }
-    for (const cap of CAPS) {
-      const lane = document.createElement('div');
-      lane.className = 'f-lane';
-      lane.dataset.capability = cap;
-      const label = document.createElement('div');
-      label.className = 'f-label';
-      label.textContent = cap.toUpperCase();
-      const track = document.createElement('div');
-      track.className = 'f-track';
-      track.append(fragments.get(cap));
-      lane.append(label, track);
-      lanes.append(lane);
+    if (!empty) {
+      for (const cap of CAPS) {
+        const lane = document.createElement('div');
+        lane.className = 'f-lane';
+        lane.dataset.capability = cap;
+        const label = document.createElement('div');
+        label.className = 'f-label';
+        label.textContent = cap.toUpperCase();
+        const track = document.createElement('div');
+        track.className = 'f-track';
+        track.append(fragments.get(cap));
+        lane.append(label, track);
+        lanes.append(lane);
+      }
     }
     const scroller = el('flow-scroller');
     if (preserveCenter == null) {
@@ -1036,6 +1048,7 @@
 
   function renderV1Flow(day, preserveCenter = null) {
     const summary = summarize(day);
+    const empty = summary.calls === 0;
     const buckets = flowCache.get(day)?.buckets || [];
     const width = flowWidth();
     const inner = width - GUTTER;
@@ -1050,13 +1063,15 @@
     el('flow-count').textContent = fmt(summary.calls) + ' calls';
     const hours = el('flow-hours');
     hours.replaceChildren();
-    for (let hour = 0; hour <= 24; hour += 1) {
-      const line = document.createElement('div');
-      line.className = 'flow-hour' + (hour % 3 === 0 ? ' major' : '');
-      line.style.left = (GUTTER + (hour / 24) * inner) + 'px';
-      const labelEvery = zoom >= 2 ? 1 : 3;
-      if (hour % labelEvery === 0) line.textContent = String(hour).padStart(2, '0') + ':00';
-      hours.append(line);
+    if (!empty) {
+      for (let hour = 0; hour <= 24; hour += 1) {
+        const line = document.createElement('div');
+        line.className = 'flow-hour' + (hour % 3 === 0 ? ' major' : '');
+        line.style.left = (GUTTER + (hour / 24) * inner) + 'px';
+        const labelEvery = zoom >= 2 ? 1 : 3;
+        if (hour % labelEvery === 0) line.textContent = String(hour).padStart(2, '0') + ':00';
+        hours.append(line);
+      }
     }
     const lanes = el('flow-lanes');
     lanes.replaceChildren();
@@ -1092,18 +1107,20 @@
       }
       fragments.get(cap).append(marker);
     }
-    for (const cap of CAPS) {
-      const lane = document.createElement('div');
-      lane.className = 'f-lane';
-      lane.dataset.capability = cap;
-      const label = document.createElement('div');
-      label.className = 'f-label';
-      label.textContent = cap.toUpperCase();
-      const track = document.createElement('div');
-      track.className = 'f-track';
-      track.append(fragments.get(cap));
-      lane.append(label, track);
-      lanes.append(lane);
+    if (!empty) {
+      for (const cap of CAPS) {
+        const lane = document.createElement('div');
+        lane.className = 'f-lane';
+        lane.dataset.capability = cap;
+        const label = document.createElement('div');
+        label.className = 'f-label';
+        label.textContent = cap.toUpperCase();
+        const track = document.createElement('div');
+        track.className = 'f-track';
+        track.append(fragments.get(cap));
+        lane.append(label, track);
+        lanes.append(lane);
+      }
     }
     const scroller = el('flow-scroller');
     if (preserveCenter == null) {