clearhand 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,146 @@
+# clearhand
+
+**Safe hands for your agent.**
+
+Your coding agent — Claude Code, Codex — is already smart enough to run your
+customer support: read the inbox, know the customer, draft the reply, decide
+the refund. What it isn't, is safe enough to be trusted with your Stripe
+account and your customers' trust.
+
+ClearHand is the missing layer: a small, local, deterministic server that lets
+your agent *propose* support actions — refunds, cancellations, replies,
+GitHub issues — and lets **you** execute them with one click, through an
+executor the agent cannot bypass. Every guard in it exists because of a real
+incident from months of running support this way across 13 SaaS products.
+
+```
+your agent (brain)          clearhand (hands)                      you
+──────────────────    ─────────────────────────────    ──────────────────
+reads cases            typed Action Proposal v1
+enriches w/ Stripe  →  lint · freshness · ordering  →   [ Approve ] click
+drafts in your voice   CAS claim · confirm-or-fail
+proposes actions       proration & resolve guards       full audit trail
+```
+
+## Try it in 60 seconds (no accounts needed)
+
+```bash
+npx clearhand demo
+```
+
+Opens a local dashboard with seeded cases. Open
+`http://localhost:3117/#/onboarding` and run the 90-second demo to watch the
+whole guided setup drive itself through the real endpoints; or go to the
+queue, click through the approve flow, try to resolve a case while its
+refund is still pending, and watch the guards fire.
+
+> **Pre-launch:** until the package is published to npm, install from source
+> instead of `npx`:
+> ```bash
+> git clone https://github.com/honganai/clearhand-help && cd clearhand-help
+> npm install && npm run build && npm link      # provides the `clearhand` CLI
+> ```
+
+## Real setup (~30–45 min)
+
+```bash
+npx clearhand init
+npx clearhand start        # dashboard on http://localhost:3117
+```
+
+1. **Connect** on the dashboard Connections page — never in chat:
+   - Stripe **restricted** key (`customers:read, charges:read,
+     refunds:write, subscriptions:write, invoices:read`). Full-access keys
+     get a loud warning.
+   - Your support mailbox (Gmail app password; IMAP in, provider SMTP out).
+   - Optionally GitHub (bug reports become issues).
+2. **Onboard** — tell your agent:
+   > read CLEARHAND.md and run the clearhand-onboard skill
+
+   It reads your sent mail (locally), your Stripe history, and your public
+   policy pages; builds your policy book in `.clearhand/overlay/`; interviews
+   you with evidence-based questions ("your site says 14 days, you actually
+   refunded outside it 12 times — which do I follow?"); then runs
+   **shadow-draft calibration**: side-by-side "what I would have sent vs.
+   what you actually sent" for threads you already answered.
+3. **Work the queue** — tell your agent:
+   > run the clearhand-cs skill
+
+   It triages, enriches, drafts, proposes. You approve on the dashboard.
+   Money moves only on your click. Every draft you edit teaches it.
+
+**Agents can install this themselves.** Paste this into Claude Code, Codex,
+or any coworking agent — `CLEARHAND.md` and the skills are written for it:
+
+> Set up ClearHand (safe hands for customer support) in this project:
+> 1. Run `npx clearhand@latest init`, then start its server in the background
+>    with `npx clearhand start`.
+> 2. Open http://localhost:3117/#/onboarding in a browser for me.
+> 3. Read CLEARHAND.md at the project root, then follow the clearhand-onboard
+>    skill to guide my setup. I will enter my mailbox and Stripe credentials
+>    in the local dashboard myself — never ask for them in chat. Show me
+>    everything you learn, and finish by processing my last 3 days of support
+>    email. Nothing sends or moves money without my click.
+
+## Why trust it with a Stripe key?
+
+Because you don't have to trust *the agent* — only ~4k lines of deterministic
+TypeScript you can read in an afternoon:
+
+- **The agent never holds secrets.** Credentials are entered in a local
+  dashboard form and stored in your **OS keychain** (encrypted-file and
+  explicit-plaintext fallbacks exist). No API or MCP tool returns them; a
+  redaction layer scrubs secret-shaped strings from every response as
+  defense-in-depth. If you paste a key into chat, the agent is instructed to
+  refuse it and tell you to rotate.
+- **Just-in-time decryption with an audit trail.** Keys are decrypted at the
+  moment of the API call, and every access is logged with its purpose
+  ("Stripe key accessed by refund execution, case #12") — visible on the
+  Trust page.
+- **An egress ledger.** The server records every host it contacts. With your
+  own agent as the brain, ClearHand's server contacts **no LLM at all**. Verify
+  independently: `clearhand doctor --network`.
+- **Every money mutation is confirmed or failed** — a 200 with an unchanged
+  object is a failure, not a success. Double-execution is impossible by
+  construction (a compare-and-set claim in a synchronous single-writer
+  store). Refunds above the charge amount abort. Cancels never re-apply to an
+  already-scheduled subscription (that's how a wrongful proration happens).
+  A case can't be resolved — and a reply can't be sent — while a refund is
+  still owed.
+- **No telemetry.** There is no endpoint to send it to.
+
+Read the incident stories behind each guard in [docs/PORT_SPEC.md](docs/PORT_SPEC.md)
+and the threat model in [SECURITY.md](SECURITY.md).
+
+## What it is not
+
+Not a help desk, not a ticketing system, not an AI support SaaS. No seats, no
+workflows, no help-center CMS, no auto-send (autonomy is earned, not
+default). If you outgrow one founder + one inbox + one Approve button, you'll
+know.
+
+## Layout
+
+```
+bin/           CLI: init · start · demo · doctor · mcp
+src/server/    the hands: executor, lint, approval, secrets, connectors
+src/mcp/       thin typed MCP proxy (zero business logic)
+templates/     CLEARHAND.md, agent skills, overlay policy-book starters
+dashboard/     local web UI (queue · approve · trust · calibration)
+site/          clearhand.help sources
+docs/          PORT_SPEC (the ported invariants), verification
+```
+
+## Development
+
+```bash
+npm install && npm test        # safety-core tests (CAS race, guards, lint)
+npm run dev                    # server from source
+cd dashboard && npm run dev    # UI with proxy
+```
+
+Rule enforced forever: **every new action type lands a lint rule and an
+executor guard in the same change**, or the LLM regains a money-unsafe path.
+
+Apache-2.0. Local-first forever; a hosted always-on tier is planned — the
+[site](site/) has the waitlist.

package/SECURITY.md

@@ -0,0 +1,77 @@
+# Security model
+
+ClearHand moves real money on a machine that also runs a non-deterministic,
+prompt-injectable agent. This document states plainly what is defended, how,
+and what is not.
+
+## Threat model
+
+**Defended:**
+
+| Threat | Defense |
+|---|---|
+| Secrets leaking into agent transcripts / session logs | Secrets are only ever entered in the local dashboard form (127.0.0.1). No API or MCP tool returns a secret. Agents are instructed (CLEARHAND.md) to refuse pasted secrets and advise rotation. |
+| A prompt-injected agent reading credential files | Credentials live in the OS keychain, not files, wherever possible. Keychain reads by a foreign process are OS-mediated, unlike a silent `cat`. `~/.clearhand` is user-scope, outside any repo. |
+| Malicious instructions inside customer email | Inbound mail is data, not instructions — the skills state this as a hard rule and require escalation on social-engineering signals. Structurally: even a fully hijacked brain can only *propose*; execution requires the human click, and the executor validates every identifier and amount. |
+| Accidental repo commits of secrets | Credentials never live in the project tree. `.clearhand/.gitignore` excludes the DB and manifests on init. |
+| Over-scoped keys | Stripe keys are scope-checked at entry; full-access live keys produce a prominent warning with instructions for a restricted key. |
+| A buggy route leaking a value | Redaction middleware scrubs every JSON/text response against (a) all secret values decrypted this process lifetime and (b) generic secret-shaped patterns (`sk_live_…`, `ghp_…`, bearer tokens). |
+| Double execution / races | Compare-and-set claim on a synchronous single-writer store; idempotent-error mapping makes operator retries safe. |
+| "Success" that didn't happen | Every Stripe mutation is confirmed by a follow-up read; unconfirmed mutations are reported as failures. |
+| Network exposure | The server binds to 127.0.0.1 only. The money route optionally requires a bearer token (`CLEARHAND_EXECUTE_TOKEN`). |
+
+**NOT defended (say it honestly):**
+
+- Malware running as your OS user, or a compromised machine. Local-first
+  means your machine is the trust boundary.
+- A user who grants keychain access prompts to arbitrary processes.
+- Plaintext storage if you explicitly opt in with `--storage plain`.
+
+## Verifying the claims yourself
+
+- **Egress**: `clearhand doctor --network` prints every host the server has
+  ever contacted (from the ledger) next to live sockets from `lsof`. The
+  Trust page shows the same ledger.
+- **Secret access**: the Trust page lists every decryption with its purpose
+  and timestamp.
+- **Code**: the entire secrets surface is `src/server/secrets/` (~300
+  lines); the money surface is `src/server/services/executor.ts` +
+  `approval.ts` + `lint.ts`. Read them.
+- **No telemetry**: grep the codebase for an analytics endpoint; there isn't
+  one.
+
+## Storage backends
+
+1. **OS keychain** (macOS Keychain / Windows Credential Manager / libsecret)
+   — default when available.
+2. **Encrypted file** (`~/.clearhand/credentials.enc`, AES-256-GCM, scrypt) —
+   requires an externally supplied `CLEARHAND_MASTER_KEY`; refuses to run
+   without one rather than storing a key next to its ciphertext.
+3. **Plaintext** (`~/.clearhand/credentials.json`, mode 600) — explicit
+   `clearhand init --storage plain` opt-in only.
+
+## Planned: one-click connections (pre-registered commitments)
+
+One-click OAuth connects are designed but not yet shipped
+(docs/design/ONE_CLICK_CONNECT.md). We state the rules before building, so
+they can be held against us:
+
+- **Google (Search Console, Ads):** desktop loopback OAuth runs entirely on
+  your machine — no ClearHand server is involved; tokens go straight to your
+  OS keychain like every other credential.
+- **Stripe (Stripe App install):** Stripe requires our app secret to
+  exchange and refresh tokens, so those two calls route through a broker at
+  `connect.clearhand.help`. The broker **sees tokens in transit and stores
+  nothing** — no database, pure exchange/refresh passthrough. That claim is
+  stated the same way as "no telemetry": verifiable, and load-bearing.
+- The broker's host appears in your egress ledger like any other host.
+- **Paste-a-key never goes away.** It remains the offline fallback, and the
+  automatic failure mode if the broker is unreachable.
+- Connector cards badge their method honestly (PASTE-A-KEY today; ONE-CLICK
+  only once it actually works).
+
+## Reporting a vulnerability
+
+Open a GitHub security advisory on this repository, or email the maintainer
+(see package.json). Please do not open public issues for exploitable
+problems. Money-safety reports are treated as the highest severity.

package/bin/clearhand.js

@@ -0,0 +1,230 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn, execSync } from 'node:child_process';
+import { Command } from 'commander';
+
+const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const templates = path.join(pkgRoot, 'templates');
+const cwd = process.cwd();
+const projectDir = path.join(cwd, '.clearhand');
+
+const program = new Command();
+program
+  .name('clearhand')
+  .description('Safe hands for your agent — local, human-approved customer support execution.')
+  .version('0.1.0');
+
+function copyIfMissing(src, dest) {
+  if (fs.existsSync(dest)) return false;
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.copyFileSync(src, dest);
+  return true;
+}
+
+function copyDirIfMissing(srcDir, destDir) {
+  const copied = [];
+  if (!fs.existsSync(srcDir)) return copied;
+  for (const entry of fs.readdirSync(srcDir, { withFileTypes: true })) {
+    const s = path.join(srcDir, entry.name);
+    const d = path.join(destDir, entry.name);
+    if (entry.isDirectory()) copied.push(...copyDirIfMissing(s, d));
+    else if (copyIfMissing(s, d)) copied.push(path.relative(cwd, d));
+  }
+  return copied;
+}
+
+program
+  .command('init')
+  .description('Set up ClearHand in this project: overlay policy book, agent skills, MCP registration.')
+  .option('--storage <backend>', 'secret storage: auto | keychain | encrypted-file | plain', 'auto')
+  .option('--demo', 'enable demo mode (seeded sample cases, simulated connectors)')
+  .option('--port <port>', 'dashboard port', '3117')
+  .action((opts) => {
+    if (opts.storage === 'plain') {
+      console.log('\n⚠  You chose PLAINTEXT secret storage (~/.clearhand/credentials.json, chmod 600).');
+      console.log('   An OS keychain or CLEARHAND_MASTER_KEY is strongly recommended.\n');
+    }
+    const created = [];
+
+    // Project config
+    fs.mkdirSync(projectDir, { recursive: true });
+    const configPath = path.join(projectDir, 'config.json');
+    if (!fs.existsSync(configPath)) {
+      fs.writeFileSync(
+        configPath,
+        JSON.stringify(
+          { port: Number(opts.port), secretStorage: opts.storage, demoMode: Boolean(opts.demo) },
+          null,
+          2,
+        ) + '\n',
+      );
+      created.push('.clearhand/config.json');
+    }
+
+    // Never let runtime data reach the repo.
+    const gi = path.join(projectDir, '.gitignore');
+    if (!fs.existsSync(gi)) {
+      fs.writeFileSync(gi, 'clearhand.db*\nconnections.json\n');
+      created.push('.clearhand/.gitignore');
+    }
+
+    // Overlay policy book (user-owned, committable).
+    created.push(...copyDirIfMissing(path.join(templates, 'overlay'), path.join(projectDir, 'overlay')));
+
+    // Agent-facing protocol doc + skills.
+    if (copyIfMissing(path.join(templates, 'CLEARHAND.md'), path.join(cwd, 'CLEARHAND.md')))
+      created.push('CLEARHAND.md');
+    created.push(...copyDirIfMissing(path.join(templates, 'skills'), path.join(cwd, '.claude', 'skills')));
+
+    // MCP registration (merge, don't clobber).
+    const mcpPath = path.join(cwd, '.mcp.json');
+    let mcp = {};
+    try {
+      mcp = JSON.parse(fs.readFileSync(mcpPath, 'utf8'));
+    } catch {
+      /* fresh file */
+    }
+    mcp.mcpServers = mcp.mcpServers ?? {};
+    if (!mcp.mcpServers.clearhand) {
+      mcp.mcpServers.clearhand = { command: 'npx', args: ['-y', 'clearhand', 'mcp'] };
+      fs.writeFileSync(mcpPath, JSON.stringify(mcp, null, 2) + '\n');
+      created.push('.mcp.json (clearhand server registered)');
+    }
+
+    console.log('clearhand init complete.\n');
+    if (created.length) {
+      console.log('Created:');
+      for (const f of created) console.log(`  + ${f}`);
+    } else {
+      console.log('Everything was already in place.');
+    }
+    console.log(`
+Next steps:
+  1. clearhand start          # dashboard on http://localhost:${opts.port}
+  2. Open http://localhost:${opts.port}/#/onboarding — the guided setup.
+     You'll connect Stripe (restricted key) + your mailbox there.
+     Secrets go into the local dashboard form — NEVER into an agent chat.
+  3. In your agent: "read CLEARHAND.md and run the clearhand-onboard skill".
+${opts.demo ? '\nDemo mode is ON — `clearhand start` seeds sample cases, and the onboarding page can run a simulated 90-second demo.\n' : ''}`);
+  });
+
+async function startServer(port) {
+  const distEntry = path.join(pkgRoot, 'dist', 'server', 'index.js');
+  if (fs.existsSync(distEntry)) {
+    process.env.CLEARHAND_PORT = String(port ?? '');
+    const mod = await import(distEntry);
+    await mod.startServer(port ? { port: Number(port) } : {});
+    return;
+  }
+  // Dev checkout: run TypeScript directly.
+  const child = spawn('npx', ['tsx', path.join(pkgRoot, 'src', 'server', 'index.ts')], {
+    stdio: 'inherit',
+    env: { ...process.env, ...(port ? { CLEARHAND_PORT: String(port) } : {}) },
+  });
+  child.on('exit', (code) => process.exit(code ?? 0));
+}
+
+program
+  .command('start')
+  .description('Start the local ClearHand server + dashboard (binds to 127.0.0.1 only).')
+  .option('--port <port>')
+  .action(async (opts) => {
+    await startServer(opts.port);
+  });
+
+program
+  .command('demo')
+  .description('Init in demo mode (if needed) and start with seeded sample cases.')
+  .option('--port <port>', 'dashboard port', '3117')
+  .action(async (opts) => {
+    const configPath = path.join(projectDir, 'config.json');
+    if (!fs.existsSync(configPath)) {
+      program.commands.find((c) => c.name() === 'init').parse(['--demo', '--port', opts.port], { from: 'user' });
+    } else {
+      const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      if (!cfg.demoMode) {
+        cfg.demoMode = true;
+        fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2) + '\n');
+        console.log('Demo mode enabled in .clearhand/config.json');
+      }
+    }
+    await startServer(opts.port);
+  });
+
+program
+  .command('mcp')
+  .description('Run the ClearHand MCP server (stdio). Used by .mcp.json; not for humans.')
+  .action(async () => {
+    const distEntry = path.join(pkgRoot, 'dist', 'mcp', 'index.js');
+    if (fs.existsSync(distEntry)) {
+      await import(distEntry);
+      return;
+    }
+    const child = spawn('npx', ['tsx', path.join(pkgRoot, 'src', 'mcp', 'index.ts')], {
+      stdio: 'inherit',
+      env: process.env,
+    });
+    child.on('exit', (code) => process.exit(code ?? 0));
+  });
+
+program
+  .command('doctor')
+  .description('Check the local setup. --network prints the egress ledger next to live sockets.')
+  .option('--network', 'show what hosts ClearHand has contacted and current open connections')
+  .option('--port <port>', 'server port', '3117')
+  .action(async (opts) => {
+    console.log(`node: ${process.version}`);
+    try {
+      const { Entry } = await import('@napi-rs/keyring');
+      const probe = new Entry('clearhand-doctor', 'probe');
+      probe.setPassword('ok');
+      const ok = probe.getPassword() === 'ok';
+      probe.deletePassword();
+      console.log(`os keychain: ${ok ? 'available ✓' : 'NOT available'}`);
+    } catch {
+      console.log('os keychain: NOT available (encrypted-file or plain storage will be used)');
+    }
+    console.log(`project config: ${fs.existsSync(path.join(projectDir, 'config.json')) ? 'found ✓' : 'missing — run `clearhand init`'}`);
+
+    let status = null;
+    try {
+      const res = await fetch(`http://localhost:${opts.port}/api/status`);
+      status = await res.json();
+      console.log(`server: running on :${opts.port} ✓ ${status.demo_mode ? '(demo mode)' : ''}`);
+      console.log(`secret storage in use: ${status.secret_storage}`);
+      for (const [id, conn] of Object.entries(status.connections)) {
+        console.log(`connection ${id}: ${conn.connected ? 'connected ✓' : 'not connected'}`);
+      }
+    } catch {
+      console.log(`server: not running on :${opts.port} (start with \`clearhand start\`)`);
+    }
+
+    if (opts.network) {
+      console.log('\n— Egress ledger (every host ClearHand has ever contacted) —');
+      try {
+        const res = await fetch(`http://localhost:${opts.port}/api/trust`);
+        const trust = await res.json();
+        if (!trust.egress.length) console.log('  (no outbound connections recorded yet)');
+        for (const e of trust.egress) {
+          console.log(`  ${e.host}  ×${e.count}  last: ${e.last_at}  (${e.purpose})`);
+        }
+        console.log(`\ntelemetry: ${trust.telemetry}`);
+      } catch {
+        console.log('  server not running — start it to read the ledger');
+      }
+      console.log('\n— Live sockets (verify independently) —');
+      try {
+        const out = execSync(
+          `lsof -nP -iTCP -sTCP:ESTABLISHED | grep -E "node|clearhand" | awk '{print $9}' | sort -u`,
+          { encoding: 'utf8' },
+        );
+        console.log(out.trim() || '  (none)');
+      } catch {
+        console.log('  (lsof unavailable or nothing to show)');
+      }
+    }
+  });
+
+program.parseAsync();