ghost-dragon 4.2.1

package/src/commands/config.ts

@@ -0,0 +1,137 @@
+/**
+ * dragon config — inspect + set the agent's brain and credentials.
+ *
+ *   dragon config show
+ *   dragon config brain claude|openai|local
+ *   dragon config model claude-sonnet-4-6
+ *   dragon config local-model qwen2.5-coder:7b
+ *   dragon config key anthropic sk-ant-…      (stored in ~/.dragon/config.json, 0600)
+ *
+ * Env vars (ANTHROPIC_API_KEY / OPENAI_API_KEY / DRAGON_BRAIN / DRAGON_MODEL)
+ * always take precedence over stored config.
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+
+import type { Command } from 'commander'
+import { loadConfig, saveConfig, type DragonConfig } from '../config.js'
+import { resolveProvider, PROVIDERS } from '../brain/index.js'
+import { resolveAuth } from '../auth.js'
+import { C, success, error } from '../utils.js'
+import { panel, chrome, statusDot } from '../ui.js'
+import { chmodSync, existsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+function lock(): void {
+  try { chmodSync(join(homedir(), '.dragon', 'config.json'), 0o600) } catch { /* best-effort */ }
+}
+
+function redact(v?: string): string {
+  if (!v) return C.faint('—')
+  return C.accent(`set (…${v.slice(-4)})`)
+}
+
+export function registerConfigCommands(program: Command, _config: DragonConfig) {
+  const cfg = program.command('config').description('Inspect + set the Dragon agent brain + credentials')
+
+  cfg
+    .command('show')
+    .description('Show current config (secrets redacted)')
+    .action(() => {
+      const c = loadConfig()
+      const a = resolveAuth()
+      console.log()
+      console.log(`  ${C.accent.bold('brain')}`)
+      console.log(`    provider:    ${C.info(resolveProvider())}  ${C.faint('(default')} ${C.faint(c.brain?.provider ?? 'claude')}${C.faint(')')}`)
+      console.log(`    model:       ${C.info(c.brain?.model ?? C.faint('default'))}`)
+      console.log(`    local model: ${C.info(c.brain?.localModel ?? 'qwen2.5-coder:7b')}  ${C.faint(c.brain?.localBaseURL ?? 'http://localhost:11434/v1')}`)
+      console.log(`    keys:        anthropic ${redact(process.env.ANTHROPIC_API_KEY ?? c.brain?.keys?.anthropic)}   openai ${redact(process.env.OPENAI_API_KEY ?? c.brain?.keys?.openai)}`)
+      console.log(`  ${C.accent.bold('portal')} (account.ghosts.lk)`)
+      console.log(`    endpoint:    ${C.info(a.apiBase)}`)
+      console.log(`    auth:        ${a.mode === 'none' ? C.faint('none') : C.accent(a.mode)}${a.email ? C.faint(' · ' + a.email) : ''}`)
+      console.log()
+    })
+
+  cfg
+    .command('brain <provider>')
+    .description(`Set the default reasoning brain: ${PROVIDERS.join(' | ')}`)
+    .action((provider: string) => {
+      const p = provider.toLowerCase()
+      if (!(PROVIDERS as string[]).includes(p)) { error(`unknown provider "${provider}". One of: ${PROVIDERS.join(', ')}`); process.exitCode = 1; return }
+      const c = loadConfig()
+      c.brain = { ...(c.brain ?? {}), provider: p as 'claude' | 'openai' | 'local' | 'ghost' | 'worker' | 'custom' }
+      saveConfig(c)
+      success(`default brain → ${p}`)
+    })
+
+  cfg
+    .command('model <id>')
+    .description('Set the hosted model id (claude/openai), e.g. claude-sonnet-4-6')
+    .action((id: string) => {
+      const c = loadConfig()
+      c.brain = { ...(c.brain ?? {}), model: id }
+      saveConfig(c)
+      success(`model → ${id}`)
+    })
+
+  cfg
+    .command('local-model <tag>')
+    .description('Set the local (Ollama) model tag, e.g. qwen2.5-coder:7b')
+    .action((tag: string) => {
+      const c = loadConfig()
+      c.brain = { ...(c.brain ?? {}), localModel: tag }
+      saveConfig(c)
+      success(`local model → ${tag}`)
+    })
+
+  cfg
+    .command('key <provider> <key>')
+    .description('Store an API key (anthropic | openai) in ~/.dragon/config.json (0600)')
+    .action((provider: string, key: string) => {
+      const p = provider.toLowerCase()
+      if (p !== 'anthropic' && p !== 'openai') { error('provider must be "anthropic" or "openai"'); process.exitCode = 1; return }
+      const c = loadConfig()
+      c.brain = { ...(c.brain ?? {}), keys: { ...(c.brain?.keys ?? {}), [p]: key } }
+      saveConfig(c)
+      lock()
+      success(`${p} key stored (config locked to 0600). Env vars still override.`)
+    })
+
+  cfg
+    .command('custom-url <url>')
+    .description('Set a custom OpenAI-compatible endpoint (OpenRouter / vLLM / LM Studio)')
+    .action((url: string) => { const c = loadConfig(); c.brain = { ...(c.brain ?? {}), customBaseURL: url }; saveConfig(c); success(`custom endpoint → ${url}  (use: dragon config brain custom)`) })
+
+  cfg
+    .command('custom-model <id>')
+    .description('Set the model id for the custom endpoint')
+    .action((id: string) => { const c = loadConfig(); c.brain = { ...(c.brain ?? {}), customModel: id }; saveConfig(c); success(`custom model → ${id}`) })
+
+  // `dragon brains` — the model picker, as a command.
+  program
+    .command('brains')
+    .description('List reasoning brains + which are ready (the model picker)')
+    .action(() => {
+      const c = loadConfig()
+      const a = resolveAuth()
+      const active = resolveProvider()
+      const hasA = !!(process.env.ANTHROPIC_API_KEY || c.brain?.keys?.anthropic)
+      const hasO = !!(process.env.OPENAI_API_KEY || c.brain?.keys?.openai)
+      const hasC = !!(process.env.DRAGON_OPENAI_BASE || c.brain?.customBaseURL)
+      const ollama = ['/usr/local/bin/ollama', '/usr/bin/ollama', join(homedir(), '.local/bin/ollama')].some((p) => existsSync(p))
+      const rows: [string, boolean, string, string][] = [
+        ['claude', hasA, 'best for code', hasA ? '' : 'set ANTHROPIC_API_KEY'],
+        ['worker', a.mode !== 'none', 'free · our Cloudflare', a.mode !== 'none' ? '' : 'run `dragon login`'],
+        ['local', ollama, 'Ollama · private · free', ollama ? 'pull a model' : 'install Ollama'],
+        ['ghost', false, 'DragonSpark · our nano LLM', 'train + serve it'],
+        ['openai', hasO, 'GPT', hasO ? '' : 'set OPENAI_API_KEY'],
+        ['custom', hasC, 'any OpenAI-compatible endpoint', hasC ? '' : 'dragon config custom-url <url>'],
+      ]
+      const lines = rows.map(([id, ready, desc, need]) =>
+        `${id === active ? C.accent('▸') : ' '} ${statusDot(ready)} ${C.info(id.padEnd(7))} ${C.faint(desc)}${need ? C.faint('  · ' + need) : ''}`)
+      console.log()
+      console.log(panel(lines, { title: chrome('BRAINS') }))
+      console.log(`  ${C.faint('active:')} ${C.accent(active)}   ${C.faint('switch:')} dragon config brain <name>   ${C.faint('per-run:')} dragon chat --brain <name>`)
+    })
+}

package/src/commands/doctor.ts

@@ -0,0 +1,71 @@
+/**
+ * dragon doctor — one-glance health check of everything the agent depends on:
+ * node, the active brain + readiness, auth, Wyrm memory, Ollama, the skill library,
+ * disk, and config-file permissions. Read-only; green/amber/red per check.
+ *
+ * Copyright 2026 Ghost Protocol (Pvt) Ltd. All Rights Reserved.
+ */
+
+import type { Command } from 'commander'
+import { loadConfig, type DragonConfig } from '../config.js'
+import { C } from '../utils.js'
+import { panel, chrome } from '../ui.js'
+import { resolveAuth, whoami } from '../auth.js'
+import { resolveProvider } from '../brain/index.js'
+import { Wyrm } from '../wyrm/mcp.js'
+import { loadSkillLibrary } from '../agent/skills.js'
+import { existsSync, statSync, statfsSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+type Status = 'ok' | 'warn' | 'fail'
+const mark = (s: Status) => (s === 'ok' ? C.accent('●') : s === 'warn' ? C.high('◐') : C.critical('○'))
+const paint = (s: Status, v: string) => (s === 'fail' ? C.critical(v) : s === 'warn' ? C.high(v) : C.info(v))
+
+export function registerDoctorCommands(program: Command, _config: DragonConfig) {
+  program
+    .command('doctor')
+    .description('Health check — brain, auth, memory, models, disk, perms')
+    .action(async () => {
+      const rows: [Status, string, string][] = []
+      const cfg = loadConfig()
+      const a = resolveAuth()
+      const ollama = ['/usr/local/bin/ollama', '/usr/bin/ollama', join(homedir(), '.local/bin/ollama')].some(existsSync)
+
+      const major = Number(process.version.slice(1).split('.')[0])
+      rows.push([major >= 20 ? 'ok' : 'warn', 'node', `${process.version}${major >= 20 ? '' : ' (20+ recommended)'}`])
+
+      const active = resolveProvider()
+      const ready: Record<string, boolean> = {
+        claude: !!(process.env.ANTHROPIC_API_KEY || cfg.brain?.keys?.anthropic),
+        worker: a.mode !== 'none',
+        local: ollama,
+        openai: !!(process.env.OPENAI_API_KEY || cfg.brain?.keys?.openai),
+        custom: !!(process.env.DRAGON_OPENAI_BASE || cfg.brain?.customBaseURL),
+        ghost: false,
+      }
+      const brainOk = ready[active] ?? false
+      rows.push([brainOk ? 'ok' : 'warn', 'brain', `${active}${brainOk ? ' · ready' : ' · not set up (will fall back)'}`])
+
+      if (a.mode === 'none') rows.push(['warn', 'auth', 'not signed in — run `dragon login`'])
+      else { const me = await whoami(); rows.push([me.ok ? 'ok' : 'fail', 'auth', me.ok ? `${a.mode} · ${me.email ?? 'verified'}` : `${a.mode} · invalid (re-login)`]) }
+
+      const w = new Wyrm()
+      const wok = await w.connect()
+      rows.push([wok ? 'ok' : 'warn', 'memory', wok ? `Wyrm · ${w.toolSpecs().length} tools` : 'Wyrm unavailable (agent works without it)'])
+      await w.close()
+
+      rows.push([ollama ? 'ok' : 'warn', 'ollama', ollama ? 'installed' : 'not found (local brain needs it)'])
+      const sk = loadSkillLibrary()
+      rows.push([sk.count > 0 ? 'ok' : 'warn', 'skills', `${sk.count} loaded`])
+
+      try { const st = statfsSync(process.cwd()); const g = (st.bavail * st.bsize) / 1e9; rows.push([g > 2 ? 'ok' : g > 0.5 ? 'warn' : 'fail', 'disk', `${g.toFixed(1)} GB free`]) } catch { /* skip */ }
+      try { const m = statSync(join(homedir(), '.dragon', 'config.json')).mode & 0o777; rows.push([m === 0o600 ? 'ok' : 'warn', 'config', `~/.dragon/config.json ${m.toString(8)}${m === 0o600 ? '' : ' (expected 600)'}`]) } catch { /* no config yet */ }
+
+      console.log()
+      console.log(panel(rows.map(([s, k, v]) => `${mark(s)} ${C.faint(k.padEnd(7))} ${paint(s, v)}`), { title: chrome('DOCTOR') }))
+      const fails = rows.filter((r) => r[0] === 'fail').length
+      const warns = rows.filter((r) => r[0] === 'warn').length
+      console.log(`  ${fails ? C.critical(`${fails} failing`) : warns ? C.high(`${warns} warning${warns > 1 ? 's' : ''}`) : C.accent('all systems green')}`)
+    })
+}

package/src/commands/global.ts

@@ -0,0 +1,256 @@
+/**
+ * dragon init / dragon status / dragon doctor — Global commands
+ *
+ * - init:    Auto-detect product paths and write ~/.dragon/config.json
+ * - status:  Health check across all products + APIs
+ * - doctor:  Contract-test the cross-tool flows (lightweight)
+ */
+
+import type { Command } from 'commander'
+import type { DragonConfig } from '../config.js'
+import { saveConfig } from '../config.js'
+import { label, success, warn } from '../utils.js'
+import chalk from 'chalk'
+import { existsSync, statSync } from 'fs'
+import { join, resolve } from 'path'
+import { homedir } from 'os'
+
+const KNOWN_MARKERS: Record<string, { files: string[]; name: string }> = {
+  scale:   { files: ['includes/payment.php', 'admin/orders.php', 'api/health.php'], name: 'DragonScale' },
+  wyrm:    { files: ['packages/mcp-server/src/index.ts', 'install.sh'], name: 'Wyrm' },
+  pentest: { files: ['phantomdragon.py', 'phantom_dragon_ai/control_api.py'], name: 'PhantomDragon' },
+  keep:    { files: ['src/engine/sentinel.rs', 'src/engine/shield.rs'], name: 'DragonKeep' },
+  net:     { files: ['packages/api/src/server.ts', 'pnpm-workspace.yaml'], name: 'DragonNet' },
+}
+
+function detectProduct(dir: string, product: string): boolean {
+  const markers = KNOWN_MARKERS[product]
+  if (!markers) return false
+  return markers.files.some(f => existsSync(join(dir, f)))
+}
+
+async function ping(url: string, timeoutMs = 1500): Promise<{ ok: boolean; status?: number; data?: any; error?: string }> {
+  try {
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), timeoutMs)
+    try {
+      const res = await fetch(url, { signal: controller.signal })
+      const text = await res.text()
+      let parsed: any = null
+      try { parsed = JSON.parse(text) } catch { parsed = text }
+      return { ok: res.ok, status: res.status, data: parsed }
+    } finally { clearTimeout(timer) }
+  } catch (e) {
+    return { ok: false, error: String(e) }
+  }
+}
+
+export function registerGlobalCommands(program: Command, config: DragonConfig) {
+
+  // --- init ---
+  program
+    .command('init')
+    .description('Auto-detect products and configure dragon CLI')
+    .option('-d, --dir <dir>', 'Directory to scan', resolve('.'))
+    .action(async (opts) => {
+      console.log(label('Dragon'), 'Initializing...\n')
+
+      const scanDirs = [
+        opts.dir,
+        join(homedir(), 'Git Projects'),
+        join(homedir(), 'Projects'),
+        join(homedir(), 'src'),
+      ]
+
+      const found: Record<string, string> = {}
+
+      for (const baseDir of scanDirs) {
+        if (!existsSync(baseDir)) continue
+        const { readdirSync } = await import('fs')
+        const entries = readdirSync(baseDir, { withFileTypes: true })
+
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue
+          const fullPath = join(baseDir, entry.name)
+
+          for (const [product, _] of Object.entries(KNOWN_MARKERS)) {
+            if (!found[product] && detectProduct(fullPath, product)) {
+              found[product] = fullPath
+            }
+          }
+        }
+      }
+
+      // Update config
+      for (const [product, path] of Object.entries(found)) {
+        (config.products as any)[product].path = path
+        success(`${KNOWN_MARKERS[product].name} → ${chalk.dim(path)}`)
+      }
+
+      for (const [product, markers] of Object.entries(KNOWN_MARKERS)) {
+        if (!found[product]) {
+          warn(`${markers.name} not found`)
+        }
+      }
+
+      saveConfig(config)
+      console.log()
+      success(`Config saved to ${chalk.dim('~/.dragon/config.json')}`)
+    })
+
+  // --- status ---
+  program
+    .command('status')
+    .description('Health check across all products + APIs')
+    .action(async () => {
+      console.log(label('Dragon'), 'System status:\n')
+
+      // DragonScale
+      const scaleUrl = config.products.scale.url
+      const scalePath = config.products.scale.path
+      if (scalePath && existsSync(join(scalePath, 'index.php'))) {
+        console.log(`  ${chalk.green('●')} DragonScale          ${chalk.dim(scaleUrl || scalePath)}  ${chalk.green('Installed')}`)
+      } else {
+        console.log(`  ${chalk.dim('○')} DragonScale          ${chalk.dim('Not configured')}`)
+      }
+
+      // Wyrm
+      const wyrmPath = config.products.wyrm.path
+      const wyrmPort = config.products.wyrm.port || 3333
+      if (wyrmPath) {
+        const r = await ping(`http://localhost:${wyrmPort}/health`)
+        if (r.ok) {
+          console.log(`  ${chalk.green('●')} Wyrm                 ${chalk.dim(`localhost:${wyrmPort}`)}  ${chalk.green('Online')}`)
+        } else {
+          console.log(`  ${chalk.yellow('●')} Wyrm                 ${chalk.dim(`localhost:${wyrmPort}`)}  ${chalk.yellow('Installed · Offline')}`)
+        }
+      } else {
+        console.log(`  ${chalk.dim('○')} Wyrm                 ${chalk.dim('Not configured')}`)
+      }
+
+      // PhantomDragon engine + control_api
+      const pentestPath = config.products.pentest.path
+      if (pentestPath && (existsSync(join(pentestPath, 'phantom_dragon_ai/control_api.py'))
+                         || existsSync(join(pentestPath, 'phantomdragon.py')))) {
+        console.log(`  ${chalk.green('●')} PhantomDragon engine ${chalk.dim(pentestPath)}  ${chalk.green('Installed')}`)
+        const apiPort = config.products.pentest.controlPort ?? 4091
+        const uiPort = config.products.pentest.controlUiPort ?? 4090
+        const apiR = await ping(`http://localhost:${apiPort}/health`)
+        if (apiR.ok && apiR.data) {
+          const d = apiR.data as any
+          console.log(`    ${chalk.green('●')} Control API        ${chalk.dim(`localhost:${apiPort}`)}  ${chalk.green('Online')}  ${chalk.dim(`(${d.scan_count} scans, ${d.active_runs} runs)`)}`)
+        } else {
+          console.log(`    ${chalk.yellow('●')} Control API        ${chalk.dim(`localhost:${apiPort}`)}  ${chalk.yellow('Offline')}`)
+        }
+        const uiR = await ping(`http://localhost:${uiPort}/`)
+        if (uiR.ok) {
+          console.log(`    ${chalk.green('●')} Control Dashboard  ${chalk.dim(`localhost:${uiPort}`)}  ${chalk.green('Online')}`)
+        } else {
+          console.log(`    ${chalk.yellow('●')} Control Dashboard  ${chalk.dim(`localhost:${uiPort}`)}  ${chalk.yellow('Offline')}`)
+        }
+      } else {
+        console.log(`  ${chalk.dim('○')} PhantomDragon engine ${chalk.dim('Not configured')}`)
+      }
+
+      // DragonNet
+      const netPath = config.products.net.path
+      if (netPath && existsSync(join(netPath, 'pnpm-workspace.yaml'))) {
+        console.log(`  ${chalk.green('●')} DragonNet            ${chalk.dim(netPath)}  ${chalk.green('Installed')}`)
+        const apiPort = config.products.net.apiPort ?? 4080
+        const uiPort = config.products.net.uiPort ?? 4081
+        const apiR = await ping(`http://localhost:${apiPort}/health`)
+        if (apiR.ok) {
+          console.log(`    ${chalk.green('●')} OSINT API          ${chalk.dim(`localhost:${apiPort}`)}  ${chalk.green('Online')}`)
+        } else {
+          console.log(`    ${chalk.yellow('●')} OSINT API          ${chalk.dim(`localhost:${apiPort}`)}  ${chalk.yellow('Offline')}`)
+        }
+        const uiR = await ping(`http://localhost:${uiPort}/`)
+        if (uiR.ok) {
+          console.log(`    ${chalk.green('●')} OSINT Dashboard    ${chalk.dim(`localhost:${uiPort}`)}  ${chalk.green('Online')}`)
+        } else {
+          console.log(`    ${chalk.yellow('●')} OSINT Dashboard    ${chalk.dim(`localhost:${uiPort}`)}  ${chalk.yellow('Offline')}`)
+        }
+      } else {
+        console.log(`  ${chalk.dim('○')} DragonNet            ${chalk.dim('Not configured')}`)
+      }
+
+      // Phantom Memory
+      const memPath = join(homedir(), '.copilot', 'phantom-memory.db')
+      if (existsSync(memPath)) {
+        const bytes = statSync(memPath).size
+        const apiPort = config.products.pentest.controlPort ?? 4091
+        const memR = await ping(`http://localhost:${apiPort}/v1/memory`)
+        let targetCount = '—'
+        if (memR.ok && memR.data?.targets) targetCount = String(memR.data.targets.length)
+        const sizeStr = bytes < 1024*1024 ? `${(bytes/1024).toFixed(1)} KB` : `${(bytes/1024/1024).toFixed(1)} MB`
+        console.log(`  ${chalk.green('●')} Phantom Memory       ${chalk.dim(memPath)}  ${chalk.green(`${targetCount} targets · ${sizeStr}`)}`)
+      } else {
+        console.log(`  ${chalk.dim('○')} Phantom Memory       ${chalk.dim('No DB yet — runs auto-create on first scan')}`)
+      }
+
+      // DragonKeep (Rust defensive backbone)
+      const keepPath = config.products.keep.path
+      if (keepPath && existsSync(join(keepPath, 'Cargo.toml'))) {
+        const dbgBin = join(keepPath, 'target/debug/dragonkeep')
+        const relBin = join(keepPath, 'target/release/dragonkeep')
+        const built = existsSync(relBin) || existsSync(dbgBin)
+        const label_ = built ? chalk.green('Installed · built') : chalk.yellow('Installed · not yet built')
+        console.log(`  ${chalk.green('●')} DragonKeep           ${chalk.dim(keepPath)}  ${label_}`)
+        if (!built) {
+          console.log(`    ${chalk.dim('→ cargo build --release in ' + keepPath)}`)
+        }
+      } else {
+        console.log(`  ${chalk.dim('○')} DragonKeep           ${chalk.dim('Not configured')}`)
+      }
+      console.log()
+    })
+
+  // --- contract (cross-tool flow checks; `dragon doctor` is the health panel) ---
+  program
+    .command('contract')
+    .description('Contract-test cross-tool flows (Phantom Memory / Control API / DragonNet / Wyrm)')
+    .action(async () => {
+      console.log(label('Dragon'), 'Contract checks:\n')
+
+      const checks: Array<{ name: string; ok: boolean; note?: string }> = []
+
+      // Phantom Memory exists?
+      const memPath = join(homedir(), '.copilot', 'phantom-memory.db')
+      checks.push({ name: 'Phantom Memory DB present', ok: existsSync(memPath), note: memPath })
+
+      // Control API speaks memory?
+      const apiPort = config.products.pentest.controlPort ?? 4091
+      const memR = await ping(`http://localhost:${apiPort}/v1/memory`)
+      checks.push({
+        name: 'Control API /v1/memory reachable',
+        ok: memR.ok,
+        note: memR.ok ? `${memR.data?.targets?.length ?? 0} targets` : memR.error,
+      })
+
+      // DragonNet API reachable?
+      const dnPort = config.products.net.apiPort ?? 4080
+      const dnR = await ping(`http://localhost:${dnPort}/health`)
+      checks.push({
+        name: 'DragonNet /health reachable',
+        ok: dnR.ok,
+        note: dnR.ok ? 'OK' : 'offline (run: dragon osint serve)',
+      })
+
+      // Wyrm reachable?
+      const wyrmR = await ping(`http://localhost:${config.products.wyrm.port ?? 3333}/health`)
+      checks.push({
+        name: 'Wyrm /health reachable',
+        ok: wyrmR.ok,
+        note: wyrmR.ok ? 'OK' : 'offline (Wyrm integration becomes best-effort)',
+      })
+
+      checks.forEach((c) => {
+        const sym = c.ok ? chalk.green('✓') : chalk.yellow('⚠')
+        console.log(`  ${sym} ${c.name.padEnd(40)}  ${chalk.dim(c.note ?? '')}`)
+      })
+      console.log()
+      const failing = checks.filter((c) => !c.ok).length
+      if (failing === 0) success('All contract checks passing')
+      else warn(`${failing} check(s) need attention — see ~/Git Projects/dragon-cli/docs/SYSTEM-PREMORTEM.md`)
+    })
+}

package/src/commands/keep.ts

@@ -0,0 +1,67 @@
+/**
+ * dragon keep — DragonKeep defensive engine bridge.
+ *
+ * DragonKeep ships independently as a Rust binary (`dragonkeep`); this
+ * subcommand is a thin shim that surfaces its status + control loop
+ * from the unified `dragon` CLI so operators don't need to memorise
+ * a second toolchain.
+ */
+
+import type { Command } from 'commander'
+import type { DragonConfig } from '../config.js'
+import { spawnSync } from 'node:child_process'
+import { error, info, label } from '../utils.js'
+import chalk from 'chalk'
+
+function which(bin: string): string | null {
+  const r = spawnSync('command', ['-v', bin], { shell: true, encoding: 'utf-8' })
+  const out = (r.stdout || '').trim()
+  return out || null
+}
+
+function passthrough(args: string[]): number {
+  const bin = which('dragonkeep')
+  if (!bin) {
+    error('dragonkeep binary not on PATH')
+    info('install it via `dragon install dragonkeep` or build from source in ~/Git Projects/DragonKeep')
+    return 127
+  }
+  const r = spawnSync(bin, args, { stdio: 'inherit' })
+  return r.status ?? 1
+}
+
+export function registerKeepCommands(program: Command, _config: DragonConfig) {
+  const keep = program
+    .command('keep')
+    .description('DragonKeep — defensive engine (NGAV · MDR · compliance · SOAR)')
+
+  keep
+    .command('status')
+    .description('Show DragonKeep daemon status + active engines')
+    .action(() => { process.exit(passthrough(['status'])) })
+
+  keep
+    .command('scan [path]')
+    .description('Run an on-demand AV scan')
+    .action((path?: string) => { process.exit(passthrough(['scan', ...(path ? [path] : [])])) })
+
+  keep
+    .command('engines')
+    .description('List the active defensive engines')
+    .action(() => { process.exit(passthrough(['engines'])) })
+
+  // Default action: print a short summary instead of dumping help.
+  keep.action(() => {
+    console.log()
+    console.log(`  ${label('DragonKeep')}  ${chalk.dim('defensive engine · 28 modules · NGAV + MDR')}`)
+    console.log()
+    console.log(`  ${chalk.dim('dragon keep status')}   ${chalk.dim('— daemon + engine health')}`)
+    console.log(`  ${chalk.dim('dragon keep scan')}     ${chalk.dim('— on-demand scan')}`)
+    console.log(`  ${chalk.dim('dragon keep engines')}  ${chalk.dim('— list active engines')}`)
+    console.log()
+    if (!which('dragonkeep')) {
+      info(`run ${chalk.green('dragon install dragonkeep')} to install the daemon`)
+      console.log()
+    }
+  })
+}