kronk-cli 0.1.0 → 0.1.1

package/README.md

@@ -23,8 +23,67 @@ entirely on your machine. No network, no API key, no per-token cost.
   2104→812 tok · 61.3 tok/s · ttft 240ms · 1980 cached
 ```
 
+[![ci](https://github.com/BardiaN/kronk-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/BardiaN/kronk-cli/actions/workflows/ci.yml)
+[![security](https://github.com/BardiaN/kronk-cli/actions/workflows/security.yml/badge.svg)](https://github.com/BardiaN/kronk-cli/actions/workflows/security.yml)
+[![codeql](https://github.com/BardiaN/kronk-cli/actions/workflows/codeql.yml/badge.svg)](https://github.com/BardiaN/kronk-cli/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/BardiaN/kronk-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/BardiaN/kronk-cli)
+[![npm](https://img.shields.io/npm/v/kronk-cli?logo=npm)](https://www.npmjs.com/package/kronk-cli)
+
 **Zero dependencies.** It is `fetch` and `readline` against Kronk's OpenAI-compatible API.
 
+**It talks to your Kronk server and nothing else** — enforced in CI by running the whole thing
+inside a network namespace with only loopback. See [Verifying this build](#verifying-this-build).
+
+---
+
+## Verifying this build
+
+This tool reads your files and runs your commands. You should not have to take anyone's word for
+what it does with them — so every claim here is machine-checkable.
+
+### Check the artifact came from this source
+
+Every release tarball carries a signed attestation binding it to the repository, commit and
+workflow run that produced it:
+
+```bash
+gh attestation verify kronk-cli-*.tgz --repo BardiaN/kronk-cli
+```
+
+npm packages carry the same provenance, shown as a **Provenance** panel on the
+[package page](https://www.npmjs.com/package/kronk-cli), and verifiable locally:
+
+```bash
+npm audit signatures
+```
+
+Both fail if the artifact was built anywhere other than this repository's CI.
+
+### Read the scan results yourself
+
+| | |
+|---|---|
+| [Security tab](https://github.com/BardiaN/kronk-cli/security/code-scanning) | every CodeQL and Scorecard finding, open and closed |
+| [Scorecard report](https://scorecard.dev/viewer/?uri=github.com/BardiaN/kronk-cli) | per-check supply-chain scores, updated weekly |
+| [Actions](https://github.com/BardiaN/kronk-cli/actions/workflows/security.yml) | full logs of every scan, including the egress proof |
+
+These are published by GitHub and the OpenSSF, not by this project. Nobody here can edit them.
+
+### Check it does not phone home
+
+The strongest claim, and the easiest to test yourself:
+
+```bash
+# Linux — run it with no network except loopback
+sudo unshare --net bash -c 'ip link set lo up; kronk-cli --models'
+```
+
+CI runs exactly this on every pull request against a stub server, and a second step proves the
+namespace was really isolated so a pass cannot be a false negative.
+
+Or just read `src/` — it is under 1,500 lines with no dependencies, and every network call goes
+through one function in `src/client.js`.
+
 ---
 
 ## Requirements

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kronk-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "A Claude-Code-style terminal agent for local models served by Kronk.",
   "license": "Apache-2.0",
   "type": "module",

package/src/config.js

@@ -35,6 +35,27 @@ export const config = {
   rcPath: RC,
 };
 
+/**
+ * File contents and command output leave this process in request bodies, which
+ * is the whole job. Over loopback that is fine. Pointed at a remote host over
+ * plain HTTP it is not, so say so once rather than letting it pass silently.
+ */
+export function warnIfInsecure(warn = console.error) {
+  let url;
+  try { url = new URL(config.baseUrl); } catch { return false; }
+
+  const local = ['localhost', '127.0.0.1', '::1', '0.0.0.0'].includes(url.hostname)
+    || url.hostname.endsWith('.local')
+    || url.hostname === 'host.docker.internal';
+
+  if (url.protocol === 'https:' || local) return false;
+
+  warn(`  warning: ${config.baseUrl} is remote and unencrypted.`);
+  warn('  File contents and command output will cross the network in clear text.');
+  warn('  Use https, or an SSH tunnel to keep the endpoint on localhost.');
+  return true;
+}
+
 export const headers = () => ({
   'Content-Type': 'application/json',
   Authorization: `Bearer ${config.token}`,

package/src/index.js

@@ -2,7 +2,7 @@
 import readline from 'node:readline/promises';
 import { stdin, stdout } from 'node:process';
 import { readFile } from 'node:fs/promises';
-import { config, DEFAULT_MODEL } from './config.js';
+import { config, DEFAULT_MODEL, warnIfInsecure } from './config.js';
 import { listModels, listModelDetails, listLoaded, modelLimits, tokenize } from './client.js';
 import { runTurn, SYSTEM, SYSTEM_AUTO } from './agent.js';
 import { c, banner, fmtContext, statusLine } from './ui.js';
@@ -322,6 +322,9 @@ async function oneShot(prompt) {
 }
 
 async function main() {
+  // Before anything reaches the network, on every path through the program.
+  warnIfInsecure();
+
   if (SHOW_MODELS) { await showModels(); return; }
   if (SHOW_MCP) { await showMcp(); process.exit(0); }