mneme-ai 3.146.0 → 3.147.0

package/dist/commands/posture.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `mneme posture` (v3.147.0) — the signed Agent Security Posture report.
+ * Composes MUTAGEN (input-guardrail breach test) + ESCALON (tool-graph escalation +
+ * poisoning) into one A–F graded, Ed25519-signed certificate.
+ *
+ *   mneme posture scan --file agent.json
+ *   mneme posture verify --file posture.json
+ */
+import type { Command } from "commander";
+export declare function registerPostureCommands(program: Command): void;
+//# sourceMappingURL=posture.d.ts.map

package/dist/commands/posture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/commands/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoC9D"}

package/dist/commands/posture.js

@@ -0,0 +1,79 @@
+/**
+ * `mneme posture` (v3.147.0) — the signed Agent Security Posture report.
+ * Composes MUTAGEN (input-guardrail breach test) + ESCALON (tool-graph escalation +
+ * poisoning) into one A–F graded, Ed25519-signed certificate.
+ *
+ *   mneme posture scan --file agent.json
+ *   mneme posture verify --file posture.json
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { posture } from "@mneme-ai/core";
+function out(s) { process.stdout.write(s + "\n"); }
+export function registerPostureCommands(program) {
+    const c = program.command("posture")
+        .description("🛡 AGENT SECURITY POSTURE — grade an AI agent's whole safety surface (input guardrail via MUTAGEN + tool-graph escalation/poisoning via ESCALON) into one A–F, Ed25519-signed report. ★HONEST: grades the DECLARED config against a known attack space — a posture assessment, not a live pentest.");
+    c.command("scan").description("grade an agent profile (JSON: {name, guardrail:'mneme|naive|none', tools:[...]})")
+        .option("--file <file>", "agent profile JSON")
+        .option("--out <file>", "write the signed posture certificate JSON")
+        .option("--json", "print the report JSON")
+        .action((o) => {
+        let raw = "";
+        try {
+            raw = o.file ? readFileSync(o.file, "utf8") : readFileSync(0, "utf8");
+        }
+        catch {
+            out("⛔ provide --file <agent.json> (or pipe it on stdin)");
+            process.exitCode = 2;
+            return;
+        }
+        let profile;
+        try {
+            profile = JSON.parse(raw);
+        }
+        catch {
+            out("⛔ not valid JSON");
+            process.exitCode = 2;
+            return;
+        }
+        const { report, receipt } = posture.certifyPosture(process.cwd(), profile);
+        if (o.out)
+            writeFileSync(o.out, JSON.stringify(receipt, null, 2) + "\n");
+        if (o.json) {
+            out(JSON.stringify(report, null, 2));
+            return;
+        }
+        const mark = report.grade === "A" || report.grade === "B" ? "🟢" : report.grade === "C" || report.grade === "D" ? "🟠" : "🔴";
+        out(`${mark} AGENT POSTURE — ${report.agent}: grade ${report.grade} (${report.score}/100)`);
+        out(`   input '${report.input.guardrail}': ${Math.round(report.input.breachRate * 100)}% of ${report.input.tested} variants breach · tools: ${report.toolGraph.verdict} (${report.toolGraph.critical} critical, ${report.toolGraph.poisoned} poisoned)`);
+        for (const f of report.findings)
+            out(`   ${f}`);
+        out(`   signed ${receipt.issuerFingerprint} · verify offline: mneme posture verify`);
+    });
+    c.command("verify").description("verify a posture certificate OFFLINE (Ed25519 + grade re-derives from score)")
+        .option("--file <file>", "posture certificate JSON")
+        .action((o) => {
+        let raw = "";
+        try {
+            raw = o.file ? readFileSync(o.file, "utf8") : readFileSync(0, "utf8");
+        }
+        catch {
+            out("⛔ provide --file <posture.json>");
+            process.exitCode = 2;
+            return;
+        }
+        let receipt;
+        try {
+            receipt = JSON.parse(raw);
+        }
+        catch {
+            out("⛔ not valid JSON");
+            process.exitCode = 2;
+            return;
+        }
+        const v = posture.verifyPosture(receipt);
+        out(v.valid ? `🟢 VALID — grade ${v.grade} (${v.score}/100)` : `🔴 INVALID — ${v.reason}`);
+        if (!v.valid)
+            process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=posture.js.map

package/dist/commands/posture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/commands/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;SACjC,WAAW,CAAC,oSAAoS,CAAC,CAAC;IAErT,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,kFAAkF,CAAC;SAC9G,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC;SAC7C,MAAM,CAAC,cAAc,EAAE,2CAA2C,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,CAAC,CAAkD,EAAE,EAAE;QAC7D,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAC9E,MAAM,CAAC;YAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnG,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAuD,CAAC,CAAC;QAC3H,IAAI,CAAC,CAAC,GAAG;YAAE,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9H,GAAG,CAAC,GAAG,IAAI,oBAAoB,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC;QAC5F,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,SAAS,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,MAAM,6BAA6B,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,SAAS,CAAC,QAAQ,cAAc,MAAM,CAAC,SAAS,CAAC,QAAQ,YAAY,CAAC,CAAC;QACzP,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;YAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,GAAG,CAAC,aAAa,OAAO,CAAC,iBAAiB,yCAAyC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,8EAA8E,CAAC;SAC5G,MAAM,CAAC,eAAe,EAAE,0BAA0B,CAAC;SACnD,MAAM,CAAC,CAAC,CAAoB,EAAE,EAAE;QAC/B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAC9E,MAAM,CAAC;YAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/E,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnG,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoNA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAunNvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAqNA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwnNvD"}

package/dist/index.js

@@ -143,6 +143,7 @@ import { registerCosmosCommands } from "./commands/cosmos.js";
 import { registerLedgerCommands } from "./commands/honesty_ledger.js";
 import { registerMutagenCommands } from "./commands/mutagen.js";
 import { registerEscalonCommands } from "./commands/escalon.js";
+import { registerPostureCommands } from "./commands/posture.js";
 import { registerMoatCommands } from "./commands/moat.js";
 import { attachRegretOracle } from "./commands/regret.js";
 import { registerTrustCommands } from "./commands/trust.js";
@@ -4843,6 +4844,7 @@ export async function run(argv) {
     registerLedgerCommands(program);
     registerMutagenCommands(program);
     registerEscalonCommands(program);
+    registerPostureCommands(program);
     registerMoatCommands(program);
     // ─── Trust calibrator (v1.31.0) -- per-subsystem precision/recall/band
     registerTrustCommands(program);