opena2a-cli 0.1.2 → 0.3.0

package/README.md

@@ -52,6 +52,8 @@ Run `opena2a init` in any project directory to get an instant security assessmen
   MCP config           found
   -----------------------------------------------
   Trust Score      30 / 100  [Grade: F]
+  Shield Posture   25 / 100  (CRITICAL)
+  Products         1/7 active
 
   Next Steps
   -----------------------------------------------
@@ -177,6 +179,228 @@ opena2a config contribute on      # Enable community data sharing
 opena2a config llm on             # Enable LLM-powered command matching
 ```
 
+## Shield: Unified Security Orchestration
+
+Shield ties all OpenA2A products into a single security layer for AI coding assistants. It provides a tamper-evident event log, policy evaluation, runtime monitoring, session identification, integrity verification, and LLM-powered analysis.
+
+```bash
+opena2a shield init              # Full environment scan + policy generation
+opena2a shield status            # Product availability and integrity state
+opena2a shield selfcheck         # Run integrity checks across all subsystems
+```
+
+### How Shield protects your workstation
+
+| Capability | What it does | Status |
+|-----------|-------------|--------|
+| **Credential scanning** | Detects hardcoded API keys (Anthropic, OpenAI, AWS, Google, GitHub) | Active |
+| **Scope drift detection** | Finds API keys that silently access unintended services (DRIFT-001, DRIFT-002) | Active |
+| **Tamper-evident event log** | SHA-256 hash-chained event log -- any modification breaks the chain | Active |
+| **Policy evaluation** | Allow/deny rules for processes, credentials, network, filesystem, MCP servers | Active |
+| **Session identification** | Detects which AI assistant is running (Claude Code, Cursor, Copilot, Windsurf) | Active |
+| **Config integrity** | Signs config files and detects unauthorized modifications | Active |
+| **ARP bridge** | Imports runtime protection events from HackMyAgent's ARP into Shield's log | Active |
+| **Posture scoring** | 0-100 security score based on active products, policy, hooks, credentials | Active |
+| **LLM intelligence** | AI-powered policy suggestions, anomaly explanations, incident triage | Active (opt-in) |
+| **Integrity selfcheck** | Verifies policy, shell hooks, event chain, process, and artifact signatures | Active |
+| **Lockdown mode** | Enters lockdown when integrity checks fail; requires explicit recovery | Active |
+| **Adaptive baselines** | Learns per-agent behavior, tracks stability across sessions, suggests policies | Active |
+| **Enforcement mode** | Shell hooks check policy in enforce mode and block denied commands | Active |
+| **HTML posture report** | Interactive dark-theme HTML report with severity chart, filters, and agent activity | Active |
+
+Shield operates in three modes:
+- **Monitor** (default): Logs and surfaces security events for developer review.
+- **Enforce**: Shell hooks call `opena2a shield evaluate` before each command. Denied commands are blocked with exit code 1.
+- **Baseline learning**: Observes agent behavior across sessions and suggests policy rules when behavior stabilizes.
+
+### Subcommands
+
+#### `opena2a shield init`
+
+Full environment scan: detects project type, scans for credentials, discovers AI assistants, MCP servers, and OAuth sessions, generates a YAML policy file, installs shell hooks, and writes a genesis event to the tamper-evident log.
+
+```bash
+opena2a shield init                    # Scan current directory
+opena2a shield init --dir ./my-agent   # Scan specific directory
+opena2a shield init --format json      # Machine-readable output
+```
+
+#### `opena2a shield status`
+
+Shows product availability, policy mode, shell integration, and integrity state.
+
+```bash
+opena2a shield status
+opena2a shield status --format json
+```
+
+#### `opena2a shield log`
+
+Query the tamper-evident event log with filters.
+
+```bash
+opena2a shield log                           # Last 20 events
+opena2a shield log --count 50               # Last 50 events
+opena2a shield log --severity high          # High+ severity only
+opena2a shield log --source arp             # ARP runtime events
+opena2a shield log --agent claude-code      # Events from Claude Code
+opena2a shield log --since 7d              # Last 7 days
+opena2a shield log --format json           # JSON output
+```
+
+#### `opena2a shield selfcheck`
+
+Runs five integrity checks: policy hash, shell hook content, event chain validity, process binary, and artifact signatures. Returns `healthy`, `degraded`, or `compromised` status.
+
+```bash
+opena2a shield selfcheck
+opena2a shield check                    # Alias
+opena2a shield selfcheck --format json
+```
+
+#### `opena2a shield policy`
+
+Show the loaded security policy (mode, rule counts, agent overrides).
+
+```bash
+opena2a shield policy
+opena2a shield policy --format json
+```
+
+#### `opena2a shield evaluate`
+
+Evaluate an action against the loaded policy. Returns `ALLOWED`, `BLOCKED`, or `MONITORED`. In enforce mode, shell hooks call this before every command and block denied actions.
+
+```bash
+opena2a shield evaluate --category processes --agent claude-code
+opena2a shield evaluate "curl evil.com"    # Evaluate a command string
+opena2a shield evaluate --format json
+```
+
+#### `opena2a shield monitor`
+
+Import ARP (Agent Runtime Protection) events into Shield's hash-chained log and display runtime stats.
+
+```bash
+opena2a shield monitor                      # Import events + show stats
+opena2a shield monitor --agent cursor       # Tag imported events
+opena2a shield monitor --since 7d          # Stats for last 7 days
+opena2a shield monitor --format json
+```
+
+#### `opena2a shield report`
+
+Generate a security posture report from event data. Includes severity breakdown, agent activity, policy violations, and top actions. Supports interactive HTML output.
+
+```bash
+opena2a shield report                       # Last 7 days (text)
+opena2a shield report --report posture.html # Interactive HTML report
+opena2a shield report --since 30d          # Last 30 days
+opena2a shield report --analyze            # Include LLM narrative
+opena2a shield report --format json
+```
+
+#### `opena2a shield session`
+
+Detect the current AI coding assistant session. Identifies Claude Code, Cursor, GitHub Copilot, Windsurf, Aider, and Continue.
+
+```bash
+opena2a shield session
+opena2a shield session --verbose            # Show raw detection signals
+opena2a shield session --format json
+```
+
+#### `opena2a shield recover`
+
+Exit lockdown mode after integrity failures. Optionally re-verify before lifting lockdown.
+
+```bash
+opena2a shield recover                      # Exit lockdown
+opena2a shield recover --verify             # Verify first, then exit
+```
+
+#### `opena2a shield suggest`
+
+LLM-powered policy suggestion based on observed agent behavior. Requires LLM backend (enable with `opena2a config llm on`).
+
+```bash
+opena2a shield suggest                      # Suggest policy from all events
+opena2a shield suggest --agent cursor       # For specific agent
+opena2a shield suggest --format json
+```
+
+#### `opena2a shield explain`
+
+LLM-powered explanation of security events. Provides severity assessment, risk factors, and recommended actions.
+
+```bash
+opena2a shield explain                      # Explain most recent event
+opena2a shield explain --count 5           # Explain last 5 events
+opena2a shield explain --severity high     # High+ severity only
+```
+
+#### `opena2a shield triage`
+
+LLM-powered incident classification. Correlates multiple events and classifies as false-positive, suspicious, or confirmed-threat.
+
+```bash
+opena2a shield triage                       # Triage high+ severity events
+opena2a shield triage --severity medium    # Include medium severity
+opena2a shield triage --agent windsurf     # For specific agent
+```
+
+#### `opena2a shield baseline`
+
+Manage per-agent behavioral baselines. Baselines track observed actions across sessions and compute stability scores to determine when behavior has converged enough to generate policy recommendations.
+
+```bash
+opena2a shield baseline                    # List all baselines
+opena2a shield baseline claude-code        # Show detail for specific agent
+opena2a shield baseline --format json
+```
+
+Phases: **learning** (collecting observations) -> **stabilizing** (fewer new behaviors) -> **stable** (ready for policy generation). Stability is measured as the fraction of recent sessions with no previously-unseen behavior.
+
+### CI Integration
+
+Shield includes a GitHub Actions workflow for automated security checks on every PR.
+
+```bash
+# Copy the example workflow to your project
+cp node_modules/opena2a-cli/examples/github-actions-shield.yml .github/workflows/shield.yml
+```
+
+See `examples/github-actions-shield.yml` for a minimal copy-paste-ready workflow, or `.github/workflows/shield-check.yml` for the full implementation with PR comment integration.
+
+### Event Log Format
+
+Shield maintains a tamper-evident event log at `~/.opena2a/shield/events.jsonl`. Each event is SHA-256 hash-chained to the previous event, starting from a genesis hash. Any modification to a past event breaks the chain and is detected by `selfcheck`.
+
+```
+[2026-03-02T12:00:00Z] [HIGH] process.anomaly -> curl evil.com (monitored)
+[2026-03-02T12:01:00Z] [CRITICAL] prompt.threat -> injection-attempt (blocked)
+[2026-03-02T12:02:00Z] [INFO] process.spawn -> /usr/bin/ls (allowed)
+```
+
+### Quick Start
+
+```bash
+# 1. Initialize Shield in your project
+opena2a shield init
+
+# 2. Check what AI assistants are running
+opena2a shield session
+
+# 3. View security events
+opena2a shield log --severity medium
+
+# 4. Generate a posture report
+opena2a shield report
+
+# 5. Run integrity verification
+opena2a shield selfcheck
+```
+
 ## Smart Input Modes
 
 The CLI includes built-in intelligence for command discovery:
@@ -234,7 +458,7 @@ All commands support `--format json` and `--ci` flags for pipeline integration:
 |--------|------|----------|
 | Text | `--format text` (default) | Human-readable terminal output |
 | JSON | `--format json` | CI pipelines, programmatic consumption |
-| HTML | `--report <path>` | Interactive report with filtering (protect command) |
+| HTML | `--report <path>` | Interactive report with filtering (protect and shield report) |
 
 ## Credential Patterns
 

package/dist/commands/guard-hooks.d.ts

@@ -0,0 +1,27 @@
+/**
+ * ConfigGuard pre-commit hook integration.
+ *
+ * Installs/uninstalls a git pre-commit hook that runs `opena2a guard verify`
+ * before each commit, preventing commits when config files have been tampered.
+ */
+export interface InstallResult {
+    installed: boolean;
+    path: string;
+    appended: boolean;
+    message: string;
+}
+declare function getHookScript(): string;
+declare function installPreCommitHook(targetDir: string): InstallResult;
+declare function uninstallPreCommitHook(targetDir: string): boolean;
+declare function isHookInstalled(targetDir: string): boolean;
+export declare function guardHook(action: string, targetDir: string): Promise<number>;
+export declare const _internals: {
+    HOOK_MARKER: string;
+    HOOK_END_MARKER: string;
+    getHookScript: typeof getHookScript;
+    installPreCommitHook: typeof installPreCommitHook;
+    uninstallPreCommitHook: typeof uninstallPreCommitHook;
+    isHookInstalled: typeof isHookInstalled;
+};
+export {};
+//# sourceMappingURL=guard-hooks.d.ts.map

package/dist/commands/guard-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-hooks.d.ts","sourceRoot":"","sources":["../../src/commands/guard-hooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AASD,iBAAS,aAAa,IAAI,MAAM,CAuB/B;AAID,iBAAS,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAyD9D;AAID,iBAAS,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAuB1D;AAID,iBAAS,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAKnD;AAID,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAID,eAAO,MAAM,UAAU;;;;;;;CAOtB,CAAC"}

package/dist/commands/guard-hooks.js

@@ -0,0 +1,207 @@
+"use strict";
+/**
+ * ConfigGuard pre-commit hook integration.
+ *
+ * Installs/uninstalls a git pre-commit hook that runs `opena2a guard verify`
+ * before each commit, preventing commits when config files have been tampered.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._internals = void 0;
+exports.guardHook = guardHook;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const colors_js_1 = require("../util/colors.js");
+// --- Constants ---
+const HOOK_MARKER = '# opena2a-guard pre-commit hook';
+const HOOK_END_MARKER = '# end opena2a-guard pre-commit hook';
+// --- Hook script ---
+function getHookScript() {
+    return [
+        HOOK_MARKER,
+        '# Verify config file integrity before committing.',
+        '# Set SKIP_GUARD_VERIFY=1 to bypass in emergencies.',
+        'if [ "$SKIP_GUARD_VERIFY" = "1" ]; then',
+        '  echo "[guard] SKIP_GUARD_VERIFY is set -- skipping config integrity check."',
+        'else',
+        '  if [ -f ".opena2a/guard/signatures.json" ]; then',
+        '    npx opena2a guard verify --ci --format text',
+        '    GUARD_EXIT=$?',
+        '    if [ $GUARD_EXIT -ne 0 ]; then',
+        '      echo ""',
+        '      echo "[guard] Config integrity check FAILED. Commit blocked."',
+        '      echo "[guard] Run: opena2a guard sign   to re-sign after intentional changes."',
+        '      echo "[guard] Set SKIP_GUARD_VERIFY=1 to bypass in emergencies."',
+        '      exit 1',
+        '    fi',
+        '  fi',
+        'fi',
+        HOOK_END_MARKER,
+        '',
+    ].join('\n');
+}
+// --- Install ---
+function installPreCommitHook(targetDir) {
+    const gitDir = path.join(targetDir, '.git');
+    if (!fs.existsSync(gitDir) || !fs.statSync(gitDir).isDirectory()) {
+        return {
+            installed: false,
+            path: '',
+            appended: false,
+            message: 'No .git directory found. Is this a git repository?',
+        };
+    }
+    const hooksDir = path.join(gitDir, 'hooks');
+    fs.mkdirSync(hooksDir, { recursive: true });
+    const hookPath = path.join(hooksDir, 'pre-commit');
+    const hookScript = getHookScript();
+    let appended = false;
+    if (fs.existsSync(hookPath)) {
+        const existing = fs.readFileSync(hookPath, 'utf-8');
+        // Already installed -- replace with latest version
+        if (existing.includes(HOOK_MARKER)) {
+            const before = existing.slice(0, existing.indexOf(HOOK_MARKER));
+            const afterMarker = existing.indexOf(HOOK_END_MARKER);
+            const after = afterMarker >= 0
+                ? existing.slice(afterMarker + HOOK_END_MARKER.length).replace(/^\n/, '')
+                : '';
+            const updated = before + hookScript + after;
+            fs.writeFileSync(hookPath, updated, 'utf-8');
+            fs.chmodSync(hookPath, 0o755);
+            return {
+                installed: true,
+                path: hookPath,
+                appended: false,
+                message: 'Pre-commit hook updated.',
+            };
+        }
+        // Foreign hook exists -- append ours
+        const separator = existing.endsWith('\n') ? '\n' : '\n\n';
+        fs.writeFileSync(hookPath, existing + separator + hookScript, 'utf-8');
+        appended = true;
+    }
+    else {
+        fs.writeFileSync(hookPath, '#!/bin/bash\n\n' + hookScript, 'utf-8');
+    }
+    fs.chmodSync(hookPath, 0o755);
+    return {
+        installed: true,
+        path: hookPath,
+        appended,
+        message: appended
+            ? 'Pre-commit hook appended to existing hook.'
+            : 'Pre-commit hook installed.',
+    };
+}
+// --- Uninstall ---
+function uninstallPreCommitHook(targetDir) {
+    const hookPath = path.join(targetDir, '.git', 'hooks', 'pre-commit');
+    if (!fs.existsSync(hookPath))
+        return false;
+    const content = fs.readFileSync(hookPath, 'utf-8');
+    if (!content.includes(HOOK_MARKER))
+        return false;
+    const before = content.slice(0, content.indexOf(HOOK_MARKER));
+    const afterMarker = content.indexOf(HOOK_END_MARKER);
+    const after = afterMarker >= 0
+        ? content.slice(afterMarker + HOOK_END_MARKER.length).replace(/^\n/, '')
+        : '';
+    const remaining = (before + after).trim();
+    if (!remaining || remaining === '#!/bin/bash') {
+        // Nothing left -- remove the file entirely
+        fs.unlinkSync(hookPath);
+    }
+    else {
+        fs.writeFileSync(hookPath, remaining + '\n', 'utf-8');
+    }
+    return true;
+}
+// --- Status ---
+function isHookInstalled(targetDir) {
+    const hookPath = path.join(targetDir, '.git', 'hooks', 'pre-commit');
+    if (!fs.existsSync(hookPath))
+        return false;
+    const content = fs.readFileSync(hookPath, 'utf-8');
+    return content.includes(HOOK_MARKER);
+}
+// --- CLI handler ---
+async function guardHook(action, targetDir) {
+    switch (action) {
+        case 'install': {
+            const result = installPreCommitHook(targetDir);
+            if (!result.installed) {
+                process.stderr.write((0, colors_js_1.red)(result.message) + '\n');
+                return 1;
+            }
+            process.stdout.write((0, colors_js_1.green)(result.message) + '\n');
+            process.stdout.write((0, colors_js_1.dim)(`  ${result.path}`) + '\n');
+            return 0;
+        }
+        case 'uninstall': {
+            const removed = uninstallPreCommitHook(targetDir);
+            if (removed) {
+                process.stdout.write((0, colors_js_1.green)('Pre-commit hook removed.') + '\n');
+            }
+            else {
+                process.stdout.write((0, colors_js_1.yellow)('No ConfigGuard hook found to remove.') + '\n');
+            }
+            return 0;
+        }
+        case 'status': {
+            const installed = isHookInstalled(targetDir);
+            if (installed) {
+                process.stdout.write((0, colors_js_1.bold)('ConfigGuard pre-commit hook: ') + (0, colors_js_1.green)('installed') + '\n');
+            }
+            else {
+                process.stdout.write((0, colors_js_1.bold)('ConfigGuard pre-commit hook: ') + (0, colors_js_1.dim)('not installed') + '\n');
+            }
+            return 0;
+        }
+        default:
+            process.stderr.write((0, colors_js_1.red)(`Unknown hook action: ${action}`) + '\n');
+            process.stderr.write('Usage: opena2a guard hook <install|uninstall|status>\n');
+            return 1;
+    }
+}
+// --- Testable internals ---
+exports._internals = {
+    HOOK_MARKER,
+    HOOK_END_MARKER,
+    getHookScript,
+    installPreCommitHook,
+    uninstallPreCommitHook,
+    isHookInstalled,
+};
+//# sourceMappingURL=guard-hooks.js.map

package/dist/commands/guard-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-hooks.js","sourceRoot":"","sources":["../../src/commands/guard-hooks.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkJH,8BAyCC;AAzLD,4CAA8B;AAC9B,gDAAkC;AAClC,iDAAkE;AAWlE,oBAAoB;AAEpB,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D,sBAAsB;AAEtB,SAAS,aAAa;IACpB,OAAO;QACL,WAAW;QACX,mDAAmD;QACnD,qDAAqD;QACrD,yCAAyC;QACzC,+EAA+E;QAC/E,MAAM;QACN,oDAAoD;QACpD,iDAAiD;QACjD,mBAAmB;QACnB,oCAAoC;QACpC,eAAe;QACf,qEAAqE;QACrE,sFAAsF;QACtF,wEAAwE;QACxE,cAAc;QACd,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,eAAe;QACf,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,kBAAkB;AAElB,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,EAAE;YACR,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,oDAAoD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEpD,mDAAmD;QACnD,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACzE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;YAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,0BAA0B;aACpC,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC;QACvE,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,iBAAiB,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE9B,OAAO;QACL,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,QAAQ;QACd,QAAQ;QACR,OAAO,EAAE,QAAQ;YACf,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,4BAA4B;KACjC,CAAC;AACJ,CAAC;AAED,oBAAoB;AAEpB,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC;QAC5B,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACxE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAE1C,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QAC9C,2CAA2C;QAC3C,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iBAAiB;AAEjB,SAAS,eAAe,CAAC,SAAiB;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,sBAAsB;AAEf,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,SAAiB;IAEjB,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,eAAG,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBACjD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,iBAAK,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,eAAG,EAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,iBAAK,EAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,kBAAM,EAAC,sCAAsC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,gBAAI,EAAC,+BAA+B,CAAC,GAAG,IAAA,iBAAK,EAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1F,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,gBAAI,EAAC,+BAA+B,CAAC,GAAG,IAAA,eAAG,EAAC,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,eAAG,EAAC,wBAAwB,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,6BAA6B;AAEhB,QAAA,UAAU,GAAG;IACxB,WAAW;IACX,eAAe;IACf,aAAa;IACb,oBAAoB;IACpB,sBAAsB;IACtB,eAAe;CAChB,CAAC"}

package/dist/commands/guard-policy.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Guard policy: signing requirements and heartbeat disable on tamper.
+ *
+ * Loads policy from `.opena2a/guard/policy.json`, checks compliance
+ * against the signature store, and manages the heartbeat-disabled marker.
+ */
+export interface GuardPolicy {
+    version: 1;
+    requiredFiles: string[];
+    blockOnUnsigned: boolean;
+    disableHeartbeatOnTamper: boolean;
+    autoRemediate: boolean;
+}
+export interface PolicyComplianceResult {
+    compliant: boolean;
+    requiredSigned: number;
+    requiredUnsigned: string[];
+    requiredTampered: string[];
+    requiredMissing: string[];
+}
+interface HeartbeatStatus {
+    disabled: boolean;
+    reason?: string;
+    disabledAt?: string;
+}
+declare function emitEvent(category: string, action: string, target: string, severity: 'info' | 'low' | 'medium' | 'high' | 'critical', outcome: 'allowed' | 'blocked' | 'monitored', detail: Record<string, unknown>): Promise<void>;
+export declare function loadGuardPolicy(targetDir: string): GuardPolicy | null;
+export declare function saveGuardPolicy(targetDir: string, policy: GuardPolicy): void;
+export declare function generateDefaultPolicy(targetDir: string): GuardPolicy;
+export declare function checkPolicyCompliance(targetDir: string, policy: GuardPolicy): PolicyComplianceResult;
+export declare function disableHeartbeat(targetDir: string, reason: string): void;
+export declare function isHeartbeatDisabled(targetDir: string): HeartbeatStatus;
+export declare function enableHeartbeat(targetDir: string): void;
+export declare function guardPolicy(targetDir: string, action: string, options: {
+    format?: 'text' | 'json';
+}): Promise<number>;
+export declare const _internals: {
+    loadGuardPolicy: typeof loadGuardPolicy;
+    saveGuardPolicy: typeof saveGuardPolicy;
+    generateDefaultPolicy: typeof generateDefaultPolicy;
+    checkPolicyCompliance: typeof checkPolicyCompliance;
+    disableHeartbeat: typeof disableHeartbeat;
+    isHeartbeatDisabled: typeof isHeartbeatDisabled;
+    enableHeartbeat: typeof enableHeartbeat;
+    guardPolicy: typeof guardPolicy;
+    emitEvent: typeof emitEvent;
+    GUARD_DIR: string;
+    POLICY_FILE: string;
+    HEARTBEAT_DISABLED_FILE: string;
+    SIGNATURES_FILE: string;
+    DEFAULT_CONFIG_FILES: string[];
+};
+export {};
+//# sourceMappingURL=guard-policy.d.ts.map

package/dist/commands/guard-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-policy.d.ts","sourceRoot":"","sources":["../../src/commands/guard-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,wBAAwB,EAAE,OAAO,CAAC;IAClC,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,UAAU,eAAe;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAsBD,iBAAe,SAAS,CACtB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAChD,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,EACzD,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,EAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAWf;AAID,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAIrE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAI5E;AAID,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CASpE;AAID,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,sBAAsB,CA6BpG;AAID,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAKxE;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAOtE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAGvD;AAID,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyD3H;AAID,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;CAKtB,CAAC"}