opena2a-cli 0.5.9 → 0.5.11

package/dist/commands/identity.js

@@ -1,7 +1,70 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.identity = identity;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
 const colors_js_1 = require("../util/colors.js");
+const USAGE = [
+    '',
+    'Usage: opena2a identity <subcommand>',
+    '',
+    'Identity & Keys',
+    '  list               Show local agent identity',
+    '  create --name <n>  Create a new agent identity',
+    '  sign --data <d>    Sign a string with agent private key',
+    '  sign --file <f>    Sign a file with agent private key',
+    '  verify             Verify a signature against a public key',
+    '',
+    'Trust & Audit',
+    '  trust              Show trust score with factor breakdown',
+    '  audit [--limit N]  Show recent audit events',
+    '  log                Log an audit event manually',
+    '',
+    'Policy',
+    '  policy             Show current capability policy',
+    '  policy load <file> Load a YAML capability policy',
+    '  check <capability> Check if a capability is allowed',
+    '',
+    'Cross-Tool Integration',
+    '  attach [--tools <list>]  Wire tools to identity (audit + trust)',
+    '  attach --all             Enable all detected tools',
+    '  detach                   Remove cross-tool wiring',
+    '  sync                     Sync events from enabled tools',
+    '',
+].join('\n');
 async function identity(options) {
     const sub = options.subcommand;
     switch (sub) {
@@ -14,13 +77,25 @@ async function identity(options) {
             return handleTrust(options);
         case 'audit':
             return handleAudit(options);
+        case 'log':
+            return handleLog(options);
+        case 'policy':
+            return handlePolicy(options);
+        case 'check':
+            return handleCheck(options);
+        case 'sign':
+            return handleSign(options);
+        case 'verify':
+            return handleVerify(options);
+        case 'attach':
+            return handleAttach(options);
+        case 'detach':
+            return handleDetach(options);
+        case 'sync':
+            return handleSync(options);
         default:
             process.stderr.write(`Unknown identity subcommand: ${sub}\n`);
-            process.stderr.write('\nUsage: opena2a identity <list|create|trust|audit>\n\n');
-            process.stderr.write('  list               Show local agent identity\n');
-            process.stderr.write('  create --name <n>  Create a new agent identity\n');
-            process.stderr.write('  trust              Show trust score\n');
-            process.stderr.write('  audit [--limit N]  Show recent audit events\n');
+            process.stderr.write(USAGE + '\n');
             return 1;
     }
 }
@@ -34,6 +109,9 @@ async function loadAimCore() {
         return null;
     }
 }
+// ---------------------------------------------------------------------------
+// list / show
+// ---------------------------------------------------------------------------
 async function handleList(options) {
     const mod = await loadAimCore();
     if (!mod)
@@ -52,6 +130,7 @@ async function handleList(options) {
         process.stdout.write(`  Name:        ${id.agentName}\n`);
         process.stdout.write(`  Public Key:  ${(0, colors_js_1.dim)(id.publicKey.slice(0, 32) + '...')}\n`);
         process.stdout.write(`  Created:     ${id.createdAt}\n`);
+        process.stdout.write(`  Data Dir:    ${(0, colors_js_1.dim)(aim.getDataDir())}\n`);
         process.stdout.write((0, colors_js_1.gray)('-'.repeat(50)) + '\n');
         return 0;
     }
@@ -60,6 +139,9 @@ async function handleList(options) {
         return 1;
     }
 }
+// ---------------------------------------------------------------------------
+// create
+// ---------------------------------------------------------------------------
 async function handleCreate(options) {
     const mod = await loadAimCore();
     if (!mod)
@@ -73,12 +155,30 @@ async function handleCreate(options) {
     const isJson = options.format === 'json';
     try {
         const aim = new mod.AIMCore({ agentName: name });
-        const id = aim.getIdentity();
+        // Check if identity already exists
+        let existing = false;
+        try {
+            const prev = aim.getIdentity();
+            if (prev && prev.agentId) {
+                existing = true;
+            }
+        }
+        catch {
+            // No existing identity -- good, we'll create one
+        }
+        const id = aim.getOrCreateIdentity();
         if (isJson) {
-            process.stdout.write(JSON.stringify(id, null, 2) + '\n');
+            process.stdout.write(JSON.stringify({ ...id, created: !existing }, null, 2) + '\n');
             return 0;
         }
-        process.stdout.write((0, colors_js_1.green)('Identity created') + '\n');
+        if (existing) {
+            process.stdout.write((0, colors_js_1.yellow)('Identity already exists') + '\n');
+            process.stdout.write((0, colors_js_1.dim)('  aim-core uses a single identity per data directory.') + '\n');
+            process.stdout.write((0, colors_js_1.dim)('  To start fresh, remove ~/.opena2a/aim-core/ and re-run.') + '\n\n');
+        }
+        else {
+            process.stdout.write((0, colors_js_1.green)('Identity created') + '\n');
+        }
         process.stdout.write(`  Agent ID:    ${(0, colors_js_1.cyan)(id.agentId)}\n`);
         process.stdout.write(`  Name:        ${id.agentName}\n`);
         process.stdout.write(`  Public Key:  ${(0, colors_js_1.dim)(id.publicKey.slice(0, 32) + '...')}\n`);
@@ -90,6 +190,9 @@ async function handleCreate(options) {
         return 1;
     }
 }
+// ---------------------------------------------------------------------------
+// trust
+// ---------------------------------------------------------------------------
 async function handleTrust(options) {
     const mod = await loadAimCore();
     if (!mod)
@@ -98,24 +201,70 @@ async function handleTrust(options) {
     try {
         const aim = new mod.AIMCore({ agentName: 'default' });
         aim.getIdentity(); // ensure identity exists
+        // Auto-sync trust hints if a manifest exists (tools are attached)
+        const targetDir = path.resolve(options.dir ?? process.cwd());
+        let hasManifest = false;
+        try {
+            const { readManifest } = await import('../identity/manifest.js');
+            const { collectTrustHints } = await import('../identity/trust-collector.js');
+            const manifest = readManifest(targetDir);
+            if (manifest) {
+                hasManifest = true;
+                const { hints } = collectTrustHints(targetDir, manifest);
+                aim.setTrustHints(hints);
+            }
+        }
+        catch {
+            // Identity module not available or manifest missing — that's fine
+        }
         const trust = aim.calculateTrust();
         if (isJson) {
-            process.stdout.write(JSON.stringify(trust, null, 2) + '\n');
+            process.stdout.write(JSON.stringify({ ...trust, attached: hasManifest }, null, 2) + '\n');
             return 0;
         }
+        const displayScore = trust.score ?? Math.round((trust.overall ?? 0) * 100);
+        const displayGrade = trust.grade ?? scoreToGrade(displayScore);
+        const gradeColor = displayScore >= 80 ? colors_js_1.green : displayScore >= 60 ? colors_js_1.yellow : colors_js_1.red;
         process.stdout.write((0, colors_js_1.bold)('Trust Score') + '\n');
         process.stdout.write((0, colors_js_1.gray)('-'.repeat(50)) + '\n');
-        const displayScore = trust.score ?? Math.round((trust.overall ?? 0) * 100);
-        const displayGrade = trust.grade ?? (displayScore >= 80 ? 'strong' : displayScore >= 60 ? 'good' : displayScore >= 40 ? 'moderate' : displayScore >= 20 ? 'improving' : 'needs-attention');
-        process.stdout.write(`  Score:  ${(0, colors_js_1.bold)(String(displayScore))}  Grade: ${(0, colors_js_1.bold)(displayGrade)}\n`);
+        process.stdout.write(`  Score:  ${gradeColor((0, colors_js_1.bold)(String(displayScore) + '/100'))}  (${gradeColor(displayGrade)})\n`);
         process.stdout.write('\n');
-        process.stdout.write('  Factors:\n');
+        process.stdout.write((0, colors_js_1.bold)('  Factors:') + '\n');
         for (const [factor, value] of Object.entries(trust.factors)) {
             const label = factor.replace(/([A-Z])/g, ' $1').toLowerCase().trim();
-            const status = value > 0 ? (0, colors_js_1.green)('active') : (0, colors_js_1.dim)('inactive');
-            process.stdout.write(`    ${label.padEnd(22)} ${status}\n`);
+            const pct = Math.round(value * 100);
+            const bar = progressBar(pct, 20);
+            process.stdout.write(`    ${label.padEnd(18)} ${bar} ${pct}%\n`);
         }
         process.stdout.write((0, colors_js_1.gray)('-'.repeat(50)) + '\n');
+        if (options.verbose) {
+            if (trust.calculatedAt) {
+                process.stdout.write((0, colors_js_1.dim)(`  Calculated: ${trust.calculatedAt}`) + '\n');
+            }
+            // Show improvement suggestions for factors at 0%
+            const zeroFactors = Object.entries(trust.factors).filter(([, v]) => v === 0);
+            if (zeroFactors.length > 0) {
+                process.stdout.write('\n' + (0, colors_js_1.bold)('  How to improve:') + '\n');
+                const factorSuggestions = {
+                    secretsManaged: 'npx secretless-ai init',
+                    configSigned: 'opena2a guard sign',
+                    skillsVerified: 'npx hackmyagent secure',
+                    networkControlled: 'opena2a runtime --init',
+                    heartbeatMonitored: 'opena2a shield init',
+                };
+                for (const [factor] of zeroFactors) {
+                    const suggestion = factorSuggestions[factor];
+                    if (suggestion) {
+                        const label = factor.replace(/([A-Z])/g, ' $1').toLowerCase().trim();
+                        process.stdout.write(`    ${label.padEnd(18)} ${(0, colors_js_1.dim)(suggestion)}\n`);
+                    }
+                }
+            }
+        }
+        if (!hasManifest) {
+            process.stdout.write('\n' + (0, colors_js_1.dim)('  No tools attached. Run: opena2a identity attach --all') + '\n');
+            process.stdout.write((0, colors_js_1.dim)('  Attaching tools improves trust by syncing real security state.') + '\n');
+        }
         return 0;
     }
     catch (err) {
@@ -123,6 +272,9 @@ async function handleTrust(options) {
         return 1;
     }
 }
+// ---------------------------------------------------------------------------
+// audit
+// ---------------------------------------------------------------------------
 async function handleAudit(options) {
     const mod = await loadAimCore();
     if (!mod)
@@ -138,15 +290,16 @@ async function handleAudit(options) {
         }
         if (events.length === 0) {
             process.stdout.write((0, colors_js_1.dim)('No audit events recorded yet.') + '\n');
-            process.stdout.write((0, colors_js_1.dim)('Events are logged when using aim-core in your agent.') + '\n');
+            process.stdout.write((0, colors_js_1.dim)('Log events with: opena2a identity log --action <action> --target <target>') + '\n');
             return 0;
         }
         process.stdout.write((0, colors_js_1.bold)(`Audit Log (last ${events.length})`) + '\n');
         process.stdout.write((0, colors_js_1.gray)('-'.repeat(70)) + '\n');
         for (const e of events) {
             const ts = e.timestamp.slice(0, 19).replace('T', ' ');
-            const resultColor = e.result === 'allowed' ? colors_js_1.green : e.result === 'denied' ? colors_js_1.yellow : colors_js_1.dim;
-            process.stdout.write(`  ${(0, colors_js_1.dim)(ts)}  ${e.action.padEnd(16)} ${e.target.padEnd(16)} ${resultColor(e.result)}\n`);
+            const resultColor = e.result === 'allowed' ? colors_js_1.green : e.result === 'denied' ? colors_js_1.red : colors_js_1.yellow;
+            const pluginLabel = e.plugin && e.plugin !== 'unknown' ? (0, colors_js_1.dim)(` [${e.plugin}]`) : '';
+            process.stdout.write(`  ${(0, colors_js_1.dim)(ts)}  ${(e.action ?? '').padEnd(16)} ${(e.target ?? '').padEnd(16)} ${resultColor(e.result ?? '')}${pluginLabel}\n`);
         }
         process.stdout.write((0, colors_js_1.gray)('-'.repeat(70)) + '\n');
         return 0;
@@ -156,4 +309,695 @@ async function handleAudit(options) {
         return 1;
     }
 }
+// ---------------------------------------------------------------------------
+// log -- write an audit event
+// ---------------------------------------------------------------------------
+async function handleLog(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    const action = options.action;
+    if (!action) {
+        process.stderr.write('Missing required option: --action <action>\n');
+        process.stderr.write('Usage: opena2a identity log --action db:read --target customers [--result allowed]\n');
+        return 1;
+    }
+    const isJson = options.format === 'json';
+    try {
+        const aim = new mod.AIMCore({ agentName: 'default' });
+        aim.getIdentity(); // ensure identity exists
+        const validResults = ['allowed', 'denied', 'error'];
+        const resultInput = options.result ?? 'allowed';
+        if (!validResults.includes(resultInput)) {
+            process.stderr.write(`Invalid --result value: ${resultInput}\n`);
+            process.stderr.write('Valid values: allowed, denied, error\n');
+            return 1;
+        }
+        const event = aim.logEvent({
+            action,
+            target: options.target ?? '',
+            result: resultInput,
+            plugin: options.plugin ?? 'cli',
+        });
+        if (isJson) {
+            process.stdout.write(JSON.stringify(event, null, 2) + '\n');
+            return 0;
+        }
+        process.stdout.write((0, colors_js_1.green)('Event logged') + '\n');
+        process.stdout.write(`  Action:  ${event.action}\n`);
+        process.stdout.write(`  Target:  ${event.target}\n`);
+        process.stdout.write(`  Result:  ${event.result}\n`);
+        process.stdout.write(`  Time:    ${(0, colors_js_1.dim)(event.timestamp)}\n`);
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to log event: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// policy -- show or load capability policy
+// ---------------------------------------------------------------------------
+async function handlePolicy(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    const isJson = options.format === 'json';
+    const args = options.file ? ['load', options.file] : [];
+    // If first positional arg is "load", load a YAML policy
+    if (args[0] === 'load' || options.file) {
+        return handlePolicyLoad(mod, options);
+    }
+    // Otherwise show the current policy
+    try {
+        const aim = new mod.AIMCore({ agentName: 'default' });
+        const p = aim.loadPolicy();
+        if (isJson) {
+            process.stdout.write(JSON.stringify(p, null, 2) + '\n');
+            return 0;
+        }
+        process.stdout.write((0, colors_js_1.bold)('Capability Policy') + '\n');
+        process.stdout.write((0, colors_js_1.gray)('-'.repeat(50)) + '\n');
+        process.stdout.write(`  Default: ${p.defaultAction === 'deny' ? (0, colors_js_1.red)('deny') : (0, colors_js_1.green)('allow')}\n`);
+        process.stdout.write(`  Rules:   ${p.rules.length}\n`);
+        process.stdout.write('\n');
+        if (p.rules.length === 0) {
+            process.stdout.write((0, colors_js_1.dim)('  No rules defined.') + '\n');
+            process.stdout.write((0, colors_js_1.dim)('  Load a policy: opena2a identity policy --file policy.yaml') + '\n');
+        }
+        else {
+            for (const rule of p.rules) {
+                const actionColor = rule.action === 'allow' ? colors_js_1.green : colors_js_1.red;
+                const pluginNote = rule.plugins?.length ? (0, colors_js_1.dim)(` (plugins: ${rule.plugins.join(', ')})`) : '';
+                process.stdout.write(`  ${actionColor(rule.action.padEnd(5))}  ${rule.capability}${pluginNote}\n`);
+            }
+        }
+        process.stdout.write((0, colors_js_1.gray)('-'.repeat(50)) + '\n');
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to read policy: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+async function handlePolicyLoad(mod, options) {
+    const filePath = options.file;
+    if (!filePath) {
+        process.stderr.write('Missing file path.\n');
+        process.stderr.write('Usage: opena2a identity policy --file policy.yaml\n');
+        return 1;
+    }
+    const isJson = options.format === 'json';
+    const resolved = path.resolve(filePath);
+    if (!fs.existsSync(resolved)) {
+        process.stderr.write(`File not found: ${resolved}\n`);
+        return 1;
+    }
+    try {
+        const content = fs.readFileSync(resolved, 'utf-8');
+        let parsed;
+        if (resolved.endsWith('.json')) {
+            parsed = JSON.parse(content);
+        }
+        else if (resolved.endsWith('.yaml') || resolved.endsWith('.yml')) {
+            parsed = parseSimpleYamlPolicy(content);
+        }
+        else {
+            process.stderr.write('Unsupported file format. Use .json or .yaml/.yml\n');
+            return 1;
+        }
+        const aim = new mod.AIMCore({ agentName: 'default' });
+        aim.savePolicy(parsed);
+        if (isJson) {
+            process.stdout.write(JSON.stringify({ loaded: true, rules: parsed.rules?.length ?? 0, path: resolved }, null, 2) + '\n');
+            return 0;
+        }
+        process.stdout.write((0, colors_js_1.green)('Policy loaded') + '\n');
+        process.stdout.write(`  File:    ${(0, colors_js_1.dim)(resolved)}\n`);
+        process.stdout.write(`  Default: ${parsed.defaultAction}\n`);
+        process.stdout.write(`  Rules:   ${parsed.rules?.length ?? 0}\n`);
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to load policy: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// check -- check if a capability is allowed
+// ---------------------------------------------------------------------------
+async function handleCheck(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    const capability = options.capability;
+    if (!capability) {
+        process.stderr.write('Missing capability to check.\n');
+        process.stderr.write('Usage: opena2a identity check <capability> [--plugin <name>]\n');
+        return 1;
+    }
+    const isJson = options.format === 'json';
+    try {
+        const aim = new mod.AIMCore({ agentName: 'default' });
+        aim.loadPolicy(); // load from file
+        const allowed = aim.checkCapability(capability, options.plugin);
+        if (isJson) {
+            process.stdout.write(JSON.stringify({ capability, allowed, plugin: options.plugin ?? null }, null, 2) + '\n');
+            return 0;
+        }
+        const label = allowed ? (0, colors_js_1.green)('ALLOWED') : (0, colors_js_1.red)('DENIED');
+        process.stdout.write(`${label}  ${capability}`);
+        if (options.plugin)
+            process.stdout.write((0, colors_js_1.dim)(` (plugin: ${options.plugin})`));
+        process.stdout.write('\n');
+        return allowed ? 0 : 1;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to check capability: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// sign -- sign data with agent private key
+// ---------------------------------------------------------------------------
+async function handleSign(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    let data = options.data;
+    let label = data;
+    let dataBytes;
+    if (options.file && options.subcommand === 'sign') {
+        // Sign file contents
+        const resolved = path.resolve(options.file);
+        if (!fs.existsSync(resolved)) {
+            process.stderr.write(`File not found: ${resolved}\n`);
+            return 1;
+        }
+        const fileContents = fs.readFileSync(resolved);
+        dataBytes = new Uint8Array(fileContents);
+        label = path.basename(resolved);
+    }
+    else if (data) {
+        dataBytes = new TextEncoder().encode(data);
+    }
+    else {
+        process.stderr.write('Missing required option: --data <string> or --file <path>\n');
+        process.stderr.write('Usage:\n');
+        process.stderr.write('  opena2a identity sign --data "message to sign"\n');
+        process.stderr.write('  opena2a identity sign --file ./config.json\n');
+        return 1;
+    }
+    const isJson = options.format === 'json';
+    try {
+        const aim = new mod.AIMCore({ agentName: 'default' });
+        const id = aim.getIdentity();
+        const signature = aim.sign(dataBytes);
+        const sigBase64 = Buffer.from(signature).toString('base64');
+        if (isJson) {
+            process.stdout.write(JSON.stringify({
+                ...(options.file ? { file: path.resolve(options.file) } : { data }),
+                signature: sigBase64,
+                publicKey: id.publicKey,
+                agentId: id.agentId,
+            }, null, 2) + '\n');
+            return 0;
+        }
+        process.stdout.write((0, colors_js_1.bold)('Signature') + '\n');
+        const displayLabel = label && label.length > 60 ? label.slice(0, 60) + '...' : (label ?? '');
+        if (options.file) {
+            process.stdout.write(`  File:       ${(0, colors_js_1.dim)(path.resolve(options.file))}\n`);
+        }
+        else {
+            process.stdout.write(`  Data:       ${(0, colors_js_1.dim)(displayLabel)}\n`);
+        }
+        process.stdout.write(`  Signature:  ${sigBase64}\n`);
+        process.stdout.write(`  Public Key: ${(0, colors_js_1.dim)(id.publicKey)}\n`);
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to sign: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// verify -- verify a signature
+// ---------------------------------------------------------------------------
+async function handleVerify(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    const data = options.data;
+    const signature = options.signature;
+    const publicKey = options.publicKey;
+    if (!data || !signature || !publicKey) {
+        process.stderr.write('Missing required options.\n');
+        process.stderr.write('Usage: opena2a identity verify --data "message" --signature <base64> --public-key <base64>\n');
+        return 1;
+    }
+    const isJson = options.format === 'json';
+    try {
+        const aim = new mod.AIMCore({ agentName: 'default' });
+        const dataBytes = new TextEncoder().encode(data);
+        const sigBytes = new Uint8Array(Buffer.from(signature, 'base64'));
+        const valid = aim.verify(dataBytes, sigBytes, publicKey);
+        if (isJson) {
+            process.stdout.write(JSON.stringify({ valid, data, publicKey }, null, 2) + '\n');
+            return 0;
+        }
+        if (valid) {
+            process.stdout.write((0, colors_js_1.green)('VALID') + '  Signature verified\n');
+        }
+        else {
+            process.stdout.write((0, colors_js_1.red)('INVALID') + '  Signature verification failed\n');
+        }
+        return valid ? 0 : 1;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to verify: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// attach -- wire tools to identity
+// ---------------------------------------------------------------------------
+async function handleAttach(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    const isJson = options.format === 'json';
+    const targetDir = path.resolve(options.dir ?? process.cwd());
+    try {
+        // 1. Get or create identity
+        const agentName = options.name ?? 'default';
+        const aim = new mod.AIMCore({ agentName });
+        const id = aim.getOrCreateIdentity();
+        if (!isJson) {
+            process.stdout.write((0, colors_js_1.bold)('Attaching identity to tools') + '\n');
+            process.stdout.write((0, colors_js_1.gray)('-'.repeat(60)) + '\n');
+            process.stdout.write(`  Agent:     ${(0, colors_js_1.cyan)(id.agentId)}\n`);
+            process.stdout.write(`  Name:      ${id.agentName}\n`);
+            process.stdout.write(`  Directory: ${(0, colors_js_1.dim)(targetDir)}\n\n`);
+        }
+        // 2. Determine which tools to enable
+        const { readManifest, writeManifest } = await import('../identity/manifest.js');
+        const { collectTrustHints } = await import('../identity/trust-collector.js');
+        const { importAllToolEvents } = await import('../identity/bridges.js');
+        const existing = readManifest(targetDir);
+        let enabledTools = {
+            secretless: false,
+            configguard: false,
+            arp: false,
+            hma: false,
+            shield: false,
+        };
+        if (options.all) {
+            // Enable all
+            enabledTools = { secretless: true, configguard: true, arp: true, hma: true, shield: true };
+        }
+        else if (options.tools) {
+            // Enable specific tools, merge with existing
+            const requested = options.tools.split(',').map(t => t.trim().toLowerCase());
+            const knownTools = ['secretless', 'configguard', 'guard', 'arp', 'hma', 'hackmyagent', 'shield'];
+            const unknown = requested.filter(t => !knownTools.includes(t));
+            if (unknown.length > 0) {
+                process.stderr.write(`Unknown tool(s): ${unknown.join(', ')}\n`);
+                process.stderr.write(`Valid tools: secretless, configguard, arp, hma, shield\n`);
+                return 1;
+            }
+            if (existing) {
+                enabledTools = { ...existing.tools };
+            }
+            for (const tool of requested) {
+                if (tool === 'secretless')
+                    enabledTools.secretless = true;
+                if (tool === 'configguard' || tool === 'guard')
+                    enabledTools.configguard = true;
+                if (tool === 'arp')
+                    enabledTools.arp = true;
+                if (tool === 'hma' || tool === 'hackmyagent')
+                    enabledTools.hma = true;
+                if (tool === 'shield')
+                    enabledTools.shield = true;
+            }
+        }
+        else if (existing) {
+            // Re-attach with existing config
+            enabledTools = existing.tools;
+        }
+        else {
+            // First attach with no flags — enable all by default
+            enabledTools = { secretless: true, configguard: true, arp: true, hma: true, shield: true };
+        }
+        // 3. Collect trust hints from enabled tools
+        const manifest = {
+            version: '1',
+            agent: { name: id.agentName, agentId: id.agentId, publicKey: id.publicKey, created: id.createdAt },
+            tools: enabledTools,
+            bridging: { autoSync: options.autoSync ?? true, lastSyncAt: null },
+            registry: { contribute: false, gtin: false, sensorToken: null },
+        };
+        const { hints, details } = collectTrustHints(targetDir, manifest);
+        if (!isJson) {
+            if (options.tools) {
+                process.stdout.write((0, colors_js_1.bold)('  Requested tools: ') + options.tools + '\n\n');
+            }
+            process.stdout.write((0, colors_js_1.bold)('  Tool Detection:') + '\n');
+            // Show all tools (not just enabled ones) so user sees the full picture
+            const allToolNames = [
+                { key: 'secretless', label: 'Secretless' },
+                { key: 'configguard', label: 'ConfigGuard' },
+                { key: 'arp', label: 'ARP' },
+                { key: 'hma', label: 'HMA' },
+                { key: 'shield', label: 'Shield' },
+            ];
+            for (const t of allToolNames) {
+                const isEnabled = enabledTools[t.key];
+                const detail = details.find(d => d.tool === t.label);
+                let icon;
+                let reason;
+                if (!isEnabled) {
+                    icon = (0, colors_js_1.dim)(' SKIP ');
+                    reason = 'not requested';
+                }
+                else if (detail?.active) {
+                    icon = (0, colors_js_1.green)('ACTIVE');
+                    reason = detail.reason;
+                }
+                else {
+                    icon = (0, colors_js_1.yellow)(' OFF  ');
+                    reason = detail?.reason ?? 'not detected';
+                }
+                const suffix = '';
+                process.stdout.write(`    ${icon}  ${t.label.padEnd(14)} ${(0, colors_js_1.dim)(reason)}${suffix}\n`);
+            }
+            process.stdout.write('\n');
+        }
+        // 4. Apply trust hints
+        aim.setTrustHints(hints);
+        // 5. Calculate trust score BEFORE sync
+        const trustBefore = aim.calculateTrust();
+        // 6. Import events from enabled tools
+        const bridgeResults = importAllToolEvents(aim, targetDir, enabledTools);
+        // 7. Calculate trust score AFTER sync
+        const trustAfter = aim.calculateTrust();
+        // 8. Write manifest
+        manifest.bridging.lastSyncAt = new Date().toISOString();
+        writeManifest(targetDir, manifest);
+        // 9. Log the attach event
+        aim.logEvent({
+            action: 'identity.attach',
+            target: targetDir,
+            result: 'allowed',
+            plugin: 'opena2a-cli',
+        });
+        if (isJson) {
+            process.stdout.write(JSON.stringify({
+                agentId: id.agentId,
+                name: id.agentName,
+                tools: enabledTools,
+                hints,
+                bridgeResults: bridgeResults.total,
+                trustBefore: { score: trustBefore.score, grade: trustBefore.grade },
+                trustAfter: { score: trustAfter.score, grade: trustAfter.grade },
+                manifestPath: path.join(targetDir, '.opena2a', 'agent.yaml'),
+            }, null, 2) + '\n');
+            return 0;
+        }
+        // 10. Display results
+        if (bridgeResults.total.imported > 0) {
+            process.stdout.write((0, colors_js_1.bold)('  Event Sync:') + '\n');
+            const tools = ['shield', 'arp', 'hma', 'configguard', 'secretless'];
+            for (const t of tools) {
+                const r = bridgeResults[t];
+                if (r.imported > 0 || r.skipped > 0) {
+                    process.stdout.write(`    ${t.padEnd(14)} ${(0, colors_js_1.green)(`+${r.imported}`)} imported${r.skipped > 0 ? (0, colors_js_1.dim)(`, ${r.skipped} skipped`) : ''}\n`);
+                }
+            }
+            process.stdout.write('\n');
+        }
+        process.stdout.write((0, colors_js_1.bold)('  Trust Score:') + '\n');
+        const beforeColor = trustBefore.score >= 60 ? colors_js_1.yellow : colors_js_1.red;
+        const afterColor = trustAfter.score >= 80 ? colors_js_1.green : trustAfter.score >= 60 ? colors_js_1.yellow : colors_js_1.red;
+        const delta = trustAfter.score - trustBefore.score;
+        const deltaLabel = delta > 0 ? (0, colors_js_1.green)(`+${delta}`) : delta < 0 ? (0, colors_js_1.red)(`${delta}`) : (0, colors_js_1.dim)('+0');
+        process.stdout.write(`    ${beforeColor(String(trustBefore.score))} -> ${afterColor((0, colors_js_1.bold)(String(trustAfter.score)))} (${deltaLabel})\n`);
+        process.stdout.write(`    Grade: ${afterColor(trustAfter.grade)}\n\n`);
+        // Active hints
+        const activeHintCount = Object.values(hints).filter(Boolean).length;
+        const totalHintCount = Object.keys(hints).length;
+        process.stdout.write(`  Trust factors active: ${(0, colors_js_1.green)(String(activeHintCount))}/${totalHintCount}\n`);
+        process.stdout.write((0, colors_js_1.gray)('-'.repeat(60)) + '\n');
+        process.stdout.write((0, colors_js_1.dim)(`  Manifest: ${path.join(targetDir, '.opena2a', 'agent.yaml')}`) + '\n');
+        // Suggestions for inactive tools
+        const inactiveTools = details.filter(d => !d.active);
+        if (inactiveTools.length > 0) {
+            process.stdout.write('\n' + (0, colors_js_1.dim)('  To improve your trust score:') + '\n');
+            for (const t of inactiveTools) {
+                const suggestion = getToolSuggestion(t.tool);
+                if (suggestion) {
+                    process.stdout.write((0, colors_js_1.dim)(`    ${t.tool}: ${suggestion}`) + '\n');
+                }
+            }
+        }
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to attach: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+function getToolSuggestion(tool) {
+    switch (tool) {
+        case 'Secretless': return 'npx secretless-ai init';
+        case 'ConfigGuard': return 'opena2a guard sign';
+        case 'ARP': return 'opena2a runtime --init';
+        case 'HMA': return 'npx hackmyagent secure';
+        case 'Shield': return 'opena2a shield init';
+        default: return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// detach -- remove cross-tool wiring
+// ---------------------------------------------------------------------------
+async function handleDetach(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    const isJson = options.format === 'json';
+    const targetDir = path.resolve(options.dir ?? process.cwd());
+    try {
+        const { readManifest, removeManifest } = await import('../identity/manifest.js');
+        const manifest = readManifest(targetDir);
+        if (!manifest) {
+            if (isJson) {
+                process.stdout.write(JSON.stringify({ detached: false, reason: 'no manifest found' }, null, 2) + '\n');
+            }
+            else {
+                process.stderr.write('No identity attachment found in this directory.\n');
+                process.stderr.write((0, colors_js_1.dim)('Run: opena2a identity attach') + '\n');
+            }
+            return 1;
+        }
+        // Log detach event before removing
+        const aim = new mod.AIMCore({ agentName: manifest.agent.name });
+        aim.logEvent({
+            action: 'identity.detach',
+            target: targetDir,
+            result: 'allowed',
+            plugin: 'opena2a-cli',
+        });
+        // Clear trust hints
+        aim.setTrustHints({});
+        // Remove manifest
+        removeManifest(targetDir);
+        if (isJson) {
+            process.stdout.write(JSON.stringify({ detached: true, agentId: manifest.agent.agentId }, null, 2) + '\n');
+        }
+        else {
+            process.stdout.write((0, colors_js_1.green)('Identity detached') + '\n');
+            process.stdout.write(`  Agent:     ${manifest.agent.agentId}\n`);
+            process.stdout.write(`  Directory: ${(0, colors_js_1.dim)(targetDir)}\n`);
+            process.stdout.write((0, colors_js_1.dim)('\n  Identity, audit log, and tool configs are preserved.') + '\n');
+            process.stdout.write((0, colors_js_1.dim)('  Only the cross-tool wiring was removed.') + '\n');
+        }
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to detach: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// sync -- re-sync events from enabled tools
+// ---------------------------------------------------------------------------
+async function handleSync(options) {
+    const mod = await loadAimCore();
+    if (!mod)
+        return 1;
+    const isJson = options.format === 'json';
+    const targetDir = path.resolve(options.dir ?? process.cwd());
+    try {
+        const { readManifest, writeManifest } = await import('../identity/manifest.js');
+        const { applyTrustHints } = await import('../identity/trust-collector.js');
+        const { importAllToolEvents } = await import('../identity/bridges.js');
+        const manifest = readManifest(targetDir);
+        if (!manifest) {
+            if (isJson) {
+                process.stdout.write(JSON.stringify({ synced: false, reason: 'no manifest found' }, null, 2) + '\n');
+            }
+            else {
+                process.stderr.write('No identity attachment found. Run: opena2a identity attach\n');
+            }
+            return 1;
+        }
+        const aim = new mod.AIMCore({ agentName: manifest.agent.name });
+        // Refresh trust hints
+        const { hints, score } = applyTrustHints(aim, targetDir, manifest);
+        // Import new events
+        const bridgeResults = importAllToolEvents(aim, targetDir, manifest.tools);
+        // Update manifest sync timestamp
+        manifest.bridging.lastSyncAt = new Date().toISOString();
+        writeManifest(targetDir, manifest);
+        if (isJson) {
+            process.stdout.write(JSON.stringify({
+                synced: true,
+                imported: bridgeResults.total.imported,
+                skipped: bridgeResults.total.skipped,
+                trustScore: score.score,
+                trustGrade: score.grade,
+            }, null, 2) + '\n');
+            return 0;
+        }
+        process.stdout.write((0, colors_js_1.green)('Sync complete') + '\n');
+        process.stdout.write(`  Events imported: ${bridgeResults.total.imported}\n`);
+        if (bridgeResults.total.skipped > 0) {
+            process.stdout.write(`  Skipped (dedup): ${bridgeResults.total.skipped}\n`);
+        }
+        const scoreColor = score.score >= 80 ? colors_js_1.green : score.score >= 60 ? colors_js_1.yellow : colors_js_1.red;
+        process.stdout.write(`  Trust score:     ${scoreColor((0, colors_js_1.bold)(`${score.score}/100`))} (${scoreColor(score.grade)})\n`);
+        const activeHints = Object.entries(hints).filter(([, v]) => v).map(([k]) => k);
+        if (activeHints.length > 0) {
+            process.stdout.write(`  Active factors:  ${activeHints.join(', ')}\n`);
+        }
+        return 0;
+    }
+    catch (err) {
+        process.stderr.write(`Failed to sync: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function scoreToGrade(score) {
+    if (score >= 80)
+        return 'strong';
+    if (score >= 60)
+        return 'good';
+    if (score >= 40)
+        return 'moderate';
+    if (score >= 20)
+        return 'improving';
+    return 'needs-attention';
+}
+function progressBar(pct, width) {
+    const filled = Math.round((pct / 100) * width);
+    const empty = width - filled;
+    return (0, colors_js_1.green)('#'.repeat(filled)) + (0, colors_js_1.dim)('.'.repeat(empty));
+}
+/**
+ * Parse a simple YAML capability policy file.
+ *
+ * Supports the format:
+ *   version: "1"
+ *   defaultAction: deny
+ *   rules:
+ *     - capability: "db:read"
+ *       action: allow
+ *     - capability: "net:*"
+ *       action: deny
+ *       plugins:
+ *         - untrusted-plugin
+ */
+function parseSimpleYamlPolicy(content) {
+    const lines = content.split('\n');
+    let version = '1';
+    let defaultAction = 'deny';
+    const rules = [];
+    let inRules = false;
+    let currentRule = null;
+    let inPlugins = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed === '' || trimmed.startsWith('#'))
+            continue;
+        // Top-level keys
+        if (!line.startsWith(' ') && !line.startsWith('\t')) {
+            inRules = false;
+            inPlugins = false;
+            if (currentRule?.capability && currentRule?.action) {
+                rules.push(currentRule);
+                currentRule = null;
+            }
+        }
+        const kvMatch = trimmed.match(/^(\w+):\s*(.*)$/);
+        if (kvMatch && !inRules) {
+            const [, key, val] = kvMatch;
+            const cleanVal = val.replace(/^["']|["']$/g, '');
+            if (key === 'version')
+                version = cleanVal;
+            if (key === 'defaultAction')
+                defaultAction = cleanVal;
+            if (key === 'rules')
+                inRules = true;
+            continue;
+        }
+        if (inRules) {
+            // New rule entry (starts with "- ")
+            if (trimmed.startsWith('- ')) {
+                if (currentRule?.capability && currentRule?.action) {
+                    rules.push(currentRule);
+                }
+                currentRule = {};
+                inPlugins = false;
+                const inlineKv = trimmed.slice(2).match(/^(\w+):\s*(.*)$/);
+                if (inlineKv) {
+                    const cleanVal = inlineKv[2].replace(/^["']|["']$/g, '');
+                    if (inlineKv[1] === 'capability')
+                        currentRule.capability = cleanVal;
+                    if (inlineKv[1] === 'action')
+                        currentRule.action = cleanVal;
+                }
+                continue;
+            }
+            // Rule properties
+            if (currentRule && kvMatch) {
+                const [, key, val] = kvMatch;
+                const cleanVal = val.replace(/^["']|["']$/g, '');
+                if (key === 'capability')
+                    currentRule.capability = cleanVal;
+                if (key === 'action')
+                    currentRule.action = cleanVal;
+                if (key === 'plugins') {
+                    inPlugins = true;
+                    currentRule.plugins = [];
+                }
+                continue;
+            }
+            // Plugin list items
+            if (inPlugins && currentRule && trimmed.startsWith('- ')) {
+                const pluginName = trimmed.slice(2).replace(/^["']|["']$/g, '');
+                if (!currentRule.plugins)
+                    currentRule.plugins = [];
+                currentRule.plugins.push(pluginName);
+            }
+        }
+    }
+    // Flush last rule
+    if (currentRule?.capability && currentRule?.action) {
+        rules.push(currentRule);
+    }
+    return { version, defaultAction, rules };
+}
 //# sourceMappingURL=identity.js.map