perimetercli 0.1.0 → 0.1.1

package/README.md

@@ -11,6 +11,9 @@ perimeter audit
 Zero runtime dependencies · Works offline · Open-core (MIT)
 
 [![Node](https://img.shields.io/badge/node-%3E%3D18-43853d?logo=node.js&logoColor=white)](https://nodejs.org)
+[![Test](https://github.com/stealth-alpha/perimeter/actions/workflows/test.yml/badge.svg)](https://github.com/stealth-alpha/perimeter/actions/workflows/test.yml)
+[![audit](https://github.com/stealth-alpha/perimeter/actions/workflows/audit-ci.yml/badge.svg)](https://github.com/stealth-alpha/perimeter/actions/workflows/audit-ci.yml)
+[![site](https://img.shields.io/badge/site-stealth--alpha.github.io/perimeter-ef4444)](https://stealth-alpha.github.io/perimeter/)
 [![npm](https://img.shields.io/npm/v/perimetercli)](https://www.npmjs.com/package/perimetercli)
 [![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
@@ -113,6 +116,10 @@ Cost: model claude-sonnet · ~8,652 tokens/load · $0.09/load
 reports what was *really* called (Bash `×3`, Write `×1`…), with exact token
 spend when the log records it.
 
+See a full [example audit report](docs/example-audit.md) — a deliberately risky
+toolchain (shell server, curl-piped hook, injected rules, credential-sniffing
+skill) audited to a CRITICAL verdict with remediation for every finding.
+
 ## Runtime guard
 
 `perimeter guard` proxies a real MCP server and **blocks risky tool calls at
@@ -154,11 +161,24 @@ you push.
 ## CI
 
 ```yaml
+permissions:
+  contents: read
+  security-events: write   # needed for the SARIF upload step below
+steps:
+- uses: actions/checkout@v4
+- uses: actions/setup-node@v4
+  with:
+    node-version: 20
 - run: npm install --global perimetercli
 - run: perimeter baseline
 - run: perimeter audit --enforce --fail-on high --out perimeter-report
 - uses: actions/upload-artifact@v4
   with: { path: perimeter-report/ }
+# Optional: publish findings to GitHub code scanning
+- uses: github/codeql-action/upload-sarif@v3
+  if: always()
+  with:
+    sarif_file: perimeter-report/audit.sarif
 ```
 
 Perimeter emits **SARIF** too, so findings land directly in GitHub code scanning.
@@ -201,3 +221,7 @@ npm test
 ## License
 
 [MIT](LICENSE)
+
+---
+
+Part of the [stealth-alpha toolkit](https://stealth-alpha.github.io/toolkit/) — eight zero-dependency CLIs for release automation, agent security, and repo hygiene.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "perimetercli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Security and cost audit for your AI agent toolchain — MCP servers, hooks, skills. One command finds poisoning, dangerous capabilities, context bloat and drift, and gates CI.",
   "type": "module",
   "bin": {
@@ -44,12 +44,12 @@
     "name": "Perimeter Contributors",
     "email": "hello@perimetercli.dev"
   },
-  "homepage": "https://perimetercli.dev",
+  "homepage": "https://stealth-alpha.github.io/perimeter/",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/perimetercli/perimeter.git"
+    "url": "git+https://github.com/stealth-alpha/perimeter.git"
   },
   "bugs": {
-    "url": "https://github.com/perimetercli/perimeter/issues"
+    "url": "https://github.com/stealth-alpha/perimeter/issues"
   }
 }

package/src/catalog.js

@@ -269,18 +269,34 @@ const servers = [
 
 export const KNOWN_SERVERS = servers;
 
+/**
+ * Match a package name or config entry against the catalog.
+ *
+ * Rules:
+ * - empty/missing input never matches
+ * - exact alias match always wins
+ * - a key that fully embeds an alias matches (e.g. "org/server-slack")
+ * - a key may act as shorthand only when it equals a whole delimiter-separated
+ *   segment of the alias (e.g. "github" ~ "server-github"), which prevents
+ *   short generic names like "git" from hijacking unrelated profiles
+ */
 export function catalogFor(packageOrName) {
-  const key = String(packageOrName || "").toLowerCase();
+  const key = String(packageOrName ?? "").trim().toLowerCase();
+  if (!key) return null;
   for (const s of servers) {
     for (const m of s.match) {
-      if (key.includes(m.toLowerCase()) || m.toLowerCase().includes(key)) {
-        return s;
-      }
+      if (matchesAlias(key, m.toLowerCase())) return s;
     }
   }
   return null;
 }
 
+function matchesAlias(key, alias) {
+  if (alias === key) return true;
+  if (key.includes(alias)) return true;
+  return alias.split(/[^a-z0-9]+/).includes(key);
+}
+
 /** A default token/risk profile for an unknown server. */
 export function unknownServerProfile(name) {
   return {

package/src/report.js

@@ -162,7 +162,7 @@ export function formatMarkdown(audit) {
   }
   lines.push("");
   lines.push("---", "");
-  lines.push(`_Generated by [Perimeter](https://perimetercli.dev)._`);
+  lines.push(`_Generated by [Perimeter](https://github.com/stealth-alpha/perimeter)._`);
   return lines.join("\n");
 }
 
@@ -215,7 +215,7 @@ export function formatSarif(audit) {
             driver: {
               name: "perimeter",
               version: "0.1.0",
-              informationUri: "https://perimetercli.dev",
+              informationUri: "https://github.com/stealth-alpha/perimeter",
               rules: audit.findings.map((f, i) => ({
                 id: f.id,
                 name: f.title,
@@ -315,7 +315,7 @@ footer{margin-top:28px;color:var(--muted);font-size:13px;text-align:center}
 <tbody>${serversHtml}</tbody></table>
 <h2>Findings</h2>
 ${findingsHtml}
-<footer>Generated by <a href="https://perimetercli.dev">Perimeter</a></footer>
+<footer>Generated by <a href="https://github.com/stealth-alpha/perimeter">Perimeter</a></footer>
 </div></body></html>`;
 }