shield-harness 0.1.0 → 0.3.0

package/bin/shield-harness.js

@@ -208,6 +208,84 @@ function printBasicGuide() {
   console.log("    3. openshell sandbox start");
 }
 
+// ---------------------------------------------------------------------------
+// generate-policy command
+// ---------------------------------------------------------------------------
+
+const POLICY_PROFILES = ["standard", "strict"];
+const DEFAULT_POLICY_OUTPUT = path.join(
+  ".claude",
+  "policies",
+  "openshell-generated.yaml",
+);
+
+/**
+ * Generate OpenShell policy YAML from permissions-spec.json.
+ * @param {string[]} args - CLI arguments (after "generate-policy")
+ */
+function generatePolicy(args) {
+  // Parse --output
+  let output = DEFAULT_POLICY_OUTPUT;
+  const outputIdx = args.indexOf("--output");
+  if (outputIdx !== -1 && args[outputIdx + 1]) {
+    output = args[outputIdx + 1];
+  }
+
+  // Parse --profile
+  let profile = "standard";
+  const profileIdx = args.indexOf("--profile");
+  if (profileIdx !== -1 && args[profileIdx + 1]) {
+    profile = args[profileIdx + 1];
+    if (!POLICY_PROFILES.includes(profile)) {
+      console.error(`Unknown profile: ${profile}`);
+      console.error(`Available profiles: ${POLICY_PROFILES.join(", ")}`);
+      process.exit(1);
+    }
+  }
+
+  // Read permissions-spec.json
+  const specPath = path.join(process.cwd(), ".claude", "permissions-spec.json");
+  if (!fs.existsSync(specPath)) {
+    console.error("permissions-spec.json not found at: " + specPath);
+    console.error("Run 'npx shield-harness init' first.");
+    process.exit(1);
+  }
+
+  let spec;
+  try {
+    spec = JSON.parse(fs.readFileSync(specPath, "utf8"));
+  } catch (err) {
+    console.error("Failed to parse permissions-spec.json: " + err.message);
+    process.exit(1);
+  }
+
+  // Generate YAML
+  let yaml;
+  try {
+    const {
+      generatePolicyYaml,
+    } = require("../.claude/hooks/lib/tier-policy-gen");
+    yaml = generatePolicyYaml(spec, { profile });
+  } catch (err) {
+    console.error("Failed to generate policy: " + err.message);
+    process.exit(1);
+  }
+
+  // Write output
+  const outputPath = path.resolve(process.cwd(), output);
+  const outputDir = path.dirname(outputPath);
+  if (!fs.existsSync(outputDir)) {
+    fs.mkdirSync(outputDir, { recursive: true });
+  }
+  fs.writeFileSync(outputPath, yaml);
+
+  console.log(`Policy generated successfully (profile: ${profile}).`);
+  console.log(`  Output: ${output}`);
+  console.log("");
+  console.log("Usage:");
+  console.log(`  openshell sandbox create --policy ${output} -- claude`);
+}
+
 // ---------------------------------------------------------------------------
 // CLI
 // ---------------------------------------------------------------------------
@@ -227,12 +305,17 @@ if (command === "init") {
     }
   }
   init(profile);
+} else if (command === "generate-policy") {
+  generatePolicy(args);
 } else {
   const pkg = require("../package.json");
   console.log(`Shield Harness v${pkg.version}`);
   console.log("");
   console.log("Usage:");
   console.log("  npx shield-harness init [--profile minimal|standard|strict]");
+  console.log(
+    "  npx shield-harness generate-policy [--output <path>] [--profile standard|strict]",
+  );
   console.log("");
   console.log("Profiles:");
   console.log("  minimal   — Minimal config, approval-free");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shield-harness",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Security harness for Claude Code — hooks-driven, zero-hassle defense",
   "bin": {
     "shield-harness": "./bin/shield-harness.js"
@@ -10,6 +10,7 @@
     ".claude/patterns/",
     ".claude/policies/",
     ".claude/rules/",
+    ".claude/permissions-spec.json",
     "bin/"
   ],
   "scripts": {
@@ -21,7 +22,12 @@
     "test:boundary": "node --test tests/data-boundary-evasion.test.js",
     "test:output": "node --test tests/output-security.test.js",
     "test:ocsf": "node --test tests/ocsf-mapper.test.js",
-    "test:policy-compat": "node --test tests/policy-compat.test.js"
+    "test:policy-compat": "node --test tests/policy-compat.test.js",
+    "test:permissions": "node --test tests/permissions-alignment.test.js",
+    "test:openshell-detect": "node --test tests/openshell-detect.test.js",
+    "test:openshell-evidence": "node --test tests/openshell-evidence.test.js",
+    "test:tier-policy": "node --test tests/tier-policy-gen.test.js",
+    "test:policy-effectiveness": "node --test tests/policy-effectiveness.test.js"
   },
   "keywords": [
     "claude-code",