srvgov-cli 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +29 -0
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -28,6 +28,7 @@ srvgov ports -o json
28
28
  srvgov logs --unit sshd --since "1 hour ago" --lines 50 -o json
29
29
  srvgov svc status sshd -o json
30
30
  srvgov file stat /etc/hosts -o json
31
+ srvgov docker list -o json
31
32
  srvgov exec --dry-run "uptime" -o json
32
33
  srvgov exec "uptime" -o json
33
34
  srvgov audit query --limit 20 -o json
@@ -144,6 +145,34 @@ file content; audit stores only the redacted path, byte count, and SHA-256.
144
145
  Writes are direct and non-atomic; temporary-file plus rename is not implemented
145
146
  in this release. `file` never uses SFTP and never adds `sudo`.
146
147
 
148
+ ## Docker Governance
149
+
150
+ Docker reads provide stable, redacted structures:
151
+
152
+ ```bash
153
+ srvgov docker list -o json
154
+ srvgov docker inspect api -o json
155
+ srvgov docker logs api --tail 100 -o json
156
+ ```
157
+
158
+ `docker list`, `inspect`, and `logs` are audited R0 operations. Inspect uses a
159
+ remote fixed-field projection and excludes container environment variables and
160
+ the full inspect document. Logs default to 100 lines and accept `--tail`
161
+ between 1 and 10000.
162
+
163
+ Lifecycle changes are R2 and require human authorization:
164
+
165
+ ```bash
166
+ srvgov docker restart api \
167
+ --reason "restart after reviewed deployment" --ticket OPS-123 --yes -o json
168
+ ```
169
+
170
+ The fixed whitelist contains only `ps`/`list`, `inspect`, `logs`, `start`,
171
+ `stop`, `restart`, and `rm`, one container at a time. It never exposes Docker
172
+ run, create, exec, build, copy, compose, or prune. Protected contexts raise
173
+ lifecycle changes to R3 and require human-supplied `--allow-destructive`.
174
+ Container identifiers are shell-quoted.
175
+
147
176
  ## Governed Execution
148
177
 
149
178
  Preview without connecting or executing:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "srvgov-cli",
3
- "version": "0.3.0",
3
+ "version": "0.4.0",
4
4
  "description": "Governed remote server command execution CLI for AI agents",
5
5
  "bin": {
6
6
  "srvgov": "bin/srvgov-cli.js",