veefore 0.0.0-stage → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +101 -2
- package/dist/veefore.mjs +8767 -0
- package/package.json +39 -4
package/README.md
CHANGED
|
@@ -1,3 +1,102 @@
|
|
|
1
|
-
#
|
|
1
|
+
# veefore
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
The Veefore command line. Run it in an agent project and it puts every tool
|
|
4
|
+
call behind Veefore identity, policy and approval.
|
|
5
|
+
|
|
6
|
+
## Install
|
|
7
|
+
|
|
8
|
+
```bash
|
|
9
|
+
npm install -g veefore
|
|
10
|
+
cd your-agent-project
|
|
11
|
+
veefore
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
Requires Node 20.10 or newer. To upgrade: `npm install -g veefore@latest`.
|
|
15
|
+
|
|
16
|
+
Or run it without installing anything:
|
|
17
|
+
|
|
18
|
+
```bash
|
|
19
|
+
npx veefore scan
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
It connects to Veefore by itself. If your organization runs its own Veefore,
|
|
23
|
+
name it once with `veefore --control-plane https://veefore.your-company.com`;
|
|
24
|
+
the CLI remembers it.
|
|
25
|
+
|
|
26
|
+
## First run
|
|
27
|
+
|
|
28
|
+
That one command:
|
|
29
|
+
|
|
30
|
+
1. Signs you in through your browser. The terminal never sees your password.
|
|
31
|
+
Over SSH it shows a link and a code instead (`veefore login --device`).
|
|
32
|
+
2. Scans the project for the agent framework, its tools, the hosts they call
|
|
33
|
+
and the credentials they read. Code is read, never run, and nothing is sent.
|
|
34
|
+
3. Shows a plan and, once you confirm, registers the agent, its tools and a
|
|
35
|
+
starter policy in observe mode. The agent's private key is generated on
|
|
36
|
+
your machine and written only to `.env.local`.
|
|
37
|
+
4. Wraps each tool in `guard()`, showing the diff first, backing up every file
|
|
38
|
+
and rolling back automatically if your project's checks fail.
|
|
39
|
+
|
|
40
|
+
Tools it cannot change safely are listed with the exact edit to make, or
|
|
41
|
+
changed with AI using your own key or Veefore AI, if you choose.
|
|
42
|
+
|
|
43
|
+
Then, in order:
|
|
44
|
+
|
|
45
|
+
```bash
|
|
46
|
+
veefore dev # watch what your agent actually does
|
|
47
|
+
veefore doctor # check the security posture
|
|
48
|
+
veefore deploy # turn enforcement on
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
## Commands
|
|
52
|
+
|
|
53
|
+
| Command | Does |
|
|
54
|
+
| --- | --- |
|
|
55
|
+
| `veefore init` | Sign in, scan, register the agent and its tools, write config. Also runs as plain `veefore` |
|
|
56
|
+
| `veefore scan` | Show what setup would find, without signing in. Needs no network |
|
|
57
|
+
| `veefore integrate` | Wrap registered tools in `guard()`, with a diff, a backup and a rollback |
|
|
58
|
+
| `veefore undo` | Restore the files from the last code change |
|
|
59
|
+
| `veefore remove` | Take `guard()` out of the code and disconnect the project |
|
|
60
|
+
| `veefore dev` | Watch decisions live while you run your agent |
|
|
61
|
+
| `veefore doctor` | Audit the security posture of this setup |
|
|
62
|
+
| `veefore status` | Current environment, enforcement mode and agent health |
|
|
63
|
+
| `veefore test` | Verify enforcement works, without performing any action. Suitable as a CI gate |
|
|
64
|
+
| `veefore agents` | `list`, `show`, `pause`, `resume`, `suspend`, `revoke`, `rotate-key` |
|
|
65
|
+
| `veefore policies` | `list`, `show`, `test`, `deploy`, `diff` |
|
|
66
|
+
| `veefore logs` | Read or stream the decision log |
|
|
67
|
+
| `veefore audit` | `list`, `show`, `verify`, `export` the audit trail |
|
|
68
|
+
| `veefore deploy` | Promote the environment to enforcement |
|
|
69
|
+
| `veefore login` | Sign in through your browser and store a session token |
|
|
70
|
+
| `veefore logout` | Sign out on this machine, on the server too |
|
|
71
|
+
| `veefore help` | Every command |
|
|
72
|
+
|
|
73
|
+
Run `veefore <command> --help` for the full options of any one of them.
|
|
74
|
+
|
|
75
|
+
### Global options
|
|
76
|
+
|
|
77
|
+
| Option | Does |
|
|
78
|
+
| --- | --- |
|
|
79
|
+
| `--json` | Machine-readable output |
|
|
80
|
+
| `--yes`, `-y` | Assume yes for confirmations. Never skips step-up authentication |
|
|
81
|
+
| `--verbose` | Expanded output |
|
|
82
|
+
| `--control-plane <url>` | Use this Veefore instead of the one found automatically |
|
|
83
|
+
| `--gateway <url>` | Override the configured gateway URL |
|
|
84
|
+
| `--version`, `-V` | Print the CLI version |
|
|
85
|
+
| `--help`, `-h` | Show help |
|
|
86
|
+
|
|
87
|
+
### Exit codes
|
|
88
|
+
|
|
89
|
+
| Code | Means |
|
|
90
|
+
| --- | --- |
|
|
91
|
+
| `0` | Success |
|
|
92
|
+
| `1` | The command ran and reported a problem: a failed check, a refused action |
|
|
93
|
+
| `2` | The CLI was used incorrectly: unknown command, missing argument |
|
|
94
|
+
|
|
95
|
+
So `veefore test`, `veefore integrate --check` and `veefore audit verify` all
|
|
96
|
+
work as CI gates without parsing their output.
|
|
97
|
+
|
|
98
|
+
## What runs without a Veefore
|
|
99
|
+
|
|
100
|
+
`veefore scan`, `veefore --help` and `veefore --version` need no sign-in and no
|
|
101
|
+
network. Every other command talks to a control plane, and says so plainly when
|
|
102
|
+
it cannot reach one.
|