zeuslock-dlp-cli 0.2.0 → 0.2.2

package/LICENSE

@@ -0,0 +1,72 @@
+ZeusLock CLI — End User Licence Agreement
+Copyright (c) 2026 ZeusLock. All rights reserved.
+
+This software (the "Software") is proprietary to ZeusLock and is licensed, not
+sold. By downloading, installing or using the Software you agree to the terms
+below. If you do not agree, do not install or use it.
+
+1. Grant of licence
+
+   ZeusLock grants you a non-exclusive, non-transferable, revocable, worldwide
+   licence to install and use the Software, in object and source form as
+   distributed, solely to access and administer a ZeusLock service for which you
+   hold a valid subscription or evaluation entitlement.
+
+   You may install the Software on any number of machines you or your
+   organisation control, and use it in automated systems such as CI pipelines,
+   for that purpose.
+
+2. Restrictions
+
+   Except where the applicable law of your jurisdiction grants a right that
+   cannot lawfully be waived, you may not:
+
+   a. distribute, sublicense, sell, rent, lease or host the Software, or make it
+      available to any third party as part of a service offering;
+   b. modify or create derivative works of the Software, other than local
+      configuration and scripting that invokes it as published;
+   c. remove or obscure any copyright, trademark or other proprietary notice;
+   d. use the Software to access a ZeusLock service you are not authorised to
+      access, or to circumvent any licensing, quota or entitlement control.
+
+3. Third-party components
+
+   The Software depends on separately licensed open-source packages, which are
+   installed from their own registries and remain governed by their own licence
+   terms. Nothing in this Agreement limits any right you have under those terms.
+
+4. Ownership
+
+   ZeusLock and its licensors retain all right, title and interest in and to the
+   Software, including all intellectual property rights. No rights are granted
+   except as expressly stated in this Agreement.
+
+5. Term and termination
+
+   This licence takes effect on first use and continues until terminated. It
+   terminates automatically if you breach any term, or when your entitlement to
+   the corresponding ZeusLock service ends. On termination you must stop using
+   the Software and remove all copies under your control. Sections 4, 6, 7 and 8
+   survive termination.
+
+6. No warranty
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+
+7. Limitation of liability
+
+   TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL ZEUSLOCK
+   OR ITS LICENSORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+   IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+   CONNECTION WITH THE SOFTWARE OR ITS USE. Nothing in this Agreement excludes
+   or limits liability that cannot lawfully be excluded or limited.
+
+8. Precedence
+
+   If you or your organisation have a signed written agreement with ZeusLock
+   covering the Software, that agreement prevails over this one to the extent of
+   any conflict.
+
+Contact: https://zeuslock.ai

package/README.md

@@ -55,7 +55,7 @@ npm start -- auth api-key set zl_your_org_api_key
 npm start -- scan ./README.md --json
 npm start -- anonymize ./dataset.txt --output dataset.safe.txt
 npm start -- hook install --force
-npm start -- deploy gpo-config --api-key zl_your_key_here --output zeuslock-deploy
+npm start -- deploy generate --api-key zl_your_key_here --output zeuslock-deploy
 npm start -- deploy agent-verify --hostname CLIENT01
 npm start -- agents list
 npm start -- agents list --status offline --search linux
@@ -96,7 +96,7 @@ zeuslock scan ./README.md
 zeuslock scan --stdin
 zeuslock anonymize ./dataset.txt --output dataset.safe.txt
 zeuslock hook install
-zeuslock deploy gpo-config --api-key zl_your_key_here --output zeuslock-deploy
+zeuslock deploy generate --api-key zl_your_key_here --output zeuslock-deploy
 zeuslock deploy agent-verify --hostname CLIENT01
 zeuslock agents list --status online
 zeuslock agents revoke <agent_id> --yes
@@ -252,20 +252,20 @@ Deployment commands mirror only the dashboard Extension page and Agents deployme
 
 | Command | Purpose |
 | --- | --- |
-| `zeuslock deploy gpo-config` | Generate dashboard-supported extension GPO policy files and desktop-agent config files. |
+| `zeuslock deploy generate` | Generate enrollment files: extension managed-configuration policies and desktop-agent config. Alias: `gpo-config`. |
 | `zeuslock deploy agent-verify` | Verify installed/enrolled/reachable state from `GET /api/agents`. |
 
 Supported filters and values:
 
 | Command | Option | Values |
 | --- | --- | --- |
-| `deploy gpo-config` | `--artifact` | `all`, `extension`, `agent`; default `all` |
-| `deploy gpo-config` | `--browser` | `all`, `chrome`, `edge`; default `all`; applies to extension artifacts |
-| `deploy gpo-config` | `--output` | Output directory; default `zeuslock-deploy` |
-| `deploy gpo-config` | `--api-key` | Full organization API key to embed in generated files |
-| `deploy gpo-config` | `--key-id` | Existing key id from `zeuslock keys list --show-secret`; requires a decryptable key from `GET /api/keys` |
-| `deploy gpo-config` | `--create-key-name` | Creates a new key with `POST /api/keys` and embeds the returned full key |
-| `deploy gpo-config` | `--json` | Prints generated artifact metadata without secret values |
+| `deploy generate` | `--artifact` | `all`, `extension`, `agent`; default `all` |
+| `deploy generate` | `--browser` | `all`, `chrome`, `edge`; default `all`; applies to extension artifacts |
+| `deploy generate` | `--output` | Output directory; default `zeuslock-deploy` |
+| `deploy generate` | `--api-key` | Full organization API key to embed in generated files |
+| `deploy generate` | `--key-id` | Existing key id from `zeuslock keys list --show-secret`; requires a decryptable key from `GET /api/keys` |
+| `deploy generate` | `--create-key-name` | Creates a new key with `POST /api/keys` and embeds the returned full key |
+| `deploy generate` | `--json` | Prints generated artifact metadata without secret values |
 | `deploy agent-verify` | `--agent-id` | Exact agent id from `zeuslock agents list` |
 | `deploy agent-verify` | `--hostname` | Exact hostname, case-insensitive |
 | `deploy agent-verify` | `--platform` | `windows`, `macos`, `linux` |
@@ -411,12 +411,12 @@ Supported filters and values:
 | Command | Option | Values |
 | --- | --- | --- |
 | `incidents list` | `--days` | `7`, `30`, `90`; `90` requires Business or Enterprise |
-| `incidents list` | `--severity` | `critical`, `warning`; `warning` includes high, medium, and low |
+| `incidents list` | `--severity` | `critical`, `warning`; policy outcome — `critical` = blocked, `warning` = everything else |
 | `incidents list` | `--search` | Any text; searches user email, URL, and finding type |
 | `incidents list` | `--jailbreak` | Only incidents with a `jailbreak_attempt` finding |
 | `incidents stats` | `--days` | `1`, `7`, `30`, `365`; `365` requires Business or Enterprise |
 | `incidents export` | `--days` | `7`, `30`, `90`; default `30`; export requires Business or Enterprise |
-| `incidents export` | `--severity` | `critical`, `warning`; `warning` includes high, medium, and low |
+| `incidents export` | `--severity` | `critical`, `warning`; policy outcome — `critical` = blocked, `warning` = everything else |
 | `incidents export` | `--search` | Any text; searches user email, URL, and finding type |
 | `incidents export` | `--jailbreak` | Only incidents with a `jailbreak_attempt` finding |
 | `incidents export` | `--format` | `csv`, `json`; default `csv` |
@@ -561,7 +561,26 @@ Rules export scopes:
 
 This package is configured as `zeuslock-dlp-cli` and exposes the executable command `zeuslock`.
 
-Before publishing, confirm that the npm account is the intended package owner, choose the final license, and verify that `package.json` is already at the intended release version. Then run:
+Before publishing, confirm that the npm account is the intended package owner, choose the final license, and verify that `package.json` is already at the intended release version.
+
+### GitHub Actions
+
+Create a GitHub repository secret named `NPM_PUBLISH_TOKEN`. The token must belong to an npm account that can publish `zeuslock-dlp-cli`.
+
+Release a new version:
+
+```bash
+npm version patch
+git push origin main --follow-tags
+```
+
+The `vX.Y.Z` tag created by `npm version` triggers `.github/workflows/npm-publish.yml`. The workflow verifies the tag matches `package.json`, runs tests, checks publish contents, confirms the version is not already on npm, and publishes to the npm registry.
+
+You can also run the workflow manually from the `main` branch in GitHub Actions. Manual runs publish the version already present in `package.json`.
+
+### Manual Fallback
+
+If you need to publish from a local machine, run:
 
 ```bash
 npm publish --access public

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "zeuslock-dlp-cli",
-  "version": "0.2.0",
-  "description": "Command line tools for ZeusLock.",
+  "version": "0.2.2",
+  "description": "Terminal client for ZeusLock DLP — scan files and prompts for sensitive data, block risky commits, and manage policies, agents, incidents and SIEM events.",
   "type": "module",
   "bin": {
     "zeuslock": "bin/zeuslock.js"
@@ -9,7 +9,8 @@
   "files": [
     "bin",
     "src",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
     "start": "node ./bin/zeuslock.js",
@@ -22,10 +23,26 @@
   },
   "keywords": [
     "zeuslock",
+    "dlp",
+    "data-loss-prevention",
     "cli",
-    "security"
+    "security",
+    "ai-security",
+    "shadow-ai",
+    "siem",
+    "ocsf",
+    "pre-commit",
+    "compliance"
   ],
-  "license": "UNLICENSED",
+  "author": "ZeusLock (https://zeuslock.ai)",
+  "homepage": "https://zeuslock.ai/en/docs/getting-started/zeuslock-cli/",
+  "bugs": {
+    "url": "https://zeuslock.ai/en/docs/getting-started/zeuslock-cli/"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "publishConfig": {
+    "access": "public"
+  },
   "dependencies": {
     "commander": "^15.0.0",
     "yaml": "^2.9.0"

package/src/commands/deploy.js

@@ -1,4 +1,4 @@
-import { mkdir, writeFile } from "node:fs/promises";
+import { chmod, mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { Command } from "commander";
 
@@ -18,12 +18,27 @@ const EXTENSION_ID = "hgooghpcnalhpjbemnnmdoabfjhchoip";
 const EXTENSION_UPDATE_URL = "https://clients2.google.com/service/update2/crx";
 const AGENT_ONLINE_WINDOW_MS = 5 * 60 * 1000;
 
+// Chromium reads an extension's managed configuration from a policy tree that is
+// SEPARATE from ExtensionSettings — ExtensionSettings only controls install and
+// host permissions, and silently drops any key it does not recognise. Managed
+// values live under `<browser policy root>\3rdparty\extensions\<id>\policy`.
+const EXTENSION_MANAGED_POLICY_ROOT = {
+  chrome: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Google\\Chrome",
+  edge: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Edge"
+};
+
+// Property names the extension actually reads. These must match
+// `managed_schema.json` in zeuslock-extension exactly: Chromium validates
+// managed storage against that schema and discards anything not declared, and
+// background.js gates on `managed.apiUrl && managed.apiKey` (camelCase).
+const EXTENSION_MANAGED_KEYS = ["apiUrl", "apiKey", "orgName", "enabled", "showNotifications"];
+
 export function createDeployCommand({
   stdout = process.stdout,
   env = process.env
 } = {}) {
   const command = new Command("deploy")
-    .description("Generate and verify ZeusLock deployment artifacts");
+    .description("Generate and verify ZeusLock enrollment files");
 
   command.addCommand(createGpoConfigCommand({ stdout, env }));
   command.addCommand(createAgentVerifyCommand({ stdout, env }));
@@ -32,8 +47,13 @@ export function createDeployCommand({
 }
 
 function createGpoConfigCommand({ stdout, env }) {
-  return new Command("gpo-config")
-    .description("Generate dashboard-supported GPO and agent deployment artifacts")
+  // `generate` is the documented name: this command writes local enrollment
+  // files for any rollout channel (GPO, Intune, Jamf, MDM), not GPO alone, and
+  // it never touches Active Directory. `gpo-config` stays as an alias so
+  // existing scripts and the published docs keep working.
+  return new Command("generate")
+    .alias("gpo-config")
+    .description("Generate managed-configuration files for mass deployment (GPO, Intune, Jamf, MDM)")
     .option("--artifact <set>", "artifact set: all, extension, or agent", "all")
     .option("--browser <browser>", "extension browser policy: chrome, edge, or all", "all")
     .option("--output <dir>", "output directory", "zeuslock-deploy")
@@ -65,7 +85,8 @@ function createGpoConfigCommand({ stdout, env }) {
           outputDir,
           browser,
           apiUrl,
-          apiKey: selectedKey.api_key
+          apiKey: selectedKey.api_key,
+          orgName: org?.name || ""
         }));
       }
 
@@ -312,7 +333,7 @@ function formatMaskedPrefix(prefix) {
   return prefix ? `${prefix}***...****` : "";
 }
 
-async function writeExtensionArtifacts({ outputDir, browser, apiUrl, apiKey }) {
+async function writeExtensionArtifacts({ outputDir, browser, apiUrl, apiKey, orgName }) {
   const artifacts = [];
   const browsers = browser === "all" ? ["chrome", "edge"] : [browser];
   for (const target of browsers) {
@@ -325,44 +346,98 @@ async function writeExtensionArtifacts({ outputDir, browser, apiUrl, apiKey }) {
     artifacts.push(await writeArtifact(
       outputDir,
       `extension/${target}-extension-settings.json`,
-      `${JSON.stringify(buildExtensionSettings({ apiUrl, apiKey }), null, 2)}\n`,
+      `${JSON.stringify(buildExtensionSettings({ apiUrl }), null, 2)}\n`,
       "extension"
     ));
+    artifacts.push(await writeArtifact(
+      outputDir,
+      `extension/${target}-extension-managed-policy.reg`,
+      buildExtensionManagedRegistry({ browser: target, apiUrl, apiKey, orgName }),
+      "extension",
+      { secret: true }
+    ));
+    artifacts.push(await writeArtifact(
+      outputDir,
+      `extension/${target}-extension-managed-config.json`,
+      `${JSON.stringify(buildExtensionManagedConfig({ apiUrl, apiKey, orgName }), null, 2)}\n`,
+      "extension",
+      { secret: true }
+    ));
   }
   return artifacts;
 }
 
-function buildExtensionSettings({ apiUrl, apiKey }) {
+/**
+ * Chromium `ExtensionSettings` policy value — install and host permissions only.
+ *
+ * This deliberately carries NO credentials. An earlier version nested a
+ * `configuration` block here; `configuration` is not a recognised
+ * ExtensionSettings key, so Chromium dropped it without warning and the
+ * extension fell back to per-user setup — the exact thing this command exists to
+ * avoid. Managed values go through buildExtensionManagedConfig() instead.
+ */
+function buildExtensionSettings({ apiUrl }) {
   const apiHost = new URL(apiUrl).host;
   return {
     [EXTENSION_ID]: {
       installation_mode: "force_installed",
+      update_url: EXTENSION_UPDATE_URL,
       runtime_allowed_hosts: [`*://${apiHost}`],
-      runtime_blocked_hosts: [],
-      configuration: {
-        api_url: apiUrl,
-        api_key: apiKey,
-        monitor_clipboard: true,
-        monitor_ai_apps: true,
-        show_notifications: true
-      }
+      runtime_blocked_hosts: []
     }
   };
 }
 
+/** Managed-storage values the extension reads via `chrome.storage.managed`. */
+function buildExtensionManagedConfig({ apiUrl, apiKey, orgName }) {
+  return {
+    apiUrl,
+    apiKey,
+    orgName: orgName || "",
+    enabled: true,
+    showNotifications: true
+  };
+}
+
+/**
+ * The same managed configuration as a Windows `.reg` file, for GPO rollout.
+ * Booleans must be REG_DWORD; Chromium rejects "true"/"false" strings.
+ */
+function buildExtensionManagedRegistry({ browser, apiUrl, apiKey, orgName }) {
+  const config = buildExtensionManagedConfig({ apiUrl, apiKey, orgName });
+  const lines = [
+    "Windows Registry Editor Version 5.00",
+    "",
+    `; ZeusLock extension managed configuration (${browser}).`,
+    "; Read by the extension through chrome.storage.managed.",
+    "",
+    `[${EXTENSION_MANAGED_POLICY_ROOT[browser]}\\3rdparty\\extensions\\${EXTENSION_ID}\\policy]`
+  ];
+  for (const key of EXTENSION_MANAGED_KEYS) {
+    const value = config[key];
+    lines.push(typeof value === "boolean"
+      ? `"${key}"=dword:${value ? "00000001" : "00000000"}`
+      : `"${key}"="${escapeRegString(String(value ?? ""))}"`);
+  }
+  lines.push("");
+  return lines.join("\r\n");
+}
+
 async function writeAgentArtifacts({ outputDir, apiUrl, apiKey }) {
   return [
     await writeArtifact(
       outputDir,
       "agent/windows-agent-policy.reg",
       buildWindowsAgentRegistry({ apiUrl, apiKey }),
-      "agent"
+      "agent",
+      { secret: true }
     ),
     await writeArtifact(
       outputDir,
       "agent/agent-config.json",
       `${JSON.stringify(buildAgentConfig({ apiUrl, apiKey }), null, 2)}\n`,
-      "agent"
+      "agent",
+      { secret: true }
     )
   ];
 }
@@ -391,13 +466,23 @@ function escapeRegString(value) {
   return String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
 
-async function writeArtifact(outputDir, relativePath, content, type) {
+async function writeArtifact(outputDir, relativePath, content, type, { secret = false } = {}) {
   const fullPath = path.join(outputDir, relativePath);
   await mkdir(path.dirname(fullPath), { recursive: true });
-  await writeFile(fullPath, content, "utf8");
+  // Artifacts carrying the organization API key get the same 0600 treatment as
+  // the CLI's own api-key.json — writing a plaintext fleet credential
+  // world-readable would undo that hardening. `mode` is a no-op on Windows.
+  await writeFile(fullPath, content, { encoding: "utf8", mode: secret ? 0o600 : 0o644 });
+  if (secret) {
+    // writeFile's `mode` only applies when the file is created, and this command
+    // overwrites on re-run — chmod explicitly so a file left over from an older
+    // build does not keep 0644. Best-effort: unsupported on Windows.
+    await chmod(fullPath, 0o600).catch(() => {});
+  }
   return {
     type,
-    path: fullPath
+    path: fullPath,
+    ...(secret ? { contains_secret: true } : {})
   };
 }
 

package/src/commands/incidents.js

@@ -209,13 +209,7 @@ function applyIncidentFilters(incidents, { severity = null, search = "", jailbre
   }
 
   if (severity) {
-    filtered = filtered.filter((incident) => {
-      const riskLevel = String(incident.risk_level || incident.severity || "").toLowerCase();
-      if (severity === "warning") {
-        return ["high", "medium", "low"].includes(riskLevel);
-      }
-      return riskLevel === severity;
-    });
+    filtered = filtered.filter((incident) => outcomeSeverity(incident) === severity);
   }
 
   const query = String(search || "").trim().toLowerCase();
@@ -230,6 +224,24 @@ function applyIncidentFilters(incidents, { severity = null, search = "", jailbre
   return filtered;
 }
 
+/**
+ * Severity as the dashboard shows it: the POLICY OUTCOME decides, not the
+ * detector's risk score. A credit-card hit under an `alert` policy is a
+ * warning; the same hit under a `block` policy is critical.
+ *
+ * Kept byte-for-byte equivalent to `outcomeSeverity()` in the dashboard's
+ * IncidentsPage.tsx. The CLI used to read `risk_level` here, which disagreed
+ * with the dashboard on 44% of rows (alert-mode findings still carry
+ * risk_level "critical"). Change both or neither.
+ */
+function outcomeSeverity(incident) {
+  const action = String(incident?.action || "").toLowerCase();
+  if (action) {
+    return action === "blocked" || action === "block" ? "critical" : "warning";
+  }
+  return incident?.blocked === true ? "critical" : "warning";
+}
+
 function isDashboardVisibleIncident(incident) {
   const hasFindings = Array.isArray(incident.findings) && incident.findings.length > 0;
   const isBlocked = incident.blocked === true;
@@ -250,7 +262,7 @@ function getFindingTypes(incident) {
 function formatIncidentTable(incidents) {
   const rows = incidents.map((incident) => ({
     date: formatDate(incident.created_at),
-    severity: incident.risk_level || incident.severity || "-",
+    severity: outcomeSeverity(incident),
     type: formatFindingTypes(incident),
     user: incident.user_email || "-",
     platform: formatPlatform(incident),
@@ -365,6 +377,10 @@ function formatIncidentsCsv(incidents) {
   const columns = [
     ["incident_id", (incident) => incident.incident_id || incident.id || ""],
     ["created_at", (incident) => incident.created_at || ""],
+    // `severity` is the dashboard-visible value (policy outcome); `risk_level`
+    // is kept alongside it as the raw detector score so nothing is lost for
+    // anyone already parsing that column.
+    ["severity", (incident) => outcomeSeverity(incident)],
     ["risk_level", (incident) => incident.risk_level || incident.severity || ""],
     ["type", (incident) => formatFindingTypes(incident)],
     ["user_email", (incident) => incident.user_email || ""],

package/src/lib/api-client.js

@@ -292,9 +292,9 @@ async function fetchJson(url, request) {
 
   if (!response.ok) {
     const message =
-      data?.error ||
-      data?.detail ||
-      data?.message ||
+      errorText(data?.error) ||
+      errorText(data?.detail) ||
+      errorText(data?.message) ||
       responseText ||
       `Request failed with status ${response.status}`;
     throw new ApiError(message, { status: response.status, data, responseText });
@@ -303,6 +303,36 @@ async function fetchJson(url, request) {
   return data ?? {};
 }
 
+/**
+ * Coerce one backend error field into displayable text.
+ *
+ * Most endpoints return `detail` as a plain string, but the policy, group and
+ * principal routes wrap it (`{"detail": {"error": "Policy not found"}}` — see
+ * `policies.py` `_translate`, which passes `detail=exc.to_dict()`). Handing that
+ * object straight to `new Error()` printed the literal `[object Object]` and
+ * threw away a perfectly good message, so unwrap the common shapes first.
+ */
+function errorText(value) {
+  if (typeof value === "string") {
+    return value.trim() || null;
+  }
+  if (Array.isArray(value)) {
+    // FastAPI request-validation errors arrive as a list of {loc, msg, type}.
+    const parts = value.map((entry) => errorText(entry)).filter(Boolean);
+    return parts.length ? parts.join("; ") : null;
+  }
+  if (value && typeof value === "object") {
+    return (
+      errorText(value.error) ||
+      errorText(value.message) ||
+      errorText(value.msg) ||
+      errorText(value.detail) ||
+      null
+    );
+  }
+  return null;
+}
+
 function ensureTrailingSlash(apiUrl) {
   return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
 }