netconverter-cli 0.4.0__tar.gz

netconverter_cli-0.4.0/.gitignore

@@ -0,0 +1,9 @@
+.venv/
+dist/
+__pycache__/
+.pytest_cache/
+*.egg-info/
+.netconverter/
+
+.superdesign/
+.DS_Store

netconverter_cli-0.4.0/CHANGELOG.md

@@ -0,0 +1,189 @@
+# Changelog
+
+## 0.4.0 — 2026-10-21
+
+- **On PyPI as `netconverter-cli`.** `uv tool install --python 3.12 netconverter-cli`
+  installs the CLI; each tagged release is published from GitHub Actions with PyPI
+  trusted publishing, and the wheel plus `SHA256SUMS` stay on the GitHub Release.
+- **One-line installers.** `curl -LsSf https://netconverter.ai/install.sh | sh`
+  (macOS/Linux) and `irm https://netconverter.ai/install.ps1 | iex` (Windows) install uv
+  if needed and the CLI from PyPI (or the latest release wheel after its SHA-256 check
+  when PyPI is unreachable), sign you in, create `~/migrations` and run
+  `connect --all`. `--yes` for IT/MDM, `--no-connect`, `--workspace PATH`. Safe to run
+  again. Sources: `scripts/install.sh`, `scripts/install.ps1`.
+- **`netconverter update` follows the install.** A copy uv installed from PyPI is
+  upgraded with `uv tool upgrade netconverter-cli`; a copy installed from a wheel keeps
+  the verified-wheel path.
+- **`netconverter --version`.**
+
+## 0.3.2 — 2026-10-21
+
+- **Safer Claude Code read rule.** `connect claude-code` no longer offers the
+  `Read(//<folder>/**)` deny rule when the workspace is your home folder (or contains
+  it): there it would stop Claude Code reading every project. Use a dedicated folder
+  such as `~/migrations`.
+- **`connect --all` skips optional extras** such as that rule; run
+  `netconverter connect claude-code` on its own to review it.
+- **Getting access guide** for new users and administrators: `docs/connect/getting-access.md`.
+
+## 0.3.1 — 2026-10-21
+
+- **More assistants.** `netconverter connect gemini` (Gemini CLI), `windsurf` and
+  `lmstudio` merge the bridge into each client's MCP config, keeping every other key
+  and a `.bak`, like `claude-desktop`.
+- **ChatGPT and claude.ai.** `netconverter connect chatgpt` / `claude-ai` print the
+  steps to add NetConverter's hosted MCP as a custom connector. Those apps cannot start
+  a local program, so they read jobs, results and the knowledge base but do not submit
+  files; nothing on the computer is changed.
+- **`netconverter connect --all`** connects every local assistant found on this
+  computer that is not connected yet, one prompt each (`--yes` for all). The list view
+  now marks connected (●), found (○ found on this computer) and remote (↗) clients.
+
+## 0.3.0 — 2026-10-20
+
+- **Remote tool allowlist.** The bridge proxies a NetConverter MCP tool only when it
+  is on the client's allowlist: the read tools the server advertises today plus the
+  new `get_account`. A tool the server adds later, or any `submit_*` tool, is not
+  offered to your AI until a client release lists it.
+- **Strict mode.** `netconverter mcp --strict` (or `NETCONVERTER_MCP_STRICT=1`)
+  proxies only the strict-view set: `list_jobs`, `select_job`, `get_account`, `search`,
+  `fetch`, `kb_search`, `kb_explain`, `vendor_capability_lookup`, `get_job_brief`,
+  `get_evidence`, `get_report`, whatever the server advertises. When your account is
+  in the server's strict view mode, names in results arrive as `<name:…>` tokens.
+- **New bridge tools.** `account` (tier, job types, rate limit, daily quota, auth kind,
+  client version, `update_available`; no tokens or e-mail addresses) and
+  `wait_for_job(job_id, timeout_s ≤ 600)`, which polls with backoff and returns the
+  `job_status` summary plus `waited_s` and `timed_out`. It sends MCP progress
+  notifications when the assistant asks for them. `job_status` also reports the job's
+  stage and percentage when the server sends them. `submit_file` accepts
+  `job_type: "analyze"` as an alias of validate.
+- **`netconverter connect claude-desktop`** merges the bridge into Claude Desktop's
+  `claude_desktop_config.json` (macOS and Windows), after showing a diff, with a `.bak`.
+- **Claude Code read rule.** After `connect claude-code`, the CLI and the app offer
+  (default yes) to add `Read(//<folder>/**)` to `permissions.deny` in
+  `~/.claude/settings.json`, so Claude Code works on the folder's configurations
+  through the bridge instead of reading them itself. See [privacy](docs/PRIVACY.md).
+- **`netconverter update`** installs the latest GitHub release after verifying its
+  SHA-256 against the release's `SHA256SUMS` (`--check` only reports, `--yes` skips
+  the prompt). Interactive commands show a one-line notice at most once a day when
+  a newer release exists; `NETCONVERTER_NO_UPDATE_CHECK=1` turns it off.
+
+## 0.2.2 — 2026-10-19
+
+- **Validate and optimize downloads keep the result.** `download` (bridge and app)
+  saved only an empty `report.json` for these jobs; it now saves
+  `<job>.validation.json` or `<job>.optimization.json` from the job's result, plus the
+  evidence workbook when the server has one. An unfinished job answers
+  `job_not_completed` instead of writing an empty file. Conversion downloads are unchanged.
+
+## 0.2.1 — 2026-10-19
+
+- **Your sign-in just works.** After `netconverter login --clerk`, plain commands
+  (`capabilities`, `jobs`, `validate`, `convert`, …) and the app use it with no
+  `NETCONVERTER_AUTH` variable; 0.2.0 prompted for an API key. A stored key is
+  still used first, the sign-in only ever goes to a trusted NetConverter host, and
+  `NETCONVERTER_AUTH=key|clerk` forces one. With neither, the command says how to
+  connect instead of prompting.
+- **First-run setup offers sign-in.** Plain `netconverter` in a new folder uses an
+  existing sign-in, or asks: sign in with your NetConverter account (browser) or
+  paste an API key. A workspace's `connection.json` still never chooses the credential.
+
+## 0.2.0 — 2026-10-19
+
+**NetConverter CLI.** The package is now `netconverter-cli` (the command is still
+`netconverter`). Run `uv tool uninstall netconverter-terminal` before installing;
+saved keys, sign-ins and workspace state carry over.
+
+- **Every vendor the server supports.** Full-API keys and Clerk sign-ins use the
+  External API: menus come from `GET /capabilities` (vendors, source → target paths,
+  job types, limits), so firewalls, routers and switches all work and new server
+  vendors need no client release. Terminal Quick pilot keys keep ASA → Palo Alto
+  and are labelled as such.
+- **`/validate` and `/optimize`** alongside `/convert`; the file's vendor is
+  suggested from a local look at its first lines.
+- **Redesigned app.** One-row header (server, bridge, model, allowance), cards with
+  verdict badges, a bordered choice panel with a `▸` cursor and 1–9 jump keys, a
+  bordered prompt, one status line with a spinner and progress bar, a contextual
+  footer, readable labels instead of raw codes, and no wrapped review tables at 80 columns.
+- **Your AI, visible.** `netconverter connect claude-code|cursor|vscode|codex` (or
+  `/connect`) wires the bridge after showing the change. The bridge records metadata-only
+  activity, shown live in the app and in `/activity`.
+- **Bridge fixes.** Submissions send `technology` from the vendor code (router and
+  switch jobs were labelled firewall). Validate/optimize work as soon as the server
+  advertises them in `/me` (server change shipped alongside). Downloads add the
+  evidence workbook.
+- `netconverter capabilities`; `validate`/`convert --vendor … --to …` in plain mode.
+  `login` and `setup` accept full-API keys (0.1.x checked only the pilot profile).
+
+## 0.1.6 — 2026-10-18
+
+- `netconverter login --clerk`: sign in with your NetConverter account (OAuth 2.1
+  PKCE through clerk.netconverter.ai). `--device` for machines without a browser.
+  Tokens live only in the OS credential store and refresh automatically.
+  `netconverter whoami` and `netconverter logout` added. Key login is unchanged.
+- `netconverter mcp`: a local MCP server for Claude Code, Cursor, VS Code and Codex.
+  Your AI passes file paths; the client uploads the configuration directly to
+  NetConverter, so the configuration never goes through the model. Tools:
+  `submit_file`, `job_status`, `download`, plus the remote read-only NetConverter
+  tools (evidence, NAT, flows, knowledge base).
+- Your sign-in is only ever sent to api.netconverter.ai (or hosts you trust with
+  `NETCONVERTER_TRUSTED_HOSTS`); a workspace file cannot redirect it.
+
+## 0.1.5 — 2026-10-01
+
+- Display server-authorized unlimited allowances as Unlimited in the status line
+  and `/allowance`. This client update does not grant or change server entitlements.
+
+## 0.1.4 — 2026-10-01
+
+- Skip `evidence.json` and `pipeline-evidence.json` in automatic downloads and
+  `/download`. Keep converted configs, YAML, reports and TXT/XLSX evidence.
+- Existing local artifacts are not deleted. Follow-up query JSON/TXT is unchanged.
+
+## 0.1.3 — 2026-10-01
+
+- Replace modal forms, dropdowns and oversized buttons with compact inline
+  keyboard questions: arrow keys choose, Enter continues, Esc cancels a choice.
+- Disable mouse capture so normal terminal text selection works.
+- `/convert` starts with an ASA source, then asks separately for Palo Alto output,
+  server-supported options, cleanup and optional advanced overrides. Show the
+  review before explicit job submission; uploads are separately confirmed.
+- `/open`, `/analyze` and `/model` use the same inline flow. Keep keys masked and
+  out of conversation history, preserve model connections on failed retries.
+- A selected Palo Alto source now leads `/convert` to ASA file selection instead
+  of leaving the user at a source-format validation error.
+- Preserve server job status, warnings, downloads, privacy and no-clobber behavior.
+
+## 0.1.2 — 2026-10-01
+
+- Implement the approved NETCONVERTER.ai terminal design: compact welcome commands,
+  persistent prompt/status, workspace file browser, readable jobs and local artifacts.
+- File browser actions upload the selected config and open explicit conversion
+  choices or submit analysis. ASA-only migration and the 50,000-byte limit remain.
+- Replace raw JSON help and generic errors with readable commands and next steps.
+- Add `/model` with hidden key entry, a synthetic compatibility probe, and retry
+  without replacing a working model on failure. Setup distinguishes provider
+  authentication, permissions, model access, quota, rate limits, and connectivity.
+- Detect keys accidentally entered in the server URL field and reprompt.
+- Display server progress/verdicts and hash-verified local downloads. Failed
+  downloads remain retryable; existing outputs and source configurations survive.
+- Responsive interaction coverage at 126×41 and 80×24; expanded negative tests.
+
+Model protocol tests use mocks. The reported customer OpenAI connection failure
+still needs live retesting with the customer's chosen API model. This release
+does not add archive encryption, job cancellation, or a runtime guarantee.
+
+## 0.1.1 — 2026-10-01
+
+First public pilot client release under the MIT license.
+
+- NetConverter branding and guided ASA → Palo Alto SET/XML/Panorama conversion.
+- Production HTTPS setup, separate server/model credentials, and OS credential storage.
+- Optional Anthropic, OpenAI, Gemini, and Ollama operation adapters.
+- Analysis, optimization findings, structured policy questions, and revision selection.
+- Server job IDs, resumable sessions, and verified artifacts beside the source.
+- Customer installation, settings, privacy, troubleshooting, and uninstall guides.
+
+This public repository begins with a reviewed client snapshot. Private development
+history and server implementation are not included. See verification notes for
+remaining acceptance work.

netconverter_cli-0.4.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ValeronLabs LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

netconverter_cli-0.4.0/PKG-INFO

@@ -0,0 +1,167 @@
+Metadata-Version: 2.5
+Name: netconverter-cli
+Version: 0.4.0
+Summary: NetConverter CLI — any-vendor network configuration migration, validation and optimization, and a local MCP bridge for your AI assistant
+Project-URL: Homepage, https://netconverter.ai
+Project-URL: Repository, https://github.com/valeronlabs/netconverter_terminals
+Project-URL: Documentation, https://github.com/valeronlabs/netconverter_terminals/blob/main/QUICK_START.md
+Project-URL: Issues, https://github.com/valeronlabs/netconverter_terminals/issues
+Project-URL: Changelog, https://github.com/valeronlabs/netconverter_terminals/blob/main/CHANGELOG.md
+Author-email: ValeronLabs LLC <contact@netconverter.ai>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: check-point,cisco,firewall,fortinet,mcp,migration,model-context-protocol,netconverter,network-automation,palo-alto
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Telecommunications Industry
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Networking :: Firewalls
+Classifier: Topic :: Utilities
+Requires-Python: >=3.12
+Requires-Dist: httpx==0.28.1
+Requires-Dist: keyring==25.7.0
+Requires-Dist: pydantic==2.13.5
+Requires-Dist: textual==8.2.8
+Description-Content-Type: text/markdown
+
+# NetConverter CLI
+
+<!-- mcp-name: ai.netconverter/netconverter -->
+
+**Migrate, validate and optimize network configurations from the folder that holds them — and let your own AI assistant do it too, without the configuration ever passing through the model.**
+
+NetConverter — by ValeronLabs LLC.
+
+```text
+◆ NetConverter  v0.3.0                      ● Server   ◆ Bridge claude-code · 2m ago
+▍ Start
+▍ /convert    Migrate a configuration to another vendor
+▍ /validate   Check a configuration before migrating
+▍ /optimize   Cleanup and optimization findings
+▍ /activity   What your AI assistant did here
+╭ What does edge-fw.conf contain? ───────────────────────────────╮
+│ ▸  1  Fortinet FortiGate  · detected                            │
+│    2  Cisco ASA                                                 │
+╰──────────────────────────────── ↑↓ choose · 1–9 jump · Enter ───╯
+```
+
+One small client, three ways in:
+
+| | What it is |
+| --- | --- |
+| `netconverter` | A keyboard-first full-screen app: pick a file, answer a few inline questions, follow the job, get verified outputs beside your source. |
+| `netconverter mcp` | A local MCP bridge for Claude Code, Claude Desktop, Cursor, VS Code and Codex. Your AI passes a **file path**; the bridge reads the file and uploads it straight to NetConverter. The AI sees paths, job IDs and summaries — never the configuration. |
+| `netconverter validate edge.cfg --vendor fortinet` | Plain one-shot commands that print JSON, for scripts and CI. |
+
+## What it supports
+
+Whatever the NetConverter server you sign in to supports — the client reads
+`GET /capabilities` and builds every menu from it, so new vendors appear
+without a client update. Today that is:
+
+- **Firewalls:** Palo Alto (SET, XML, Panorama), Fortinet FortiGate, Cisco FMC (JSON);
+  Cisco ASA as a source. Check Point is a source through a handoff bundle in the portal.
+- **Routers and switches:** Cisco IOS-XE, Juniper JunOS (braces and set), Aruba CX;
+  ArubaOS as a source.
+- **Jobs:** convert, validate, optimize; follow-up questions on NAT, policy, routes,
+  interfaces, unused objects, object dependencies and traffic flows.
+
+Run `netconverter capabilities` to see exactly what your credential can do.
+A 0.1.x **Terminal Quick pilot key** still works and keeps its ASA → Palo Alto
+scope; the app labels it as such.
+
+## Start here
+
+One line installs everything (uv, the CLI from PyPI), signs you in and connects
+your AI assistants to `~/migrations`:
+
+```sh
+curl -LsSf https://netconverter.ai/install.sh | sh              # macOS / Linux
+```
+
+```powershell
+irm https://netconverter.ai/install.ps1 | iex                    # Windows PowerShell
+```
+
+Options: `--yes` (no prompts, for IT/MDM), `--no-connect`, `--workspace PATH`
+(`curl … | sh -s -- --yes`; PowerShell: `-Yes -NoConnect -Workspace PATH`, see
+[scripts/install.ps1](scripts/install.ps1)). Running it again only does what is missing.
+
+Or by hand:
+
+```sh
+# 1. Install (Python 3.12+ via uv: https://docs.astral.sh/uv)
+uv tool install --python 3.12 netconverter-cli
+
+# 2. Sign in once
+netconverter login --clerk          # your NetConverter account, in the browser
+#    or: netconverter login          # paste an API key at a hidden prompt
+
+# 3. Work in the folder that holds your configs
+cd ~/migrations && netconverter
+```
+
+Upgrading from `netconverter-terminal` 0.1.x: `uv tool uninstall netconverter-terminal`
+first. Saved keys and sign-ins carry over (Keychain service **NetConverter Terminal**).
+
+Full walkthrough: [Quick start](QUICK_START.md).
+
+## Use it from your AI
+
+Step-by-step guides for every assistant (Claude, ChatGPT, Cursor, Gemini CLI, Codex …):
+[docs/connect](docs/connect/README.md).
+
+```sh
+netconverter connect claude-code    # or claude-desktop, cursor, vscode, codex, gemini, windsurf, lmstudio
+netconverter connect --all          # every assistant found on this computer
+netconverter connect chatgpt        # ChatGPT / claude.ai: remote-connector setup steps
+```
+
+`connect` shows the exact change it will make and asks before applying it
+(Claude Code through its own `claude mcp add`; JSON files keep a `.bak`). For
+Claude Code it then offers a `Read` deny rule for the folder, so the assistant
+works on your configurations only through the bridge.
+Then ask your assistant, for example: *"Validate edge-fw.conf and tell me what it finds,"*
+*"Convert it to Palo Alto XML,"* *"Can WEB reach DB on tcp/1433?"*
+
+Bridge tools: `submit_file`, `job_status`, `wait_for_job`, `account`, `download`,
+plus an allowlist of NetConverter's read-only tools (reports, evidence, NAT, flows,
+knowledge base). `netconverter mcp --strict` narrows those to the strict-view set.
+
+Inside the app, `/activity` and the header's **Bridge** pill show what your AI did
+through the bridge — paths, sizes, SHA-256 and job IDs only.
+
+## Stay current
+
+`netconverter update` upgrades a PyPI install with `uv tool upgrade netconverter-cli`;
+a copy installed from a release wheel gets the latest wheel after its SHA-256 is
+checked (`--check` only reports). Interactive commands mention a new release at most once
+a day; set `NETCONVERTER_NO_UPDATE_CHECK=1` to turn that off.
+
+## Boundaries
+
+- Configurations travel only from your workspace to NetConverter, over HTTPS.
+  The bridge never returns configuration text to the AI; the server tokenizes
+  addresses and removes credentials from every summary.
+- The client never pushes to a device. Outputs are files you review and load.
+- Downloads are hash-verified and never overwrite a file you changed.
+- An optional in-app model (`/model`: Anthropic, OpenAI, Gemini or local Ollama)
+  only chooses among fixed operations; it never receives configurations or results.
+
+## Documentation
+
+- [Quick start](QUICK_START.md) · [Commands and troubleshooting](docs/COMMANDS.md)
+- [Privacy and data flow](docs/PRIVACY.md) · [Verification status](docs/VERIFICATION.md)
+- [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md)
+
+The client is [MIT licensed](LICENSE). The license does not grant access to the
+hosted service or license the server code. macOS is the exercised platform;
+Windows acceptance remains pending.

netconverter_cli-0.4.0/QUICK_START.md

@@ -0,0 +1,128 @@
+# Quick start (Mac)
+
+Use synthetic configurations for your first run, and read the
+[privacy notes](docs/PRIVACY.md) before using real ones.
+
+## 1. Install
+
+```sh
+curl -LsSf https://netconverter.ai/install.sh | sh
+```
+
+This installs uv and `netconverter-cli` from PyPI, signs you in, creates
+`~/migrations` and offers to connect each AI assistant it finds (steps 2 and 6 below).
+Add `--no-connect` (`… | sh -s -- --no-connect`) to only install and sign in.
+
+By hand:
+
+```sh
+brew install uv                      # if `uv --version` fails
+uv tool install --python 3.12 netconverter-cli
+uv tool update-shell                 # then open a new Terminal window
+netconverter --version
+```
+
+Without PyPI access, download `netconverter_cli-<version>-py3-none-any.whl` and
+`SHA256SUMS` from the [latest release](https://github.com/valeronlabs/netconverter_terminals/releases/latest),
+run `shasum -a 256 -c SHA256SUMS` (stop if it fails), then
+`uv tool install --python 3.12 ./netconverter_cli-<version>-py3-none-any.whl`.
+
+Coming from 0.1.x? Run `uv tool uninstall netconverter-terminal` first. Your
+saved key, sign-in and per-folder `.netconverter/` state are kept.
+
+## 2. Sign in
+
+```sh
+netconverter login --clerk           # NetConverter account in the browser (MFA, SSO)
+netconverter login --clerk --device  # same, on a machine without a browser
+netconverter login                   # or paste an API key / trial key, hidden
+netconverter whoami
+netconverter capabilities            # what your credential can convert
+```
+
+After `login --clerk`, every command and the app use your sign-in; no key and no environment
+variable are needed. A stored API key, if you also have one, is used first.
+Credentials live in the macOS Keychain (service **NetConverter Terminal**), never
+in the workspace folder. A 0.1.x Terminal Quick pilot key keeps working with its
+ASA → Palo Alto scope.
+
+## 3. Run the app in your config folder
+
+```sh
+mkdir -p ~/NetConverter-Demo && cd ~/NetConverter-Demo
+cp /path/to/examples/demo-asa.cfg .
+netconverter
+```
+
+The folder you start in is the workspace. Nothing is uploaded when the app opens.
+
+| Key | Does |
+| --- | --- |
+| `↑` `↓` / `1`–`9` | Move / jump to a choice |
+| `Enter` | Continue |
+| `Esc` | Cancel the open question (never a submitted job) |
+| `Ctrl+O` · `Ctrl+J` · `Ctrl+R` | Open a file · jobs · refresh the active job |
+| `F1` · `Ctrl+Q` | Help · quit |
+
+## 4. Convert
+
+1. Type `/convert` and pick the file.
+2. **What does it contain?** The likely vendor is pre-selected from a local
+   look at the file (marked *detected*); confirm or choose another.
+3. **Convert to** lists only the targets the server supports for that source.
+4. Review the card and choose **Submit to NetConverter**. This is the moment
+   the file is sent, and it uses one conversion.
+5. Follow the job in the status line. When it completes, the outputs download
+   beside the source, hash-verified:
+
+```text
+tra_….translated.txt      converted configuration
+tra_….report.json         structured verdict, findings and reasons
+tra_….evidence.xlsx       evidence workbook, when the job has one
+```
+
+Read warnings before using an output. `NEEDS REVIEW` and `BLOCKED` are set by
+deterministic checks, not by AI.
+
+## 5. Validate, optimize, ask
+
+- `/validate` and `/optimize` follow the same file → vendor → review steps.
+- After a job completes: `/nat`, `/policy`, `/routes`, `/interfaces`,
+  `/unused_objects`, and structured questions such as
+  `/flow {"source_ip":"192.0.2.10","destination_ip":"198.51.100.10","protocol":"tcp","destination_port":80}`.
+  Results are saved as JSON and TXT beside the source.
+- `/target` saves the generated configuration and selects it, so you can `/validate` it.
+
+## 6. Connect your AI assistant
+
+```sh
+netconverter connect                 # which assistants are already connected
+netconverter connect claude-code     # shows the change, asks, then applies
+netconverter connect claude-desktop  # Claude Desktop: merges its config file, keeps a .bak
+netconverter connect --all           # every assistant found here (Gemini CLI, Cursor, Codex …)
+netconverter connect chatgpt         # ChatGPT or claude.ai: prints the remote-connector steps
+```
+
+Or `/connect` inside the app. For Claude Code, `connect` then offers a second
+change (Enter accepts): a `Read(//…/**)` deny rule for this folder in
+`~/.claude/settings.json`, so Claude Code hands files to the bridge by path instead
+of reading them itself. Restart Claude Code or Claude Desktop afterwards. Then ask your assistant to validate or convert a file
+by name. `/activity` shows each call the bridge handled: time, assistant, file,
+size, SHA-256 and job ID — never content.
+
+## 7. Resume, update, uninstall
+
+- Quit with `Ctrl+Q`; run `netconverter` in the same folder to continue.
+  `/jobs` lists your jobs; `/resume JOB_ID` follows one. An interrupted submit is
+  retried by `/resume` with the same idempotency key, so it is not duplicated.
+- Update: `netconverter update` runs `uv tool upgrade netconverter-cli` for a PyPI
+  install; for a copy installed from a wheel it downloads the latest release's wheel
+  and `SHA256SUMS`, checks the hash and runs `uv tool install --force` after you
+  confirm (`--check` only reports). Interactive commands mention a new release at most once
+  a day; `NETCONVERTER_NO_UPDATE_CHECK=1` turns that off. Manual route: verify the
+  new wheel, then `uv tool install --force ./netconverter_cli-….whl`.
+- Remove: `uv tool uninstall netconverter-cli`. Configs, outputs, Keychain entries
+  and `.netconverter/` folders stay until you delete them; `netconverter logout --all`
+  removes the saved sign-in and key.
+
+Something failed? See [troubleshooting](docs/COMMANDS.md#troubleshooting).

netconverter_cli-0.4.0/README.md

@@ -0,0 +1,133 @@
+# NetConverter CLI
+
+<!-- mcp-name: ai.netconverter/netconverter -->
+
+**Migrate, validate and optimize network configurations from the folder that holds them — and let your own AI assistant do it too, without the configuration ever passing through the model.**
+
+NetConverter — by ValeronLabs LLC.
+
+```text
+◆ NetConverter  v0.3.0                      ● Server   ◆ Bridge claude-code · 2m ago
+▍ Start
+▍ /convert    Migrate a configuration to another vendor
+▍ /validate   Check a configuration before migrating
+▍ /optimize   Cleanup and optimization findings
+▍ /activity   What your AI assistant did here
+╭ What does edge-fw.conf contain? ───────────────────────────────╮
+│ ▸  1  Fortinet FortiGate  · detected                            │
+│    2  Cisco ASA                                                 │
+╰──────────────────────────────── ↑↓ choose · 1–9 jump · Enter ───╯
+```
+
+One small client, three ways in:
+
+| | What it is |
+| --- | --- |
+| `netconverter` | A keyboard-first full-screen app: pick a file, answer a few inline questions, follow the job, get verified outputs beside your source. |
+| `netconverter mcp` | A local MCP bridge for Claude Code, Claude Desktop, Cursor, VS Code and Codex. Your AI passes a **file path**; the bridge reads the file and uploads it straight to NetConverter. The AI sees paths, job IDs and summaries — never the configuration. |
+| `netconverter validate edge.cfg --vendor fortinet` | Plain one-shot commands that print JSON, for scripts and CI. |
+
+## What it supports
+
+Whatever the NetConverter server you sign in to supports — the client reads
+`GET /capabilities` and builds every menu from it, so new vendors appear
+without a client update. Today that is:
+
+- **Firewalls:** Palo Alto (SET, XML, Panorama), Fortinet FortiGate, Cisco FMC (JSON);
+  Cisco ASA as a source. Check Point is a source through a handoff bundle in the portal.
+- **Routers and switches:** Cisco IOS-XE, Juniper JunOS (braces and set), Aruba CX;
+  ArubaOS as a source.
+- **Jobs:** convert, validate, optimize; follow-up questions on NAT, policy, routes,
+  interfaces, unused objects, object dependencies and traffic flows.
+
+Run `netconverter capabilities` to see exactly what your credential can do.
+A 0.1.x **Terminal Quick pilot key** still works and keeps its ASA → Palo Alto
+scope; the app labels it as such.
+
+## Start here
+
+One line installs everything (uv, the CLI from PyPI), signs you in and connects
+your AI assistants to `~/migrations`:
+
+```sh
+curl -LsSf https://netconverter.ai/install.sh | sh              # macOS / Linux
+```
+
+```powershell
+irm https://netconverter.ai/install.ps1 | iex                    # Windows PowerShell
+```
+
+Options: `--yes` (no prompts, for IT/MDM), `--no-connect`, `--workspace PATH`
+(`curl … | sh -s -- --yes`; PowerShell: `-Yes -NoConnect -Workspace PATH`, see
+[scripts/install.ps1](scripts/install.ps1)). Running it again only does what is missing.
+
+Or by hand:
+
+```sh
+# 1. Install (Python 3.12+ via uv: https://docs.astral.sh/uv)
+uv tool install --python 3.12 netconverter-cli
+
+# 2. Sign in once
+netconverter login --clerk          # your NetConverter account, in the browser
+#    or: netconverter login          # paste an API key at a hidden prompt
+
+# 3. Work in the folder that holds your configs
+cd ~/migrations && netconverter
+```
+
+Upgrading from `netconverter-terminal` 0.1.x: `uv tool uninstall netconverter-terminal`
+first. Saved keys and sign-ins carry over (Keychain service **NetConverter Terminal**).
+
+Full walkthrough: [Quick start](QUICK_START.md).
+
+## Use it from your AI
+
+Step-by-step guides for every assistant (Claude, ChatGPT, Cursor, Gemini CLI, Codex …):
+[docs/connect](docs/connect/README.md).
+
+```sh
+netconverter connect claude-code    # or claude-desktop, cursor, vscode, codex, gemini, windsurf, lmstudio
+netconverter connect --all          # every assistant found on this computer
+netconverter connect chatgpt        # ChatGPT / claude.ai: remote-connector setup steps
+```
+
+`connect` shows the exact change it will make and asks before applying it
+(Claude Code through its own `claude mcp add`; JSON files keep a `.bak`). For
+Claude Code it then offers a `Read` deny rule for the folder, so the assistant
+works on your configurations only through the bridge.
+Then ask your assistant, for example: *"Validate edge-fw.conf and tell me what it finds,"*
+*"Convert it to Palo Alto XML,"* *"Can WEB reach DB on tcp/1433?"*
+
+Bridge tools: `submit_file`, `job_status`, `wait_for_job`, `account`, `download`,
+plus an allowlist of NetConverter's read-only tools (reports, evidence, NAT, flows,
+knowledge base). `netconverter mcp --strict` narrows those to the strict-view set.
+
+Inside the app, `/activity` and the header's **Bridge** pill show what your AI did
+through the bridge — paths, sizes, SHA-256 and job IDs only.
+
+## Stay current
+
+`netconverter update` upgrades a PyPI install with `uv tool upgrade netconverter-cli`;
+a copy installed from a release wheel gets the latest wheel after its SHA-256 is
+checked (`--check` only reports). Interactive commands mention a new release at most once
+a day; set `NETCONVERTER_NO_UPDATE_CHECK=1` to turn that off.
+
+## Boundaries
+
+- Configurations travel only from your workspace to NetConverter, over HTTPS.
+  The bridge never returns configuration text to the AI; the server tokenizes
+  addresses and removes credentials from every summary.
+- The client never pushes to a device. Outputs are files you review and load.
+- Downloads are hash-verified and never overwrite a file you changed.
+- An optional in-app model (`/model`: Anthropic, OpenAI, Gemini or local Ollama)
+  only chooses among fixed operations; it never receives configurations or results.
+
+## Documentation
+
+- [Quick start](QUICK_START.md) · [Commands and troubleshooting](docs/COMMANDS.md)
+- [Privacy and data flow](docs/PRIVACY.md) · [Verification status](docs/VERIFICATION.md)
+- [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md)
+
+The client is [MIT licensed](LICENSE). The license does not grant access to the
+hosted service or license the server code. macOS is the exercised platform;
+Windows acceptance remains pending.

netconverter_cli-0.4.0/SECURITY.md

@@ -0,0 +1,14 @@
+# Security reporting
+
+Do not publish credentials, customer configurations, reports, addresses, or
+exploitable vulnerability details in a public issue.
+
+Use GitHub's **Report a vulnerability** option when it is available, or contact
+your established NetConverter support contact privately to arrange secure
+submission. If you have no private contact, open a public issue asking for a
+private reporting channel without including the sensitive details.
+
+For a suspected credential exposure, revoke or rotate the affected credential
+with its issuer. Deleting a local file or Keychain item does not revoke the key.
+See [the privacy boundary](docs/PRIVACY.md) and
+[current verification limits](docs/VERIFICATION.md).