opsentry 1.8.0__py3-none-any.whl

opsentry/config/templates/generic.yaml

@@ -0,0 +1,84 @@
+# guardrails.yaml — Single configuration file for all enforcement layers.
+# Run `python3 config/generate.py guardrails.yaml` to produce CLAUDE.md, settings.json, hooks, and CI config.
+
+version: "2.0"
+
+# === Organization Info (used in generated headers) ===
+organization:
+  name: ""
+  contact: ""
+
+# === Rule Toggles (maps to the 18 CLAUDE.md sections) ===
+rules:
+  sensitive_file_access: true      # Rule 1: Block reading .env, credentials, keys, certs
+  client_confidential_data: true   # Rule 2: Never include client data in outputs
+  credentials_no_hardcode: true    # Rule 3: Never hardcode passwords, API keys, tokens
+  sql_safety: true                 # Rule 4: Parameterized queries only
+  dangerous_code_patterns: true    # Rule 5: No eval(), pickle, shell=True, etc.
+  frontend_security_xss: true      # Rule 6: No innerHTML with unsanitized input
+  git_operations: true             # Rule 7: Git restrictions (see git_policy)
+  destructive_commands: true       # Rule 8: No rm -rf, sudo, chmod 777
+  database_safety: true            # Rule 9: No direct DB connections
+  network_requests: true           # Rule 10: No unsanctioned outbound requests
+  code_quality_standards: true     # Rule 11: Follow project style, specific exceptions
+  data_exfiltration: true          # Rule 12: No curl uploads, base64 encoding, /tmp writes
+  package_installation: true       # Rule 13: Official registries only
+  scope_boundaries: true           # Rule 14: Stay in project directory
+  environment_isolation: true      # Rule 15: No SSH, restricted Docker/Terraform/kubectl
+  resource_limits: true            # Rule 16: Max file size, bounded operations
+  compliance_data_privacy: true    # Rule 17: No real PII, respect licenses
+  when_in_doubt: true              # Rule 18: Stop and ask when uncertain
+
+# === PII Detection Locales ===
+pii:
+  locales: ["US"]                  # Options: US, KR, EU
+  synthetic_ssns: ["000-00-0000", "555-55-5555"]
+
+# === Git Policy ===
+git_policy: "block_all"           # Options: block_all, read_only, allow_all
+
+# === Infrastructure Tools Policy ===
+infra_tools:
+  docker: "read_only"             # Options: block, read_only, allow
+  terraform: "read_only"
+  kubectl: "read_only"
+
+# === Blocked File Patterns (extends built-in sensitive file list) ===
+blocked_files:
+  extra_patterns: []
+
+# === Blocked Commands (extends built-in dangerous command list) ===
+blocked_commands:
+  extra_patterns: []
+
+# === Client Data Patterns (for governance scanner) ===
+client_data:
+  patterns:
+    - pattern: "[a-zA-Z0-9._%+-]+@(?!example\\.com|test\\.com|noreply)[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
+      name: "Possible real email address"
+    - pattern: "(?:CONFIDENTIAL|INTERNAL[- ]ONLY|DO NOT DISTRIBUTE)"
+      name: "Confidentiality marker in code"
+  skip_words: ["example", "test", "mock", "sample", "placeholder", "todo", "fixme", "xxx", "your-"]
+
+# === Compliance Frameworks ===
+compliance:
+  frameworks: []                   # Options: iso_27001, soc2, hipaa, pci_dss
+
+# === CI Agent Configuration ===
+ci_agents:
+  llm_provider: "bedrock"          # Options: bedrock, anthropic, openai, local
+  scan_mode: "changed"             # Options: changed, full
+  base_branch: "main"
+  auto_commit: false
+  code_health:
+    max_file_lines: 500
+    max_function_lines: 50
+    dead_code_threshold: 3
+    missing_docstrings: true
+    missing_type_hints: true
+    missing_tests: true
+  custom_rules: []
+
+# === Resource Limits ===
+resource_limits:
+  max_file_lines: 500

opsentry/deployment/.claude/commands/code-health.md

@@ -0,0 +1,42 @@
+Review the current project for code health and quality issues. Scan all files changed in the current git branch compared to main (use `git diff --name-only main` to get the list). If that fails, scan all Python, JavaScript, and TypeScript files in the project.
+
+For each file, check for the following rules and report every finding with the file path, line number, severity, and a recommended fix:
+
+## High Severity (should fix before merge)
+
+1. **500-Line Shield**: Any file exceeding 500 lines. Report the current line count and suggest how to split it (which functions or classes could be extracted into separate modules).
+
+2. **Missing Tests**: Any new pure logic module (no I/O, no database, no network) that does not have a corresponding test file. Check for test files matching patterns like test_*.py, *_test.py, *.test.ts, *.spec.ts.
+
+## Medium Severity (should fix)
+
+3. **Function Size Limit**: Any function or method exceeding 50 lines. Report the function name, current line count, and suggest which parts could be extracted into helper functions.
+
+4. **Mandatory Docstrings**: Any Python file missing a module-level docstring (first 3-sentence summary). Any public function or class missing a docstring.
+
+5. **No Dead Code**: Blocks of 3 or more consecutive commented-out lines of code (not regular comments explaining logic, but actual code that has been commented out).
+
+6. **Domain-Specific Errors**: Bare `except:` clauses or `except Exception:` without logging or re-raising. These should catch specific exceptions.
+
+7. **Import Direction**: Lower-level utility modules importing from higher-level application modules (circular dependency risk).
+
+## Low Severity (suggestion)
+
+8. **Explicit Interfaces**: Public functions and classes missing type hints on parameters or return types.
+
+9. **Named Constants**: Magic numbers (other than 0, 1, -1) or magic strings used in logic. These should be extracted to named constants.
+
+10. **I/O Separation**: Database imports (sqlalchemy, mysql.connector, psycopg2), network imports (requests, httpx, aiohttp), or filesystem operations mixed into modules that should be pure business logic.
+
+## Output Format
+
+Present findings as a structured report:
+- Start with a summary: total files scanned, total findings by severity, and an overall health score (A/B/C/D/F based on finding density)
+- Group findings by severity (High first)
+- For each finding: file path, line number, the rule violated, the problematic code, and the specific fix
+- End with a list of auto-fixable items (missing docstrings, dead code removal, bare except fixes) and ask if I want you to apply the fixes
+- If applying fixes: generate meaningful docstrings based on what the code actually does, remove commented-out code blocks, replace bare except with specific exception handling
+
+If you find no issues, confirm the scan passed with the number of files checked and the health score.
+
+$ARGUMENTS

opsentry/deployment/.claude/commands/governance-check.md

@@ -0,0 +1,29 @@
+Review the current project for governance and guardrail compliance. Check the entire repository structure, not just changed files.
+
+## Guardrail File Checks
+
+1. **CLAUDE.md**: Does the file exist at the project root? If yes, does it contain all 18 required sections (Sensitive File Access, Client Confidential Data, Credentials and Connection Strings, SQL Safety, Dangerous Code Patterns, Frontend Security, Git Operations, Destructive Commands, Database Safety, Network Requests, Code Quality Standards, Data Exfiltration, Package Installation Safety, Scope Boundaries, Environment Isolation, Resource Limits, Compliance and Data Privacy, When in Doubt)? Report any missing sections.
+
+2. **.claude/settings.json**: Does it exist? Does it contain a permissions.deny array? Are the following critical deny rules present: Read(**/.env), Read(**/.env.*), Read(**/credentials.json), Read(**/*secret*), Bash(git *), Bash(rm -rf *), Bash(sudo *)? Report any missing rules.
+
+3. **.claude/hooks/**: Do the following hook scripts exist and are they executable: block-sensitive-files.sh, block-dangerous-commands.sh, block-git-commands.sh, block-data-exfiltration.sh, block-package-install.sh, block-scope-escape.sh, block-environment-escape.sh, block-pii-leakage.sh? Report any missing or non-executable hooks.
+
+4. **hooks registered**: Does settings.json contain a hooks.PreToolUse configuration that references all eight hook scripts? Report if hooks are not registered.
+
+## Data Classification Checks
+
+5. **No .env files in repo**: Scan the entire repository for any .env, .env.*, .env.local, .env.production files. These should never be committed. Report any found.
+
+6. **No hardcoded client data patterns**: Scan code comments, log statements, docstrings, and string literals for patterns that look like they could be real client data: real email addresses, confidentiality markers, internal identifiers. Flag anything suspicious for human review.
+
+7. **.gitignore coverage**: Check that .gitignore includes: .env, .env.*, credentials.json, *.pem, *.key, secrets/, credentials/, .claude/hooks/guardrail-blocks.log.
+
+## Output Format
+
+Present findings as a structured report:
+- Start with a compliance summary: PASS or FAIL for each of the 7 checks above
+- For each failing check: what is missing, where it should be, and how to fix it
+- End with: "Run ./install.sh from the ai-guardrails repo to auto-fix guardrail file issues" if any guardrail files are missing or incomplete
+- If everything passes, confirm full compliance with a summary
+
+$ARGUMENTS

opsentry/deployment/.claude/commands/security-audit.md

@@ -0,0 +1,41 @@
+Review the current project for security vulnerabilities. Scan all files changed in the current git branch compared to main (use `git diff --name-only main` to get the list). If that fails, scan all Python, JavaScript, and TypeScript files in the project.
+
+For each file, check for the following issues and report every finding with the file path, line number, severity, and a recommended fix:
+
+## Critical Severity (must fix before merge)
+
+1. **Hardcoded secrets**: API keys, passwords, tokens, connection strings written directly in code. Look for patterns like `password = "..."`, `api_key = "..."`, `token = "..."`, connection strings with credentials embedded.
+
+2. **SQL injection**: Any SQL query built using string concatenation, f-strings, format strings, or % formatting with variables. Every query must use parameterized queries.
+
+3. **Credential files**: Any .env, .env.*, credentials.json, *.pem, *.key files present in the project that are not in .gitignore.
+
+4. **Exposed connection strings**: Database URIs (PostgreSQL, MySQL, Snowflake, MSSQL) with passwords embedded in code.
+
+## High Severity (should fix before merge)
+
+5. **Dangerous Python patterns**: eval(), exec(), pickle.loads() on untrusted data, os.system(), subprocess with shell=True and variable input, __import__() with variable input.
+
+6. **XSS vulnerabilities**: innerHTML assignments with unsanitised user input, dangerouslySetInnerHTML without DOMPurify, document.write() with variables.
+
+7. **Unsafe subprocess calls**: subprocess.run() or subprocess.Popen() with shell=True where the command includes any variable.
+
+## Medium Severity (warning)
+
+8. **Missing .gitignore entries**: Check if .gitignore exists and includes .env, .env.*, credentials.json, *.pem, *.key, secrets/.
+
+9. **Bare exception handlers**: except: or except Exception: without logging or re-raising.
+
+10. **Unsafe deserialization**: pickle.load/loads, yaml.load without SafeLoader.
+
+## Output Format
+
+Present findings as a structured report:
+- Start with a summary: total files scanned, total findings by severity
+- Group findings by severity (Critical first)
+- For each finding: file path, line number, the problematic code snippet, why it is a problem, and the specific fix
+- End with a list of auto-fixable items and ask if I want you to apply the fixes
+
+If you find no issues, confirm the scan passed with the number of files checked.
+
+$ARGUMENTS

opsentry/deployment/baseline.py

@@ -0,0 +1,440 @@
+#!/usr/bin/env python3
+"""
+Configuration baseline integrity helper for OpSentry.
+Computes SHA-256 hashes over the guardrail-controlled subset of CLAUDE.md
+(content between guardrail markers) and settings.json (intersection of
+installed deny rules with source deny rules + OpSentry hook entries
+identified by command path) so install.sh can write a baseline manifest at
+install time and patrol.sh can detect tampering against that manifest later.
+The subset approach is required because both files are merge-installed:
+employees may add their own deny rules and CLAUDE.md content that must not
+break the integrity check.
+"""
+
+from __future__ import annotations
+
+import argparse
+import datetime
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+SCHEMA_VERSION = 1
+BASELINE_FILENAME = ".opsentry-baseline.json"
+
+GUARDRAILS_START = "<!-- GUARDRAILS START — DO NOT EDIT THIS SECTION -->"
+GUARDRAILS_END = "<!-- GUARDRAILS END -->"
+
+GUARDRAIL_HOOK_PREFIX = "block-"
+GUARDRAIL_HOOK_SUFFIX = ".sh"
+GUARDRAIL_MATCHERS = ("Read", "Write", "Edit", "Bash")
+
+
+# ---------------------------------------------------------------------------
+# Subset extraction
+# ---------------------------------------------------------------------------
+
+
+def extract_claude_md_section(claude_md_path: Path) -> bytes | None:
+    """
+    Return the guardrail section of CLAUDE.md as bytes (markers included).
+
+    Returns None when the file is missing or markers cannot be found, so
+    callers can distinguish "not installed" from "installed but tampered".
+    """
+    if not claude_md_path.is_file():
+        return None
+    content = claude_md_path.read_bytes()
+    start = content.find(GUARDRAILS_START.encode())
+    end = content.find(GUARDRAILS_END.encode())
+    if start < 0 or end < 0:
+        return None
+    return content[start : end + len(GUARDRAILS_END.encode())]
+
+
+def _is_guardrail_hook_command(command: str) -> bool:
+    """A hook command path is ours iff its basename is block-*.sh."""
+    if not command:
+        return False
+    basename = command.rsplit("/", 1)[-1]
+    return basename.startswith(GUARDRAIL_HOOK_PREFIX) and basename.endswith(
+        GUARDRAIL_HOOK_SUFFIX
+    )
+
+
+def extract_settings_subset(
+    settings_path: Path, source_settings_path: Path
+) -> dict | None:
+    """
+    Return the guardrail-controlled subset of an installed settings.json.
+
+    The subset is:
+        - The installed deny rules that are also present in the source
+          guardrail settings (so user-added denies don't poison the hash,
+          but a missing or mutated guardrail deny does).
+        - The PreToolUse entries for OpSentry's matchers (Read/Write/Edit/
+          Bash), with non-guardrail hook commands stripped out so user-added
+          custom hooks for the same matcher don't poison the hash.
+
+    Within each matcher the guardrail hooks are kept in *installed order* so
+    that an attacker who reorders the hook list (placing a custom one first
+    to bypass enforcement) is detected by the hash mismatch.
+
+    Returns None when either file is missing.
+    """
+    if not settings_path.is_file() or not source_settings_path.is_file():
+        return None
+
+    installed = json.loads(settings_path.read_text())
+    source = json.loads(source_settings_path.read_text())
+
+    source_deny = set(source.get("permissions", {}).get("deny", []))
+    installed_deny = installed.get("permissions", {}).get("deny", [])
+    relevant_deny = sorted(rule for rule in installed_deny if rule in source_deny)
+
+    pre_tool_use = installed.get("hooks", {}).get("PreToolUse", [])
+    matcher_to_guardrail_hooks: dict[str, list[str]] = {}
+    for entry in pre_tool_use:
+        matcher = entry.get("matcher", "")
+        if matcher not in GUARDRAIL_MATCHERS:
+            continue
+        guardrail_cmds: list[str] = []
+        for hook in entry.get("hooks", []):
+            cmd = hook.get("command", "")
+            if _is_guardrail_hook_command(cmd):
+                # Normalize: drop the absolute install dir prefix so hashes
+                # are stable across machines with different $HOME paths.
+                guardrail_cmds.append(cmd.rsplit("/", 1)[-1])
+        if guardrail_cmds:
+            matcher_to_guardrail_hooks[matcher] = guardrail_cmds
+
+    return {
+        "deny": relevant_deny,
+        "pre_tool_use": [
+            {"matcher": m, "hooks": matcher_to_guardrail_hooks[m]}
+            for m in GUARDRAIL_MATCHERS
+            if m in matcher_to_guardrail_hooks
+        ],
+    }
+
+
+def hash_settings_subset(subset: dict) -> str:
+    """Hash a settings subset dict via canonical JSON."""
+    canonical = json.dumps(subset, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+def hash_bytes(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def hash_file(path: Path) -> str | None:
+    if not path.is_file():
+        return None
+    return hash_bytes(path.read_bytes())
+
+
+# ---------------------------------------------------------------------------
+# Baseline write / verify
+# ---------------------------------------------------------------------------
+
+
+def compute_baseline(
+    claude_home: Path, source_dir: Path, version: str | None = None
+) -> dict:
+    """
+    Compute a baseline manifest dict for the freshly-installed claude_home.
+
+    `source_dir` is the guardrail source directory (the one that contains
+    `CLAUDE.md`, `settings.json`, and `hooks/`). `version` is the OpSentry
+    version string written into the manifest for traceability.
+    """
+    settings_path = claude_home / "settings.json"
+    source_settings_path = source_dir / "settings.json"
+    claude_md_path = claude_home / "CLAUDE.md"
+
+    section = extract_claude_md_section(claude_md_path)
+    settings_subset = extract_settings_subset(settings_path, source_settings_path)
+
+    hooks_block: dict[str, str] = {}
+    hooks_dir = claude_home / "hooks"
+    if hooks_dir.is_dir():
+        for hook_path in sorted(hooks_dir.glob("block-*.sh")):
+            digest = hash_file(hook_path)
+            if digest is not None:
+                hooks_block[hook_path.name] = digest
+
+    return {
+        "schema": SCHEMA_VERSION,
+        "version": version or "unknown",
+        "installed_at": datetime.datetime.now(datetime.timezone.utc).strftime(
+            "%Y-%m-%dT%H:%M:%SZ"
+        ),
+        "claude_md": {
+            "section_sha256": hash_bytes(section) if section is not None else None,
+            "markers_present": section is not None,
+        },
+        "settings": {
+            "guardrail_subset_sha256": (
+                hash_settings_subset(settings_subset) if settings_subset is not None else None
+            ),
+            "subset_present": settings_subset is not None,
+        },
+        "hooks": hooks_block,
+    }
+
+
+def write_baseline(
+    claude_home: Path,
+    source_dir: Path,
+    version: str | None = None,
+) -> Path:
+    """Compute and write the baseline manifest to claude_home / .opsentry-baseline.json."""
+    manifest = compute_baseline(claude_home, source_dir, version=version)
+    manifest_path = claude_home / BASELINE_FILENAME
+    manifest_path.write_text(json.dumps(manifest, indent=2) + "\n")
+    return manifest_path
+
+
+def verify_baseline(
+    claude_home: Path,
+    source_dir: Path,
+) -> tuple[bool, list[dict]]:
+    """
+    Compare the current installed state against the stored baseline manifest.
+
+    Returns (overall_ok, findings) where findings is a list of dicts with
+    keys: status ('pass'|'fail'|'warn'), check, expected, actual, message.
+    """
+    manifest_path = claude_home / BASELINE_FILENAME
+    findings: list[dict] = []
+
+    if not manifest_path.is_file():
+        findings.append(
+            {
+                "status": "warn",
+                "check": "manifest",
+                "expected": str(manifest_path),
+                "actual": None,
+                "message": (
+                    f"Baseline manifest missing at {manifest_path}. Run install.sh "
+                    "to generate one. Skipping baseline integrity check."
+                ),
+            }
+        )
+        return True, findings
+
+    try:
+        manifest = json.loads(manifest_path.read_text())
+    except (OSError, ValueError) as exc:
+        findings.append(
+            {
+                "status": "fail",
+                "check": "manifest",
+                "expected": "valid JSON",
+                "actual": str(exc),
+                "message": f"Baseline manifest at {manifest_path} could not be parsed.",
+            }
+        )
+        return False, findings
+
+    schema = manifest.get("schema")
+    if schema != SCHEMA_VERSION:
+        findings.append(
+            {
+                "status": "warn",
+                "check": "schema",
+                "expected": SCHEMA_VERSION,
+                "actual": schema,
+                "message": (
+                    f"Baseline schema is {schema}, expected {SCHEMA_VERSION}. "
+                    "Re-run install.sh to refresh the baseline."
+                ),
+            }
+        )
+
+    current = compute_baseline(claude_home, source_dir, version=manifest.get("version"))
+    overall_ok = True
+
+    # CLAUDE.md guardrail section
+    expected_md = manifest.get("claude_md", {}).get("section_sha256")
+    actual_md = current["claude_md"]["section_sha256"]
+    if expected_md is None and actual_md is None:
+        findings.append(
+            {
+                "status": "warn",
+                "check": "claude_md.section_sha256",
+                "expected": None,
+                "actual": None,
+                "message": "Neither baseline nor current CLAUDE.md has guardrail markers.",
+            }
+        )
+    elif expected_md == actual_md:
+        findings.append(
+            {
+                "status": "pass",
+                "check": "claude_md.section_sha256",
+                "expected": expected_md,
+                "actual": actual_md,
+                "message": "CLAUDE.md guardrail section matches baseline.",
+            }
+        )
+    else:
+        overall_ok = False
+        findings.append(
+            {
+                "status": "fail",
+                "check": "claude_md.section_sha256",
+                "expected": expected_md,
+                "actual": actual_md,
+                "message": (
+                    "CLAUDE.md guardrail section has been MODIFIED since install. "
+                    "Re-run install.sh to restore."
+                ),
+            }
+        )
+
+    # settings.json guardrail subset
+    expected_settings = manifest.get("settings", {}).get("guardrail_subset_sha256")
+    actual_settings = current["settings"]["guardrail_subset_sha256"]
+    if expected_settings is None and actual_settings is None:
+        findings.append(
+            {
+                "status": "warn",
+                "check": "settings.guardrail_subset_sha256",
+                "expected": None,
+                "actual": None,
+                "message": "Neither baseline nor current settings.json has a guardrail subset.",
+            }
+        )
+    elif expected_settings == actual_settings:
+        findings.append(
+            {
+                "status": "pass",
+                "check": "settings.guardrail_subset_sha256",
+                "expected": expected_settings,
+                "actual": actual_settings,
+                "message": "settings.json guardrail subset matches baseline.",
+            }
+        )
+    else:
+        overall_ok = False
+        findings.append(
+            {
+                "status": "fail",
+                "check": "settings.guardrail_subset_sha256",
+                "expected": expected_settings,
+                "actual": actual_settings,
+                "message": (
+                    "settings.json guardrail subset has been MODIFIED since install "
+                    "(deny rule removed/mutated, or hook registration tampered). "
+                    "Re-run install.sh to restore."
+                ),
+            }
+        )
+
+    # Hook hashes (each hook independently)
+    expected_hooks = manifest.get("hooks", {}) or {}
+    actual_hooks = current.get("hooks", {}) or {}
+    for hook_name, expected_hash in expected_hooks.items():
+        actual_hash = actual_hooks.get(hook_name)
+        if actual_hash is None:
+            overall_ok = False
+            findings.append(
+                {
+                    "status": "fail",
+                    "check": f"hooks.{hook_name}",
+                    "expected": expected_hash,
+                    "actual": None,
+                    "message": f"Hook {hook_name} is MISSING since install.",
+                }
+            )
+        elif actual_hash != expected_hash:
+            overall_ok = False
+            findings.append(
+                {
+                    "status": "fail",
+                    "check": f"hooks.{hook_name}",
+                    "expected": expected_hash,
+                    "actual": actual_hash,
+                    "message": f"Hook {hook_name} has been MODIFIED since install.",
+                }
+            )
+        else:
+            findings.append(
+                {
+                    "status": "pass",
+                    "check": f"hooks.{hook_name}",
+                    "expected": expected_hash,
+                    "actual": actual_hash,
+                    "message": f"Hook {hook_name} matches baseline.",
+                }
+            )
+
+    return overall_ok, findings
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+
+def _print_findings(findings: list[dict]) -> None:
+    for f in findings:
+        status = f["status"].upper()
+        check = f["check"]
+        message = f["message"]
+        print(f"  {status}  {check} — {message}")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="OpSentry baseline integrity helper.",
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    write_p = sub.add_parser("write", help="Write the baseline manifest.")
+    write_p.add_argument("--claude-home", required=True, type=Path)
+    write_p.add_argument(
+        "--source-dir",
+        required=True,
+        type=Path,
+        help="Path to the guardrail source dir (the one with CLAUDE.md, settings.json, hooks/).",
+    )
+    write_p.add_argument("--version", default=None)
+
+    verify_p = sub.add_parser(
+        "verify", help="Verify the installed state against the baseline manifest."
+    )
+    verify_p.add_argument("--claude-home", required=True, type=Path)
+    verify_p.add_argument(
+        "--source-dir",
+        required=True,
+        type=Path,
+        help="Path to the guardrail source dir (used to extract the canonical deny rule set).",
+    )
+    verify_p.add_argument(
+        "--quiet", action="store_true", help="Only print findings on failure."
+    )
+
+    args = parser.parse_args()
+
+    if args.command == "write":
+        manifest_path = write_baseline(
+            args.claude_home, args.source_dir, version=args.version
+        )
+        print(f"  Baseline written to {manifest_path}")
+        return 0
+
+    if args.command == "verify":
+        ok, findings = verify_baseline(args.claude_home, args.source_dir)
+        if not args.quiet or not ok:
+            _print_findings(findings)
+        return 0 if ok else 1
+
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())