sernixa-cli 0.4.2__tar.gz → 0.4.4__tar.gz

{sernixa_cli-0.4.2 → sernixa_cli-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sernixa-cli
-Version: 0.4.2
+Version: 0.4.4
 Summary: Official Sernixa CLI for policy-governed local AI agent actions
 Author: Sernixa Team
 License-Expression: MIT
@@ -22,7 +22,7 @@ Description-Content-Type: text/markdown
 Requires-Dist: platformdirs>=4.0.0
 Requires-Dist: prompt-toolkit>=3.0.48
 Requires-Dist: rich>=13.8.0
-Requires-Dist: sernixa>=0.4.1
+Requires-Dist: sernixa>=0.4.3
 Requires-Dist: sernixa-agent>=1.6.1
 Requires-Dist: typer>=0.12.0
 
@@ -37,8 +37,8 @@ macOS and Linux:
 ```bash
 python3 -m pip install --upgrade sernixa-cli
 sernixa auth login
-sernixa setup
-sernixa doctor --strict
+sernixa protect
+sernixa protect --status
 ```
 
 Windows PowerShell:
@@ -46,8 +46,8 @@ Windows PowerShell:
 ```powershell
 py -m pip install --upgrade sernixa-cli
 sernixa auth login
-sernixa setup
-sernixa doctor --strict
+sernixa protect
+sernixa protect --status
 ```
 
 `sernixa auth login` opens the Sernixa sign-in page, displays a short confirmation
@@ -74,6 +74,7 @@ Then run `sernixa` by itself to open the persistent governance console. Type
 ```text
 sernixa › @status
 sernixa › @discover
+sernixa › @protect
 sernixa › @integrations
 sernixa › @events
 sernixa › @approvals
@@ -82,7 +83,31 @@ sernixa › @exit
 
 The console is project-aware, remains open across commands, supports tab completion and private local history, and dispatches only Sernixa commands. The palette shows only actions available on the authenticated plan; direct commands are still checked by the backend. `@` is the primary command-palette prefix and slash-prefixed forms remain compatible. Every normal command such as `validate request.json` also works inside it. Bare `sernixa` remains concise when stdout or stdin is not a terminal, so scripts and CI never hang; `sernixa shell` is the explicit interactive entry point.
 
-`sernixa setup` configures Claude Code, Claude Desktop, Codex, and Cursor, preserves unrelated entries, backs up changed files, registers the bounded `sernixa://` dashboard launcher, and reports host restart or hook-trust steps. Preview without changing files:
+`sernixa protect` is the recommended first run. It detects installed Codex,
+Claude, and Cursor hosts, validates live organization policy access, installs
+Sernixa as a first-class Codex and Claude Code plugin, configures the supported
+Cursor boundary, and prints the actual coverage limitations instead of claiming
+control over host events that were never emitted:
+
+```bash
+sernixa protect
+sernixa protect --status
+sernixa protect --target codex --target claude
+sernixa protect --dry-run --json
+```
+
+After installation, restart open agent hosts. In Codex, open `/plugins`; in
+Claude Code, open `/plugin`. Select **Sernixa Security** and trust its hook and
+MCP server when prompted. Once each plugin is visible, Sernixa removes only its
+own older standalone hook/MCP blocks (with backups), so the same enforcement
+command is not registered twice.
+The plugin still contains a hook because pre-tool blocking requires one; it is
+owned and displayed as part of the plugin rather than user config.
+`sernixa setup` remains
+available for the broader developer setup, including Claude Desktop and the
+bounded `sernixa://` dashboard launcher. It preserves unrelated entries, backs
+up changed files, and reports host restart or hook-trust steps. Preview it
+without changing files:
 
 ```bash
 sernixa setup --dry-run
@@ -117,12 +142,28 @@ Discovery candidates are observations for review. Enrollment is inventory. An ac
 
 Supported global targets:
 
-- `claude`: Claude Code enforcement and lifecycle hooks in `~/.claude/settings.json`, plus the Sernixa MCP server in `~/.claude.json`.
+- `claude`: a visible **Sernixa Security** plugin containing enforcement/lifecycle hooks, the Sernixa MCP server, and a protection skill. Users can inspect it from `/plugin`.
 - `claude-desktop`: real stdio MCP server in the OS-specific Claude Desktop configuration.
-- `codex`: enforcement and lifecycle hooks plus the Sernixa MCP server in `~/.codex`. Hooks are effective by default unless `[features].hooks = false`; users still review/trust new non-managed hooks in Codex.
+- `codex`: a visible **Sernixa Security** plugin containing the enforcement hook, Sernixa MCP server, and protection skill. Users review/trust the plugin hook, and can inspect it from `/plugins`.
 - `cursor`: global MCP entry in `~/.cursor/mcp.json`, shared by Cursor IDE and CLI.
 
-Install or repair an individual integration:
+`sernixa protect` is the supported automatic installer. Anyone can also add the
+public repository marketplace directly:
+
+```bash
+codex plugin marketplace add abhishekdhull63/Sernixa.ai-Web
+codex plugin add sernixa@sernixa
+
+claude plugin marketplace add abhishekdhull63/Sernixa.ai-Web
+claude plugin install sernixa@sernixa --scope user
+```
+
+Inside Claude Code, the equivalent interactive commands are
+`/plugin marketplace add abhishekdhull63/Sernixa.ai-Web`,
+`/plugin install sernixa@sernixa`, and `/reload-plugins`.
+
+The legacy config installer remains available for Claude Desktop, Cursor, and
+older host builds:
 
 ```bash
 sernixa hook install claude
@@ -130,7 +171,7 @@ sernixa hook install claude-desktop
 sernixa hook install codex
 sernixa hook install cursor
 
-sernixa hook repair codex
+sernixa hook repair cursor
 sernixa hook status
 ```
 
@@ -138,14 +179,41 @@ Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execu
 
 Hook handlers allow 35 seconds for the live policy request; the CLI request budget is 30 seconds. This prevents slow semantic evaluations from being killed by a shorter host-hook timeout.
 
-Claude Code, Claude Desktop, Codex, and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
+Claude Code, Claude Desktop, Codex, and Cursor run `sernixa mcp serve`. The stdio MCP server exposes four non-mutating tools:
 
 - `sernixa_policy_check`: evaluate one proposed action.
 - `sernixa_plan_check`: evaluate a declared multi-step plan.
+- `sernixa_execution_passport`: issue and persist a signed, exact-step Execution Passport for an allowed plan.
 - `sernixa_identity`: validate auth and return non-secret principal metadata.
 
 MCP tools provide explicit model capabilities; the installed hooks are the local tool-call enforcement points.
 
+### Execution Passports
+
+An approved plan is not a reusable local “allow.” Sernixa signs each exact
+tool/action/arguments/resource binding, and the API atomically consumes the
+matching proof once before execution. Changed arguments, undeclared tools,
+expired tokens, and replayed steps fail closed.
+
+Issue or inspect a passport directly:
+
+```bash
+sernixa passport issue --agent-type codex plan.json
+sernixa passport status
+sernixa passport clear
+```
+
+In Codex, Claude, Cursor, or another MCP host, ask the model to call
+`sernixa_execution_passport` with its complete intended plan before it begins
+tool use. The installed Codex/Claude pre-tool hook then consumes the matching
+proof for each emitted tool event. The passport authorizes only the declared
+steps; it never executes them and never bypasses native host permissions.
+
+Coverage remains explicit: no integration can block a capability that the host
+does not expose through a hook or MCP call. On current Codex Windows builds,
+Sernixa remains available as a plugin and MCP policy/passport layer, while
+pre-tool blocking depends on Codex adding Windows hook support.
+
 ## Governance and execution
 
 ```bash

{sernixa_cli-0.4.2 → sernixa_cli-0.4.4}/README.md

@@ -9,8 +9,8 @@ macOS and Linux:
 ```bash
 python3 -m pip install --upgrade sernixa-cli
 sernixa auth login
-sernixa setup
-sernixa doctor --strict
+sernixa protect
+sernixa protect --status
 ```
 
 Windows PowerShell:
@@ -18,8 +18,8 @@ Windows PowerShell:
 ```powershell
 py -m pip install --upgrade sernixa-cli
 sernixa auth login
-sernixa setup
-sernixa doctor --strict
+sernixa protect
+sernixa protect --status
 ```
 
 `sernixa auth login` opens the Sernixa sign-in page, displays a short confirmation
@@ -46,6 +46,7 @@ Then run `sernixa` by itself to open the persistent governance console. Type
 ```text
 sernixa › @status
 sernixa › @discover
+sernixa › @protect
 sernixa › @integrations
 sernixa › @events
 sernixa › @approvals
@@ -54,7 +55,31 @@ sernixa › @exit
 
 The console is project-aware, remains open across commands, supports tab completion and private local history, and dispatches only Sernixa commands. The palette shows only actions available on the authenticated plan; direct commands are still checked by the backend. `@` is the primary command-palette prefix and slash-prefixed forms remain compatible. Every normal command such as `validate request.json` also works inside it. Bare `sernixa` remains concise when stdout or stdin is not a terminal, so scripts and CI never hang; `sernixa shell` is the explicit interactive entry point.
 
-`sernixa setup` configures Claude Code, Claude Desktop, Codex, and Cursor, preserves unrelated entries, backs up changed files, registers the bounded `sernixa://` dashboard launcher, and reports host restart or hook-trust steps. Preview without changing files:
+`sernixa protect` is the recommended first run. It detects installed Codex,
+Claude, and Cursor hosts, validates live organization policy access, installs
+Sernixa as a first-class Codex and Claude Code plugin, configures the supported
+Cursor boundary, and prints the actual coverage limitations instead of claiming
+control over host events that were never emitted:
+
+```bash
+sernixa protect
+sernixa protect --status
+sernixa protect --target codex --target claude
+sernixa protect --dry-run --json
+```
+
+After installation, restart open agent hosts. In Codex, open `/plugins`; in
+Claude Code, open `/plugin`. Select **Sernixa Security** and trust its hook and
+MCP server when prompted. Once each plugin is visible, Sernixa removes only its
+own older standalone hook/MCP blocks (with backups), so the same enforcement
+command is not registered twice.
+The plugin still contains a hook because pre-tool blocking requires one; it is
+owned and displayed as part of the plugin rather than user config.
+`sernixa setup` remains
+available for the broader developer setup, including Claude Desktop and the
+bounded `sernixa://` dashboard launcher. It preserves unrelated entries, backs
+up changed files, and reports host restart or hook-trust steps. Preview it
+without changing files:
 
 ```bash
 sernixa setup --dry-run
@@ -89,12 +114,28 @@ Discovery candidates are observations for review. Enrollment is inventory. An ac
 
 Supported global targets:
 
-- `claude`: Claude Code enforcement and lifecycle hooks in `~/.claude/settings.json`, plus the Sernixa MCP server in `~/.claude.json`.
+- `claude`: a visible **Sernixa Security** plugin containing enforcement/lifecycle hooks, the Sernixa MCP server, and a protection skill. Users can inspect it from `/plugin`.
 - `claude-desktop`: real stdio MCP server in the OS-specific Claude Desktop configuration.
-- `codex`: enforcement and lifecycle hooks plus the Sernixa MCP server in `~/.codex`. Hooks are effective by default unless `[features].hooks = false`; users still review/trust new non-managed hooks in Codex.
+- `codex`: a visible **Sernixa Security** plugin containing the enforcement hook, Sernixa MCP server, and protection skill. Users review/trust the plugin hook, and can inspect it from `/plugins`.
 - `cursor`: global MCP entry in `~/.cursor/mcp.json`, shared by Cursor IDE and CLI.
 
-Install or repair an individual integration:
+`sernixa protect` is the supported automatic installer. Anyone can also add the
+public repository marketplace directly:
+
+```bash
+codex plugin marketplace add abhishekdhull63/Sernixa.ai-Web
+codex plugin add sernixa@sernixa
+
+claude plugin marketplace add abhishekdhull63/Sernixa.ai-Web
+claude plugin install sernixa@sernixa --scope user
+```
+
+Inside Claude Code, the equivalent interactive commands are
+`/plugin marketplace add abhishekdhull63/Sernixa.ai-Web`,
+`/plugin install sernixa@sernixa`, and `/reload-plugins`.
+
+The legacy config installer remains available for Claude Desktop, Cursor, and
+older host builds:
 
 ```bash
 sernixa hook install claude
@@ -102,7 +143,7 @@ sernixa hook install claude-desktop
 sernixa hook install codex
 sernixa hook install cursor
 
-sernixa hook repair codex
+sernixa hook repair cursor
 sernixa hook status
 ```
 
@@ -110,14 +151,41 @@ Claude Code and Codex hooks call `sernixa hook run <provider>` before tool execu
 
 Hook handlers allow 35 seconds for the live policy request; the CLI request budget is 30 seconds. This prevents slow semantic evaluations from being killed by a shorter host-hook timeout.
 
-Claude Code, Claude Desktop, Codex, and Cursor run `sernixa mcp serve`. The stdio MCP server exposes three non-mutating tools:
+Claude Code, Claude Desktop, Codex, and Cursor run `sernixa mcp serve`. The stdio MCP server exposes four non-mutating tools:
 
 - `sernixa_policy_check`: evaluate one proposed action.
 - `sernixa_plan_check`: evaluate a declared multi-step plan.
+- `sernixa_execution_passport`: issue and persist a signed, exact-step Execution Passport for an allowed plan.
 - `sernixa_identity`: validate auth and return non-secret principal metadata.
 
 MCP tools provide explicit model capabilities; the installed hooks are the local tool-call enforcement points.
 
+### Execution Passports
+
+An approved plan is not a reusable local “allow.” Sernixa signs each exact
+tool/action/arguments/resource binding, and the API atomically consumes the
+matching proof once before execution. Changed arguments, undeclared tools,
+expired tokens, and replayed steps fail closed.
+
+Issue or inspect a passport directly:
+
+```bash
+sernixa passport issue --agent-type codex plan.json
+sernixa passport status
+sernixa passport clear
+```
+
+In Codex, Claude, Cursor, or another MCP host, ask the model to call
+`sernixa_execution_passport` with its complete intended plan before it begins
+tool use. The installed Codex/Claude pre-tool hook then consumes the matching
+proof for each emitted tool event. The passport authorizes only the declared
+steps; it never executes them and never bypasses native host permissions.
+
+Coverage remains explicit: no integration can block a capability that the host
+does not expose through a hook or MCP call. On current Codex Windows builds,
+Sernixa remains available as a plugin and MCP policy/passport layer, while
+pre-tool blocking depends on Codex adding Windows hook support.
+
 ## Governance and execution
 
 ```bash

{sernixa_cli-0.4.2 → sernixa_cli-0.4.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sernixa-cli"
-version = "0.4.2"
+version = "0.4.4"
 description = "Official Sernixa CLI for policy-governed local AI agent actions"
 readme = "README.md"
 license = "MIT"
@@ -21,7 +21,7 @@ dependencies = [
     "platformdirs>=4.0.0",
     "prompt-toolkit>=3.0.48",
     "rich>=13.8.0",
-    "sernixa>=0.4.1",
+    "sernixa>=0.4.3",
     "sernixa-agent>=1.6.1",
     "typer>=0.12.0",
 ]
@@ -42,6 +42,20 @@ build-backend = "setuptools.build_meta"
 [tool.setuptools.packages.find]
 include = ["sernixa_cli*"]
 
+[tool.setuptools.package-data]
+sernixa_cli = [
+    "claude_marketplace/.claude-plugin/marketplace.json",
+    "claude_marketplace/plugins/sernixa/.claude-plugin/plugin.json",
+    "claude_marketplace/plugins/sernixa/.mcp.json",
+    "claude_marketplace/plugins/sernixa/hooks/hooks.json",
+    "claude_marketplace/plugins/sernixa/skills/sernixa-protection/SKILL.md",
+    "codex_marketplace/.agents/plugins/marketplace.json",
+    "codex_marketplace/plugins/sernixa/.codex-plugin/plugin.json",
+    "codex_marketplace/plugins/sernixa/.mcp.json",
+    "codex_marketplace/plugins/sernixa/hooks/hooks.json",
+    "codex_marketplace/plugins/sernixa/skills/sernixa-protection/SKILL.md",
+]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["."]

{sernixa_cli-0.4.2 → sernixa_cli-0.4.4}/sernixa_cli/__init__.py

@@ -1,3 +1,3 @@
 """Official Sernixa command-line client."""
 
-__version__ = "0.4.2"
+__version__ = "0.4.4"

sernixa_cli-0.4.4/sernixa_cli/claude_marketplace/.claude-plugin/marketplace.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "sernixa",
+  "version": "0.4.4",
+  "description": "Sernixa policy enforcement and signed Execution Passports for AI agent actions.",
+  "owner": {
+    "name": "Sernixa Team"
+  },
+  "plugins": [
+    {
+      "name": "sernixa",
+      "description": "Govern Claude actions with live organization policy and one-time exact-step proofs.",
+      "version": "0.4.4",
+      "source": "./plugins/sernixa",
+      "category": "security"
+    }
+  ]
+}

sernixa_cli-0.4.4/sernixa_cli/claude_marketplace/plugins/sernixa/.claude-plugin/plugin.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
+  "name": "sernixa",
+  "displayName": "Sernixa Security",
+  "version": "0.4.4",
+  "description": "Server-authoritative policy and signed, one-time Execution Passports for Claude Code.",
+  "author": {
+    "name": "Sernixa Team",
+    "url": "https://sernixa.com"
+  },
+  "homepage": "https://sernixa.com",
+  "repository": "https://github.com/abhishekdhull63/Sernixa.ai-Web",
+  "license": "MIT",
+  "keywords": ["ai-security", "governance", "policy", "execution-passport"],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json"
+}

sernixa_cli-0.4.4/sernixa_cli/claude_marketplace/plugins/sernixa/.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sernixa-governance": {
+      "command": "sernixa",
+      "args": ["mcp", "serve"],
+      "env": {
+        "SERNIXA_AGENT_TYPE": "claude"
+      }
+    }
+  }
+}

sernixa_cli-0.4.4/sernixa_cli/claude_marketplace/plugins/sernixa/hooks/hooks.json

@@ -0,0 +1,130 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35,
+            "statusMessage": "Checking Sernixa policy and Execution Passport"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "PostCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sernixa hook run claude",
+            "timeout": 35
+          }
+        ]
+      }
+    ]
+  }
+}

sernixa_cli-0.4.4/sernixa_cli/claude_marketplace/plugins/sernixa/skills/sernixa-protection/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: sernixa-protection
+description: Use when a Claude plan should be checked and bound to Sernixa policy before tool execution, or when explaining a Sernixa denial.
+---
+
+# Sernixa protection
+
+Before a multi-step tool workflow:
+
+1. Call `sernixa_identity` to verify the active organization context.
+2. Build exact steps with `tool_name`, canonical `action`, `arguments`, and
+   `resource`.
+3. Call `sernixa_execution_passport` once with the complete plan.
+4. Do not change tool arguments after the passport is issued. If the plan
+   changes, issue a new passport.
+5. Treat any missing, expired, replayed, or mismatched proof as blocked.
+
+Sernixa policy never replaces Claude permissions or user approval. Both
+boundaries must allow the action.