mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-10-27 07:52:03 +00:00
118 lines
4.0 KiB
Python
118 lines
4.0 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
from typing import Any
|
|
|
|
import click
|
|
import typer
|
|
|
|
|
|
def build_capabilities() -> dict[str, Any]:
|
|
"""Return a deterministic capability map for CLI/API discovery."""
|
|
return {
|
|
"schema_version": 1,
|
|
"product": "SeedPass",
|
|
"interfaces": {
|
|
"cli": {
|
|
"root_commands": [
|
|
"lock",
|
|
"gui",
|
|
"capabilities",
|
|
"entry",
|
|
"vault",
|
|
"nostr",
|
|
"config",
|
|
"fingerprint",
|
|
"util",
|
|
"api",
|
|
"agent",
|
|
],
|
|
"global_options": [
|
|
"--fingerprint",
|
|
"--no-clipboard",
|
|
"--deterministic-totp",
|
|
],
|
|
},
|
|
"api": {
|
|
"discovery": ["/docs"],
|
|
"auth_headers": ["Authorization: Bearer <token>"],
|
|
"sensitive_auth_headers": ["X-SeedPass-Password"],
|
|
},
|
|
},
|
|
"security_features": {
|
|
"auth_brokers": {
|
|
"available": ["env", "keyring", "command", "prompt"],
|
|
"agent_commands": ["agent init", "agent get"],
|
|
"vault_commands": ["vault unlock"],
|
|
"api_commands": ["api start --unlock"],
|
|
},
|
|
"policy": {
|
|
"commands": ["agent policy-show", "agent policy-lint", "agent policy-set"],
|
|
"default_effect": "deny",
|
|
},
|
|
"tokens": {
|
|
"commands": ["agent token-issue", "agent token-list", "agent token-revoke"],
|
|
"supports_ttl": True,
|
|
"supports_use_limits": True,
|
|
"supports_revocation": True,
|
|
},
|
|
"redaction": {
|
|
"default_safe_output": True,
|
|
"reveal_override": "agent get --reveal",
|
|
},
|
|
"audit": {
|
|
"log_file": "~/.seedpass/agent_audit.log",
|
|
"integrity": "HMAC chained append-only records",
|
|
},
|
|
},
|
|
"high_risk_operations": [
|
|
"vault export",
|
|
"vault reveal-parent-seed",
|
|
"entry get (sensitive kinds)",
|
|
"api /api/v1/vault/export",
|
|
],
|
|
"help_hints": [
|
|
"Run `seedpass --help` for top-level commands.",
|
|
"Run `seedpass <group> --help` for detailed options.",
|
|
"Use `seedpass capabilities --format json` for machine-readable discovery.",
|
|
],
|
|
}
|
|
|
|
|
|
def emit_capabilities(output_format: str) -> str:
|
|
data = build_capabilities()
|
|
if output_format == "json":
|
|
return json.dumps(data, indent=2, sort_keys=True)
|
|
|
|
lines: list[str] = []
|
|
lines.append("SeedPass Capabilities (schema v1)")
|
|
lines.append("")
|
|
lines.append("CLI root commands:")
|
|
lines.append(", ".join(data["interfaces"]["cli"]["root_commands"]))
|
|
lines.append("")
|
|
lines.append("Security highlights:")
|
|
lines.append("- Auth brokers: env, keyring, command, prompt")
|
|
lines.append("- Policy controls: agent policy-show/policy-lint/policy-set")
|
|
lines.append("- Scoped tokens: issue/list/revoke with TTL and use limits")
|
|
lines.append("- Safe output redaction default with explicit --reveal")
|
|
lines.append("- Audited access log with chained HMAC signatures")
|
|
lines.append("")
|
|
lines.append("Discovery hints:")
|
|
for hint in data["help_hints"]:
|
|
lines.append(f"- {hint}")
|
|
return "\n".join(lines)
|
|
|
|
|
|
def register_capabilities_command(app: typer.Typer) -> None:
|
|
@app.command("capabilities")
|
|
def capabilities_command(
|
|
format: str = typer.Option(
|
|
"text",
|
|
"--format",
|
|
help="Output format for capabilities map",
|
|
click_type=click.Choice(["text", "json"], case_sensitive=False),
|
|
)
|
|
) -> None:
|
|
"""Show a deterministic capabilities map for users and agents."""
|
|
typer.echo(emit_capabilities(format.lower()))
|