assay-cli 3.26.0

Policy-as-code gate for MCP agent tool calls, with verifiable evidence and Linux kernel enforcement.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

use super::report::*;

pub fn format_text(report: &DiagnosticReport) -> String {
    let mut s = String::new();
    s.push_str(&format!("Assay v{}\n", report.assay_version));
    s.push_str("────────────\n");
    s.push_str(&format!("Platform:   {}\n", report.platform));
    if let Some(k) = &report.kernel {
        s.push_str(&format!("Kernel:     {}\n", k));
    }

    s.push_str("\nSecurity Modules:\n");
    if let Some(abi) = report.landlock.abi_version {
        s.push_str(&format!(
            "  Landlock:   ✓ ABI v{abi} (FS); net_connect_tcp={}, no_new_privs_settable={}, ruleset_probe={:?}\n",
            report.landlock.net_connect_tcp_supported,
            report.landlock.no_new_privs_settable,
            report.landlock.net_connect_ruleset_probe,
        ));
    } else {
        s.push_str(&format!(
            "  Landlock:   ✗ {:?} (no usable ABI)\n",
            report.landlock.abi_probe_status
        ));
    }

    if report.bpf_lsm.available {
        s.push_str("  BPF-LSM:    ✓ enabled\n");
    } else {
        s.push_str("  BPF-LSM:    ✗ unavailable\n");
    }

    s.push_str("\nHelper:\n");
    if report.helper.exists {
        s.push_str("  Status:     installed\n");
    } else {
        s.push_str("  Status:     not installed\n");
        s.push_str(&format!("  Expected:   {}\n", report.helper.path.display()));
    }

    s.push_str("\nBackend:\n");
    s.push_str(&format!(
        "  Active:     {} ({} Mode)\n",
        report.backend.selected, report.backend.mode
    ));
    s.push_str(&format!("  Details:    {}\n", report.backend.reason));

    // Phase 5 hardening features
    s.push_str("\nSandbox Hardening (v2.3):\n");
    let f = &report.sandbox_features;
    s.push_str(&format!(
        "  Env Scrubbing:      {}\n",
        if f.env_scrubbing { "✓" } else { "✗" }
    ));
    s.push_str(&format!(
        "  Scoped /tmp:        {}\n",
        if f.scoped_tmp { "✓" } else { "✗" }
    ));
    s.push_str(&format!(
        "  Fork-safe pre_exec: {}\n",
        if f.fork_safe_preexec { "✓" } else { "✗" }
    ));
    s.push_str(&format!(
        "  Deny Conflict Det:  {}\n",
        if f.deny_conflict_detection {
            "✓"
        } else {
            "✗"
        }
    ));

    if !report.metrics.is_empty() {
        s.push_str("\nTelemetry Counters (local):\n");
        // Sort keys for deterministic output
        let mut keys: Vec<&String> = report.metrics.keys().collect();
        keys.sort();

        for key in keys {
            if let Some(val) = report.metrics.get(key) {
                s.push_str(&format!("  {}: {}\n", key, val));
            }
        }
    }

    s.push_str("\nStatus: ");
    match report.status {
        SystemStatus::Ready => s.push_str("✓ READY\n"),
        SystemStatus::Degraded => s.push_str("⚠ DEGRADED\n"),
        SystemStatus::Unsupported => s.push_str("✗ UNSUPPORTED\n"),
    }

    if !report.suggestions.is_empty() {
        s.push_str("\nActions:\n");
        for sugg in &report.suggestions {
            s.push_str(&format!("  → {}\n", sugg));
        }
    }

    s
}