assay-cli 5.3.0

Policy-as-code gate for MCP agent tool calls, with verifiable evidence and Linux kernel enforcement.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

//! Policy command arguments.

use std::path::PathBuf;

use clap::{Args, Subcommand};

use crate::cli::commands::{generate::GenerateArgs, record::RecordArgs};

use super::common::OutputFormat;

#[derive(Args, Clone, Debug)]
pub struct PolicyArgs {
    #[command(subcommand)]
    pub cmd: PolicyCommand,
}

#[derive(Subcommand, Clone, Debug)]
pub enum PolicyCommand {
    /// Generate policy from trace or profile input
    Generate(GenerateArgs),

    /// Capture runtime behavior and generate a policy
    Record(RecordArgs),

    /// Validate policy syntax and (v2) JSON Schemas
    Validate(PolicyValidateArgs),

    /// Migrate v1.x constraints policy to v2.0 schemas
    Migrate(PolicyMigrateArgs),

    /// Format policy YAML (normalizes formatting)
    Fmt(PolicyFmtArgs),
}

#[derive(Args, Clone, Debug)]
pub struct PolicyValidateArgs {
    /// Policy file path (YAML)
    #[arg(short, long)]
    pub input: PathBuf,

    /// Fail if deprecated v1 policy format is detected
    #[arg(long)]
    pub deny_deprecations: bool,

    /// Output format; JSON writes a machine-readable validation report to stdout
    #[arg(long, value_enum, default_value_t = OutputFormat::Text)]
    pub format: OutputFormat,
}

impl PolicyValidateArgs {
    pub(crate) fn is_json(&self) -> bool {
        self.format == OutputFormat::Json
    }
}

#[derive(Args, Clone, Debug)]
pub struct PolicyMigrateArgs {
    /// Input policy file (v1.x or v2.0)
    #[arg(short, long)]
    pub input: PathBuf,

    /// Output file (default: overwrite input)
    #[arg(short, long)]
    pub output: Option<PathBuf>,

    /// Dry run (print to stdout instead of overwriting)
    #[arg(long)]
    pub dry_run: bool,

    /// Preview only (no write)
    #[arg(long)]
    pub check: bool,
}

#[derive(Args, Clone, Debug)]
pub struct PolicyFmtArgs {
    /// Policy file path (YAML)
    #[arg(short, long)]
    pub input: PathBuf,

    /// Output file (default: overwrite input)
    #[arg(short, long)]
    pub output: Option<PathBuf>,
}