@oconnector/devshield

The official Command Line Interface (CLI) for ABS Core.

What does it do?

1. Static Analysis (scan): Scans your agent's repository and intercepts dangerously written system calls (rm -rf, eval, or leaked API keys like sk-xxx).
2. Offline Governance (paat): Emits Policy-as-a-Token (PAAT). These are policies packed into RS256 typed JWTs that your Node.js or Python runtime can unwrap using the engine WASM without ANY latency or HTTP call to our servers.

Installation

npm install -g @oconnector/devshield

Creating PAAT (Policy-as-a-Token)

You can pass a policies JSON representation to evaluate your agent entirely on the Node.js/Edge node.

1. Ephemeral Key (Local Mode)

devshield paat policies.json

Generates an ephemeral RSA pair on the fly.

2. Enterprise PKI (HashiCorp Vault Mode)

If you manage high stakes architectures (Fintech, Healthcare), you don't want bare metal keys anywhere. The CLI integrates with the Vault Transit engine:

devshield paat policies.json \
  --key-provider vault \
  --vault-addr https://vault.yourcompany.internal \
  --vault-token $VAULT_TOKEN

Your policy logic is sent via Transit API, HashiCorp signs the token inside their secure enclaves and returns your PAAT, ensuring strict production readiness.