Atbash Safety

View saved version →

---
name: atbash-manage
description: Prepare and obtain browser approval for a change to an existing Atbash agent's name, purpose, risk, or active state.
---

# Atbash Management

Use Node.js 22.13.0 or newer in a local desktop thread. Resolve `<skill-directory>` to this file's directory and run:

```text
node <skill-directory>/scripts/atbash-control.mjs manage start --host codex
```

Show the returned verification URL and code. After the user verifies their wallet, run `manage inspect <job-id>` through the same launcher. Use discovery to identify the exact agent and organization; clarify an ambiguous target.

Create a non-secret plan file with exactly one `update_agent` action:

```json
{
  "actions": [
    {
      "type": "update_agent",
      "network": "public",
      "organization": "<discovered organization>",
      "agentPubkey": "<discovered public key>",
      "changes": { "purpose": "<user-requested purpose>" }
    }
  ]
}
```

Use the discovered network and identity. Include only requested fields in `changes`: `name`, `purpose`, `risk` (`low`, `medium`, `high`, `critical`), or `active` (boolean). Submit with `manage plan <job-id> --input <path>` through the launcher.

The user reviews and signs the exact change in Connect Atbash. Never click approval controls or sign for them. A prior setup or management authorization does not authorize a new change. Inspect the job after approval; when execution is complete, run `manage continue <job-id>` and report its result. A management completion requires no new agent key or profile activation. On partial completion, report completed and failed steps; further changes need a new session and approval.

Use `manage cancel <job-id>` when the user asks to cancel. Stop on expiry or terminal failure. Do not create replacement mutation sessions without the user's intent to continue.

Policy editing, billing, ownership transfer, key recovery, and certification use their dedicated dashboard flows. Never read, print, transmit, or request an agent private key.

Referenced files: 2 — file references are metadata, not package contents.

View saved version →

---
name: atbash-safety
description: Check a specific proposed command or tool action against the selected local Atbash agent's safety policy, or inspect that agent's readiness and policy.
---

# Atbash Safety Check

Run explicit checks using the packaged helper in a local desktop thread with Node.js 22.13.0 or newer. Resolve `<skill-directory>` to this file's directory.

For readiness and policy, run:

```text
node <skill-directory>/scripts/atbash-safety.mjs status
```

For a specific action, send JSON on standard input to:

```text
node <skill-directory>/scripts/atbash-safety.mjs evaluate
```

The input is `{"toolName":"<actual tool>","args":{...},"context":"<brief task purpose>"}`. Use the exact proposed tool name and arguments. Context is optional and must be a short explanation of this action; do not send conversation history or transcripts. Clarify missing action details before checking. Do not execute a proposed command merely to evaluate it. Submit only the action information needed for the requested check; omit credentials and unrelated private data.

The helper uses the selected local `codex` profile and signs locally. It sends the tool name, SDK-redacted arguments, and action context to the package's Atbash service. No private key belongs in action input or output.

Read the JSON result even if the process exits nonzero:

- Only `allow: true` with `verdict: "ALLOW"` permits proceeding within the user's already-authorized task. A check by itself does not authorize executing the action.
- `HOLD`: stop the action and explain the returned review reason.
- `BLOCK`: stop the action and explain the returned policy reason.
- `ERROR`, missing or malformed output, timeout, or configuration failure: stop the action; report that a safe decision was unavailable. For profile setup, use `$atbash-setup`.

If the user asked only for an evaluation, report the result and do not execute the action. If the user also authorized execution, check the exact action immediately before executing it through its normal tool. A changed command or arguments need a new evaluation. Never use the helper as a command executor or treat an evaluation reference as reusable authorization.

State the checked action and relevant reason. This package does not automatically intercept other tools; never report agent readiness or a successful check as proof of universal protection.

Referenced files: 2 — file references are metadata, not package contents.

View saved version →

---
name: atbash-setup
description: Set up, connect, verify, or switch the local Atbash agent used for explicit safety checks. Use for Atbash signup, existing-agent connection, setup progress, or local profile troubleshooting.
---

# Atbash Setup

Run the bundled helper yourself in a local desktop thread. It requires Node.js 22.13.0 or newer on macOS arm64, Linux x64/arm64 with glibc, or Windows x64. Resolve `<skill-directory>` to the directory containing this file; use its installed launcher throughout a job. If local execution is unavailable, explain that this package requires a local desktop thread.

## Onboard an agent

```text
node <skill-directory>/scripts/atbash-control.mjs setup start --host codex
```

The helper uses the `codex` host profile namespace in both ChatGPT desktop and Codex. Show the returned `verificationUri` and code. The user signs in and verifies their wallet in Connect Atbash. Keep the job ID to resume the same job. Ask only for missing choices and browser approval; perform helper commands and plan-file creation yourself.

Run `setup inspect <job-id>` through the same launcher after wallet verification. Follow `nextAction`:

- `OPEN_BROWSER`: wait for the user to verify their wallet at the returned URL.
- `PREPARE_PLAN`: use discovery and user-provided choices to create a non-secret JSON file with an `actions` array. Submit it with `setup plan <job-id> --input <path>`.
- `REVIEW_IN_BROWSER`: show the verification URL; the user reviews and signs the exact proposal. Do not approve or sign for them.
- `WAIT`: inspect again after two seconds, keeping the user informed. Stop on expiry or terminal failure; do not repeatedly create new sessions.
- `ACTIVATE`: run `setup continue <job-id>` to decrypt the key locally and select the agent profile.
- `RECOVER`: report completed and failed steps. Further mutations require a new authorization session.
- `DONE`: run `node <skill-directory>/../../runtime/public-safety.cjs status`. Report whether the agent is ready for explicit safety checks.

A new-agent plan uses `create_account` and `create_organization` when missing, `activate_free_plan` if needed, then one `create_agent` with `keySource: "generate_in_browser"`. Include `network`, `organization`, `name`, `purpose`, and `risk` (`low`, `medium`, `high`, or `critical`) from discovery and the user's choices. Account actions have only `type` and `network`; organization creation uses `name` and `description`. Free-plan activation uses `organization` and requires the public network.

Suggest `policy: {"preset":"developer","version":1}` for coding, `devops` for operations, or `full_baseline` when the user requests the strictest protection. Explain the suggestion before approval; the user can choose a different preset or customize the policy in Connect Atbash.

If an existing organization needs a subscription, run `setup checkout <job-id> --organization <name>` and show the returned checkout URL. The user selects the plan and handles payment in their browser. Resume inspection afterward.

## Connect an existing agent

After wallet verification and discovery, run `profile connect <job-id>` through the launcher. Show the returned loopback `localUri`. The user enters their key only in that local form; the helper verifies that its public identity belongs to the verified wallet. Wait for the helper's completion, then run the status command above.

Never ask for, read, print, or put an agent private key in the conversation, tool arguments, environment assignments, or plan files. Credential and pending-session files are private. A browser verification URL and job ID may be shown; session secrets may not.

## Profiles and troubleshooting

Use the same launcher for `profile list --host codex`, `profile switch --host codex --profile <id>`, and `profile disconnect --host codex`. Disconnecting retains the stored credential and does not revoke the on-chain agent. After switching, run status again. Resolve an environment mismatch by connecting an agent belonging to the service reported by `public-safety.cjs help`; do not copy keys between environments.

Report helper failures without exposing credential contents or requesting backend credentials. If a local environment override conflicts with a profile, ask the user to correct it locally without revealing its value.

This package checks only explicitly submitted actions. Agent readiness does not mean other tool calls are automatically intercepted. After setup, use `$atbash-safety` when the user requests an action check.

Referenced files: 2 — file references are metadata, not package contents.