{"content":[{"text":"total 16\ndrwxr-xr-x 3 root root 4096 Sep 18 08:00 .\ndrwxr-xr-x 7 root root 4096 Sep 18 22:22 ..\ndrwxr-xr-x 8 root root 4096 Sep 18 08:00 .git\n-rw-r--r-- 1 root root  408 Sep 18 08:00 .gitignore\n---\n","type":"text"}]}

{"content":[{"text":"HTTP/2 404 \r\ndate: Fri, 18 Sep 2026 22:22:17 GMT\r\nvary: Origin\r\nx-service-version: be79dbaaf74dc5f04365579d214d7c75b4fec675\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bfOyXU%2F8PLNcIq8ay4oU1trKkRwcOt%2FQPmYMFBl%2F3cyJDvCETnXr3sVUCwV93fwS7aybble3txA5Unvu4%2FE%2Bz%2BZxrL2eQ8%2BvRg0AvFM194rzGRwX7xWLNZJpjNHBejCNsA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\ncf-ray: a3d3bf9f7d3d0615-IAD\r\n\r\nEXIT:0\n","type":"text"}]}

{"content":[{"text":"npm error code E404\nnpm error 404 Not Found - GET https://registry.npmjs.org/@oneleet%2fsdk - Not found\nnpm error 404\nnpm error 404  '@oneleet/sdk@*' is not in this registry.\nnpm error 404\nnpm error 404 Note that you can also install from a\nnpm error 404 tarball, folder, http url, or git url.\nnpm notice\nnpm notice New major version of npm available! 10.9.8 -> 12.0.2\nnpm notice Changelog: https://github.com/npm/cli/releases/tag/v12.0.2\nnpm notice To update run: npm install -g npm@12.0.2\nnpm notice\nnpm error A complete log of this run can be found in: /sandbox/.npm/_logs/2026-09-18T22_22_17_401Z-debug-0.log\n---\nERROR: No matching distribution found for oneleet\n","type":"text"}]}

cd /sandbox/repo && for p in /v1 /openapi.json /docs /swagger.json /api /health /v1/openapi.json; do echo "== $p"; timeout 12 curl -s -o /tmp/o -w "%{http_code}\n" "https://api.oneleet.com$p"; head -c 200 /tmp/o; echo; done

{"content":[{"text":"== /v1\n404\n{\"message\":\"no matching operation was found\"}\n\n== /openapi.json\n404\n{\"message\":\"no matching operation was found\"}\n\n== /docs\n404\n{\"message\":\"no matching operation was found\"}\n\n== /swagger.json\n404\n{\"message\":\"no matching operation was found\"}\n\n== /api\n404\n{\"message\":\"no matching operation was found\"}\n\n== /health\n404\n{\"message\":\"no matching operation was found\"}\n\n== /v1/openapi.json\n404\n{\"message\":\"no matching operation was found\"}\n\n","type":"text"}]}

{"content":[{"text":"{\"message\":\"no matching operation was found\"}\n\n== npm search\n[\n\n{\"name\":\"oneleet-cli\",\"keywords\":[\"oneleet\",\"compliance\",\"security\",\"cli\",\"agent-first\"],\"version\":\"0.1.7\",\"description\":\"Agent-first private-surface CLI for Oneleet reads and monitor refreshes\",\"sanitized_name\":\"oneleet-cli\",\"publisher\":{\"email\":\"npm-oidc-no-reply@github.com\",\"trustedPublisher\":{\"oidcConfigId\":\"oidc:1da27e42-feca-46a3-b8c1-56df56a14d24\",\"id\":\"github\"},\"username\":\"GitHub Actions\"},\"maintainers\":[{\"email\":\"daniel@danielgwilson.com\",\"username\":\"danielgwilson\"}],\"license\":\"MIT\",\"date\":\"2026-07-03T05:25:52.172Z\",\"links\":{\"homepage\":\"https://github.com/danielgwilson/oneleet-cli#readme\",\"repository\":\"git+https://github.com/danielgwilson/oneleet-cli.git\",\"bugs\":\"https://github.com/danielgwilson/oneleet-cli/issues\",\"npm\":\"https://www.npmjs.com/package/oneleet-cli\"}}\n\n,\n\n{\"name\"","type":"text"}]}

{"content":[{"text":"npm notice\noneleet-cli-0.1.7.tgz\npackage/LICENSE\npackage/dist/auth.js\npackage/dist/cli-runtime.js\npackage/dist/cli.js\npackage/dist/commands.js\npackage/dist/config.js\npackage/dist/hipaa-report-renderer.js\npackage/dist/hipaa-report.js\npackage/dist/oneleet-api.js\npackage/dist/output.js\npackage/dist/report-helpers.js\npackage/dist/reports.js\npackage/dist/safety.js\npackage/dist/summaries.js\npackage/package.json\npackage/docs/CONTRACT_V1.md\npackage/CONTRIBUTING.md\npackage/docs/COVERAGE.md\npackage/docs/PUBLISHING.md\npackage/README.md\npackage/SECURITY.md\npackage/skills/oneleet/SKILL.md\npackage/skills/oneleet/assets/oneleet-small.svg\npackage/skills/oneleet/assets/oneleet.svg\npackage/skills/oneleet/agents/openai.yaml\n","type":"text"}]}

{"content":[{"text":"  216 package/README.md\n  130 package/docs/CONTRACT_V1.md\n   51 package/docs/COVERAGE.md\n   82 package/docs/PUBLISHING.md\n   78 package/skills/oneleet/SKILL.md\n   66 package/package.json\n  623 total\n{\n  \"name\": \"oneleet-cli\",\n  \"version\": \"0.1.7\",\n  \"description\": \"Agent-first private-surface CLI for Oneleet reads and monitor refreshes\",\n  \"license\": \"MIT\",\n  \"author\": \"Daniel G Wilson\",\n  \"type\": \"module\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/danielgwilson/oneleet-cli.git\"\n  },\n  \"homepage\": \"https://github.com/danielgwilson/oneleet-cli#readme\",\n  \"bugs\": {\n    \"url\": \"https://github.com/danielgwilson/oneleet-cli/issues\"\n  },\n  \"bin\": {\n    \"oneleet\": \"dist/cli.js\",\n    \"oneleet-cli\": \"dist/cli.js\"\n  },\n  \"files\": [\n    \"dist\",\n    \"docs\",\n    \"skills\",\n    \"README.md\",\n    \"CONTRIBUTING.md\",\n    \"SECURITY.md\",\n    \"LICENSE\"\n  ],\n  \"keywords\": [\n    \"oneleet\",\n    \"compliance\",\n    \"security\",\n    \"cli\",\n    \"agent-first\"\n  ],\n  \"scripts\": {\n    \"clean\": \"node -e \\\"require('node:fs').rmSync('dist',{recursive:true,force:true})\\\"\",\n    \"build\": \"npm run clean && tsc -p tsconfig.build.json && node -e \\\"require('node:fs').chmodSync('dist/cli.js',0o755)\\\"\",\n    \"dev\": \"tsx src/cli.ts\",\n    \"typecheck\": \"tsc -p tsconfig.json --noEmit\",\n    \"lint\": \"npm run typecheck\",\n    \"lint:public-surface\": \"node scripts/public-surface-check.mjs\",\n    \"secret-sweep\": \"bash scripts/secret-sweep.sh\",\n    \"check:release\": \"npm run typecheck && npm test && npm run lint:public-surface && npm run secret-sweep\",\n    \"pretest\": \"npm run build\",\n    \"test\": \"node --test tests/*.test.js\",\n    \"prepublishOnly\": \"npm run check:release\",\n    \"prepare\": \"npm run build\",\n    \"start\": \"node dist/cli.js\"\n  },\n  \"dependencies\": {\n    \"chrome-remote-interface\": \"^0.34.0\",\n    \"commander\": \"^15.0.0\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^25.9.4\",\n    \"tsx\": \"^4.22.4\",\n    \"typescript\": \"^6.0.3\"\n  },\n  \"engines\": {\n    \"node\": \">=22.12.0\"\n  },\n  \"publishConfig\": {\n    \"access\": \"public\"\n  }\n}\n","type":"text"}]}

{"content":[{"text":"# oneleet-cli\n\nAgent-first private-surface CLI for Oneleet read workflows and narrow monitor refreshes.\n\nThis is an unofficial adapter. It is not affiliated with, endorsed by, or an\nofficial API wrapper for Oneleet. It uses Oneleet private web API surfaces and\ncan drift when Oneleet changes the app.\n\n## Current scope\n\n- browser/CDP-assisted auth import\n- session health checks\n- current user and tenant reads\n- dashboard, HIPAA aggregate report, controls, monitors, evidence, policies, frameworks, people, vendors, domains, integrations, access reviews, risk assessments, security training, trust center, reports, pentests, code security, and attack-surface reads\n- guarded evidence writes for uploading file evidence to controls and linking existing evidence to controls or vendors\n- guarded risk reads/updates for assessment triage\n- narrow `monitors refresh <monitor-ref>` rerun trigger for an existing monitor\n- read-only `/api/v1/...` escape hatch for uncovered Oneleet private API paths\n\nV1 is read-first. Mutations are limited to explicit typed workflow commands.\nEvidence and risk writes are dry-run by default and require `--write` plus an\nexact `--confirm ...` value. `monitors refresh` only triggers Oneleet's own\nrerun endpoint for a monitor that already appears in the configured tenant's\nmonitor list. Do not add broader mutations without a separate decision.\n\n## Install\n\nSource checkout:\n\n```bash\nnpm install\nnpm run build\nnode dist/cli.js --help\n```\n\nPublished package install:\n\n```bash\nnpm install -g oneleet-cli\noneleet --help\n```\n\nSkill install:\n\n```bash\nnpx -y skills add -g danielgwilson/oneleet-cli --skill oneleet\n```\n\nOne-off run:\n\n```bash\nnpx -y oneleet-cli doctor --json\n```\n\nOptional local link:\n\n```bash\nnpm link\n```\n\n## Auth\n\nRequires Node.js 22 or newer.\n\nOpen a logged-in Chrome session with remote debugging enabled, then import the\n`oneleet-app` session cookie:\n\n```bash\noneleet auth import-cdp --port 9333 --json\noneleet doctor --json\n```\n\nThe saved config lives at:\n\n```text\n~/.config/oneleet/config.json\n```\n\nIt is written with `0600` permissions. Do not commit it.\n\nEphemeral env auth is also supported:\n\n```bash\nexport ONELEET_APP_COOKIE=...\nexport ONELEET_TENANT_ID=...\noneleet doctor --json\n```\n\nDo not pass cookie values as CLI flags.\n\n`ONELEET_API_BASE_URL` is only for synthetic local tests and must point at a\nOneleet HTTPS host by default. Non-Oneleet API hosts are rejected unless\n`ONELEET_ALLOW_UNSAFE_API_BASE_URL=1` is set.\n\n## Commands\n\n```bash\noneleet auth status --json\noneleet auth clear --json\noneleet doctor --json\noneleet whoami --json\noneleet tenant get --json\noneleet dashboard --json\noneleet coverage check --json\noneleet hipaa report --json\noneleet hipaa report --format markdown --out /tmp/oneleet-hipaa.md --json\noneleet ops workforce-summary --json\noneleet vendor-risk report --json\noneleet trust readiness --json\noneleet security remediation-queue --json\noneleet monitors list --json\noneleet monitors refresh monitor-014 --wait 120 --json\noneleet controls list --json\noneleet evidence list --json\noneleet evidence list --raw --json\noneleet evidence get <evidence-id> --json\noneleet evidence upload ./register.csv --control-id <control-id> --link-control-id <control-id> --json\noneleet evidence upload ./register.csv --control-id <control-id> --link-control-id <control-id> --write --confirm register.csv --json\noneleet evidence link-control <evidence-id> --control-id <control-id> --json\noneleet evidence link-control <evidence-id> --control-id <control-id> --write --confirm <evidence-id> --json\noneleet evidence link-vendor <evidence-id> --vendor-id <tenant-vendor-id> --json\noneleet evidence link-vendor <evidence-id> --vendor-id <tenant-vendor-id> --write --confirm <evidence-id> --json\noneleet policies list --json\noneleet policies types --json\noneleet frameworks list --json\noneleet access-reviews list --json\noneleet domains list --json\noneleet integrations list --json\noneleet risk-assessments list --json\noneleet risks get <risk-id> --json\noneleet risks update <risk-id> --response MITIGATE --response-details \"Mitigation summary\" --json\noneleet risks update <risk-id> --response MITIGATE --response-details \"Mitigation summary\" --write --confirm <risk-id> --json\noneleet security-training modules --json\noneleet security-training progress --json\noneleet security-training progress --raw --json\noneleet people list --json\noneleet people list --raw --json\noneleet vendors list --json\noneleet trust config --json\noneleet trust documents --json\noneleet trust document-requests --json\noneleet trust faqs --json\noneleet trust security-issues --json\noneleet reports list --json\noneleet pentests active-request --json\noneleet code-security scan --json\noneleet code-security settings --json\noneleet code-security repositories --json\noneleet attack-surface summary --json\noneleet attack-surface issues --limit 50 --json\noneleet attack-surface scans --limit 50 --json\noneleet api get /api/v1/users/current --unsafe-raw --json\n```\n\n## Safety model\n\n- private-surface, cookie-backed API\n- read-only by default; write commands are opt-in and require `--write` plus exact confirmation\n- `monitors refresh` is an explicit rerun trigger and never accepts raw upstream IDs by default\n- refuses to send the session cookie to non-Oneleet API hosts unless explicitly opted into for synthetic local tests\n- `api get` is an unsafe raw-output escape hatch and requires `--unsafe-raw`\n- no raw HARs, screenshots, storage state, or full recon dumps in repo\n- `monitors refresh` accepts local `monitor-###` refs from `monitors list`; it resolves the upstream id internally and does not print upstream ids by default\n- people, evidence, and security-training progress output is summarized by default; use `--raw` only when you need full upstream rows\n- tenant, current-user, controls, monitors, vendors, domains, integrations, policies, access reviews, reports, trust-center rows, pentest requests, code-security rows, attack-surface issues, and attack-surface scans are also summarized by default where the upstream shape may contain sensitive or noisy details\n- default summarized list rows use local `ref` values and `hasId` booleans instead of raw upstream IDs; pass `--raw` only for short-lived local debugging\n- `coverage check`, `hipaa report`, `ops workforce-summary`, `vendor-risk report`, `trust readiness`, and `security remediation-queue` are intentionally aggregate/sanitized and avoid names, emails, cookies, URLs, UUID/internal IDs, and raw evidence filenames\n- evidence and risk write commands intentionally return the affected evidence/risk IDs needed for follow-up writes, but never print cookies\n- `hipaa report` includes `data.completeness`; treat `sourceErrors`, `shapeErrors`, or `paginationGaps` as report caveats before drawing conclusions\n\n## Evidence write workflow\n\nEvidence writes are meant for cases where a local artifact needs to become\ncontrol or vendor evidence without hand-clicking through Oneleet. Upload is\ndry-run by default:\n\n```bash\noneleet evidence upload ./baa-register.csv \\\n  --control-id <business-associate-agreements-managed-control-id> \\\n  --link-control-id <business-associate-agreements-with-subcontractors-control-id> \\\n  --link-control-id <vendor-management-control-id> \\\n  --reuse-existing-name \\\n  --json\n```\n\nTo write, repeat the command with the generated confirmation string:\n\n```bash\noneleet evidence upload ./baa-register.csv \\\n  --control-id <business-associate-agreements-managed-control-id> \\\n  --link-control-id <business-associate-agreements-with-subcontractors-control-id> \\\n  --link-control-id <vendor-management-control-id> \\\n  --reuse-existing-name \\\n  --write \\\n  --confirm baa-register.csv \\\n  --json\n```\n\nExisting evidence can be linked without re-uploading:\n\n```bash\noneleet evidence link-control <evidence-id> --control-id <control-id> --write --confirm <evidence-id> --json\noneleet evidence link-vendor <evidence-id> --vendor-id <tenant-vendor-id> --write --confirm <evidence-id> --json\n```\n\n## Contract\n\nSee [docs/CONTRACT_V1.md](./docs/CONTRACT_V1.md).\n\n## Release Hygiene\n\nSee [docs/PUBLISHING.md](./docs/PUBLISHING.md). The short gate is:\n\n```bash\nnpm run check:release\n```\n","type":"text"}]}

{"content":[{"text":"---\nname: oneleet\ndescription: \"Use the Oneleet CLI to inspect Oneleet security and compliance posture through an unofficial read-first private-surface adapter. Prefer summarized JSON and aggregate reports; never print cookies or raw sensitive payloads.\"\n---\n\n# Oneleet CLI Skill\n\nUse this skill for Oneleet compliance, HIPAA, security posture, trust-center,\nvendor, people, evidence, monitor, control, attack-surface, code-security, or\nplatform-coverage analysis.\n\n## Command\n\nPrefer an installed binary:\n\n```bash\noneleet --help\n```\n\nFor one-off package use after publication:\n\n```bash\nnpx -y oneleet-cli --help\n```\n\nFor a source checkout:\n\n```bash\nnpm install\nnpm run build\nnode dist/cli.js --help\n```\n\n## Safety Rules\n\n- Do not print, paste, store, or commit the `oneleet-app` cookie.\n- Do not commit raw HARs, browser traces, screenshots, storage state, cookie\n  dumps, or full upstream JSON exports.\n- Prefer aggregate reports and summarized list outputs.\n- Use `--raw` and `api get --unsafe-raw` only for short-lived local debugging.\n- Mutations must stay limited to explicit typed workflow commands with narrow\n  safety gates. `monitors refresh <monitor-ref>` triggers a Oneleet monitor\n  rerun for a local `monitor-###` ref from `monitors list`.\n- Default summarized list rows use local `ref` labels and `hasId` booleans\n  instead of raw upstream IDs.\n- Reports should use counts, statuses, categories, and control titles. Avoid\n  names, emails, tenant IDs, filenames, raw URLs, raw upstream IDs, and raw\n  evidence text.\n\n## First Checks\n\n```bash\noneleet auth status --json\noneleet doctor --json\n```\n\nIf auth is missing, ask Daniel to log into Oneleet in Chrome with remote\ndebugging enabled, then import:\n\n```bash\noneleet auth import-cdp --port 9333 --json\n```\n\n## Best Starting Commands\n\n```bash\noneleet coverage check --json\noneleet hipaa report --json\noneleet ops workforce-summary --json\noneleet vendor-risk report --json\noneleet trust readiness --json\noneleet security remediation-queue --json\noneleet monitors refresh monitor-014 --wait 120 --json\n```\n\nTreat scenario reports as coverage for current workflows, not full Oneleet\nprivate API coverage. If a scenario still needs raw detail, record it as a typed\nCLI gap before using `api get`.\n","type":"text"}]}

cd /tmp/package && grep -rEo "https?://[a-zA-Z0-9._/-]+" dist/*.js | sort -u | head -40; echo "=== suspicious sinks ==="; grep -nE "exec|spawn|child_process|eval\(|fetch\(|net\.|WebSocket|process\.env\.[A-Z_]+" dist/*.js | head -40

{"content":[{"text":"dist/auth.js:https://api.oneleet.com\ndist/auth.js:https://app.oneleet.com\ndist/auth.js:https://auth.oneleet.com\ndist/config.js:https://api.oneleet.com\ndist/config.js:https://app.oneleet.com\n=== suspicious sinks ===\ndist/commands.js:1013:    const match = MONITOR_REF_PATTERN.exec(selector);\ndist/config.js:7:    const xdg = process.env.XDG_CONFIG_HOME?.trim();\ndist/config.js:14:    const xdg = process.env.XDG_CONFIG_HOME?.trim();\ndist/config.js:50:    const envCookie = process.env.ONELEET_APP_COOKIE?.trim();\ndist/config.js:51:    const envTenantId = process.env.ONELEET_TENANT_ID?.trim();\ndist/config.js:52:    const envAppBaseUrl = process.env.ONELEET_APP_BASE_URL?.trim();\ndist/config.js:53:    const envApiBaseUrl = process.env.ONELEET_API_BASE_URL?.trim();\ndist/config.js:54:    const envAllowUnsafeApiBaseUrl = process.env.ONELEET_ALLOW_UNSAFE_API_BASE_URL?.trim();\ndist/oneleet-api.js:183:        const response = await fetch(url, {\n","type":"text"}]}

cd /tmp && for u in https://oneleet.com/pricing https://www.oneleet.com/pricing; do echo "=== $u"; timeout 25 curl -sL -A "Mozilla/5.0" "$u" | python3 -c "
import sys,re,html
t=sys.stdin.read()
t=re.sub(r'(?is)<(script|style|svg|noscript).*?</\1>',' ',t)
t=re.sub(r'(?s)<[^>]+>',' ',t)
t=html.unescape(re.sub(r'\s+',' ',t))
print(t[:2500])
"; done

{"content":[{"text":"=== https://oneleet.com/pricing\n Oneleet | Pricing & Custom Quotes HIRING Products Frameworks Pricing Blog Sign in Book Demo HIRING Products Frameworks Pricing Blog Sign in Book Demo Book Demo Book Demo PRICING REQUEST Book a Demo to Get Custom Quote Book a Demo to Get Custom Quote We'd love to prepare a customized proposal for you! We'd love to prepare a customized proposal for you! Oneleet’s pricing model depends on a few factors specific to your needs, so we'll need to get in touch to give you accurate pricing information. Oneleet’s pricing model depends on a few factors specific to your needs, so we'll need to get in touch to give you accurate pricing information. Please fill out the form and book a demo to get a quote. Please fill out the form and book a demo to get a quote. Supported Frameworks Supported Frameworks SOC 2 HIPAA ISO 27001 GDPR PCI DSS CIS IG1 EU DORA NIST 800-171 Other Compliance Frameworks, including Custom Frameworks Other Compliance Frameworks, including Custom Frameworks Other Compliance Frameworks, including Custom Frameworks Schedule Your 30-Min Compliance Assessment First name Last name Email (only work email) Phone number Company name Company size (headcount) Select... How did you hear about us? Select... What compliance frameworks do you need? Select all that apply - we'll customize your plan Enterprise GRC SOC 2 ISO 27001 ISO 42001 HIPAA PCI DSS HITRUST GDPR NIST SP800-171 Pentest Looking for something not listed above? How urgent is your compliance need? Yesterday! As soon as possible No fixed date yet Within a month By submitting, I agree to Oneleet's Privacy Policy. Yes, add me to Slack for fast, direct Q&A with your team. Book a Call Step 1 / 1 See My Timeline Schedule Your 30-Min Compliance Assessment First name Last name Email (only work email) Phone number Company name Company size (headcount) Select... How did you hear about us? Select... What compliance frameworks do you need? Select all that apply - we'll customize your plan Enterprise GRC SOC 2 ISO 27001 ISO 42001 HIPAA PCI DSS HITRUST GDPR NIST SP800-171 Pentest Looking for something not listed above? How urgent is your compliance need? Yesterday! As soon as possible No fixed date yet Within a month By submitting, I agree to Oneleet's Privacy Policy. Yes, add me to Slack for fast, direct Q&A with your team. Book a Call Step 1 / 1 See My Timeline Schedule Your 30-Min Compliance Assessment First name Last name Email (only work email) Phone number Company name Company size (headcount) Select... How\n=== https://www.oneleet.com/pricing\n Oneleet | Pricing & Custom Quotes HIRING Products Frameworks Pricing Blog Sign in Book Demo HIRING Products Frameworks Pricing Blog Sign in Book Demo Book Demo Book Demo PRICING REQUEST Book a Demo to Get Custom Quote Book a Demo to Get Custom Quote We'd love to prepare a customized proposal for you! We'd love to prepare a customized proposal for you! Oneleet’s pricing model depends on a few factors specific to your needs, so we'll need to get in touch to give you accurate pricing information. Oneleet’s pricing model depends on a few factors specific to your needs, so we'll need to get in touch to give you accurate pricing information. Please fill out the form and book a demo to get a quote. Please fill out the form and book a demo to get a quote. Supported Frameworks Supported Frameworks SOC 2 HIPAA ISO 27001 GDPR PCI DSS CIS IG1 EU DORA NIST 800-171 Other Compliance Frameworks, including Custom Frameworks Other Compliance Frameworks, including Custom Frameworks Other Compliance Frameworks, including Custom Frameworks Schedule Your 30-Min Compliance Assessment First name Last name Email (only work email) Phone number Company name Company size (headcount) Select... How did you hear about us? Select... What compliance frameworks do you need? Select all that apply - we'll customize your plan Enterprise GRC SOC 2 ISO 27001 ISO 42001 HIPAA PCI DSS HITRUST GDPR NIST SP800-171 Pentest Looking for something not listed above? How urgent is your compliance need? Yesterday! As soon as possible No fixed date yet Within a month By submitting, I agree to Oneleet's Privacy Policy. Yes, add me to Slack for fast, direct Q&A with your team. Book a Call Step 1 / 1 See My Timeline Schedule Your 30-Min Compliance Assessment First name Last name Email (only work email) Phone number Company name Company size (headcount) Select... How did you hear about us? Select... What compliance frameworks do you need? Select all that apply - we'll customize your plan Enterprise GRC SOC 2 ISO 27001 ISO 42001 HIPAA PCI DSS HITRUST GDPR NIST SP800-171 Pentest Looking for something not listed above? How urgent is your compliance need? Yesterday! As soon as possible No fixed date yet Within a month By submitting, I agree to Oneleet's Privacy Policy. Yes, add me to Slack for fast, direct Q&A with your team. Book a Call Step 1 / 1 See My Timeline Schedule Your 30-Min Compliance Assessment First name Last name Email (only work email) Phone number Company name Company size (headcount) Select... How\n","type":"text"}]}

{"content":[{"text":"Usage: oneleet [options] [command]\n\nAgent-first private-surface CLI for Oneleet read workflows\n\nOptions:\n  -V, --version        output the version number\n  --json               Print JSON envelope for command results and parser errors\n  -h, --help           display help for command\n\nCommands:\n  auth                 Auth commands\n  doctor [options]     Validate auth and core Oneleet read endpoints\n  whoami [options]     Read the current Oneleet user\n  tenant               Tenant commands\n  dashboard [options]  Read Oneleet dashboard summary\n  hipaa                HIPAA aggregate commands\n  coverage             Adapter coverage and drift checks\n  ops                  Operational aggregate reports\n  vendor-risk          Vendor risk aggregate reports\n  security             Security operations aggregate reports\n  monitors             Monitor commands\n  controls             Control commands\n  people               People commands\n  vendors              Vendor commands\n  evidence             Evidence commands\n  policies             Policy commands\n  frameworks           Compliance framework commands\n  access-reviews       Access review commands\n  domains              Domain commands\n  integrations         Integration commands\n  risk-assessments     Risk assessment commands\n  risks                Risk commands\n  security-training    Security training commands\n  trust                Trust center commands\n  reports              Report commands\n  pentests             Pentest commands\n  code-security        Code security commands\n  attack-surface       Attack surface commands\n  api                  Unsafe read-only private API escape hatch\n  help [command]       display help for command\n\n  Safe first commands:\n    oneleet auth status --json\n    oneleet doctor --json\n    oneleet coverage check --json\n    oneleet hipaa report --json\n  \n  Scenario reports:\n    oneleet ops workforce-summary --json\n    oneleet vendor-risk report --json\n    oneleet trust readiness --json\n    oneleet security remediation-queue --json\n  \n  Raw output warning:\n    Prefer summarized defaults. Use --raw or api get --unsafe-raw only for short-lived local debugging.\n  \n","type":"text"}]}

cd /sandbox/oneleet-demo && echo "=== auth status"; timeout 30 node node_modules/.bin/oneleet auth status --json 2>&1 | head -20; echo "=== doctor"; timeout 45 node node_modules/.bin/oneleet doctor --json 2>&1 | head -40

{"content":[{"text":"=== auth status\n{\n  \"ok\": true,\n  \"data\": {\n    \"hasOneleetAppCookie\": false,\n    \"tenantIdConfigured\": false,\n    \"source\": \"none\",\n    \"configPath\": \"~/.config/oneleet/config.json\",\n    \"validation\": {\n      \"ok\": false,\n      \"reason\": \"Missing oneleet-app cookie\"\n    }\n  }\n}\n=== doctor\n{\n  \"ok\": false,\n  \"error\": {\n    \"code\": \"AUTH_MISSING\",\n    \"message\": \"No Oneleet session. Log in through Chrome, then run 'oneleet auth import-cdp --port 9333', or set ONELEET_APP_COOKIE and ONELEET_TENANT_ID.\",\n    \"retryable\": false\n  }\n}\n","type":"text"}]}

{"content":[{"text":"=== coverage check\n{\n  \"ok\": false,\n  \"error\": {\n    \"code\": \"AUTH_MISSING\",\n    \"message\": \"No Oneleet session. Log in through Chrome, then run 'oneleet auth import-cdp --port 9333', or set ONELEET_APP_COOKIE and ONELEET_TENANT_ID.\",\n    \"retryable\": false\n  }\n}\n=== hipaa report\n{\n  \"ok\": false,\n  \"error\": {\n    \"code\": \"AUTH_MISSING\",\n    \"message\": \"No Oneleet session. Log in through Chrome, then run 'oneleet auth import-cdp --port 9333', or set ONELEET_APP_COOKIE and ONELEET_TENANT_ID.\",\n    \"retryable\": false\n  }\n}\n=== whoami\n{\n  \"ok\": false,\n  \"error\": {\n    \"code\": \"AUTH_MISSING\",\n    \"message\": \"No Oneleet session. Log in through Chrome, then run 'oneleet auth import-cdp --port 9333', or set ONELEET_APP_COOKIE and ONELEET_TENANT_ID.\",\n    \"retryable\": false\n  }\n}\n","type":"text"}]}

{"content":[{"text":"# CONTRACT V1\n\n## Output\n\nCommands with `--json` print exactly one JSON object to stdout.\n\nSuccess:\n\n```json\n{\n  \"ok\": true,\n  \"data\": {}\n}\n```\n\nFailure:\n\n```json\n{\n  \"ok\": false,\n  \"error\": {\n    \"code\": \"AUTH_INVALID\",\n    \"message\": \"unauthorized\",\n    \"retryable\": false,\n    \"http\": {\n      \"status\": 401\n    }\n  }\n}\n```\n\n## Exit codes\n\n- `0`: success\n- `1`: execution or upstream failure\n- `2`: auth missing/invalid or user action required\n\n## Stable error codes\n\n- `AUTH_MISSING`\n- `AUTH_INVALID`\n- `NOT_FOUND`\n- `RATE_LIMITED`\n- `TIMEOUT`\n- `UPSTREAM_5XX`\n- `VALIDATION`\n- `CHECK_FAILED`\n- `UNKNOWN`\n\n## Auth precedence\n\n1. `ONELEET_APP_COOKIE` and `ONELEET_TENANT_ID`\n2. `~/.config/oneleet/config.json`\n\nThe CLI never accepts session cookies as command-line flags.\n\n`ONELEET_API_BASE_URL` is allowed only for the default Oneleet HTTPS API host\nfamily unless `ONELEET_ALLOW_UNSAFE_API_BASE_URL=1` is set for synthetic local\ntests. The CLI must not send a Oneleet session cookie to arbitrary hosts by\ndefault.\n\n[71 more lines in file. Use offset=61 to continue.]","type":"text"}]}

{"content":[{"text":"added 5 packages, and audited 6 packages in 697ms\n\nfound 0 vulnerabilities\n=== run report ===\n{\n  \"ok\": false,\n  \"blocked\": true,\n  \"reason\": \"No Oneleet session cookie available.\",\n  \"howToUnblock\": [\n    \"Log in to app.oneleet.com in Chrome started with --remote-debugging-port=9333\",\n    \"then: oneleet auth import-cdp --port 9333 --json\",\n    \"or export ONELEET_APP_COOKIE and ONELEET_TENANT_ID (never as CLI flags)\"\n  ]\n}\nEXIT=2\n","type":"text"}]}

{"content":[{"text":".dart_tool/\n\n# Oneleet session material — never commit\n.env\n*.cookie\noneleet-report.json\nREADME.md\nnode_modules\npackage-lock.json\npackage.json\nposture-report.mjs\n","type":"text"}]}