@jiffylabs/jiffy-cli

Apply curated Jiffy hardening-template bundles to a repo or a managed endpoint.

Each bundle is a pre-reviewed, tier-bounded configuration for an AI developer tool (Claude Code, Cursor, Amazon Q, Claude Desktop, …). The CLI materializes the bundle's files into your cwd via the Jiffy Config Policy Translator adapters, so the output is deterministic and byte-stable across runs.

Bundles ship embedded in the CLI for offline use on the stable release channel — no network calls required.

Install / run

# Zero-install one-shot:
pnpm dlx @jiffylabs/jiffy-cli list
pnpm dlx @jiffylabs/jiffy-cli apply soc2-claude-code

# Or add to a project:
pnpm add -D @jiffylabs/jiffy-cli

Requires Node.js >= 18.17.

Commands

jiffy list

Print the available bundles. The stable channel (default) returns the embedded seed set.

jiffy list
# Available hardening-template bundles:
#
#   soc2-claude-code@1.0.0  (published, tier 1–2)
#     SOC 2 Baseline — Claude Code
#   cursor-enterprise-restricted@1.0.0  (published, tier 1–2)
#     Cursor — Enterprise Restricted
#   amazonq-finance-regulated@0.9.0  (pending, tier 2–3)
#     Amazon Q — Finance Regulated
#   claude-desktop-locked-down@0.1.0  (draft, tier 1–2) [MDM]
#     Claude Desktop — Locked Down

Add --json for machine-readable output.

jiffy apply <bundle-slug>

Materialize the bundle's files into the current working directory. Files that already exist are skipped unless you pass --force.

cd ~/my-repo
jiffy apply soc2-claude-code
# jiffy: applied soc2-claude-code@1.0.0 — 2 file(s), 1834 bytes
#   WRITE .claude/settings.json (1234 bytes)
#   WRITE .claude/CLAUDE.md (600 bytes)

Flags:

MDM-only bundles (those where mdm_supported: true and no CPT adapter targets are declared) cannot be applied to cwd — use export-mdm instead.

jiffy export-mdm <bundle-slug>

Emit the bundle's Intune and Jamf MDM payloads as JSON. Only bundles flagged mdm_supported: true in their manifest are accepted.

jiffy export-mdm claude-desktop-locked-down --pretty
# { "intune": { ... }, "jamf": { ... } }

Flags:

jiffy export-agentgateway-bundle <bundle-slug>

Emit a complete agentgateway deployment YAML — Gateway + one or more HTTPRoutes + the Sprint 53 CEL Policy + the Jiffy guardrail Webhook — for bundles whose agentgateway_bundle manifest is set. Kept on the shared 0/1/2/3 exit-code map.

jiffy export-agentgateway-bundle soc2-claude-code
# ---
# apiVersion: gateway.networking.k8s.io/v1
# kind: Gateway
# metadata:
#   name: soc2-claude-code-gateway
# ...
# apiVersion: agentgateway.dev/v1alpha1
# kind: Policy
# ...
# apiVersion: agentgateway.dev/v1alpha1
# kind: Webhook
# spec:
#   url: https://trust.jiffylabs.app/v1/agentgateway/guardrail

The emitted YAML is byte-deterministic — running the command twice on the same bundle produces identical stdout. A snapshot test in packages/jiffy-cli/src/__tests__/export-agentgateway-bundle.test.ts guards this.

Flags:

Bundles without an agentgateway_bundle manifest (hypothetical legacy bundles) exit 1 with a clear bundle <slug> has no agentgateway variant message.

Related: docs/integrations/agentgateway.md — "Hardening bundle integration" section.

Bundle catalog (stable channel)

The embedded stable catalog ships four seed bundles:

Tier bounds refer to the Jiffy attestation tier range within which the bundle is considered appropriate; they are advisory, not enforced at apply time. Deploying a bundle onto an artifact whose attested tier later drifts outside the bundle's declared range emits an advisory hardening_template.tier_drift audit event from the Jiffy platform — the bundle itself is not mutated.

Auto-scan via Claude Code (Sprint W.8)

Register a PostToolUse hook so Jiffy scans every artifact the moment Claude Code writes it:

# global (all Claude Code projects on this machine)
jiffy hook install

# or per-project (commit with your team)
jiffy hook install --project

Idempotent. Preserves existing hook entries. Backs up prior settings.json on first install. Opt out per-shell with JIFFY_AUTO_SCAN=off. Full details + fail-soft invariants in docs/auto-scan-setup.md.

Release channels

The CLI honors the JIFFY_CLI_RELEASE_CHANNEL environment variable:

JIFFY_CLI_RELEASE_CHANNEL=stable jiffy list

MDM export schemas

Both MDM payloads share the Jiffy MDM schema URI https://jiffylabs.app/schemas/hardening-template-mdm/v1.

Microsoft Intune — DeviceConfigurationProfile

Each settings[] entry:

Jamf — ConfigurationProfile

Each scripts[] entry:

Each settings[] entry:

Example (claude-desktop-locked-down)

{
  "intune": {
    "$schema": "https://jiffylabs.app/schemas/hardening-template-mdm/v1",
    "displayName": "Jiffy · Claude Desktop — Locked Down",
    "platforms": "macOS",
    "roleScopeTagIds": ["0"],
    "settings": [
      { "name": "com.anthropic.ClaudeDesktop.UpdateChannel",
        "value": "enterprise", "type": "string" },
      { "name": "com.anthropic.ClaudeDesktop.ClipboardHistoryEnabled",
        "value": false, "type": "boolean" },
      { "name": "com.anthropic.ClaudeDesktop.RequireApprovalForShellExec",
        "value": true, "type": "boolean" }
    ]
  },
  "jamf": {
    "$schema": "https://jiffylabs.app/schemas/hardening-template-mdm/v1",
    "general": {
      "name": "Jiffy · Claude Desktop — Locked Down",
      "category": "Security & Compliance",
      "distribution_method": "install_automatically"
    },
    "scripts": [ { "name": "jiffy-install-shell-exec-gate.sh", "priority": "after", "script_contents": "..." } ],
    "settings": [
      { "key": "ClipboardHistoryEnabled", "value": false, "scope": "user" },
      { "key": "UpdateChannel", "value": "enterprise", "scope": "machine" }
    ]
  }
}

Exit codes

Programmatic use

The package also exports its primitives so you can apply bundles from a Node script without spawning the CLI:

import {
  findBundle,
  emitBundleFiles,
  applyCommand,
  SEED_BUNDLES,
} from '@jiffylabs/jiffy-cli';

const bundle = findBundle('soc2-claude-code');
if (!bundle) throw new Error('bundle not found');

const files = emitBundleFiles(bundle);
for (const f of files) {
  console.log(`${f.path} (${f.bytes} bytes)`);
}

License

Apache-2.0. Copyright Jiffy Labs.