usage: riposte [-h] [--version] [--no-color] [-v]
               [--log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}]
               <command> ...

Continuous AI purple-team platform. Authorized use only.
Run with no command on a terminal to launch the full-screen chat-primary TUI (it degrades to the chat REPL when textual is absent); non-interactively it prints this help. Run `riposte chat` for the lightweight Rich REPL instead.

positional arguments:
  <command>
    scope               manage and check the rules-of-engagement file
    scan                run an end-to-end scoped scan (recon -> web -> detections)
    engage              run a bounded, scoped autonomous engagement loop (model proposes, the
                        ScopeGate disposes); default-safe offline replay provider
    baseline            manage approved-baseline snapshots (coverage drift over time)
    daemon              run scans continuously on a schedule
    detections          list/inspect verified detection rules from a run
    findings            list a run's saved findings (severity, title, target/location,
                        wstg/technique id, honest confirmation tier, validated state); read-only,
                        offline
    report              export a compliance crosswalk (WSTG/ATT&CK -> NIST controls)
    runs                manage run outputs (list/show run history, prune old artifacts)
    engagements         list the distinct engagements in a run output dir (run count + latest run
                        id/timestamp)
    audit               verify or inspect the keyed audit log
    chat                interactive chat REPL (the model proposes, you approve)
    tui                 full-screen chat-primary TUI (the model proposes, you approve); needs the
                        'tui' extra and degrades to the chat REPL when not viable (non-TTY /
                        textual absent)
    connect             connect your AI account or key (first-run wizard)
    init                scaffold an optional config profile so you set RIPOSTE_* options once
                        instead of exporting many env vars (non-secret config only)
    onboard             guided first-run setup (check the AI connection, scaffold a config
                        profile, point you at `riposte demo` and the next steps). Interactive
                        only; a clean no-op when run non-interactively.
    doctor              check the environment before a scan: Docker, sandbox image, provider,
                        audit, asset paths (offline-safe)
    preflight           run the full SAFETY preflight (hard env checks + the adversarial smoke
                        suite) and, on PASS, write a tamper-evident pass-attestation into the
                        riposte config dir (set RIPOSTE_CONFIG_DIR to relocate); high-tier
                        (active, above-POC) engagements are blocked until this passes
    demo                run a fully offline canned demonstration (no target, API key, Docker, or
                        network) and write a real run output dir
    eval                run an eval harness (red/blue/purple/live-llm) over a JSON input file
    skill               run a named SKILL: a declarative ordered tool-chain macro (e.g. web-recon
                        = subfinder->dnsx->httpx->katana->nuclei) in one command
    plan                plan a tool DAG without running anything: print the producer->consumer
                        order, concurrency levels, and per-tool cost + autonomy tier
    tools               inspect the tool arsenal (read-only): provenance/SBOM with
                        unmaintained/unknown/stale flagging
    sandbox             get/inspect the Docker sandbox image the tool arsenal runs in
                        (build/status/pull); never auto-run by scan/engage

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  --no-color            disable colored output (sets NO_COLOR before any console is built); honors
                        the existing NO_COLOR convention

logging:
  -v, --verbose         increase log verbosity: -v=INFO, -vv=DEBUG (default: WARNING)
  --log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}
                        set the log level explicitly (overrides -v and RIPOSTE_LOG_LEVEL; default
                        WARNING)

Examples:
  riposte                      # launch the full-screen chat-primary TUI (on a TTY)
  riposte chat                 # launch the lightweight chat REPL instead
  riposte connect              # first-run wizard: connect your AI account/key
  riposte scan --roe roe.yaml  # end-to-end scoped scan (recon -> web -> detections)
  riposte scan --roe roe.yaml --preflight   # hard env check first (see `riposte doctor`)
  riposte daemon --roe roe.yaml --interval 3600   # continuous scheduled scans
  riposte chat --help-commands # print the in-chat slash-commands without starting a session

Inside chat, slash-commands are the deterministic backbone (they work with no model):
  /scan  /scope  /scope-add  /scope-remove  /scope-list  /findings  /detections  /connect  /help  /exit
Type /help in a chat session for the full list.

Run only against systems you own or are authorized to test. See RESPONSIBLE_USE.md.
Exit codes (A102): 0 = ok / no findings; 1 = an actionable negative (a finding, a tampered audit, an out-of-scope target, a missing run/report); 2 = usage or config error (bad flags, malformed ROE, missing file); 3 = AI connection not configured; 4 = unexpected internal error; 130 = interrupted (Ctrl-C). Set RIPOSTE_DEBUG=1 to print a traceback on an internal error.
