drbaher CLI suite — changelog

contract-ops-agent — a ready-made, enclosed agent for the whole suite

Wed, 15 Jul 2026 00:00:00 GMT

New: contract-ops-agent, a terminal agent whose only tools are the contract-ops suite — no shell, no filesystem, no signing, by construction. Bring your own model (Claude, OpenAI, or any OpenAI-compatible endpoint). Beyond wiring the MCP server into your own agent, you can now run the ready-made enclosed one.

sign-cli v0.9 — consent & attribution layer (intent, consent, and identity assurance in the audit chain)

Mon, 13 Jul 2026 00:00:00 GMT

sign-cli now captures the evidence e-signature disputes actually turn on — intent, consent, and attribution — directly in its tamper-evident audit chain. Opt in per request: --require-consent gates signing on a recorded intent-to-sign attestation plus an electronic-records (ESIGN) disclosure; --require-email-verification gates it on proof of mailbox control. A third command records how you verified a signer's identity out-of-band. No accounts, no KYC forms, no identity documents stored — by design.

sign-cli v0.7 — verification is now cryptographic (and a security hardening pass)

Wed, 03 Jun 2026 00:00:00 GMT

A security release with breaking behavior. PDF signature verification now checks the PKCS#7 signature value against the signer certificate's public key (RSA/ECDSA), not just the /ByteRange digest — so forged or tampered signatures that previously reported ok now correctly fail. Plus the MCP server binds to loopback by default, profile secrets are auth-gated, the default provider is now the offline local PAdES signer, and 0.7.1 ships standalone binaries for macOS/Linux/Windows.

contract-ops-mcp — one MCP server for the whole suite

Sat, 23 May 2026 00:00:00 GMT

A single MCP (stdio) server that exposes all nine CLIs as agent tools — connect once and an agent can extract, draft, lint, compare, convert, review, and query the vaults. Curated typed tools plus catalog/run escape hatches, discovery-driven off each CLI's --catalog json. Signing stays human-gated.

template-vault-cli v0.5 — agent discovery + a local-first hardening pass

Sat, 23 May 2026 00:00:00 GMT

0.5.0 published the suite-wide `--catalog json` discovery contract; 0.5.1 is a security pass that hardens the vault for living on your machine — path containment (no `../` escape), http/https-only URLs (no file:// reads, no cleartext keys), owner-only 0700/0600 permissions, plus pinned actions, PEP 740 build attestations, and CodeQL/Bandit in CI.

contract-lint-cli joins the suite — a pre-signature quality gate

Fri, 22 May 2026 00:00:00 GMT

The ninth CLI: a deterministic linter for a contract's internal consistency — leftover placeholders, broken cross-references, undefined/unused defined terms, numbering gaps, party-name and date inconsistencies — with CI-gateable exit codes. Where compare-cli gates drift between versions, contract-lint gates defects within one document.

contract-vault-cli v0.2 → v0.4 — obligation lifecycle, recurring obligations, reminders

Fri, 22 May 2026 00:00:00 GMT

contract-vault grew from a register into a full obligation tracker: an obligation lifecycle (done/waived/owner), recurring obligations, per-obligation and corpus-wide reminders with a cron/agent-friendly `remind` digest, status-aware due/obligations, and adoption hardening (validated against the real extract-cli, Windows-safe .ics).

Site — contract-vault-cli joins the suite as the eighth CLI

Fri, 22 May 2026 00:00:00 GMT

contract-vault-cli is now the post-signature management layer — register signed contracts, then surface renewals, notice deadlines, and obligations — taking the suite from seven CLIs to eight. New tool page, an eight-card homepage grid, an eight-box workflow diagram + a 'Step 8 — Manage' walkthrough, an eighth playground explorer tab, and install/tour/play/og/llms all bumped to the eight-CLI narrative.

Site — extract-cli joins the suite as the seventh CLI

Fri, 22 May 2026 00:00:00 GMT

extract-cli is now the open-loop front door of the suite — ingest any contract (.md/.txt/.html/.docx/.pdf, yours or a counterparty's) into structured JSON, taking the suite from six CLIs to seven. New tool page, a seven-card homepage grid, a seven-box workflow diagram + a 'Step 0 — Ingest' walkthrough, a seventh playground tab, and install/tour/play/principles/use-cases/404/og/llms all bumped to the seven-CLI narrative.

Suite — interactive playgrounds, uniform discovery, and a polish pass

Wed, 20 May 2026 00:00:00 GMT

Run all six CLIs in the browser on the new /play page (four in a shared sandbox plus the nda-review and sign hosted demos); every CLI now answers `--catalog json` with one uniform shape; a friendly first run on every tool; the suite name standardized to contract-ops everywhere; plus a 5-minute tour and a recipes page.

Site — template-vault-cli joins the suite as the sixth CLI

Wed, 20 May 2026 00:00:00 GMT

template-vault-cli is now the Git-backed, clause-aware storage layer at the start of the pipeline, taking the suite from five CLIs to six. New tool page, six-card homepage grid, a six-box workflow diagram (one per CLI) + a 'Store & version' walkthrough step, and install/principles/use-cases/compare/404/og/llms all bumped to the six-CLI narrative.

Suite — uniform demos, stdin piping, and one shared LLM config

Wed, 20 May 2026 00:00:00 GMT

A consistency pass across the six CLIs: a zero-config `demo` on every tool (added to docx2pdf + nda-review), stdin (`-`) piping so the full pipeline composes end to end, draft-cli reading the suite-shared ~/.config/contract-ops/llm.json, and an honest per-CLI exit-code matrix on the site. Changes are on each repo's main, landing in their next releases.

template-vault-cli v0.4.8 — cross-CLI interop: schemas, INTEROP doc, shared LLM config

Tue, 19 May 2026 00:00:00 GMT

Ships the suite's storage contract: six JSON Schemas under docs/spec/ for the data template-vault produces, a docs/INTEROP.md citation point, and a suite-wide LLM-config lookup at ~/.config/contract-ops/llm.json shared with nda-review-cli.

compare-cli v0.3.0 — surface .docx track-changes metadata

Mon, 18 May 2026 00:00:00 GMT

Parses WordprocessingML track-changes ( / ) from .docx inputs and surfaces them in --json output as base.track_changes / candidate.track_changes. Informational only — track-changes presence does NOT change the exit-code classification; the text diff remains the source of truth.

Site — compare-cli joins the suite as the fifth CLI

Mon, 18 May 2026 00:00:00 GMT

compare-cli is now the pre-signature gate in the contract pipeline. New tool page and registry entry; homepage hero / workflow diagram / ToolCard grid scoped to a follow-up to keep this change minimal.

draft-cli v0.9.0 — smart run-merge for cross-run .docx placeholders

Sun, 17 May 2026 00:00:00 GMT

Real-world Word documents (notably Common Paper templates) split bracketed placeholders across multiple runs. v0.2.0 skipped these; v0.9.0 merges them by default, with --strict-runs as the opt-out.

Site — draft-cli joins the suite as the fourth CLI

Sun, 17 May 2026 00:00:00 GMT

draft-cli is now the templated drafting step at the start of the contract pipeline. New tool page, four-card homepage grid, updated workflow diagram + walkthrough, install/principles/use-cases/compare/404/og/llms all updated to the four-CLI narrative.

docx2pdf-cli v0.2.2 — `--catalog json`, agent-doc reorg, telemetry shipped

Fri, 15 May 2026 00:00:00 GMT

Ships the `--retries` flag and `--json` success telemetry (outputBytes, durationMs, exitCode in failure rows) as v0.2.2 alongside the doc reorg. Adds `--catalog json` for cross-suite agent discovery.

nda-review-cli v0.5.1 — `--catalog json`, `sample-nda`, `doctor --check-llm`, doc reorg

Fri, 15 May 2026 00:00:00 GMT

Adds --catalog json for cross-suite agent discovery, sample-nda for first-run users, doctor --check-llm for LLM-provider reachability, --help epilogs on the four user-facing subcommands. Ships the shared three-CLI-suite doc shape (AGENTS.md + docs/setup/ + docs/reference/).

sign-cli v0.6.1 — `pdf inspect` for ANY signed PDF + pre-sign visibility + verify `--recipient`

Fri, 15 May 2026 00:00:00 GMT

Inspect PADES signatures on any signed PDF — yours, Adobe's, DocuSign's, Dropbox Sign's, SignWell's. Per-signer existing-signature visibility on fetch-document. --recipient filter on verify-signed-pdf. RFC 4514 cert-subject matching fix.

sign-cli v0.6 — cross-surface parity, profiles, path-traversal guards

Thu, 14 May 2026 00:00:00 GMT

Every CLI command that has any of MCP / HTTP / both now has them all (19 MCP tools, 20 HTTP routes). Named profiles bundle provider + credentials with shell-managed secrets. Security-grade path-traversal guards on every input and output flag.

Site v0.3 — search, OG images, comparison page, embedded demo

Sun, 10 May 2026 00:00:00 GMT

Pagefind search with cmd+K, real generated OG images, side-by-side comparison page, and an embedded sandbox on the nda-review-cli page. Live version badges fetched from npm/PyPI at build time.

Site v0.2 — dark mode, asciinema demos, animated workflow

Sat, 09 May 2026 00:00:00 GMT

Major UX upgrade: dark mode, terminal-recording demos on every tool page, animated workflow diagram, copy-to-clipboard everywhere, install-method tabs, and a brand OG image.

sign-cli v0.5 — agent-as-signer, MCP stdio server, structured errors, cryptographic receipts

Thu, 07 May 2026 00:00:00 GMT

A large discoverability + agent-as-signer release. The MCP stdio server lands (8 tools over JSON-RPC) with per-signer token guardrails. Structured error envelopes, declarative signer policy, cryptographic receipts with detached signatures, and shell completion.

docx2pdf-cli v0.2 — agent-first framing, capabilities flag, smarter doctor

Tue, 05 May 2026 00:00:00 GMT

Agent affordances are now first-class: --capabilities for machine-readable feature flags, AGENTS.md for default routing, JSON schemas under schemas/, and a --doctor probe that emits enriched JSON with per-host install commands.

nda-review-cli v0.5 — fatigue concession, web demo, profile learning

Tue, 05 May 2026 00:00:00 GMT

Two-party negotiation now breaks deadlocks deterministically with fatigue concession. Counterparty profiles can be learned from past reviews. Sandboxed web demo bundled in /web.

sign-cli v0.4 — offline PAdES signer, RFC 3161 anchors, SignWell + embedded signing

Wed, 22 Apr 2026 00:00:00 GMT

The release that made sign-cli work without a third-party provider. Built-in PAdES signer (PKCS#7 in /ByteRange, self-issued cert) produces real cryptographically verifiable signed PDFs offline. RFC 3161 timestamping anchors the audit chain to an external TSA. SignWell joins Dropbox Sign + DocuSign; embedded-signing flows land for all three.