ai-cmd Guide

# ai-cmd intent resolution preview
ai-cmd query "check tor status" --dry-run --json

# ai-gateway policy/execution preview
ai-gateway run tor-switch --command tor-status --dry-run --json

# Requires valid online-auth state
ai-cmd query "what is my ip address" --json
ai-cmd feedback "check tor" --correct-command "tor-switch tor-status" --json

# Dry-run always works for planning
ai-gateway run health-control --command wipe-logs --dry-run --json

# Live execution requires explicit confirmation and policy approval
ai-gateway run health-control --command wipe-logs --confirm "I understand" --json

# Optional env prefix (single command)
KODACHI_PENTEST_MODE=true ai-gateway run health-control --command wipe-logs --confirm "I understand" --json

# Normal mode (no env)
ai-gateway run health-control --command wipe-logs --dry-run --json

# Skip gateway validation, dry run only
ai-cmd query "check tor status" --no-gateway --dry-run

# A live run with --no-gateway is rejected; run it through the gateway instead
ai-cmd query "test dns leak"

# Compare: with gateway (shows "Gateway validation passed")
ai-cmd query "check tor status" --dry-run

# Compare: without gateway (shows direct "[DRY RUN] Would execute:")
ai-cmd query "check tor status" --no-gateway --dry-run

# After sign-in: no model download or training needed
ai-cmd query "check network connectivity"
ai-cmd query "test for dns leaks"
ai-cmd query "show tor status"

# Show the matched intent and its confidence (fields sit under .data)
ai-cmd query "check network" --json | jq '.data.intent_id, .data.confidence'

# Restore the ONNX model (all-MiniLM-L6-v2) only if it is missing
sudo ai-trainer download-model

# Expected output:
# ✓ Downloading ONNX model: all-MiniLM-L6-v2.onnx
# ✓ Downloading tokenizer files
# ✓ Model saved to: models/

# Optional: build ai-trainer's own database (ai-cmd does not read it; see the ai-trainer guide)
sudo ai-trainer train --data ./data/training-data.json

# Expected output:
# ✓ Model training completed successfully
#   Embeddings created:    <n>
#   Vocabulary size:       <n>

# Now queries use semantic understanding
ai-cmd query "is my connection secure?" --engine onnx
ai-cmd query "rotate my tor identity" --engine onnx
ai-cmd query "am I leaking DNS queries?" --engine onnx

# Check which engine tiers are available
ai-cmd tiers

# Download a small GGUF model (recommended: 1-3B params for CPU)
# Place the .gguf file in the models/ directory
ai-cmd query "analyze my security posture" --engine mistral

# Ask the same model again, with a different prompt
ai-cmd query "explain tor routing" --engine mistral

# Adjust sampling for more creative responses
ai-cmd query "suggest security improvements" --engine mistral --temperature 0.8

# Check what model is loaded
ai-cmd model-info --json

# Install Ollama and pull a model
ollama pull gemma:2b
ollama serve

# Query using Ollama local model
ai-cmd query "run full security audit" --engine genai

# Use a specific Ollama model
ai-cmd query "check all services" --engine genai --model llama3:8b

# List available providers
ai-cmd providers --json

# Route the provider connection through Tor; prompt data still leaves the device
ai-cmd query "detailed threat analysis" --engine genai --model gpt-4o --tor-proxy

# Requires: OPENAI_API_KEY env var + Tor running

# AI automatically calls tools during reasoning
ai-cmd query "what's my tor status and dns config?"
# → AI calls tor_status, dns_status tools, synthesizes answer

# See available AI tools
ai-cmd tools --json

# Check which tiers are available
ai-cmd tiers --json

# Ask a question and get wrong command
ai-cmd query "check tor status"

# Output: ✓ tor-switch restart-tor (confidence: 0.85)
# Wrong! Should be "tor-switch tor-status"

# See what ai-cmd considered
ai-cmd preview "check tor status" --alternatives 5

# Expected output:
# 1. tor-switch restart-tor (0.85)
# 2. tor-switch tor-status (0.82) ← Correct one!
# 3. health-control net-check (0.71)
# 4. dns-switch status (0.65)
# 5. routing-switch status (0.61)

# Option A: Correct the intent (category)
ai-cmd feedback "check tor status" --correct-intent tor_status

# Option B: Correct the exact command
ai-cmd feedback "check tor status" --correct-command "tor-switch tor-status"

# Option C: Add a comment explaining why
ai-cmd feedback "check tor status" --correct-command "tor-switch tor-status" --comment "User meant status check, not restart"

# Fix similar queries to strengthen the pattern
ai-cmd feedback "is tor working" --correct-command "tor-switch tor-status"
ai-cmd feedback "tor connection check" --correct-intent tor_status
ai-cmd feedback "show tor state" --correct-command "tor-switch tor-status"

# Run a learning cycle: ai-learner copies your new corrections into data/kaics.db, then learns
sudo ai-learner learn

# Expected output:
# ai-cmd corrections: 6 imported now, 0 already imported (.../feedback/feedback.json)
# 6 feedback entries are waiting, a learning run needs at least 10 (lower the bar with --min-feedback)
# (ai-cmd also uses the corrections itself from its next query, see the ai-learner guide)

# Test the original query again
ai-cmd query "check tor status" --dry-run

# Expected output:
# ✓ tor-switch tor-status (confidence: 0.93)
# This is now the top match!

# Check what the learner can measure
sudo ai-learner analyze --period last-7-days

# Expected output: Kodachi does not record predictions for the learner yet,
# so there is no accuracy to show, and corrections alone do not measure it
# ✓ Accuracy Analysis
#
# Overall Accuracy: not measured (this release records no predictions, so accuracy is not measured; corrections alone do not measure it)
# Total Predictions: 0
# Correct Predictions: 0
#
# (confidence and F1 read "not measured" the same way; the last line counts
#  your corrections: ai-cmd corrections: 6 found, 6 imported, 0 waiting for the next learn)
#

# Always preview dangerous commands first
ai-cmd preview "enable panic mode" --alternatives 3

# Expected output:
# 1. health-control panic-hard (0.91)
# 2. health-control block-internet (0.84)
# 3. health-control mac-change-all (0.76)

# What each flag of a command does, before you run it (nothing is run)
ai-cmd explain --command "health-control wipe-file --file ~/.bash_history --json"

# Expected output (one line per flag, with where the meaning came from):
#   --file  health-control: Path to file to wipe [kodachi-help]
#   --json  health-control: Output in JSON format [kodachi-help]
# Nothing was run.

# Combined short flags of a Linux command come from its manual page
ai-cmd explain --command "ls -la /var/log"
#   -l  ls: use a long listing format [man]
#   -a  ls: do not ignore entries starting with . [man]

# The same table in JSON, under data.explanation
ai-cmd explain --command "ls -la /var/log" --json

# Require 95% confidence for destructive operations
ai-cmd query "enable panic mode" --threshold 0.95

# If confidence is below threshold:
# ⚠ health-control panic-hard (confidence: 0.91), below threshold 0.95
# Command not executed. Use --threshold 0.9 or lower to execute.

# If confidence meets threshold:
# ✓ health-control panic-hard (confidence: 0.96), executing

# See what WOULD execute without actually doing it
ai-cmd query "block all internet traffic" --dry-run

# Expected output:
# [DRY RUN] Would execute:
# Command: health-control block-internet
# Confidence: 0.94
# Effect: Blocks all network interfaces
# Reversible: Yes (health-control unblock-internet)

# More examples
ai-cmd query "wipe temporary data" --dry-run
ai-cmd query "randomize mac address" --dry-run
ai-cmd query "enable medium panic mode" --dry-run

# 1. Preview to see alternatives
ai-cmd preview "block internet" --alternatives 5

# 2. Dry-run to see exact effect
ai-cmd query "block internet" --dry-run

# 3. Execute with high threshold only after review
ai-cmd query "block all internet traffic" --threshold 0.95

# Verify voice support is available
ai-cmd voice --check-deps

# Expected output:
# Checking voice input dependencies...
# ✓ whisper-cpp: installed
# ✗ vosk: not installed
# ✓ microphone detected: device0 (Realtek Audio)
#
# To install missing dependencies:
# Install whisper.cpp (the whisper command) or Vosk from their upstream projects

# Install whisper.cpp (recommended): build it from its upstream project so the
# whisper command is on PATH (it is not in the Debian archive)

# Or install Vosk and an English model from the Vosk project
# (not in the Debian archive either)

# List available microphones
ai-cmd voice --list-devices

# Expected output:
# Available audio input devices:
# 0: Realtek Audio (default)
# 1: USB Microphone
# 2: Built-in Microphone

# Capture one voice command
ai-cmd voice

# Expected interaction:
# 🎤 Listening... (say your command)
# [You speak: "check network connectivity"]
# Recognized: "check network connectivity"
# ✓ health-control net-check (confidence: 0.89)
# [Command executes]

# Keep listening for multiple commands
ai-cmd voice --continuous

# Expected interaction:
# 🎤 Continuous listening mode (say "exit" to stop)
# [You speak: "check tor status"]
# ✓ tor-switch tor-status
# 🎤 Next command...
# [You speak: "rotate tor circuit"]
# ✓ tor-switch new-tor-circuit
# 🎤 Next command...
# [You speak: "exit"]
# Voice input terminated.

# Use specific speech recognition provider
ai-cmd voice --provider whisper-cpp --continuous

# Use vosk for faster recognition (less accurate)
ai-cmd voice --provider vosk --continuous

# Adjust timeout for slower speech
ai-cmd voice --timeout 10 --continuous

# Expected output:
# 🎤 Using provider: whisper-cpp
# 🎤 Timeout: 10 seconds
# 🎤 Listening...

# Use voice to act on ai-monitor suggestions
ai-cmd voice
# Speak: "show proactive suggestions"

# ai-monitor might suggest:
# → "DNS leak detected, run 'dns-switch fix-dns'"
# → "Tor circuit is stale, run 'tor-switch new-tor-circuit'"

# Then use voice to execute:
ai-cmd voice
# Speak: "fix dns leak"

# Get structured JSON instead of human-readable text
ai-cmd query "check tor status" --json

# Expected output:
{
  "status": "success", "command": "query", "data": { "query": "check tor status", "intent_id": "tor_status", "confidence": 0.94, "command": "tor-switch tor-status", "executed": true, "success": true, "exit_code": 0, "output": "..." }
}

# Extract specific fields
RESULT=$(ai-cmd query "check dns leaks" --json)
STATUS=$(echo "$RESULT" | jq -r '.data.success')
CONFIDENCE=$(echo "$RESULT" | jq -r '.data.confidence')

if [ "$STATUS" = "true" ] && (( $(echo "$CONFIDENCE > 0.85" | bc -l) )); then
  echo "DNS check completed with high confidence"
else
  echo "WARNING: DNS check uncertain or failed!"
  # Trigger automated response
  ai-cmd query "secure dns configuration" --threshold 0.8 --json
fi

#!/bin/bash
# security-monitor.sh - Automated AI-driven security checks

CHECKS=(
  "check network connectivity"
  "test dns leaks"
  "verify tor status"
  "check system integrity"
  "show security score"
)

RESULTS=()

for check in "${CHECKS[@]}"; do
  echo "Running: $check"
  RESULT=$(ai-cmd query "$check" --json)

  # Parse result
  SUCCESS=$(echo "$RESULT" | jq -r '.data.success')
  CONFIDENCE=$(echo "$RESULT" | jq -r '.data.confidence')

  # Store for analysis
  RESULTS+=("$RESULT")

  # Alert on failures
  if [ "$SUCCESS" != "true" ]; then
    echo "ALERT: $check failed!"
    # Send notification or trigger remediation
    ai-cmd query "enable network protection" --threshold 0.9 --json
  fi
done

# Generate report
echo "${RESULTS[@]}" | jq -s '.' > security-report.json
echo "Security scan complete. Report saved to security-report.json"

# Create file with queries (one per line)
cat > security-checks.txt <<EOF
check network connectivity
test for dns leaks
verify tor circuit is working
check vpn connection status
show current security score
EOF

# Process all queries and collect results
cat security-checks.txt | while read query; do
  ai-cmd query "$query" --json >> results.json
  sleep 1  # Rate limiting
done

# Analyze results
jq -s '[.[] | select(.data.success == false)]' results.json

# Add to crontab for automated checks
crontab -e

# Run security check every hour
0 * * * * /usr/local/bin/ai-cmd query "check system health" --json >> /var/log/kodachi/hourly-health.log

# Run comprehensive scan daily at 3 AM
0 3 * * * /opt/kodachi/scripts/security-monitor.sh

# Works immediately out of the box, no downloads needed
ai-cmd query "check network" --engine tfidf
ai-cmd query "test dns leaks" --engine tfidf
ai-cmd query "tor status" --engine tfidf

# Show the matched intent and its confidence
ai-cmd query "show tor circuits" --engine tfidf --json | jq '.data.intent_id, .data.confidence'

# Expected output:
# "<intent id>" and its confidence

# Download the ONNX model and tokenizer
sudo ai-trainer download-model

# Expected output:
# Downloading ONNX model: all-MiniLM-L6-v2.onnx
# ✓ Downloaded: models/all-MiniLM-L6-v2.onnx
# Downloading tokenizer files...
# ✓ Downloaded: vocab.txt (226 KB)
# ✓ Downloaded: tokenizer.json (466 KB)
# Model setup complete!

# Store models in a different location
sudo ai-trainer download-model --output-dir ./custom-models

# Expected output:
# Using custom output directory: ./custom-models
# ✓ Model saved to: ./custom-models/all-MiniLM-L6-v2.onnx

# Re-download if files are corrupted or incomplete
sudo ai-trainer download-model --force

# Expected output:
# ⚠ Existing model found. --force flag set, re-downloading...
# ✓ Model re-downloaded successfully

# Optional: build ai-trainer's own database (ai-cmd does not read it)
sudo ai-trainer train --data ./data/training-data.json

# Expected output:
# Loading training data from: ./data/training-data.json
# ✓ Model training completed successfully
# Training Results:
#   Embeddings created:    <n>
#   Vocabulary size:       <n>
#   Embedding dimension:   <n>
#   Training duration:     <n> ms

# Test semantic understanding
ai-cmd query "is my connection secure?" --engine onnx
ai-cmd query "rotate my tor identity" --engine onnx
ai-cmd query "am I leaking DNS queries?" --engine onnx

# Show the matched intent and its confidence
ai-cmd query "check network" --engine onnx --json | jq '.data.intent_id, .data.confidence'

# Expected output:
# "<intent id>" and its confidence

# Count the embeddings in ai-trainer's own database
ai-trainer status

# Expected output:
# ✓ Model Status
#   Total embeddings:      <n>

# Engine and model availability: ai-cmd tiers

# Create directory for GGUF models
mkdir -p ./models

# Option A: Download Qwen2.5-3B-Instruct (balanced; sudo ai-trainer download-model --llm fetches the Qwen3 default instead)
wget -O ./models/Qwen2.5-3B-Instruct-Q4_K_M.gguf \
  "https://huggingface.co/Qwen/Qwen2.5-3B-Instruct-GGUF/resolve/main/qwen2.5-3b-instruct-q4_k_m.gguf"

# Option B: Download Qwen2.5-1.5B-Instruct (small, fast)
wget -O ./models/Qwen2.5-1.5B-Instruct-Q4_K_M.gguf \
  "https://huggingface.co/Qwen/Qwen2.5-1.5B-Instruct-GGUF/resolve/main/qwen2.5-1.5b-instruct-q4_k_m.gguf"

# Option C: Download Phi-3.5-mini-instruct (large, advanced reasoning)
wget -O ./models/Phi-3.5-mini-instruct-Q4_K_M.gguf \
  "https://huggingface.co/microsoft/Phi-3.5-mini-instruct-gguf/resolve/main/Phi-3.5-mini-instruct-Q4_K_M.gguf"

# Verify download
ls -lh ./models/

# Test with Qwen2.5-3B-Instruct (--model-path works with --engine auto or mistral only)
ai-cmd query "what security measures should I enable?" --engine mistral --model-path models/Qwen2.5-3B-Instruct-Q4_K_M.gguf

# Expected output:
# [LLM Reasoning]
# Based on your query, I recommend enabling:
# 1. DNS leak protection (dns-switch fix-dns)
# 2. Tor routing (tor-switch start-tor)
# 3. Network monitoring (health-control net-check)
#
# ✓ Suggested command: dns-switch fix-dns
# Confidence: 0.88

# Use small model for faster inference
ai-cmd query "analyze network routing" --engine mistral --model-path models/Qwen2.5-1.5B-Instruct-Q4_K_M.gguf

# Use large model for complex reasoning
ai-cmd query "explain my current threat model" --engine mistral --model-path models/Phi-3.5-mini-instruct-Q4_K_M.gguf

# Interactive session with LLM
ai-cmd interactive --engine mistral --model-path models/Qwen2.5-3B-Instruct-Q4_K_M.gguf

# Visit https://claude.ai/code for installation instructions

# For Debian/Ubuntu (example):
curl -fsSL https://claude.ai/install.sh | bash

# Verify installation
claude --version

# Expected output:
# claude-cli 0.6.2

# Login to Claude (requires browser)
claude login

# Expected interaction:
# Opening browser for authentication...
# ✓ Successfully authenticated
# Session saved to: ~/.claude/session.json

# Use Claude for advanced reasoning
ai-cmd query "analyze my current threat model" --engine claude

# Expected output:
# [Claude Analysis]
# Based on your system configuration, your current threat model shows:
#
# Strengths:
# - Tor routing provides network anonymity
# - DNS leak protection is active
# - System integrity monitoring enabled
#
# Vulnerabilities:
# - VPN not configured (single-layer anonymity)
# - Browser fingerprinting not addressed
# - No encrypted DNS (DoH/DoT)
#
# ✓ Recommended command: dns-switch dnscrypt-set
# Confidence: 0.91

# Interactive mode with Claude
ai-cmd interactive --engine claude --threshold 0.7

# Check whether the Claude CLI tier is available
ai-cmd tiers

# Expected output:
# One row per tier with its availability; Claude Code shows as available once the claude CLI is installed

# Let ai-cmd automatically pick the best available engine
ai-cmd query "check tor status" --engine auto

# Auto mode priority order:
# 1. Try ONNX (if model downloaded)
# 2. Try Mistral.rs (if GGUF model exists)
# 3. Try GenAI/Ollama (if configured)
# 4. Try Legacy LLM (if configured)
# 5. Fallback to TF-IDF (always available)
# Note: Claude CLI requires explicit --engine claude (opt-in only, not in auto mode)

# Which tier auto would pick right now
ai-cmd model-info --json | jq '.data.best_tier'

# Expected output:
# "ONNX Classifier (intent fast path)" when the shipped classifier is present

# Start interactive mode with automatic engine selection
ai-cmd interactive

# Expected interaction:
# AI Command Interactive Mode
# Engine: auto (currently: onnx)
# Type 'help' for commands, 'exit' to quit
#
# ai-cmd> check network connectivity
# ✓ health-control net-check (confidence: 0.92)
# [Output: Network is active, no leaks detected]
#
# ai-cmd> rotate tor circuit
# ✓ tor-switch new-tor-circuit (confidence: 0.88)
# [Output: New Tor circuit established]
#
# ai-cmd> exit
# Goodbye!

# Use ONNX engine for consistent semantic matching
ai-cmd interactive --engine onnx

# Now you can use natural language freely:
# ai-cmd> is my internet working?
# ✓ health-control net-check (confidence: 0.89)
#
# ai-cmd> am I leaking DNS queries?
# ✓ dns-leak test (confidence: 0.94)
#
# ai-cmd> give me a new tor identity
# ✓ tor-switch new-tor-circuit (confidence: 0.91)

# Use local GGUF model for complex, multi-step queries
ai-cmd interactive --engine mistral --model-path models/Qwen2.5-3B-Instruct-Q4_K_M.gguf

# Expected interaction:
# AI Command Interactive Mode
# Engine: mistral (model: Qwen2.5-3B-Instruct-Q4_K_M.gguf)
# Loading model... ✓
#
# ai-cmd> what should I do to improve my security?
# [LLM Reasoning]
# To improve security, I recommend:
# 1. Enable Tor routing for anonymity
# 2. Configure DNS leak protection
# 3. Randomize MAC address
# 4. Enable system integrity monitoring
#
# ✓ Suggested: tor-switch start-tor (confidence: 0.87)
# Execute? [y/N]: y
#
# ai-cmd> explain why my DNS might be leaking
# [LLM Explanation]
# DNS leaks occur when queries bypass your VPN/Tor tunnel...
# Common causes: systemd-resolved, NetworkManager DNS, browser DNS-over-HTTPS
#
# ✓ Suggested: dns-leak test (confidence: 0.93)

# Use Claude for state-of-the-art analysis
ai-cmd interactive --engine claude --threshold 0.7

# Expected interaction:
# AI Command Interactive Mode
# Engine: claude (requires network)
#
# ai-cmd> analyze my threat model given I'm on public wifi
# [Claude Analysis]
# Public WiFi presents several threats:
# 1. Passive monitoring: ISP/network admin can see unencrypted traffic
# 2. Active MITM: Attacker could intercept connections
# 3. DNS hijacking: Malicious DNS responses
#
# Recommended protections:
# - Enable VPN + Tor (dual-layer anonymity)
# - Force encrypted DNS (DoH/DoT)
# - Disable IPv6 to prevent leaks
# - Randomize MAC address
#
# ✓ Suggested: routing-switch connect openvpn (confidence: 0.94)
# ✓ Suggested: dns-switch dnscrypt-set (confidence: 0.91)
#
# ai-cmd> what's the optimal tor+vpn configuration?
# [Claude Recommendation]
# The optimal configuration depends on your threat model:
#
# High anonymity (recommended for journalists/activists):
#   VPN → Tor → Internet
#   - Hides Tor usage from ISP
#   - VPN can't see destination
#
# Moderate anonymity (general privacy):
#   Tor → VPN → Internet
#   - VPN can't correlate entry/exit
#   - Bypasses Tor blocks
#
# ✓ Suggested: routing-switch connect tor (confidence: 0.88)

# Only execute commands when confidence is very high
ai-cmd interactive --threshold 0.9

# Expected interaction:
# AI Command Interactive Mode
# Engine: auto (threshold: 0.9)
#
# ai-cmd> block internet
# ⚠ health-control block-internet (confidence: 0.82), below threshold 0.9
# Command not executed. Did you mean:
# 1. health-control block-internet (0.82)
# 2. routing-switch disconnect (0.79)
# Execute anyway? [y/N]: n
#
# ai-cmd> block all internet traffic
# ✓ health-control block-internet (confidence: 0.95), executing
# [Output: All network interfaces blocked]

# Get AI-generated command suggestions
ai-cmd suggest

# Expected output:
# AI Command Suggestions:
# ┌──────────────────────────────────────────────────────┐
# │ 1. health-control net-check                          │
# │    Reason: Regular network security check            │
# │    Confidence: 0.87                                  │
# │                                                      │
# │ 2. tor-switch new-tor-circuit                           │
# │    Reason: Tor circuit age: 4h 23m (recommended: 1h)│
# │    Confidence: 0.92                                  │
# │                                                      │
# │ 3. dns-leak test                                     │
# │    Reason: Last DNS leak test: 8 hours ago          │
# │    Confidence: 0.85                                  │
# └──────────────────────────────────────────────────────┘

# Get proactive suggestions based on system state
ai-cmd suggest --proactive

# Expected output:
# Proactive AI Suggestions (analyzing system state...):
# ┌──────────────────────────────────────────────────────┐
# │ ⚠ URGENT                                             │
# │ 1. dns-switch fix-dns                                │
# │    Reason: DNS leak detected on interface wlan0      │
# │    Impact: Privacy compromise                        │
# │    Confidence: 0.96                                  │
# │                                                      │
# │ 🔔 RECOMMENDED                                       │
# │ 2. health-control mac-change-all                      │
# │    Reason: Connected to public WiFi                  │
# │    Impact: Prevent tracking                          │
# │    Confidence: 0.89                                  │
# │                                                      │
# │ 3. tor-switch new-tor-circuit                           │
# │    Reason: Current circuit through high-risk exit    │
# │    Impact: Improved anonymity                        │
# │    Confidence: 0.84                                  │
# │                                                      │
# │ ℹ MAINTENANCE                                        │
# │ 4. integrity-check check-all                           │
# │    Reason: Last integrity check: 3 days ago          │
# │    Impact: System validation                         │
# │    Confidence: 0.78                                  │
# └──────────────────────────────────────────────────────┘

# Get top 5 suggestions only
ai-cmd suggest --limit 5

# Get top 3 most urgent suggestions
ai-cmd suggest --proactive --limit 3

# Expected output:
# Top 3 AI Suggestions:
# 1. dns-switch fix-dns (0.96), DNS leak detected
# 2. health-control mac-change-all (0.89), Public WiFi detected
# 3. tor-switch new-tor-circuit (0.84), Stale Tor circuit

# Get suggestions in JSON format for scripting
ai-cmd suggest --proactive --limit 5 --json

# Expected output:
{
  "status": "success", "command": "suggest", "data": { "limit": 5, "count": 2, "suggestions": [
    {
      "id": "...", "title": "...", "query": "test for dns leaks", "category": "...", "reason": "...", "priority": "high", "impact": "...", "confidence": 0.96, "command_id": "...", "timestamp": "..."
    }, {
      "id": "...", "title": "...", "query": "...", "priority": "medium", "confidence": 0.89, "command_id": "..."
    }
  ] }
}

#!/bin/bash
# auto-suggest-execute.sh - Execute high-confidence suggestions

# Get proactive suggestions
SUGGESTIONS=$(ai-cmd suggest --proactive --json)

# Run high-priority suggestions with confidence above 0.9 through ai-cmd
echo "$SUGGESTIONS" | jq -r '.data.suggestions[] | select(.confidence > 0.9 and .priority == "high") | .query' | while read q; do
  echo "Auto-executing: $q"
  ai-cmd query "$q"
done

# ai-monitor detects issues, ai-cmd suggests fixes
# Terminal 1: Run monitoring
ai-monitor status --verbose

# Terminal 2: Check suggestions based on monitoring
ai-cmd suggest --proactive

# Expected workflow:
# ai-monitor detects: "DNS leak on wlan0"
# ai-cmd suggests: "dns-switch fix-dns" (confidence: 0.96)
# User executes: ai-cmd query "fix dns leak"

# Check network connectivity
ai-cmd query "check if my connection is secure"
ai-cmd query "is my internet working"
ai-cmd query "test network connectivity"

# Test for DNS leaks
ai-cmd query "test for dns leaks"
ai-cmd query "check if my dns is leaking"
ai-cmd query "verify dns privacy"

# Get IP address information
ai-cmd query "what is my current ip address"
ai-cmd query "show my public ip"
ai-cmd query "get ip geolocation"

sudo health-control net-check          # instead of "check connection"
dns-leak test                     # instead of "test dns leaks"
ip-fetch fetch                   # instead of "what is my ip"

# Start/stop Tor
ai-cmd query "start tor service"
ai-cmd query "stop tor"
ai-cmd query "restart tor daemon"

# Rotate Tor circuit
ai-cmd query "rotate my tor circuit"
ai-cmd query "get a new tor identity"
ai-cmd query "change tor exit node"

# Configure Tor exit country
ai-cmd query "change tor exit country to germany"
ai-cmd query "use swiss tor exit nodes"
ai-cmd query "route through netherlands tor"

# Check Tor status
ai-cmd query "check tor status"
ai-cmd query "is tor working"
ai-cmd query "show tor circuits"

sudo tor-switch start-tor                      # instead of "start tor"
sudo tor-switch new-tor-circuit                 # instead of "rotate circuit"
sudo tor-switch set-exit-node DE         # instead of "exit country germany"
tor-switch tor-status                  # instead of "check tor status"

# Enable panic mode (preview first!)
ai-cmd query "enable panic mode" --dry-run
ai-cmd query "activate medium panic mode" --dry-run
ai-cmd query "trigger hard panic" --dry-run

# Block internet traffic
ai-cmd query "block all internet traffic" --dry-run
ai-cmd query "disable all network interfaces" --dry-run
ai-cmd query "cut off internet connection" --dry-run

# MAC address randomization
ai-cmd query "randomize my mac address" --dry-run
ai-cmd query "change hardware address" --dry-run
ai-cmd query "spoof mac address" --dry-run

# Only execute after reviewing dry-run output
ai-cmd query "enable medium panic mode" --threshold 0.95

sudo health-control panic-medium     # instead of "medium panic mode"
sudo health-control block-internet               # instead of "block internet"
sudo health-control mac-change-all           # instead of "randomize mac"

# Check system health
ai-cmd query "check system health"
ai-cmd query "verify system status"
ai-cmd query "run health diagnostics"

# Get security score
ai-cmd query "show security score"
ai-cmd query "what is my security rating"
ai-cmd query "calculate system security"

# Verify system integrity
ai-cmd query "verify system integrity"
ai-cmd query "check for file modifications"
ai-cmd query "validate system files"

sudo health-control security-status            # instead of "check system health"
health-control security-score               # instead of "show security score"
sudo integrity-check check-all                 # instead of "verify integrity"

# Switch DNS servers
ai-cmd query "switch to cloudflare dns"
ai-cmd query "use google dns servers"
ai-cmd query "configure custom dns"

# Enable secure DNS
ai-cmd query "enable dns over https"
ai-cmd query "activate dnscrypt"
ai-cmd query "secure dns configuration"

# Check DNS status
ai-cmd query "show current dns servers"
ai-cmd query "check dns configuration"
ai-cmd query "get dns status"

sudo dns-switch switch --names cloudflare              # instead of "switch to cloudflare"
sudo dns-switch dnscrypt-set                  # instead of "enable dns over https"
dns-switch status                      # instead of "show dns servers"

# Enable VPN
ai-cmd query "enable vpn connection"
ai-cmd query "connect to vpn"
ai-cmd query "start vpn service"

# Check routing status
ai-cmd query "show current routing"
ai-cmd query "check vpn status"
ai-cmd query "display routing configuration"

# Switch routing modes
ai-cmd query "route through tor"
ai-cmd query "enable vpn routing"
ai-cmd query "use direct connection"

sudo routing-switch connect openvpn              # instead of "enable vpn"
sudo routing-switch status                  # instead of "show routing"
sudo routing-switch connect tor                 # instead of "route through tor"

# Check available AI tiers
ai-cmd tiers --json

# Expected output:
{
  "status": "success", "command": "tiers", "data": { "tiers": [
    {"tier": 1, "name": "TF-IDF", "engine": "tfidf", "available": true, ...}, {"tier": 2, "name": "ONNX Intent Classifier", "engine": "onnx-classifier", ...}, ... nine rows in all
  ] }
}

# Network status query (Network intent)
ai-cmd query "check network connectivity"
# Intent: Network (confidence: 0.92 ≥ 0.72)
# Route: FAST PATH → health-control net-check
# Time: 4ms

# Tor control query (Tor intent)
ai-cmd query "rotate my tor circuit"
# Intent: Tor (confidence: 0.89 ≥ 0.68)
# Route: FAST PATH → tor-switch new-tor-circuit
# Time: 3ms

# DNS query (Dns intent)
ai-cmd query "test for dns leaks"
# Intent: Dns (confidence: 0.94 ≥ 0.70)
# Route: FAST PATH → dns-leak test
# Time: 4ms

# Security query (Security intent)
ai-cmd query "show security score"
# Intent: Security (confidence: 0.88 ≥ 0.85)
# Route: FAST PATH → health-control security-score
# Time: 5ms

# System info query (System intent)
ai-cmd query "what is my ip address"
# Intent: System (confidence: 0.91 ≥ 0.65)
# Route: FAST PATH → ip-fetch fetch
# Time: 3ms

# View the classification details (fields sit under .data)
ai-cmd query "check network" --dry-run --json | jq '.data | {intent_id, confidence, command}'
# Expected output:
{
  "intent_id": "<intent id>", "confidence": 0.92, "command": "health-control net-check"
}

# Open question (Security intent, below its threshold)
ai-cmd query "what's the best way to secure my connection on public wifi?"
# Intent: Security (confidence: 0.65 < 0.85)
# Route: SLOW PATH → Mistral.rs analysis
# Time: 240ms
# Output: [Detailed explanation of VPN+Tor setup, MAC randomization, etc.]

# Ambiguous query (Unknown intent)
ai-cmd query "make my system safer"
# Intent: Unknown (confidence: 0.42 < 0.50)
# Route: SLOW PATH → Mistral.rs reasoning
# Time: 310ms
# Output: [AI suggests specific commands based on current system state]

# Complex threat analysis
ai-cmd query "analyze my current threat model and recommend improvements"
# Intent: Security (confidence: 0.71 < 0.85)
# Route: SLOW PATH → Mistral.rs deep analysis
# Time: 450ms
# Output: [Comprehensive threat assessment with actionable steps]

# View the classification details
ai-cmd query "explain tor routing" --dry-run --json | jq '.data | {intent_id, confidence, command}'
# Expected output:
{
  "intent_id": "<intent id>", "confidence": 0.65, "command": "<resolved command>"
}

# Vague emergency query (confidence too low)
ai-cmd query "block internet"
# Intent: Security (confidence: 0.82 < 0.85)
# Route: BLOCKED (below safety threshold)
# Output: below the 0.85 threshold, nothing is executed
# Suggestion: Be more specific, e.g., "block all internet traffic"

# Specific emergency query (confidence meets threshold)
ai-cmd query "block all internet traffic immediately"
# Intent: Security (confidence: 0.97 ≥ 0.85)
# Route: FAST PATH → health-control block-internet
# Time: 5ms
# Output: ✓ All network interfaces blocked

# Preview emergency commands before executing
ai-cmd preview "enable panic mode" --alternatives 3
# Shows top 3 panic mode options with confidence scores
# Allows review before execution

# Force execution with explicit threshold override
ai-cmd query "enable medium panic" --threshold 0.90
# Lowers threshold to 0.90 (only if you're sure!)

# Default (auto routing), let system decide
ai-cmd query "check tor status"
# Uses FAST PATH if ONNX classifier is confident

# Force FAST PATH (skip LLM reasoning)
ai-cmd query "check network" --engine onnx
# Always uses ONNX classifier, even for low-confidence queries

# Force SLOW PATH (deep reasoning)
ai-cmd query "check network" --engine mistral
# Bypasses ONNX classifier, goes straight to Mistral.rs

# Explicit Claude (opt-in only, NOT in auto mode)
ai-cmd query "analyze threat model" --engine claude
# Requires manual selection, never auto-selected

# Check the classification for any query
ai-cmd preview "your query here" --json | jq '.data'

# Check current AI policy
ai-cmd policy

# Expected output:
AI Policy (v1):
  Risk mode: safe
  Max tool steps: 5
  Signature: true
  Generated: <timestamp, once results/ai-policy.json exists>

Intent Thresholds:
  Kernel                    90%
  Firewall                  88%
  Encryption                88%
  Security                  85%
  Containers                82%
  ... (32 categories, highest first)
  Unknown                   50%

Tool Allowlist (13 tools):
  - tor_status
  - vpn_status
  - ip_info
  - dns_status
  - dns_leak_check
  - security_score
  - net_check
  - integrity_verify
  - permission_scan
  - system_info
  - auth_status
  - encryption_status
  - panic_recover


# View policy as JSON
ai-cmd policy --json > current-policy.json

# Write results/ai-policy.json after a learning cycle
sudo ai-learner learn --output-policy

# Expected output:
✓ Learning cycle completed successfully
  (statistics: feedback processed, intents updated, duration)
✓ AI policy file generated: "results/ai-policy.json"
  Signature: sha256:<first 16 hex>...<last 8 hex>
# With no feedback waiting (ai-cmd corrections included), learn prints "No feedback to process yet."
# and stops before writing the policy

# Verify policy integrity
ai-admin diagnostics --full

# Expected output:
Policy Integrity Check:
  ✓ File exists: results/ai-policy.json
  ✓ Valid JSON structure
  ✓ Signature verification: PASS
  ✓ Schema validation: PASS
  ✓ Threshold ranges: VALID (0.00-1.00)
  ✓ Tool allowlist: 9 binaries
  ✓ Risk mode: safe

# Test query against current policy
ai-cmd query "check network connectivity" --dry-run --json | jq '.data | {intent_id, confidence, command, destructive, requires_confirmation}'

# Expected output:
{
  "intent_id": "<intent id>", "confidence": 0.92, "command": "health-control net-check", "destructive": false, "requires_confirmation": false
}

# Test a high-risk query
ai-cmd query "enable panic mode" --dry-run --json | jq '.data | {intent_id, confidence, command, destructive, requires_confirmation}'

# Expected output:
{
  "intent_id": "<intent id>", "confidence": 0.88, "command": "<panic command>", "destructive": true, "requires_confirmation": true
}

# A hand edit breaks the SHA-256 digest; the policy loader warns and falls back to the default (safe) policy
ai-cmd policy
# There is no command that switches the risk mode; ai-cmd policy shows the active one

# Verify policy after manual edit
ai-admin diagnostics --full

# Query allowed by policy (confidence meets threshold)
ai-cmd query "check tor status"
# Intent: Tor (0.89 ≥ 0.68) → ALLOWED

# Query blocked by policy (confidence below threshold)
ai-cmd query "tor"
# Intent: Tor (0.62 < 0.68) → BLOCKED (too vague)
# Suggestion: Be more specific, e.g., "check tor status"

# High-risk action blocked by policy (safety threshold)
ai-cmd query "panic"
# Intent: Security (0.78 < 0.85) → BLOCKED
# Suggestion: Use explicit command, e.g., "enable medium panic mode"

# Override policy threshold (use carefully!)
ai-cmd query "panic" --threshold 0.75
# Executes despite policy threshold (manual override)

# Tool not in allowlist
ai-cmd query "run custom script"
# Intent: ServiceMgmt (0.87 ≥ 0.74) → BLOCKED
# Reason: "custom-script" not in tool allowlist

# Show the AI database: path, size, schema version, integrity, fragmentation
ai-admin db info

# Expected output:
(path, size, schema version, integrity and fragmentation of the database)

# Export policy for backup
cp results/ai-policy.json backups/ai-policy-$(date +%Y%m%d).json

# Restore policy from backup
sudo cp backups/ai-policy-20260209.json results/ai-policy.json
ai-admin diagnostics --full

# Restore the ONNX embeddings model (all-MiniLM-L6-v2) and tokenizer; the intent classifier ships pre-trained
sudo ai-trainer download-model

# Expected output:
(downloads all-MiniLM-L6-v2.onnx and tokenizer.json into models/)

# Download Mistral.rs LLM models (Tier 4, for SLOW PATH reasoning)
sudo ai-trainer download-model --llm default
# Downloads: Qwen3-1.7B-Q4_K_M (1.7B params, ~1.1 GB) Best balance for 4 GB systems

sudo ai-trainer download-model --llm small
# Downloads: Qwen3-1.7B-Q4_K_S (1.7B params, ~1.0 GB) Faster inference, smallest footprint

sudo ai-trainer download-model --llm large
# Downloads: Phi-3.5-mini-instruct (3.8B params, ~2.3 GB) 128K context, advanced reasoning

sudo ai-trainer download-model --llm xlarge
# Downloads: Qwen3-8B-Q4_K_M (8B params, ~4.8 GB) 8B class tuned for SPEED, needs 8+ GB RAM

sudo ai-trainer download-model --llm xlarge-hq
# Downloads: Qwen3-8B-Q5_K_M (8B params, ~5.6 GB) 8B class tuned for QUALITY, needs 16+ GB RAM
# Same Qwen3-8B weights as xlarge, higher-precision quantization, ~15% slower

# List all available models
sudo ai-trainer download-model --show-models

# Expected output:
Available Models:
────────────────────────────────────────────
ONNX Models (Tier 3):
  ✓ all-MiniLM-L6-v2            ~90 MB     Embeddings model (semantic search)

LLM Models (Tier 4):
  ○ Qwen3-1.7B-Q4_K_M.gguf       ~1.1 GB    default   (recommended, balanced)
  ○ Qwen3-1.7B-Q4_K_S.gguf       ~1.0 GB    small     (fastest tiny model)
  ○ Phi-3.5-mini-instruct.gguf   ~2.3 GB    large     (128K context)
  ○ Qwen3-8B-Q4_K_M.gguf         ~4.8 GB    xlarge    (8B SPEED, 8+ GB RAM)
  ○ Qwen3-8B-Q5_K_M.gguf         ~5.6 GB    xlarge-hq (8B QUALITY, 16+ GB RAM)

Use --llm [default|small|large|xlarge|xlarge-hq] to download

# Auto-detect and use best available model
ai-cmd query "check security status" --engine auto
# Auto-selects ONNX for FAST PATH or Mistral.rs for SLOW PATH

# Force the ONNX intent classifier (FAST PATH)
ai-cmd query "check tor status" --engine onnx-classifier
# Uses the shipped kodachi-intent-classifier.onnx

# Force Mistral.rs with default model (SLOW PATH)
ai-cmd query "explain threat model" --engine mistral
# Uses Qwen3-1.7B-Q4_K_M (if downloaded as `default`); if you downloaded xlarge-hq
# instead, the dashboard model selector will route to Qwen3-8B-Q5_K_M.

# Use specific GGUF model file
ai-cmd query "analyze network" --use Phi-3.5-mini-instruct-Q4_K_M.gguf
# Loads models/Phi-3.5-mini-instruct-Q4_K_M.gguf (--use takes a file name inside models/)

# Explain with the local LLM (ai-cmd prints the answer when it is complete; there is no --stream option)
ai-cmd query "explain tor routing" --engine mistral
# The answer is printed once it is complete

# Adjust LLM temperature for creativity
ai-cmd query "suggest security improvements" --engine mistral --temperature 0.8
# Higher temperature = more creative responses

# Count the embeddings in ai-trainer's own database
ai-trainer status

# Expected output:
✓ Model Status
  Total embeddings:      <n>

# Engine and model availability per tier
ai-cmd tiers
# Check specific model info
ai-cmd model-info --json

# Expected output:
{
  "status": "success", "command": "model-info", "data": {
    "embedder": "...", "best_tier": "ONNX Classifier (intent fast path)",
    "onnx": { "available": true, "model_dir": "models", "checksum_valid": true }, "gguf": { "available": true, "model_path": "models/Qwen3-1.7B-Q4_K_M.gguf", "mistral_tier": true, "llm_tier": false },
    "ollama": { "available": false }, "capabilities_summary": "..."
  }
}

# CPU-only systems / 4 GB RAM
sudo ai-trainer download-model                  # ONNX embeddings model
sudo ai-trainer download-model --llm small      # Qwen3-1.7B Q4_K_S (~1.0 GB)
ai-cmd query "check network" --engine auto      # Uses ONNX + small Qwen3

# 8 GB RAM systems (balanced)
sudo ai-trainer download-model                  # ONNX embeddings model
sudo ai-trainer download-model --llm default    # Qwen3-1.7B Q4_K_M (~1.1 GB)
ai-cmd query "analyze security" --engine auto   # Uses ONNX + default Qwen3

# 8-16 GB RAM systems, want better answers and willing to wait
sudo ai-trainer download-model                  # ONNX embeddings model
sudo ai-trainer download-model --llm xlarge     # Qwen3-8B Q4_K_M (~4.8 GB) SPEED-tuned 8B
ai-cmd query "threat analysis" --engine mistral # Uses 8B model, ~2-3 tokens/sec on CPU

# 16+ GB RAM systems (best local quality)
sudo ai-trainer download-model                  # ONNX embeddings model
sudo ai-trainer download-model --llm xlarge-hq  # Qwen3-8B Q5_K_M (~5.6 GB) QUALITY-tuned 8B
ai-cmd query "threat analysis" --engine mistral # Best local-LLM output, ~1.5-2 tokens/sec on CPU

# 32+ GB RAM systems with reasoning workloads
sudo ai-trainer download-model                  # ONNX embeddings model
sudo ai-trainer download-model --llm large      # Phi-3.5-mini (~2.3 GB), 128K context
ai-cmd query "long-context reasoning" --engine mistral

# Low storage / embedded systems
sudo ai-trainer download-model                  # ONNX only (~90 MB)
ai-cmd query "check tor" --engine onnx          # FAST PATH only

# Privacy-critical environments (no cloud)
sudo ai-trainer download-model                  # ONNX embeddings model
sudo ai-trainer download-model --llm default    # Qwen3-1.7B-Q4_K_M (or xlarge / xlarge-hq for stronger offline reasoning)
# Never use --engine claude or genai with cloud providers

# Expert analysis (opt-in cloud)
sudo ai-trainer download-model                  # ONNX embeddings model (the classifier ships pre-installed)
# Install Claude CLI separately
ai-cmd query "analyze threat model" --engine claude --tor-proxy
# Routes the connection through Tor; Claude still receives the prompt

# Force re-download if model is corrupted
sudo ai-trainer download-model --force
sudo ai-trainer download-model --llm default --force

# Verify model integrity
ai-admin diagnostics --full

# Expected output:
Model Integrity Check:
  ✓ ONNX model: Valid (SHA256 match)
  ✓ ONNX tokenizer: Valid
  ✓ Mistral model: Valid (GGUF header OK)
  ✓ Model files readable
  ✓ Disk space: 12.4 GB available

# Delete AI database records older than 30 days (it does not touch model files)
sudo ai-admin tune cleanup --days 30

# Backup current models
tar -czf models-backup-$(date +%Y%m%d).tar.gz /opt/kodachi/dashboard/hooks/models/