rebrand: declawed → leashed, Shield → Harness

Full rename across all source, tests, docs, examples, and config:
- Package: declawed → leashed
- API: createShield → createLeash, shield.yaml → leash.yaml,
  shield.task → leash.task, shield.kill → leash.yank
- Types: ShieldConfig → LeashConfig, ShieldResult → LeashResult,
  ShieldStatus → LeashStatus
- Files: .shield-session → .leash-session,
  shield-audit.jsonl → leash-audit.jsonl
- CLI: npx declawed → npx leashed
- README: new "AI got hands" branding with be-half puns
- Why This Exists: Behalf credibility angle (human delegation → agent)

All 61 tests pass. TypeScript compiles clean.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: dormstern

.github/ISSUE_TEMPLATE/bug_report.md

@@ -10,13 +10,13 @@ assignees: ''
 
 **What did you expect?**
 
-**Policy config (shield.yaml or inline)**
+**Policy config (leash.yaml or inline)**
 
 ```yaml
 
 ```
 
 **Environment**
 - Node version:
-- declawed version:
+- leashed version:
 - OS:

.gitignore

@@ -1,5 +1,5 @@
 node_modules/
 dist/
 *.jsonl
-.shield-session
+.leash-session
 .tmp-*

README.md

@@ -1,26 +1,26 @@
-# declawed
+# leashed
 
-> Your AI agent has your credentials. This gives it rules.
+> AI got hands. This is the leash.
 
-Policy, audit, kill switch for any AI agent with access to your accounts.
+Your agent gets be-half the access. The safe half. Policy, audit, kill switch for any AI agent with access to your accounts.
 
-[![npm version](https://img.shields.io/npm/v/declawed)](https://www.npmjs.com/package/declawed)
-[![license](https://img.shields.io/npm/l/declawed)](./LICENSE)
+[![npm version](https://img.shields.io/npm/v/leashed)](https://www.npmjs.com/package/leashed)
+[![license](https://img.shields.io/npm/l/leashed)](./LICENSE)
 [![tests](https://img.shields.io/badge/tests-67%20passing-brightgreen)](#)
 
-**[See the full showcase →](https://behalf-gray.vercel.app/shield/)**
+**[See the full showcase →](https://behalf-gray.vercel.app/harness/)**
 
-### OpenClaw sales bot — declawed
+### OpenClaw sales bot — leashed
 
 ![OpenClaw demo](docs/demos/openclaw-demo.gif)
 
-### Work assistant (Claude, Devin, etc.) — declawed
+### Work assistant (Claude, Devin, etc.) — leashed
 
 ![Work assistant demo](docs/demos/work-assistant-demo.gif)
 
 ## The Problem
 
-[42,000 live credentials leaked](https://www.wired.com/story/ai-agent-credential-leaks/) from AI agent workflows. The community's response? Buy a separate Mac Mini. **declawed replaces the Mac Mini** — software governance instead of hardware isolation.
+[42,000 live credentials leaked](https://www.wired.com/story/ai-agent-credential-leaks/) from AI agent workflows. The community's response? Buy a separate Mac Mini. **leashed replaces the Mac Mini** — software governance instead of hardware isolation.
 
 ## Quick Start
 
@@ -29,12 +29,12 @@ You need an [AnchorBrowser](https://anchorbrowser.io) API key: `export ANCHOR_AP
 ### 1. Install
 
 ```bash
-npm install declawed
+npm install leashed
 ```
 
 ### 2. Write a policy
 
-Create `shield.yaml`:
+Create `leash.yaml`:
 
 ```yaml
 agent: my-openclaw-sales-bot
@@ -57,28 +57,28 @@ max_actions: 50
 ### 3. Wrap your agent
 
 ```typescript
-import { createShield } from 'declawed'
+import { createLeash } from 'leashed'
 
-const shield = createShield('./shield.yaml')
+const leash = createLeash('./leash.yaml')
 
-const result = await shield.task('check linkedin inbox')
+const result = await leash.task('check linkedin inbox')
 // → { allowed: true, output: '...' }
 
-const result2 = await shield.task('export all contacts to CSV')
+const result2 = await leash.task('export all contacts to CSV')
 // → { allowed: false, reason: 'blocked by deny pattern: *export*' }
 ```
 
-That's it. Every `shield.task()` call is policy-checked, audited, and budgeted.
+That's it. Every `leash.task()` call is policy-checked, audited, and budgeted.
 
 ## Common Use Cases
 
-People give agents their passwords every day. Here's what they're afraid of — and how `declawed` fixes it.
+People give agents their passwords every day. Here's what they're afraid of — and how `leashed` fixes it.
 
 ### 1. LinkedIn Sales Agent (OpenClaw)
 
 **The fear:** Your bot has your LinkedIn password. It's supposed to read your inbox and check messages. But what if it starts mass-connecting, exporting contacts, or changing your profile?
 
-**With declawed:**
+**With leashed:**
 
 ```yaml
 agent: linkedin-sales-bot
@@ -105,7 +105,7 @@ Read inbox, check messages — allowed. Mass-connect, export contacts — blocke
 
 **The fear:** Your assistant has your Gmail. It reads your calendar and summarizes emails. But what if it deletes messages, forwards sensitive emails externally, or changes your billing settings?
 
-**With declawed:**
+**With leashed:**
 
 ```yaml
 agent: daily-briefing
@@ -132,7 +132,7 @@ Read calendar, list emails, summarize threads — allowed. Delete, forward, chan
 
 **The fear:** Your bot updates Salesforce records from your email threads. But what if it bulk-deletes contacts, exports your pipeline, or modifies deal values?
 
-**With declawed:**
+**With leashed:**
 
 ```yaml
 agent: crm-updater
@@ -159,9 +159,9 @@ Read records, update fields, search contacts — allowed. Bulk-delete, export pi
 
 ## AI got hands. We control the grip.
 
-Think of a crane operator. The brain decides what to move — but the joystick decides how far the arm can reach. **declawed is the joystick between the AI agent and your accounts.**
+Think of a crane operator. The brain decides what to move — but the joystick decides how far the arm can reach. **leashed is the joystick between the AI agent and your accounts.**
 
-### Without declawed
+### Without leashed
 
 ```mermaid
 flowchart LR
@@ -176,12 +176,12 @@ flowchart LR
 
 > **The agent IS you.** Full access. No limits. No off switch.
 
-### With declawed
+### With leashed
 
 ```mermaid
 flowchart LR
     A["🤖 AI Agent<br/><i>the brain</i>"]
-    S["🛡️ declawed<br/><i>the joystick</i>"]
+    S["🛡️ leashed<br/><i>the joystick</i>"]
     B["📧 Your Accounts<br/><i>LinkedIn, Gmail, CRM</i>"]
 
     A -- "requests action" --> S
@@ -200,7 +200,7 @@ flowchart LR
 | ❌ delete data | ❌ export contacts |
 | ⏱️ 60 min limit | 🔢 50 actions max |
 
-> *A crane operator doesn't carry the steel himself. He moves joysticks that control arms — limited to a work zone, every movement tracked, with an emergency stop within reach. That's what declawed does for AI agents.*
+> *A crane operator doesn't carry the steel himself. He moves joysticks that control arms — limited to a work zone, every movement tracked, with an emergency stop within reach. That's what leashed does for AI agents.*
 
 ### Three layers of protection
 
@@ -211,26 +211,30 @@ flowchart LR
 ## CLI
 
 ```bash
-npx declawed status   # Agent: my-openclaw-sales-bot | Allowed: 23 | Blocked: 3
-npx declawed audit    # Full audit trail
-npx declawed kill     # Kill switch — destroy session immediately
+npx leashed status   # Agent: my-openclaw-sales-bot | Allowed: 23 | Blocked: 3
+npx leashed audit    # Full audit trail
+npx leashed yank     # Kill switch — destroy session immediately
 ```
 
 [Full API reference & policy examples →](./docs/API.md)
 
 ## Empowered by AnchorBrowser
 
-declawed runs on [AnchorBrowser](https://anchorbrowser.io) — ephemeral, hardened cloud browser sessions purpose-built for AI agents. Each session is isolated, auto-expires, and leaves no trace. [Cloudflare](https://cloudflare.com) verified bot partner. SOC2 Type 2 and ISO27001 certified. Trusted by [Google](https://google.com), [Coinbase](https://coinbase.com), and [Composio](https://composio.dev). Stealth proxies, CAPTCHA solving, anti-fingerprinting, and full session isolation out of the box.
+leashed runs on [AnchorBrowser](https://anchorbrowser.io) — ephemeral, hardened cloud browser sessions purpose-built for AI agents. Each session is isolated, auto-expires, and leaves no trace. [Cloudflare](https://cloudflare.com) verified bot partner. SOC2 Type 2 and ISO27001 certified. Trusted by [Google](https://google.com), [Coinbase](https://coinbase.com), and [Composio](https://composio.dev). Stealth proxies, CAPTCHA solving, anti-fingerprinting, and full session isolation out of the box.
 
-AnchorBrowser handles the browser. declawed handles the rules.
+AnchorBrowser handles the browser. leashed handles the rules.
 
 [Get an API key →](https://anchorbrowser.io)
 
 ## Why This Exists
 
-AI agents are getting credential access with zero governance — 42,000 live credentials exposed, and the best workaround is buying separate hardware. `declawed` gives agents what they should have had from the start: **a policy file, an audit log, and a kill switch.**
+[Behalf](https://behalf-gray.vercel.app) already powers safe delegation for humans — scoped sessions, audit trails, and instant revocation for people who delegate work through their accounts. We built the trust infrastructure, battle-tested it, and realized: **agents need the exact same thing.**
 
-Built by [Behalf](https://behalf-gray.vercel.app) — delegation governance for the agent era.
+42,000 live credentials leaked from AI agent workflows. The community's best workaround is buying a separate Mac Mini. That's not security — that's surrender.
+
+So we open-sourced the engine. `leashed` gives agents what they should have had from the start: **a policy file, an audit log, and a kill switch.** The same trust model that protects human delegation — now available for every agent operator.
+
+Half the access. All the work done.
 
 ## License
 

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Reporting a Vulnerability
 
-If you discover a security vulnerability in `declawed`, **please do not file a public issue.**
+If you discover a security vulnerability in `leashed`, **please do not file a public issue.**
 
 Email: **dormstern@gmail.com**
 
@@ -15,13 +15,13 @@ We will acknowledge receipt within 48 hours and aim to release a fix within 7 da
 
 ## Scope
 
-`declawed` is responsible for:
+`leashed` is responsible for:
 - Policy evaluation (deny/allow pattern matching)
 - Audit log integrity (append-only JSONL)
 - Session lifecycle (create, kill, budget enforcement)
 - Input sanitization (Unicode bypass protection)
 
-`declawed` is **not** responsible for:
+`leashed` is **not** responsible for:
 - AnchorBrowser SDK security (report to [AnchorBrowser](https://anchorbrowser.io))
 - Semantic prompt injection (glob patterns are a coarse filter, not a semantic security boundary)
 - Credential storage (API keys are your responsibility)

agent-work.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Demo: a knowledge worker assistant — governed by declawed
+// Demo: a knowledge worker assistant — governed by leashed
 // Think Claude Computer Use, Devin, or any AI work assistant.
 
 import { loadPolicy, evaluatePolicy } from './dist/policy.js'
@@ -28,7 +28,7 @@ const tasks = [
   'share document with billing admin',
 ]
 
-console.log(`${BOLD}declawed${RESET} ${DIM}v0.1.0${RESET}`)
+console.log(`${BOLD}leashed${RESET} ${DIM}v0.1.0${RESET}`)
 console.log(`${DIM}agent: work-assistant | policy: deny-first | budget: 200 actions | expires: 8h${RESET}`)
 console.log()
 
@@ -47,4 +47,4 @@ for (const task of tasks) {
 }
 
 console.log()
-console.log(`${DIM}${allowed} allowed · ${blocked} blocked · audit: shield-audit.jsonl${RESET}`)
+console.log(`${DIM}${allowed} allowed · ${blocked} blocked · audit: leash-audit.jsonl${RESET}`)

agent.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Demo: an OpenClaw sales bot — governed by declawed
+// Demo: an OpenClaw sales bot — governed by leashed
 // This is what it looks like when your agent has rules.
 
 import { loadPolicy, evaluatePolicy } from './dist/policy.js'
@@ -28,7 +28,7 @@ const tasks = [
   'send bulk connection requests',
 ]
 
-console.log(`${BOLD}declawed${RESET} ${DIM}v0.1.0${RESET}`)
+console.log(`${BOLD}leashed${RESET} ${DIM}v0.1.0${RESET}`)
 console.log(`${DIM}agent: my-openclaw-sales-bot | policy: deny-first | budget: 50 actions | expires: 60min${RESET}`)
 console.log()
 
@@ -47,4 +47,4 @@ for (const task of tasks) {
 }
 
 console.log()
-console.log(`${DIM}${allowed} allowed · ${blocked} blocked · audit: shield-audit.jsonl${RESET}`)
+console.log(`${DIM}${allowed} allowed · ${blocked} blocked · audit: leash-audit.jsonl${RESET}`)