@agentguard-run/burn 0.1.0 → 0.2.0

package/dist/src/adapters/raw-api.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Raw orchestrator middleware.
+ *
+ * The strongest position of the adapter shapes, because the orchestrator
+ * knows things no host exposes: stable spawn IDs, the parent of each child,
+ * and the request before it leaves the process. That is why this adapter is
+ * the one that makes the full "40 spawns, depth 2, 5B tokens" claim true for
+ * an open-weights agent. A proxy alone sees tokens and no tree; a hook alone
+ * sees the tree and no tokens; this sees both.
+ *
+ *   const burn = createRawApiGuard({ sessionId: 'nightly-refactor-17' });
+ *
+ *   const spawn = burn.beforeSpawn({ parentDepth: 0 });
+ *   spawn.throwIfBlocked();
+ *   spawn.started();
+ *   try { await worker() } finally { spawn.finished() }
+ *
+ *   const call = burn.beforeCall({ estimatedTokens: 120_000 });
+ *   call.throwIfBlocked();
+ *   try {
+ *     const res = await client.chat({ ..., headers: call.headers });
+ *     call.complete({ tokens: res.usage.total_tokens });
+ *   } catch (e) { call.fail(); throw e }
+ *
+ * A model call reserves an estimate and then commits the real number under
+ * the same call ID, so a proxy observing the same request (via call.headers)
+ * supersedes rather than duplicates it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BurnStopError = void 0;
+exports.createRawApiGuard = createRawApiGuard;
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const events_1 = require("../events");
+const gateway_1 = require("../gateway");
+const render_1 = require("../replay/render");
+class BurnStopError extends Error {
+    decision;
+    constructor(decision) {
+        super((0, render_1.renderStop)(decision.report, { colour: false, subject: decision.action === 'spawn' ? 'spawn' : 'call' }));
+        this.decision = decision;
+        this.name = 'BurnStopError';
+    }
+}
+exports.BurnStopError = BurnStopError;
+const HOST = 'raw-api';
+function createRawApiGuard(opts) {
+    const home = opts.home ?? process.env.AGENTGUARD_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.agentguard');
+    const gateway = new gateway_1.Gateway(home, { sign: opts.sign, now: opts.now });
+    const now = opts.now ?? (() => Date.now());
+    const { sessionId } = opts;
+    gateway.observe([
+        { schemaVersion: 1, kind: 'session_opened', eventId: (0, events_1.eventId)(), host: HOST, sessionId, at: now(), capabilities: { spawns: 'authoritative', depth: 'authoritative', usage: 'authoritative' } },
+    ]);
+    return {
+        sessionId,
+        gateway,
+        beforeSpawn(args = { parentDepth: 0 }) {
+            const spawnId = args.spawnId ?? (0, events_1.eventId)();
+            const depth = args.parentDepth + 1;
+            const decision = gateway.beforeSpawn({
+                schemaVersion: 1,
+                kind: 'spawn_requested',
+                eventId: (0, events_1.eventId)(),
+                host: HOST,
+                sessionId,
+                at: now(),
+                spawnId,
+                proposedDepth: depth,
+                attribution: 'high',
+            });
+            return {
+                spawnId,
+                depth,
+                decision,
+                get blocked() {
+                    return decision.blocked;
+                },
+                throwIfBlocked() {
+                    if (decision.blocked)
+                        throw new BurnStopError(decision);
+                },
+                started() {
+                    gateway.observe([{ schemaVersion: 1, kind: 'spawn_started', eventId: (0, events_1.eventId)(), host: HOST, sessionId, at: now(), spawnId, depth }]);
+                },
+                finished() {
+                    gateway.observe([{ schemaVersion: 1, kind: 'spawn_finished', eventId: (0, events_1.eventId)(), host: HOST, sessionId, at: now(), spawnId }]);
+                },
+            };
+        },
+        beforeCall(args = {}) {
+            const callId = args.callId ?? (0, events_1.eventId)();
+            const decision = gateway.beforeCall({
+                schemaVersion: 1,
+                kind: 'call_requested',
+                eventId: (0, events_1.eventId)(),
+                host: HOST,
+                sessionId,
+                at: now(),
+                callId,
+                estimatedTokens: Math.max(0, args.estimatedTokens ?? 0),
+                attribution: 'high',
+            });
+            return {
+                callId,
+                decision,
+                /** Attach to the outbound request so a local proxy correlates it. */
+                headers: { [events_1.SESSION_HEADER]: sessionId, [events_1.CALL_HEADER]: callId },
+                get blocked() {
+                    return decision.blocked;
+                },
+                throwIfBlocked() {
+                    if (decision.blocked)
+                        throw new BurnStopError(decision);
+                },
+                complete(usage) {
+                    gateway.completeCall({ host: HOST, sessionId, callId, tokens: usage.tokens, cacheRead: usage.cacheRead, usageCoverage: 'authoritative', at: now() });
+                },
+                fail() {
+                    gateway.failCall({ host: HOST, sessionId, callId, at: now() });
+                },
+            };
+        },
+        /** Current state without deciding anything. */
+        status() {
+            return gateway.peek(sessionId);
+        },
+    };
+}

package/dist/src/cli.d.ts

@@ -4,11 +4,15 @@
  *
  *   replay            what enforcement would have stopped, on your history
  *   calibrate         fit thresholds to your own usage, write shadow policy
- *   status            current mode, shadow decisions, promotion eligibility
- *   init              install the PreToolUse hook (shadow mode)
+ *   status            mode, shadow decisions, eligibility, every host's sessions
+ *   init [host]       hook snippet for claude (default), cursor or codex
  *   enforce           promote shadow -> enforce, once eligible
  *   shadow            demote back to shadow
  *   resume --once     one audited override of the next STOP
- *   hook              (internal) stdin -> stdout hook entry point
+ *   proxy             loopback proxy in front of Ollama / vLLM / LM Studio
+ *   conformance       prove the storm and the grind stop identically per host
+ *   hook              (internal) Claude Code stdin -> stdout hook entry point
+ *   cursor-hook       (internal) Cursor hook entry point
+ *   codex-hook        (internal) Codex hook entry point
  */
 export {};

package/dist/src/cli.js

@@ -5,23 +5,43 @@
  *
  *   replay            what enforcement would have stopped, on your history
  *   calibrate         fit thresholds to your own usage, write shadow policy
- *   status            current mode, shadow decisions, promotion eligibility
- *   init              install the PreToolUse hook (shadow mode)
+ *   status            mode, shadow decisions, eligibility, every host's sessions
+ *   init [host]       hook snippet for claude (default), cursor or codex
  *   enforce           promote shadow -> enforce, once eligible
  *   shadow            demote back to shadow
  *   resume --once     one audited override of the next STOP
- *   hook              (internal) stdin -> stdout hook entry point
+ *   proxy             loopback proxy in front of Ollama / vLLM / LM Studio
+ *   conformance       prove the storm and the grind stop identically per host
+ *   hook              (internal) Claude Code stdin -> stdout hook entry point
+ *   cursor-hook       (internal) Cursor hook entry point
+ *   codex-hook        (internal) Codex hook entry point
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const cursor_1 = require("./adapters/cursor");
+const codex_1 = require("./adapters/codex");
 const calibrate_1 = require("./calibrate");
+const conformance_1 = require("./conformance");
 const defaults_1 = require("./defaults");
+const gateway_1 = require("./gateway");
 const pre_tool_use_1 = require("./hook/pre-tool-use");
+const server_1 = require("./proxy/server");
 const render_1 = require("./replay/render");
 const simulate_1 = require("./replay/simulate");
+const status_1 = require("./status");
 const HOME = process.env.AGENTGUARD_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.agentguard');
+const PROXY_HOSTS = ['ollama', 'vllm', 'lm-studio', 'openai-compatible'];
+function readStdinJson() {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(0, 'utf8'));
+    }
+    catch {
+        // Unparseable payload: allow. We never break the host over our own bug.
+        return null;
+    }
+}
 function savePolicy(policy) {
     (0, node_fs_1.mkdirSync)(HOME, { recursive: true, mode: 0o700 });
     (0, node_fs_1.writeFileSync)((0, node_path_1.join)(HOME, 'burn-policy.json'), JSON.stringify(policy, null, 2), { mode: 0o600 });
@@ -109,23 +129,90 @@ async function main(argv) {
         case 'status': {
             const policy = (0, pre_tool_use_1.loadPolicy)(HOME);
             const e = shadowEligibility();
+            const gateway = new gateway_1.Gateway(HOME, { sign: false });
+            const lc = policy.thresholds.localCompute;
             process.stdout.write([
                 `mode: ${policy.mode}`,
-                `thresholds: fan-out ${policy.thresholds.fanout.warn}/${policy.thresholds.fanout.stop}  sustained ${(policy.thresholds.sustained.warnTokens / 1e9).toFixed(1)}B/${(policy.thresholds.sustained.stopTokens / 1e9).toFixed(1)}B`,
+                `thresholds: fan-out ${policy.thresholds.fanout.warn}/${policy.thresholds.fanout.stop}  sustained ${(policy.thresholds.sustained.warnTokens / 1e9).toFixed(1)}B/${(policy.thresholds.sustained.stopTokens / 1e9).toFixed(1)}B  local-compute warn at ${lc?.warnConcurrent ?? 4} concurrent${lc?.stopConcurrent ? `, stop at ${lc.stopConcurrent}` : ' (no stop set)'}`,
                 policy.calibration ? `calibrated from ${policy.calibration.sessionsSampled} sessions` : 'using shipped defaults (run: agentguard-burn calibrate)',
                 `shadow observation: ${e.decisions} decisions over ${e.days.toFixed(1)} days`,
                 `  would have warned: ${e.warns}   would have blocked: ${e.wouldBlock}`,
                 `eligible for enforcement: ${e.eligible ? 'yes' : `no (need ${defaults_1.SHADOW_MIN_DECISIONS} decisions and ${defaults_1.SHADOW_MIN_DAYS} days)`}`,
+                '',
+                (0, status_1.renderMachineStatus)(gateway.sessions(), gateway.compute()),
+                '',
+                'content logging: off · telemetry: none · state: this machine only',
             ].join('\n') + '\n');
             return 0;
         }
         case 'init': {
             const policy = (0, pre_tool_use_1.loadPolicy)(HOME);
             savePolicy(policy);
-            const command = `node ${(0, node_path_1.join)(__dirname, 'cli.js')} hook`;
-            process.stdout.write(`Add this to ~/.claude/settings.json (merge into existing "hooks"):\n\n${JSON.stringify((0, pre_tool_use_1.settingsSnippet)(command), null, 2)}\n\nInstalled in ${policy.mode} mode. Nothing is blocked until you run: agentguard-burn enforce\n`);
+            const cli = (0, node_path_1.join)(__dirname, 'cli.js');
+            const target = rest.find((a) => !a.startsWith('--')) ?? 'claude';
+            if (target === 'cursor') {
+                process.stdout.write(`Add this to ~/.cursor/hooks.json (merge into existing "hooks"):\n\n${JSON.stringify((0, cursor_1.cursorHooksSnippet)(`node ${cli} cursor-hook`), null, 2)}\n\n` +
+                    `Cursor support is BETA: verified against the documented hook schema, not yet against every installed version. ` +
+                    `"failClosed": true means a crashed hook denies the subagent.\n` +
+                    `Installed in ${policy.mode} mode. Nothing is blocked until you run: agentguard-burn enforce\n`);
+                return 0;
+            }
+            if (target === 'codex') {
+                process.stdout.write(`Add this to ~/.codex/hooks.json (merge into existing "hooks"):\n\n${JSON.stringify((0, codex_1.codexHooksSnippet)(`node ${cli} codex-hook`), null, 2)}\n\n` +
+                    `Codex support is EXPERIMENTAL: the deny shape is verified against the documented schema; transcript usage is best-effort and marked estimated.\n` +
+                    `Installed in ${policy.mode} mode. Nothing is blocked until you run: agentguard-burn enforce\n`);
+                return 0;
+            }
+            process.stdout.write(`Add this to ~/.claude/settings.json (merge into existing "hooks"):\n\n${JSON.stringify((0, pre_tool_use_1.settingsSnippet)(`node ${cli} hook`), null, 2)}\n\nInstalled in ${policy.mode} mode. Nothing is blocked until you run: agentguard-burn enforce\n` +
+                `Other hosts: agentguard-burn init cursor | init codex | proxy --upstream http://127.0.0.1:11434 --host ollama\n`);
+            return 0;
+        }
+        case 'cursor-hook': {
+            const gateway = new gateway_1.Gateway(HOME);
+            process.stdout.write(JSON.stringify((0, cursor_1.handleCursorHook)(readStdinJson(), gateway)));
             return 0;
         }
+        case 'codex-hook': {
+            const gateway = new gateway_1.Gateway(HOME);
+            process.stdout.write(JSON.stringify((0, codex_1.handleCodexHook)(readStdinJson(), gateway)));
+            return 0;
+        }
+        case 'proxy': {
+            const upstreamRaw = flag('--upstream') ?? 'http://127.0.0.1:11434';
+            const host = (flag('--host') ?? 'ollama');
+            if (!PROXY_HOSTS.includes(host)) {
+                process.stderr.write(`--host must be one of ${PROXY_HOSTS.join(', ')}\n`);
+                return 64;
+            }
+            const listen = flag('--listen') ?? '127.0.0.1:18080';
+            const [listenHost, listenPortRaw] = listen.includes(':') ? [listen.slice(0, listen.lastIndexOf(':')), listen.slice(listen.lastIndexOf(':') + 1)] : ['127.0.0.1', listen];
+            const gateway = new gateway_1.Gateway(HOME);
+            const running = await (0, server_1.startProxy)({
+                upstream: new URL(upstreamRaw),
+                gateway,
+                host,
+                listenHost,
+                listenPort: Number(listenPortRaw),
+                defaultSession: flag('--session') ?? process.env.AGENTGUARD_SESSION_ID,
+                allowRemoteUpstream: has('--allow-remote-upstream'),
+                log: (l) => process.stderr.write(`${l}\n`),
+            });
+            const policy = (0, pre_tool_use_1.loadPolicy)(HOME);
+            process.stderr.write(`agentguard-burn proxy  ${running.address.origin}  ->  ${upstreamRaw}  (${host}, ${policy.mode} mode)\n` +
+                `Point your agent at ${running.address.origin}. Send x-agentguard-session: <id> so calls join a session; without it each client port is its own low-confidence session.\n` +
+                `Ctrl-C to stop.\n`);
+            await new Promise((resolve) => {
+                const stop = () => running.close().then(resolve, resolve);
+                process.once('SIGINT', stop);
+                process.once('SIGTERM', stop);
+            });
+            return 0;
+        }
+        case 'conformance': {
+            const result = await (0, conformance_1.runConformance)();
+            process.stdout.write(result.text + '\n');
+            return result.ok ? 0 : 1;
+        }
         case 'enforce': {
             const policy = (0, pre_tool_use_1.loadPolicy)(HOME);
             const e = shadowEligibility();
@@ -150,13 +237,15 @@ async function main(argv) {
             return 0;
         }
         default:
-            process.stdout.write('agentguard-burn <replay|calibrate|status|init|enforce|shadow|resume|hook>\n' +
+            process.stdout.write('agentguard-burn <replay|calibrate|status|init|enforce|shadow|resume|proxy|conformance>\n' +
                 '  replay [files...] [--json] [--top N] [--min-tokens N]\n' +
                 '  calibrate            fit thresholds to your history (writes shadow policy)\n' +
-                '  status               mode, shadow observations, eligibility\n' +
-                '  init                 print the settings.json hook snippet\n' +
+                '  status               mode, shadow observations, eligibility, every host\n' +
+                '  init [claude|cursor|codex]   print the hook snippet for that host\n' +
                 '  enforce [--force]    shadow -> enforce\n' +
-                '  resume --once --reason "..."\n');
+                '  resume --once --reason "..."\n' +
+                '  proxy --upstream http://127.0.0.1:11434 --host ollama|vllm|lm-studio|openai-compatible [--listen 127.0.0.1:18080] [--session ID]\n' +
+                '  conformance          replay the storm and the grind through every adapter shape\n');
             return command ? 64 : 0;
     }
 }

package/dist/src/conformance.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Conformance: the same failure, through every door, stops at the same step.
+ *
+ * Two fixtures, fitted on real sessions:
+ *
+ *   the storm   42 candidate spawns. First WARN must be spawn 24, first STOP
+ *               must be spawn 41. Every spawn-capable adapter replays it.
+ *   the grind   model calls of 250M tokens each. First WARN must be the call
+ *               after 3.5B, first STOP the call after 5B. Every usage-capable
+ *               adapter replays it.
+ *   composite   raw middleware supplies the spawns, the proxy supplies the
+ *               usage, one session ID. Candidate spawn 41 must see BOTH
+ *               planes in its findings. That is the claim on the box.
+ *
+ * Runs in a throwaway home in enforce mode. Nothing here touches ~/.agentguard.
+ */
+export interface ConformanceResult {
+    ok: boolean;
+    text: string;
+    checks: {
+        name: string;
+        ok: boolean;
+        detail: string;
+    }[];
+}
+export declare function runConformance(): Promise<ConformanceResult>;

package/dist/src/conformance.js

@@ -0,0 +1,261 @@
+"use strict";
+/**
+ * Conformance: the same failure, through every door, stops at the same step.
+ *
+ * Two fixtures, fitted on real sessions:
+ *
+ *   the storm   42 candidate spawns. First WARN must be spawn 24, first STOP
+ *               must be spawn 41. Every spawn-capable adapter replays it.
+ *   the grind   model calls of 250M tokens each. First WARN must be the call
+ *               after 3.5B, first STOP the call after 5B. Every usage-capable
+ *               adapter replays it.
+ *   composite   raw middleware supplies the spawns, the proxy supplies the
+ *               usage, one session ID. Candidate spawn 41 must see BOTH
+ *               planes in its findings. That is the claim on the box.
+ *
+ * Runs in a throwaway home in enforce mode. Nothing here touches ~/.agentguard.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runConformance = runConformance;
+const node_http_1 = require("node:http");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const codex_1 = require("./adapters/codex");
+const cursor_1 = require("./adapters/cursor");
+const raw_api_1 = require("./adapters/raw-api");
+const defaults_1 = require("./defaults");
+const events_1 = require("./events");
+const gateway_1 = require("./gateway");
+const server_1 = require("./proxy/server");
+const receipt_1 = require("./receipt");
+const STORM = 42;
+const WARN_AT = defaults_1.DEFAULT_THRESHOLDS.fanout.warn; // 24
+const STOP_AT = defaults_1.DEFAULT_THRESHOLDS.fanout.stop + 1; // 41
+const CALL_TOKENS = 250_000_000;
+const GRIND_WARN_CALL = Math.floor(defaults_1.DEFAULT_THRESHOLDS.sustained.warnTokens / CALL_TOKENS) + 1; // 15
+const GRIND_STOP_CALL = Math.floor(defaults_1.DEFAULT_THRESHOLDS.sustained.stopTokens / CALL_TOKENS) + 1; // 21
+function freshHome() {
+    const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agb-conf-'));
+    const policy = { mode: 'enforce', thresholds: defaults_1.DEFAULT_THRESHOLDS };
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(home, 'burn-policy.json'), JSON.stringify(policy));
+    return home;
+}
+function boundaries(steps) {
+    const w = steps.findIndex((v) => v === 'WARN');
+    const a = steps.findIndex((v) => v === 'WARN' || v === 'WARN:other');
+    const s = steps.findIndex((v) => v === 'STOP');
+    return { firstWarn: w < 0 ? null : w + 1, firstStop: s < 0 ? null : s + 1, firstAnyWarn: a < 0 ? null : a + 1 };
+}
+// Hook adapters only expose the first finding's summary. Fan-out is evaluated
+// first in the core, so when it fires it is the one in the message.
+const FANOUT_WARN = /agent spawns this session/;
+function stepFromMessage(denied, message, warnPattern) {
+    if (denied)
+        return 'STOP';
+    if (!message || !message.includes('WARN'))
+        return 'OK';
+    return warnPattern.test(message) ? 'WARN' : 'WARN:other';
+}
+// ---- storms --------------------------------------------------------------
+function stormRaw(home) {
+    const burn = (0, raw_api_1.createRawApiGuard)({ sessionId: 'storm-raw', home });
+    const steps = [];
+    for (let i = 1; i <= STORM; i++) {
+        const lease = burn.beforeSpawn({ parentDepth: 0 });
+        const d = lease.decision;
+        const fanout = d.report.findings.find((f) => f.detector === 'fanout');
+        steps.push(d.blocked ? 'STOP' : fanout?.verdict === 'WARN' ? 'WARN' : d.verdict === 'WARN' ? 'WARN:other' : 'OK');
+        if (!d.blocked)
+            lease.started();
+    }
+    return boundaries(steps);
+}
+function stormCursor(home) {
+    const gateway = new gateway_1.Gateway(home);
+    const steps = [];
+    for (let i = 1; i <= STORM; i++) {
+        const out = (0, cursor_1.handleCursorHook)({ hook_event_name: 'subagentStart', conversation_id: 'storm-cursor', subagent_id: `sub-${i}`, parent_conversation_id: 'storm-cursor' }, gateway);
+        steps.push(stepFromMessage(out.permission === 'deny', out.agent_message, FANOUT_WARN));
+    }
+    return boundaries(steps);
+}
+function stormCodex(home) {
+    const gateway = new gateway_1.Gateway(home);
+    const steps = [];
+    for (let i = 1; i <= STORM; i++) {
+        const out = (0, codex_1.handleCodexHook)({ hook_event_name: 'PreToolUse', session_id: 'storm-codex', tool_name: 'Agent', tool_use_id: `call-${i}` }, gateway);
+        steps.push(stepFromMessage(out.hookSpecificOutput?.permissionDecision === 'deny', out.systemMessage, FANOUT_WARN));
+    }
+    return boundaries(steps);
+}
+function depthRaw(home) {
+    const burn = (0, raw_api_1.createRawApiGuard)({ sessionId: 'depth-raw', home });
+    const ok1 = !burn.beforeSpawn({ parentDepth: 0 }).blocked;
+    const ok2 = !burn.beforeSpawn({ parentDepth: 1 }).blocked;
+    const denied3 = burn.beforeSpawn({ parentDepth: 2 }).blocked;
+    return ok1 && ok2 && denied3;
+}
+// ---- grinds --------------------------------------------------------------
+function grindRaw(home) {
+    const burn = (0, raw_api_1.createRawApiGuard)({ sessionId: 'grind-raw', home });
+    const steps = [];
+    for (let i = 1; i <= GRIND_STOP_CALL + 1; i++) {
+        const call = burn.beforeCall({ estimatedTokens: 1_000 });
+        const d = call.decision;
+        const sustained = d.report.findings.find((f) => f.detector === 'sustained_burn');
+        steps.push(d.blocked ? 'STOP' : sustained?.verdict === 'WARN' ? 'WARN' : d.verdict === 'WARN' ? 'WARN:other' : 'OK');
+        if (d.blocked)
+            break;
+        call.complete({ tokens: CALL_TOKENS });
+    }
+    return boundaries(steps);
+}
+/** A stand-in Ollama: streams a few NDJSON chunks then the final counts. */
+function fakeOllama(tokensPerCall) {
+    const bodies = [];
+    const server = (0, node_http_1.createServer)((req, res) => {
+        req.resume();
+        req.on('end', () => {
+            res.writeHead(200, { 'content-type': 'application/x-ndjson' });
+            const parts = [
+                JSON.stringify({ model: 'test', message: { role: 'assistant', content: 'hel' }, done: false }),
+                JSON.stringify({ model: 'test', message: { role: 'assistant', content: 'lo' }, done: false }),
+                JSON.stringify({ model: 'test', done: true, prompt_eval_count: tokensPerCall - 7, eval_count: 7 }),
+            ];
+            const body = parts.join('\n') + '\n';
+            bodies.push(body);
+            let i = 0;
+            const tick = () => {
+                if (i < parts.length) {
+                    res.write(parts[i++] + '\n');
+                    setTimeout(tick, 2);
+                }
+                else
+                    res.end();
+            };
+            tick();
+        });
+    });
+    return new Promise((resolve) => {
+        server.listen(0, '127.0.0.1', () => {
+            const a = server.address();
+            resolve({ server, url: new URL(`http://127.0.0.1:${a.port}`), bodies });
+        });
+    });
+}
+function post(url, path, headers) {
+    return new Promise((resolve, reject) => {
+        const req = (0, node_http_1.request)({ hostname: url.hostname, port: url.port, path, method: 'POST', headers: { 'content-type': 'application/json', ...headers } }, (res) => {
+            let body = '';
+            res.on('data', (d) => (body += d.toString()));
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, body, headers: res.headers }));
+        });
+        req.on('error', reject);
+        req.end(JSON.stringify({ model: 'test', messages: [{ role: 'user', content: 'x' }] }));
+    });
+}
+async function grindProxy(home, sessionId = 'grind-proxy') {
+    const upstream = await fakeOllama(CALL_TOKENS);
+    const gateway = new gateway_1.Gateway(home);
+    const proxy = await (0, server_1.startProxy)({ upstream: upstream.url, gateway, host: 'ollama' });
+    const steps = [];
+    let byteIdentical = true;
+    let stopBody = '';
+    try {
+        for (let i = 1; i <= GRIND_STOP_CALL + 1; i++) {
+            const r = await post(proxy.address, '/api/chat', { [events_1.SESSION_HEADER]: sessionId, [events_1.CALL_HEADER]: `${sessionId}-${i}` });
+            if (r.status === 429) {
+                steps.push('STOP');
+                stopBody = r.body;
+                break;
+            }
+            // The proxy only exposes the verdict header on the wire, so the grind
+            // through the proxy is checked on verdict; the raw grind above proves
+            // the detector. No spawns happen here, so no advisory WARN can fire.
+            const v = r.headers['x-agentguard-verdict'];
+            steps.push(v === 'WARN' ? 'WARN' : 'OK');
+            if (r.body !== upstream.bodies[upstream.bodies.length - 1])
+                byteIdentical = false;
+        }
+    }
+    finally {
+        await proxy.close();
+        upstream.server.close();
+    }
+    return { ...boundaries(steps), byteIdentical, stopBody };
+}
+// ---- composite -----------------------------------------------------------
+async function composite(home) {
+    // Proxy supplies usage: 14 calls = 3.5B, so the session is in WARN territory.
+    const upstream = await fakeOllama(CALL_TOKENS);
+    const gateway = new gateway_1.Gateway(home);
+    const proxy = await (0, server_1.startProxy)({ upstream: upstream.url, gateway, host: 'ollama' });
+    try {
+        for (let i = 1; i <= GRIND_WARN_CALL - 1; i++)
+            await post(proxy.address, '/api/chat', { [events_1.SESSION_HEADER]: 'composite', [events_1.CALL_HEADER]: `c-${i}` });
+    }
+    finally {
+        await proxy.close();
+        upstream.server.close();
+    }
+    // Middleware supplies the tree on the same session ID.
+    const burn = (0, raw_api_1.createRawApiGuard)({ sessionId: 'composite', home });
+    let last = burn.beforeSpawn({ parentDepth: 0 });
+    for (let i = 1; i <= STOP_AT; i++) {
+        last = burn.beforeSpawn({ parentDepth: 0 });
+        if (!last.blocked)
+            last.started();
+    }
+    const detectors = new Set(last.decision.report.findings.map((f) => f.detector));
+    const view = gateway.peek('composite');
+    const hosts = view?.hosts.join('+') ?? '';
+    const ok = last.blocked && detectors.has('fanout') && detectors.has('sustained_burn') && view?.capabilities.usage === 'authoritative' && view?.capabilities.spawns === 'authoritative';
+    return {
+        ok,
+        detail: `spawn 41 ${last.blocked ? 'denied' : 'ALLOWED'}; findings ${[...detectors].join(',')}; hosts ${hosts}; coverage spawns:${view?.capabilities.spawns} usage:${view?.capabilities.usage}; tokens ${((view?.state.totalTokens ?? 0) / 1e9).toFixed(2)}B`,
+    };
+}
+// ---- runner --------------------------------------------------------------
+async function runConformance() {
+    const home = freshHome();
+    const checks = [];
+    const expectStorm = (name, b) => checks.push({
+        name,
+        ok: b.firstWarn === WARN_AT && b.firstStop === STOP_AT,
+        detail: `fan-out WARN at ${b.firstWarn} (want ${WARN_AT}), STOP at ${b.firstStop} (want ${STOP_AT})${b.firstAnyWarn !== null && b.firstAnyWarn < WARN_AT ? `; advisory spawn-rate WARN at ${b.firstAnyWarn}` : ''}`,
+    });
+    const expectGrind = (name, b) => checks.push({ name, ok: b.firstWarn === GRIND_WARN_CALL && b.firstStop === GRIND_STOP_CALL, detail: `first WARN call ${b.firstWarn} (want ${GRIND_WARN_CALL}), first STOP call ${b.firstStop} (want ${GRIND_STOP_CALL})` });
+    try {
+        expectStorm('storm · raw middleware', stormRaw(home));
+        expectStorm('storm · cursor subagentStart', stormCursor(home));
+        expectStorm('storm · codex PreToolUse', stormCodex(home));
+        checks.push({ name: 'depth · raw middleware', ok: depthRaw(home), detail: 'depth 1 and 2 admitted, depth 3 denied' });
+        expectGrind('grind · raw middleware', grindRaw(home));
+        const p = await grindProxy(home);
+        expectGrind('grind · ollama proxy', p);
+        checks.push({ name: 'proxy · streamed bytes identical to upstream', ok: p.byteIdentical, detail: p.byteIdentical ? 'every streamed body matched upstream byte for byte' : 'MISMATCH' });
+        checks.push({ name: 'proxy · STOP answers 429 with the alarm box', ok: p.stopBody.includes('agentguard_burn_stop') && p.stopBody.includes('AGENTGUARD STOP'), detail: p.stopBody ? 'error.type=agentguard_burn_stop, box present' : 'no STOP body captured' });
+        const c = await composite(home);
+        checks.push({ name: 'composite · middleware tree + proxy usage, one session', ok: c.ok, detail: c.detail });
+        // Receipts: every spawn decision above was signed; verify the chain tail.
+        const receipts = require('node:fs')
+            .readFileSync((0, node_path_1.join)(home, 'receipts.ndjson'), 'utf8')
+            .split('\n')
+            .filter(Boolean)
+            .map((l) => JSON.parse(l));
+        const allValid = receipts.every((r) => (0, receipt_1.verifyReceipt)(r));
+        const contentFree = !receipts.some((r) => JSON.stringify(r.payload).match(/transcript|prompt|\/Users\/|content/i));
+        checks.push({ name: `receipts · ${receipts.length} signed, all verify, content-free`, ok: allValid && contentFree && receipts.length > 0, detail: `${receipts.length} receipts, verify=${allValid}, content-free=${contentFree}` });
+    }
+    finally {
+        (0, node_fs_1.rmSync)(home, { recursive: true, force: true });
+    }
+    const ok = checks.every((c) => c.ok);
+    const text = [
+        'AGENTGUARD conformance · same failure, every door, same step',
+        ...checks.map((c) => `  ${c.ok ? 'PASS' : 'FAIL'}  ${c.name.padEnd(52)} ${c.detail}`),
+        ok ? 'all adapters agree' : 'DISAGREEMENT: an adapter drifted from the core',
+    ].join('\n');
+    return { ok, text, checks };
+}

package/dist/src/defaults.d.ts

@@ -21,6 +21,17 @@ import type { Policy, Thresholds } from './types';
  * absent from these thresholds.
  */
 export declare const DEFAULT_THRESHOLDS: Thresholds;
+export declare const DEFAULT_LOCAL_COMPUTE: {
+    windowMs: number;
+    warnConcurrent: number;
+    stopConcurrent: number | null;
+    warnOccupiedMs: number | null;
+    stopOccupiedMs: number | null;
+};
+/** How long a model-call reservation may stay open before it is presumed dead. */
+export declare const CALL_RESERVATION_TTL_MS: number;
+/** Tokens assumed for a call whose caller gave no estimate. Replaced by the real count on completion. */
+export declare const DEFAULT_CALL_ESTIMATE_TOKENS = 0;
 /** First-run policy. Shadow: evaluate and record, never block. */
 export declare const DEFAULT_POLICY: Policy;
 /** Idle gaps longer than this do not count as active time. */

package/dist/src/defaults.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHADOW_MIN_DAYS = exports.SHADOW_MIN_DECISIONS = exports.ACTIVE_GAP_CAP_MS = exports.DEFAULT_POLICY = exports.DEFAULT_THRESHOLDS = void 0;
+exports.SHADOW_MIN_DAYS = exports.SHADOW_MIN_DECISIONS = exports.ACTIVE_GAP_CAP_MS = exports.DEFAULT_POLICY = exports.DEFAULT_CALL_ESTIMATE_TOKENS = exports.CALL_RESERVATION_TTL_MS = exports.DEFAULT_LOCAL_COMPUTE = exports.DEFAULT_THRESHOLDS = void 0;
 /**
  * Shipped thresholds.
  *
@@ -40,7 +40,22 @@ exports.DEFAULT_THRESHOLDS = {
         windowActiveMinutes: 300,
         warnConcurrentSessions: 4,
     },
+    // Local model runtimes. Elapsed request time is not GPU utilisation (it
+    // includes queueing and transport), so it is called occupied time and it
+    // only warns unless the operator sets a ceiling for their own hardware.
+    localCompute: {
+        windowMs: 15 * 60 * 1000,
+        warnConcurrent: 4,
+        stopConcurrent: null,
+        warnOccupiedMs: null,
+        stopOccupiedMs: null,
+    },
 };
+exports.DEFAULT_LOCAL_COMPUTE = exports.DEFAULT_THRESHOLDS.localCompute;
+/** How long a model-call reservation may stay open before it is presumed dead. */
+exports.CALL_RESERVATION_TTL_MS = 30 * 60 * 1000;
+/** Tokens assumed for a call whose caller gave no estimate. Replaced by the real count on completion. */
+exports.DEFAULT_CALL_ESTIMATE_TOKENS = 0;
 /** First-run policy. Shadow: evaluate and record, never block. */
 exports.DEFAULT_POLICY = {
     mode: 'shadow',