@agentix-security/nextjs 0.1.6 → 0.1.8

package/dist/index.cjs

@@ -418,6 +418,17 @@ async function fingerprint2(req) {
   const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data));
   return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function agentScore(req) {
+  let score = 0;
+  const ua = (req.headers.get("user-agent") ?? "").toLowerCase();
+  if (/bot|crawler|spider|python-requests|curl\/|node-fetch|axios|go-http-client|claude-web|gptbot|chatgpt|google-extended|oai-searchbot|anthropic|llm/i.test(ua)) score += 0.8;
+  if (!ua) score += 0.6;
+  if (!req.headers.get("sec-fetch-site") && !req.headers.get("sec-ch-ua")) score += 0.3;
+  if (!req.headers.get("accept-language")) score += 0.15;
+  const accept = req.headers.get("accept") ?? "";
+  if (req.method === "GET" && !accept.includes("text/html")) score += 0.2;
+  return Math.min(score, 1);
+}
 function bearer(req) {
   const auth = req.headers.get("authorization");
   if (!auth?.startsWith("Bearer ")) return null;
@@ -522,6 +533,46 @@ function agentixMiddleware(sdk) {
         expires_in: exp - iat
       });
     }
+    const isHumanPage = !pathname.startsWith("/api/") && !pathname.startsWith("/agent/") && !pathname.startsWith("/_next/") && !pathname.startsWith("/favicon");
+    if (isHumanPage && agentScore(req) >= 0.5) {
+      const registry = sdk.getIntentRegistry();
+      const tools = Object.fromEntries(
+        [...registry.entries()].map(([intent, entry]) => [intent, { routes: [...entry.routes] }])
+      );
+      void shipAudit2(cp, licenseKey, auditRow(sdk, req, pathname, 200, fp, {
+        trust_mode: "unmanaged_automation",
+        intent_scope: "none",
+        token_id: null,
+        decision: "allow",
+        decision_reason: "agent_redirected_to_lane",
+        policy_id: "agent-detection"
+      }));
+      return server_js.NextResponse.json({
+        service: "agentix-intent-sdk",
+        version: "0.2.0",
+        message: "AI agent detected. Use the agent API instead of the human-facing site.",
+        tenant_id: sdk.getResolvedTenantId(),
+        deployment_id: sdk.getDeploymentId(),
+        discovery: { well_known: `${baseUrl}/.well-known/ai-agent.json`, token_endpoint: `${baseUrl}/agent/v1/declare_intent` },
+        intents: [...registry.keys()],
+        tools
+      }, { headers: { "cache-control": "no-store" } });
+    }
+    if (req.method === "GET" && pathname === "/robots.txt") {
+      let upstream = "";
+      try {
+        const r = await fetch(`${baseUrl}/robots.txt`, { headers: { "user-agent": "agentix-sdk" } });
+        if (r.ok) upstream = await r.text();
+      } catch {
+      }
+      const directive = `
+# Agentix agent discovery
+Agent-Discovery: ${baseUrl}/.well-known/ai-agent.json
+`;
+      return new server_js.NextResponse(upstream + directive, {
+        headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" }
+      });
+    }
     const res = server_js.NextResponse.next();
     res.headers.set("link", `<${baseUrl}/.well-known/ai-agent.json>; rel="agent-discovery"`);
     return res;

package/dist/index.js

@@ -416,6 +416,17 @@ async function fingerprint2(req) {
   const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data));
   return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function agentScore(req) {
+  let score = 0;
+  const ua = (req.headers.get("user-agent") ?? "").toLowerCase();
+  if (/bot|crawler|spider|python-requests|curl\/|node-fetch|axios|go-http-client|claude-web|gptbot|chatgpt|google-extended|oai-searchbot|anthropic|llm/i.test(ua)) score += 0.8;
+  if (!ua) score += 0.6;
+  if (!req.headers.get("sec-fetch-site") && !req.headers.get("sec-ch-ua")) score += 0.3;
+  if (!req.headers.get("accept-language")) score += 0.15;
+  const accept = req.headers.get("accept") ?? "";
+  if (req.method === "GET" && !accept.includes("text/html")) score += 0.2;
+  return Math.min(score, 1);
+}
 function bearer(req) {
   const auth = req.headers.get("authorization");
   if (!auth?.startsWith("Bearer ")) return null;
@@ -520,6 +531,46 @@ function agentixMiddleware(sdk) {
         expires_in: exp - iat
       });
     }
+    const isHumanPage = !pathname.startsWith("/api/") && !pathname.startsWith("/agent/") && !pathname.startsWith("/_next/") && !pathname.startsWith("/favicon");
+    if (isHumanPage && agentScore(req) >= 0.5) {
+      const registry = sdk.getIntentRegistry();
+      const tools = Object.fromEntries(
+        [...registry.entries()].map(([intent, entry]) => [intent, { routes: [...entry.routes] }])
+      );
+      void shipAudit2(cp, licenseKey, auditRow(sdk, req, pathname, 200, fp, {
+        trust_mode: "unmanaged_automation",
+        intent_scope: "none",
+        token_id: null,
+        decision: "allow",
+        decision_reason: "agent_redirected_to_lane",
+        policy_id: "agent-detection"
+      }));
+      return NextResponse.json({
+        service: "agentix-intent-sdk",
+        version: "0.2.0",
+        message: "AI agent detected. Use the agent API instead of the human-facing site.",
+        tenant_id: sdk.getResolvedTenantId(),
+        deployment_id: sdk.getDeploymentId(),
+        discovery: { well_known: `${baseUrl}/.well-known/ai-agent.json`, token_endpoint: `${baseUrl}/agent/v1/declare_intent` },
+        intents: [...registry.keys()],
+        tools
+      }, { headers: { "cache-control": "no-store" } });
+    }
+    if (req.method === "GET" && pathname === "/robots.txt") {
+      let upstream = "";
+      try {
+        const r = await fetch(`${baseUrl}/robots.txt`, { headers: { "user-agent": "agentix-sdk" } });
+        if (r.ok) upstream = await r.text();
+      } catch {
+      }
+      const directive = `
+# Agentix agent discovery
+Agent-Discovery: ${baseUrl}/.well-known/ai-agent.json
+`;
+      return new NextResponse(upstream + directive, {
+        headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" }
+      });
+    }
     const res = NextResponse.next();
     res.headers.set("link", `<${baseUrl}/.well-known/ai-agent.json>; rel="agent-discovery"`);
     return res;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentix-security/nextjs",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Agentix Next.js adapter — AI agent intent-based authorization for Next.js apps",
   "type": "module",
   "main": "./dist/index.cjs",