@agentwares/agentguard 0.1.6 → 0.1.9

package/dist/index.d.ts

@@ -195,6 +195,11 @@ declare class ProxyRuntime {
             redact: boolean;
             include_results: boolean;
             max_chars: number;
+            rules: {
+                check: string | string[];
+                id?: string | undefined;
+                text?: string | undefined;
+            }[];
         };
         alerts: {
             on: ("KILLED" | "APPROVAL_REQUIRED" | "LOOP_DETECTED" | "CAP_EXCEEDED" | "TOOL_DENIED")[];
@@ -204,6 +209,31 @@ declare class ProxyRuntime {
         state: {
             dir: string;
         };
+        hooks: {
+            mode: "dry-run" | "enforce";
+            shell: {
+                deny: string[];
+                approval: string[];
+            };
+            paths: {
+                deny: string[];
+                approval: string[];
+            };
+            irreversible: {
+                builtins: boolean | ("git-push" | "merge" | "tag-delete" | "rm-outside-workspace" | "publish" | "send" | "guard-config")[];
+                rules: {
+                    name: string;
+                    shell: string[];
+                    paths: string[];
+                    tools: string[];
+                    mentions: string[];
+                }[];
+                window_s: number;
+                require_mention: boolean;
+                require_origin: boolean;
+                mentions: Record<string, string[]>;
+            };
+        };
         allow?: string[] | undefined;
     };
     start(): Promise<void>;
@@ -211,6 +241,13 @@ declare class ProxyRuntime {
     private wire;
     private pickSession;
     private broadcast;
+    /**
+     * Re-read an upstream's tools, every page (mcp-kit's `readAllPages`): at most 20 requests, each
+     * under the upstream's `timeout_ms`, ending at a cursor already followed. It used to follow
+     * `nextCursor` with no bound, so an upstream that echoed its cursor kept the proxy asking for
+     * the same page forever. A refresh that fails, or stops at the 20-page / 2,000-tool ceiling,
+     * changes nothing: the agent keeps the last good list, and the log says why.
+     */
     private refreshTools;
     private rebuildExposed;
     listTools(agent?: AgentScope | null): ExposedTool[];
@@ -253,6 +290,15 @@ declare function toCallToolResult(result: GuardResult, tool: ExposedTool | undef
 /** Build the per-session MCP server. */
 declare function createDownstreamServer(runtime: ProxyRuntime, opts?: DownstreamOptions): McpServer;
 
+interface HttpRegistration {
+    url: string;
+    baseUrl: string;
+    token: string;
+    pid: number;
+    startedAt: string;
+}
+declare function registrationPath(stateDir: string): string;
+
 interface HttpProxyOptions {
     runtime: ProxyRuntime;
     port?: number;
@@ -268,14 +314,7 @@ interface HttpProxy {
     token: string;
     close(): Promise<void>;
 }
-interface HttpRegistration {
-    url: string;
-    baseUrl: string;
-    token: string;
-    pid: number;
-    startedAt: string;
-}
-declare function registrationPath(stateDir: string): string;
+
 declare function startHttpProxy(opts: HttpProxyOptions): Promise<HttpProxy>;
 
 /** Tiny argv parser: `--flag value`, `--flag=value`, `--bool`, `--no-bool`, repeated flags → arrays. */
@@ -292,6 +331,8 @@ interface Io {
     env: NodeJS.ProcessEnv;
     /** false when stdout is a pipe — an MCP client spawned us and wants a server, not the help text */
     tty?: boolean;
+    /** everything on stdin (hook mode reads the harness's JSON from it) */
+    stdin?: () => Promise<string>;
 }
 declare function loadPolicyFor(args: ParsedArgs, io: Io, opts?: {
     allowMissingEnv?: boolean;
@@ -490,7 +531,32 @@ interface DemoOptions {
 /** Drive a connected client through the scripted scenario. Returns every step's outcome. */
 declare function runDemoAgent(client: Client, opts?: DemoOptions): Promise<DemoStep[]>;
 
-declare const HELP = "agentguard \u2014 MCP policy proxy for agents that touch production\n\n  npx @agentwares/agentguard init                 read your MCP config, write agentguard.yaml (dry-run), route every server through the proxy\n  agentguard report [--run id|--all]  what this run did / would have destroyed / spent, where it was halted\n  agentguard diff [--run id]          record-by-record mutation diff from a dry run\n  agentguard verify [audit.jsonl]     prove the hash-chained audit log was not edited\n  agentguard connect <key> [--write]  point this machine at your hosted proxy (paid tiers)\n\n  agentguard proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]\n  agentguard tools [--json]           the tools your agent will see, with class and why\n  agentguard status [--run id]        counters vs caps, kill state, pending approvals\n\n  agentguard kill [reason]            halt every run now (file + running HTTP proxy);  agentguard resume\n  agentguard approvals [--all]        pending approvals;  agentguard approve <id> | deny <id> [--note text]\n  agentguard key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]\n  agentguard key list | revoke <agent>\n  agentguard permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]\n\nOptions: --config <agentguard.yaml> (or AGENTGUARD_CONFIG), --json, --help, --version\nDocs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli";
+declare const AUDIT_CANARIES: readonly ["CANARY-PROMPT-7d1e", "CANARY-ASSISTANT-3b9a", "CANARY-COMMIT-MESSAGE-5c2f", "CANARY-OUTPUT-8e4d", "CANARY-PATH-2a6b", "CANARY-CONTENT-9f0c"];
+interface SyntheticAuditOptions {
+    /** the repository: rule files are written here */
+    repo: string;
+    /** stands in for ~/.claude/projects */
+    claudeDir: string;
+    /** stands in for ~/.codex/sessions */
+    codexDir: string;
+    now?: Date;
+}
+interface SyntheticAuditHistory {
+    /** sessions in the repository in the last 7 days (5 Claude Code, 1 Codex) */
+    sessionsLast7d: number;
+    /** and with the one 20 days old */
+    sessionsAll: number;
+}
+/** Write the rule files and the transcripts. */
+declare function writeSyntheticAuditHistory(opts: SyntheticAuditOptions): SyntheticAuditHistory;
+
+/** The willingness-to-pay test: a page that says what the team view would be, and one button. */
+declare const TEAM_HISTORY_URL = "https://agentwares-agentguard.vercel.app/team-history";
+/** `7d`, `30d`, `24h`, `all`, or a date. Undefined: all history. */
+declare function parseSince(value: string | undefined, now: Date): number | undefined;
+declare function auditCommand(args: ParsedArgs, io: Io): Promise<number>;
+
+declare const HELP = "agentguard \u2014 MCP policy proxy for agents that touch production\n\n  npx @agentwares/agentguard init                 read your MCP config, write agentguard.yaml (dry-run), route every server through the proxy\n  agentguard report [--run id|--all]  what this run did / would have destroyed / spent, where it was halted\n  agentguard diff [--run id]          record-by-record mutation diff from a dry run\n  agentguard verify [audit.jsonl]     prove the hash-chained audit log was not edited\n  agentguard connect <key> [--write]  point this machine at your hosted proxy (paid tiers)\n\n  agentguard hooks install [--project|--user] [--client claude|codex|gemini|all]\n                                      check a coding agent's own shell commands and file edits against agentguard.yaml (dry-run first);\n                                      irreversible commands (push, merge, publish, send, rm outside the repo) only on a turn a person typed\n  agentguard hooks uninstall | status\n  agentguard hook pre-tool-use        what the installed hook runs (reads the harness's JSON on stdin)\n\n  agentguard audit [--since 7d|30d|all] [--client claude|codex|all] [--json]\n                                      which rules in CLAUDE.md / AGENTS.md / GEMINI.md / .cursor/rules your coding agents broke,\n                                      from this machine's Claude Code and Codex sessions in this repo (nothing is sent anywhere)\n  agentguard audit --enforce [--preview]\n                                      write the checkable rules into agentguard.yaml as hook rules, in dry-run, and install the hook\n\n  agentguard proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]\n  agentguard tools [--json]           the tools your agent will see, with class and why\n  agentguard status [--run id]        counters vs caps, kill state, pending approvals\n\n  agentguard kill [reason]            halt every run now (file + running HTTP proxy);  agentguard resume\n  agentguard approvals [--all]        pending approvals;  agentguard approve <id> | deny <id> [--note text]\n  agentguard key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]\n  agentguard key list | revoke <agent>\n  agentguard permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]\n\nOptions: --config <agentguard.yaml> (or AGENTGUARD_CONFIG), --json, --help, --version\nDocs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli";
 declare function main(argv: readonly string[], io?: Io): Promise<number>;
 
-export { type CallContext, type ClientConfigFile, type CrmState, DEFAULT_PERMISSION_PATHS, type DemoOptions, type DemoStep, type DownstreamOptions, type DownstreamSession, type ExposedTool, type FileGuard, HELP, type HttpProxy, type HttpProxyOptions, type HttpRegistration, type Io, type PermissionDiffResult, type ProbeResult, type ProbedTool, ProxyRuntime, type RuntimeOptions, type ServerEntry, type UpstreamStatus, approvalSlackMessage, candidateConfigs, createAlerter, createCrmMcpServer, createDownstreamServer, createFileGuard, crmTools, detectClientConfigs, haltSlackMessage, loadPolicyFor, main, probeUpstreams, proxyEntry, readRegistration, readServers, registrationPath, renderStarterPolicy, restoreClientConfig, rewriteClientConfig, runDemoAgent, runIdFor, runPermissionDiff, seedState, serversToUpstreams, startHttpProxy, toCallToolResult };
+export { AUDIT_CANARIES, type CallContext, type ClientConfigFile, type CrmState, DEFAULT_PERMISSION_PATHS, type DemoOptions, type DemoStep, type DownstreamOptions, type DownstreamSession, type ExposedTool, type FileGuard, HELP, type HttpProxy, type HttpProxyOptions, type HttpRegistration, type Io, type PermissionDiffResult, type ProbeResult, type ProbedTool, ProxyRuntime, type RuntimeOptions, type ServerEntry, type SyntheticAuditHistory, type SyntheticAuditOptions, TEAM_HISTORY_URL, type UpstreamStatus, approvalSlackMessage, auditCommand, candidateConfigs, createAlerter, createCrmMcpServer, createDownstreamServer, createFileGuard, crmTools, detectClientConfigs, haltSlackMessage, loadPolicyFor, main, parseSince, probeUpstreams, proxyEntry, readRegistration, readServers, registrationPath, renderStarterPolicy, restoreClientConfig, rewriteClientConfig, runDemoAgent, runIdFor, runPermissionDiff, seedState, serversToUpstreams, startHttpProxy, toCallToolResult, writeSyntheticAuditHistory };