@agentwares/agentguard 0.1.7 → 0.1.10

package/dist/chunk-XOBFANL4.js

@@ -0,0 +1,119 @@
+// src/fixtures/demo-agent.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { fileURLToPath } from "url";
+import path from "path";
+function summarize(result) {
+  const text = result.content.find((c) => c.type === "text")?.text;
+  const meta = result._meta?.okgate;
+  if (result.isError) {
+    let code;
+    try {
+      code = JSON.parse(text ?? "{}").code;
+    } catch {
+    }
+    return { ok: false, code, text };
+  }
+  return { ok: true, dryRun: meta?.dryRun, text };
+}
+async function runDemoAgent(client, opts = {}) {
+  const steps = [];
+  const log = opts.log ?? (() => void 0);
+  const meta = opts.runId ? { runId: opts.runId } : void 0;
+  const call = async (step, tool, args) => {
+    const result = await client.callTool({
+      name: tool,
+      arguments: args,
+      _meta: meta
+    });
+    const s = { step, tool, ...summarize(result) };
+    steps.push(s);
+    log(
+      `${s.ok ? s.dryRun ? "faked " : "ok    " : `${s.code ?? "error"}`.padEnd(6)} ${step}: ${tool}`
+    );
+    return s;
+  };
+  await call("read: list contacts", "crm_list_contacts", { limit: 10 });
+  await call("read: get one", "crm_get_contact", { id: "c_1" });
+  await call("write: create", "crm_create_contact", {
+    name: "Demo Person",
+    email: "demo@example.com"
+  });
+  await call("write: update", "crm_update_contact", { id: "c_1", fields: { name: "Ada L." } });
+  await call("write: delete (destructive)", "crm_delete_contact", { id: "c_2" });
+  await call("write: send email", "crm_send_email", {
+    to: "ada@example.com",
+    subject: "Hi",
+    body: "Hello from the demo agent"
+  });
+  await call("spend: charge $12", "crm_charge_card", {
+    customer_id: "c_1",
+    amount_cents: 1200,
+    currency: "usd"
+  });
+  const loops = opts.loop ?? 5;
+  for (let i = 0; i < loops; i += 1) {
+    const s = await call(`loop ${i + 1}/${loops}: identical update`, "crm_update_contact", {
+      id: "c_3",
+      fields: { name: "Same Thing" }
+    });
+    if (s.code === "LOOP_DETECTED") break;
+  }
+  const burst = opts.burst ?? 60;
+  for (let i = 0; i < burst; i += 1) {
+    const s = await call(`burst ${i + 1}/${burst}: create`, "crm_create_contact", {
+      name: `Bulk ${i}`,
+      email: `bulk${i}@example.com`
+    });
+    if (s.code === "CAP_EXCEEDED") break;
+  }
+  return steps;
+}
+var isMain = process.argv[1] !== void 0 && /demo-agent\.[cm]?[jt]s$/.test(process.argv[1]);
+if (isMain) {
+  const argv = process.argv.slice(2);
+  const arg = (name) => {
+    const i = argv.indexOf(name);
+    return i >= 0 ? argv[i + 1] : void 0;
+  };
+  const url = arg("--url");
+  const config = arg("--config") ?? "okgate.yaml";
+  const client = new Client({ name: "okgate-demo-agent", version: "0.1.0" });
+  if (url) {
+    await client.connect(
+      new StreamableHTTPClientTransport(new URL(url), {
+        requestInit: {
+          headers: { "X-Run-Id": arg("--run-id") ?? `demo_${Date.now().toString(36)}` }
+        }
+      })
+    );
+  } else {
+    const cli = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../cli.js");
+    await client.connect(
+      new StdioClientTransport({
+        command: process.execPath,
+        args: [cli, "proxy", "--config", config],
+        stderr: "inherit"
+      })
+    );
+  }
+  try {
+    const steps = await runDemoAgent(client, {
+      log: (l) => console.log(l),
+      runId: arg("--run-id")
+    });
+    const halts = steps.filter((s) => !s.ok).map((s) => s.code);
+    console.log(
+      `
+${steps.length} calls; halts: ${halts.join(", ") || "none"}. Now run: okgate report`
+    );
+  } finally {
+    await client.close();
+  }
+}
+
+export {
+  runDemoAgent
+};
+//# sourceMappingURL=chunk-XOBFANL4.js.map

package/dist/chunk-XOBFANL4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fixtures/demo-agent.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * A scripted \"agent\" that misbehaves on purpose: reads, then writes, then loops, then bursts\n * writes past the cap. Run it against the proxy to see dry-run diffs, LOOP_DETECTED and\n * CAP_EXCEEDED in `okgate report`.\n *\n *   node dist/fixtures/demo-agent.js --config okgate.yaml   # spawns `okgate proxy` over stdio\n */\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { CallToolResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport { fileURLToPath } from \"node:url\";\nimport path from \"node:path\";\n\nexport interface DemoStep {\n  step: string;\n  tool: string;\n  ok: boolean;\n  code?: string;\n  dryRun?: boolean;\n  text?: string;\n}\n\nexport interface DemoOptions {\n  /** how many writes to burst at the end (default 60 — past a `writes: 50` cap) */\n  burst?: number;\n  /** how many times to repeat the identical update (default 5 — past `max_repeats: 3`) */\n  loop?: number;\n  runId?: string;\n  log?: (line: string) => void;\n}\n\nfunction summarize(result: CallToolResult): {\n  ok: boolean;\n  code?: string;\n  dryRun?: boolean;\n  text?: string;\n} {\n  const text = result.content.find((c) => c.type === \"text\")?.text;\n  const meta = (result._meta as { okgate?: { dryRun?: boolean } } | undefined)?.okgate;\n  if (result.isError) {\n    let code: string | undefined;\n    try {\n      code = (JSON.parse(text ?? \"{}\") as { code?: string }).code;\n    } catch {\n      // not JSON\n    }\n    return { ok: false, code, text };\n  }\n  return { ok: true, dryRun: meta?.dryRun, text };\n}\n\n/** Drive a connected client through the scripted scenario. Returns every step's outcome. */\nexport async function runDemoAgent(client: Client, opts: DemoOptions = {}): Promise<DemoStep[]> {\n  const steps: DemoStep[] = [];\n  const log = opts.log ?? (() => undefined);\n  const meta = opts.runId ? { runId: opts.runId } : undefined;\n  const call = async (\n    step: string,\n    tool: string,\n    args: Record<string, unknown>,\n  ): Promise<DemoStep> => {\n    const result = (await client.callTool({\n      name: tool,\n      arguments: args,\n      _meta: meta,\n    })) as CallToolResult;\n    const s = { step, tool, ...summarize(result) };\n    steps.push(s);\n    log(\n      `${s.ok ? (s.dryRun ? \"faked \" : \"ok    \") : `${s.code ?? \"error\"}`.padEnd(6)} ${step}: ${tool}`,\n    );\n    return s;\n  };\n\n  await call(\"read: list contacts\", \"crm_list_contacts\", { limit: 10 });\n  await call(\"read: get one\", \"crm_get_contact\", { id: \"c_1\" });\n  await call(\"write: create\", \"crm_create_contact\", {\n    name: \"Demo Person\",\n    email: \"demo@example.com\",\n  });\n  await call(\"write: update\", \"crm_update_contact\", { id: \"c_1\", fields: { name: \"Ada L.\" } });\n  await call(\"write: delete (destructive)\", \"crm_delete_contact\", { id: \"c_2\" });\n  await call(\"write: send email\", \"crm_send_email\", {\n    to: \"ada@example.com\",\n    subject: \"Hi\",\n    body: \"Hello from the demo agent\",\n  });\n  await call(\"spend: charge $12\", \"crm_charge_card\", {\n    customer_id: \"c_1\",\n    amount_cents: 1200,\n    currency: \"usd\",\n  });\n\n  const loops = opts.loop ?? 5;\n  for (let i = 0; i < loops; i += 1) {\n    const s = await call(`loop ${i + 1}/${loops}: identical update`, \"crm_update_contact\", {\n      id: \"c_3\",\n      fields: { name: \"Same Thing\" },\n    });\n    if (s.code === \"LOOP_DETECTED\") break;\n  }\n\n  const burst = opts.burst ?? 60;\n  for (let i = 0; i < burst; i += 1) {\n    const s = await call(`burst ${i + 1}/${burst}: create`, \"crm_create_contact\", {\n      name: `Bulk ${i}`,\n      email: `bulk${i}@example.com`,\n    });\n    if (s.code === \"CAP_EXCEEDED\") break;\n  }\n  return steps;\n}\n\nconst isMain = process.argv[1] !== undefined && /demo-agent\\.[cm]?[jt]s$/.test(process.argv[1]);\nif (isMain) {\n  const argv = process.argv.slice(2);\n  const arg = (name: string): string | undefined => {\n    const i = argv.indexOf(name);\n    return i >= 0 ? argv[i + 1] : undefined;\n  };\n  const url = arg(\"--url\");\n  const config = arg(\"--config\") ?? \"okgate.yaml\";\n  const client = new Client({ name: \"okgate-demo-agent\", version: \"0.1.0\" });\n  if (url) {\n    await client.connect(\n      new StreamableHTTPClientTransport(new URL(url), {\n        requestInit: {\n          headers: { \"X-Run-Id\": arg(\"--run-id\") ?? `demo_${Date.now().toString(36)}` },\n        },\n      }),\n    );\n  } else {\n    const cli = path.resolve(path.dirname(fileURLToPath(import.meta.url)), \"../cli.js\");\n    await client.connect(\n      new StdioClientTransport({\n        command: process.execPath,\n        args: [cli, \"proxy\", \"--config\", config],\n        stderr: \"inherit\",\n      }),\n    );\n  }\n  try {\n    const steps = await runDemoAgent(client, {\n      log: (l) => console.log(l),\n      runId: arg(\"--run-id\"),\n    });\n    const halts = steps.filter((s) => !s.ok).map((s) => s.code);\n    console.log(\n      `\\n${steps.length} calls; halts: ${halts.join(\", \") || \"none\"}. Now run: okgate report`,\n    );\n  } finally {\n    await client.close();\n  }\n}\n"],"mappings":";AAQA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAE9C,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AAoBjB,SAAS,UAAU,QAKjB;AACA,QAAM,OAAO,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,GAAG;AAC5D,QAAM,OAAQ,OAAO,OAAyD;AAC9E,MAAI,OAAO,SAAS;AAClB,QAAI;AACJ,QAAI;AACF,aAAQ,KAAK,MAAM,QAAQ,IAAI,EAAwB;AAAA,IACzD,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,IAAI,OAAO,MAAM,KAAK;AAAA,EACjC;AACA,SAAO,EAAE,IAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAChD;AAGA,eAAsB,aAAa,QAAgB,OAAoB,CAAC,GAAwB;AAC9F,QAAM,QAAoB,CAAC;AAC3B,QAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,QAAM,OAAO,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI;AAClD,QAAM,OAAO,OACX,MACA,MACA,SACsB;AACtB,UAAM,SAAU,MAAM,OAAO,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,OAAO;AAAA,IACT,CAAC;AACD,UAAM,IAAI,EAAE,MAAM,MAAM,GAAG,UAAU,MAAM,EAAE;AAC7C,UAAM,KAAK,CAAC;AACZ;AAAA,MACE,GAAG,EAAE,KAAM,EAAE,SAAS,WAAW,WAAY,GAAG,EAAE,QAAQ,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,IAAI,KAAK,IAAI;AAAA,IAChG;AACA,WAAO;AAAA,EACT;AAEA,QAAM,KAAK,uBAAuB,qBAAqB,EAAE,OAAO,GAAG,CAAC;AACpE,QAAM,KAAK,iBAAiB,mBAAmB,EAAE,IAAI,MAAM,CAAC;AAC5D,QAAM,KAAK,iBAAiB,sBAAsB;AAAA,IAChD,MAAM;AAAA,IACN,OAAO;AAAA,EACT,CAAC;AACD,QAAM,KAAK,iBAAiB,sBAAsB,EAAE,IAAI,OAAO,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC;AAC3F,QAAM,KAAK,+BAA+B,sBAAsB,EAAE,IAAI,MAAM,CAAC;AAC7E,QAAM,KAAK,qBAAqB,kBAAkB;AAAA,IAChD,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,MAAM;AAAA,EACR,CAAC;AACD,QAAM,KAAK,qBAAqB,mBAAmB;AAAA,IACjD,aAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,QAAQ,KAAK,QAAQ;AAC3B,WAAS,IAAI,GAAG,IAAI,OAAO,KAAK,GAAG;AACjC,UAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,sBAAsB,sBAAsB;AAAA,MACrF,IAAI;AAAA,MACJ,QAAQ,EAAE,MAAM,aAAa;AAAA,IAC/B,CAAC;AACD,QAAI,EAAE,SAAS,gBAAiB;AAAA,EAClC;AAEA,QAAM,QAAQ,KAAK,SAAS;AAC5B,WAAS,IAAI,GAAG,IAAI,OAAO,KAAK,GAAG;AACjC,UAAM,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,YAAY,sBAAsB;AAAA,MAC5E,MAAM,QAAQ,CAAC;AAAA,MACf,OAAO,OAAO,CAAC;AAAA,IACjB,CAAC;AACD,QAAI,EAAE,SAAS,eAAgB;AAAA,EACjC;AACA,SAAO;AACT;AAEA,IAAM,SAAS,QAAQ,KAAK,CAAC,MAAM,UAAa,0BAA0B,KAAK,QAAQ,KAAK,CAAC,CAAC;AAC9F,IAAI,QAAQ;AACV,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,MAAM,CAAC,SAAqC;AAChD,UAAM,IAAI,KAAK,QAAQ,IAAI;AAC3B,WAAO,KAAK,IAAI,KAAK,IAAI,CAAC,IAAI;AAAA,EAChC;AACA,QAAM,MAAM,IAAI,OAAO;AACvB,QAAM,SAAS,IAAI,UAAU,KAAK;AAClC,QAAM,SAAS,IAAI,OAAO,EAAE,MAAM,qBAAqB,SAAS,QAAQ,CAAC;AACzE,MAAI,KAAK;AACP,UAAM,OAAO;AAAA,MACX,IAAI,8BAA8B,IAAI,IAAI,GAAG,GAAG;AAAA,QAC9C,aAAa;AAAA,UACX,SAAS,EAAE,YAAY,IAAI,UAAU,KAAK,QAAQ,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG;AAAA,QAC9E;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,WAAW;AAClF,UAAM,OAAO;AAAA,MACX,IAAI,qBAAqB;AAAA,QACvB,SAAS,QAAQ;AAAA,QACjB,MAAM,CAAC,KAAK,SAAS,YAAY,MAAM;AAAA,QACvC,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACF,UAAM,QAAQ,MAAM,aAAa,QAAQ;AAAA,MACvC,KAAK,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MACzB,OAAO,IAAI,UAAU;AAAA,IACvB,CAAC;AACD,UAAM,QAAQ,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC1D,YAAQ;AAAA,MACN;AAAA,EAAK,MAAM,MAAM,kBAAkB,MAAM,KAAK,IAAI,KAAK,MAAM;AAAA,IAC/D;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;","names":[]}

package/dist/chunk-XPNBYSIN.js

@@ -0,0 +1,23 @@
+// src/install.ts
+var NEW_NPM_NAMES = false;
+var FROM_GITHUB = false;
+var BIN = "okgate";
+var PACKAGE = NEW_NPM_NAMES ? "@agentwares/okgate" : "@agentwares/agentguard";
+var GITHUB = "--allow-git=root github:agentwares/okgate";
+function npxArgs(opts = {}) {
+  const pkg = `${PACKAGE}${opts.version ? `@${opts.version}` : ""}`;
+  return [...opts.yes ? ["-y"] : [], ...NEW_NPM_NAMES ? [pkg] : ["-p", pkg, BIN]];
+}
+var INSTALL = FROM_GITHUB ? `npx ${GITHUB}` : ["npx", ...npxArgs()].join(" ");
+var RUN = FROM_GITHUB ? `npx -y ${GITHUB}` : ["npx", ...npxArgs({ yes: true })].join(" ");
+function npxCommand(version) {
+  return ["npx", ...npxArgs({ yes: true, version })].join(" ");
+}
+
+export {
+  npxArgs,
+  INSTALL,
+  RUN,
+  npxCommand
+};
+//# sourceMappingURL=chunk-XPNBYSIN.js.map

package/dist/chunk-XPNBYSIN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/install.ts"],"sourcesContent":["/**\n * How to run okgate: the one constant behind every place the command is shown, printed or\n * written into someone's config: `--help` and the CLI's own hints, the hook command `hooks\n * install` writes, the MCP server entry `init` writes, the README, llms.txt, server.json and the\n * plugin files. src/distribution.test.ts fails while any of them names a form that does not run.\n *\n * agentguard was renamed okgate on 8 Oct 2026 (brief REN-1). The new npm names need the owner's\n * security key for their first publish, so until then npm serves okgate as a second bin of the\n * package it always was: `npx -p @agentwares/agentguard okgate`.\n *\n * - NEW_NPM_NAMES: flip when `@agentwares/okgate`, `-core` and `-sdk` 0.2.0 are on npm (and the\n *   old names have become shims). Hook commands and MCP entries then name `@agentwares/okgate`.\n *   The rest of the flip is listed in docs/handoff/briefs/REN-1.md's PR and in shims/README.md.\n * - FROM_GITHUB: the npm-free form REL-1 uses for the doors,\n *   `npx --allow-git=root github:agentwares/okgate` (npm 12 refuses a git spec unless\n *   `--allow-git` permits it; `root` permits only the one named; npm 10 and 11 accept the flag).\n *   It needs the public repo renamed AND a runnable package at its root, which it does not have\n *   today: scripts/sync-oss-repos.sh generates agentguard as a private pnpm workspace. Leave it\n *   off until `npx --allow-git=root github:agentwares/okgate --version` prints a version.\n */\nexport const NEW_NPM_NAMES: boolean = false;\nexport const FROM_GITHUB: boolean = false;\n\nexport const BIN = \"okgate\";\n/** The npm package that serves the CLI. */\nexport const PACKAGE = NEW_NPM_NAMES ? \"@agentwares/okgate\" : \"@agentwares/agentguard\";\n/** The npm package the policy engine is published as. */\nexport const CORE_PACKAGE = NEW_NPM_NAMES\n  ? \"@agentwares/okgate-core\"\n  : \"@agentwares/agentguard-core\";\n/** The npm package the SDK is published as. */\nexport const SDK_PACKAGE = NEW_NPM_NAMES ? \"@agentwares/okgate-sdk\" : \"@agentwares/agentguard-sdk\";\n\nconst GITHUB = \"--allow-git=root github:agentwares/okgate\";\n\n/** `npx` arguments that run the CLI from npm; `version` pins it. */\nexport function npxArgs(opts: { yes?: boolean; version?: string } = {}): string[] {\n  const pkg = `${PACKAGE}${opts.version ? `@${opts.version}` : \"\"}`;\n  return [...(opts.yes ? [\"-y\"] : []), ...(NEW_NPM_NAMES ? [pkg] : [\"-p\", pkg, BIN])];\n}\n\n/** What a person types. */\nexport const INSTALL = FROM_GITHUB ? `npx ${GITHUB}` : [\"npx\", ...npxArgs()].join(\" \");\n\n/** What an agent runs unattended: no install prompt. */\nexport const RUN = FROM_GITHUB ? `npx -y ${GITHUB}` : [\"npx\", ...npxArgs({ yes: true })].join(\" \");\n\n/**\n * The command a hook or an MCP client config runs: always from npm, pinned when `version` is\n * given, so a committed settings file keeps running the build that wrote it.\n */\nexport function npxCommand(version?: string): string {\n  return [\"npx\", ...npxArgs({ yes: true, version })].join(\" \");\n}\n"],"mappings":";AAoBO,IAAM,gBAAyB;AAC/B,IAAM,cAAuB;AAE7B,IAAM,MAAM;AAEZ,IAAM,UAAU,gBAAgB,uBAAuB;AAQ9D,IAAM,SAAS;AAGR,SAAS,QAAQ,OAA4C,CAAC,GAAa;AAChF,QAAM,MAAM,GAAG,OAAO,GAAG,KAAK,UAAU,IAAI,KAAK,OAAO,KAAK,EAAE;AAC/D,SAAO,CAAC,GAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAI,GAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,CAAE;AACpF;AAGO,IAAM,UAAU,cAAc,OAAO,MAAM,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,EAAE,KAAK,GAAG;AAG9E,IAAM,MAAM,cAAc,UAAU,MAAM,KAAK,CAAC,OAAO,GAAG,QAAQ,EAAE,KAAK,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG;AAM1F,SAAS,WAAW,SAA0B;AACnD,SAAO,CAAC,OAAO,GAAG,QAAQ,EAAE,KAAK,MAAM,QAAQ,CAAC,CAAC,EAAE,KAAK,GAAG;AAC7D;","names":[]}