@agentwares/agentguard 0.1.7 → 0.1.10

package/dist/init-MKPQU2JG.js

@@ -0,0 +1,17 @@
+import {
+  initCommand,
+  renderStarterPolicy
+} from "./chunk-IEJK7N3B.js";
+import "./chunk-OM5L7A32.js";
+import "./chunk-DEVXG3IB.js";
+import "./chunk-TJXZBOHL.js";
+import "./chunk-IS3DAHZI.js";
+import "./chunk-2QDPPTPY.js";
+import "./chunk-XPNBYSIN.js";
+import "./chunk-4WTFMFRY.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  initCommand,
+  renderStarterPolicy
+};
+//# sourceMappingURL=init-MKPQU2JG.js.map

package/dist/init-MKPQU2JG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/proxy-6GP63TLD.js

@@ -0,0 +1,146 @@
+import {
+  INIT_COMMAND,
+  createDownstreamServer,
+  startHttpProxy
+} from "./chunk-JSELR4SG.js";
+import {
+  ProxyRuntime
+} from "./chunk-TJXZBOHL.js";
+import {
+  serveStdio
+} from "./chunk-IS3DAHZI.js";
+import "./chunk-XPNBYSIN.js";
+import {
+  createFileGuard,
+  flagBool,
+  flagNumber,
+  flagString,
+  loadPolicyFor,
+  policyPathFrom
+} from "./chunk-4WTFMFRY.js";
+import "./chunk-5WRI5ZAA.js";
+
+// src/commands/proxy.ts
+import { existsSync } from "fs";
+import { Guard, defaultPolicy, envTwin, resolveAgent } from "@agentwares/agentguard-core";
+import {
+  killSwitchFor,
+  resolveLoadedPolicy
+} from "@agentwares/agentguard-core/node";
+function newRunId(now = /* @__PURE__ */ new Date()) {
+  return `run_${now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;
+}
+function unconfiguredPolicy(args, io) {
+  if (flagString(args, "config") !== void 0 || envTwin(io.env, "CONFIG")) return void 0;
+  const path = policyPathFrom(args, io);
+  if (existsSync(path)) return void 0;
+  return resolveLoadedPolicy(defaultPolicy(), path, {});
+}
+async function serveOverStdio(runtime) {
+  const server = createDownstreamServer(runtime);
+  const stop = async () => {
+    await runtime.close();
+  };
+  process.once("SIGINT", () => void stop().then(() => process.exit(0)));
+  process.once("SIGTERM", () => void stop().then(() => process.exit(0)));
+  await serveStdio(server);
+  await stop();
+  return 0;
+}
+async function proxyCommand(args, io) {
+  const log = (line) => io.err(`[okgate] ${line}`);
+  const modeOverride = flagString(args, "mode");
+  const http = flagBool(args, "http") === true;
+  const unconfigured = http ? void 0 : unconfiguredPolicy(args, io);
+  if (unconfigured) {
+    if (modeOverride === "dry-run" || modeOverride === "enforce")
+      unconfigured.policy.mode = modeOverride;
+    const runtime2 = new ProxyRuntime({
+      loaded: unconfigured,
+      guard: new Guard({
+        policy: unconfigured.policy,
+        env: io.env,
+        kill: killSwitchFor(unconfigured)
+      }),
+      configured: false,
+      defaultRunId: flagString(args, "run-id") ?? newRunId(),
+      log
+    });
+    await runtime2.start();
+    log(
+      `no policy file at ${unconfigured.path}: serving okgate's own read-only tools only. To guard your MCP servers, run \`${INIT_COMMAND}\` in the project directory.`
+    );
+    return serveOverStdio(runtime2);
+  }
+  const loaded = loadPolicyFor(args, io);
+  if (modeOverride === "dry-run" || modeOverride === "enforce") loaded.policy.mode = modeOverride;
+  const agentName = flagString(args, "agent");
+  let agent = void 0;
+  if (agentName) {
+    const resolved = await resolveAgent(loaded.policy, { name: agentName });
+    if (resolved.error) {
+      io.err(
+        `unknown agent "${agentName}" \u2014 agents in okgate.yaml: ${loaded.policy.agents.map((a) => a.name).join(", ") || "none"}`
+      );
+      return 1;
+    }
+    agent = resolved.agent;
+  }
+  let approvalBase;
+  const fileGuard = createFileGuard(loaded, {
+    log,
+    env: io.env,
+    approvalUrl: (r) => approvalBase ? `${approvalBase.baseUrl}/approve/${r.id}?token=${approvalBase.token}` : void 0,
+    onEvent: (e) => {
+      if (e.type === "APPROVAL_DECIDED") return;
+      log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : ""}`);
+      if (e.type === "APPROVAL_REQUIRED" && e.approval)
+        log(`approve with: okgate approve ${e.approval.id}`);
+    }
+  });
+  const runtime = new ProxyRuntime({
+    loaded,
+    guard: fileGuard.guard,
+    agent,
+    defaultRunId: flagString(args, "run-id") ?? newRunId(),
+    log
+  });
+  await runtime.start();
+  const killed = await fileGuard.kill.check();
+  if (killed.killed)
+    log(`kill switch is ON (${killed.reason}); every call returns KILLED until \`okgate resume\``);
+  if (runtime.upstreamStatus().length === 0)
+    log(
+      `${loaded.path} lists no upstreams: serving okgate's own read-only tools only. Add servers under \`upstreams:\` to guard them.`
+    );
+  if (http) {
+    const server = await startHttpProxy({
+      runtime,
+      port: flagNumber(args, "port") ?? 8788,
+      host: flagString(args, "host") ?? "127.0.0.1",
+      token: envTwin(io.env, "HTTP_TOKEN")
+    });
+    approvalBase = { baseUrl: server.url.replace(/\/mcp$/, ""), token: server.token };
+    log(
+      `Streamable HTTP at ${server.url} \xB7 GET ${approvalBase.baseUrl}/health \xB7 control token in ${loaded.stateDir}/http.json`
+    );
+    log(
+      `point your agent at ${server.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`
+    );
+    const stop = async () => {
+      await server.close();
+      await runtime.close();
+      process.exit(0);
+    };
+    process.once("SIGINT", () => void stop());
+    process.once("SIGTERM", () => void stop());
+    await new Promise(() => void 0);
+  }
+  return serveOverStdio(runtime);
+}
+export {
+  newRunId,
+  proxyCommand,
+  unconfiguredPolicy
+};
+//# sourceMappingURL=proxy-6GP63TLD.js.map

package/dist/proxy-6GP63TLD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/proxy.ts"],"sourcesContent":["/**\n * `okgate proxy` — stdio by default (what MCP clients spawn), `--http` for Streamable HTTP\n * with the control endpoints. Logs go to stderr only; stdout is the MCP channel.\n */\nimport { existsSync } from \"node:fs\";\nimport { serveStdio } from \"@agentwares/mcp-kit\";\nimport { Guard, defaultPolicy, envTwin, resolveAgent } from \"@agentwares/agentguard-core\";\nimport {\n  killSwitchFor,\n  resolveLoadedPolicy,\n  type LoadedPolicy,\n} from \"@agentwares/agentguard-core/node\";\nimport { flagBool, flagNumber, flagString, type ParsedArgs } from \"../args.js\";\nimport { createFileGuard, loadPolicyFor, policyPathFrom, type Io } from \"../context.js\";\nimport { startHttpProxy } from \"../proxy/http.js\";\nimport { INIT_COMMAND } from \"../proxy/own-tools.js\";\nimport { ProxyRuntime } from \"../proxy/runtime.js\";\nimport { createDownstreamServer } from \"../proxy/server.js\";\n\nexport function newRunId(now: Date = new Date()): string {\n  return `run_${now\n    .toISOString()\n    .replace(/[-:.TZ]/g, \"\")\n    .slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;\n}\n\n/**\n * The policy okgate runs on when no `okgate.yaml` exists and none was named: the\n * defaults, no upstreams, paths resolved where the file would be. It is what an install button\n * or a registry install starts before `init` has run. Nothing is written for it: the guard built\n * on it keeps counters, audit and approvals in memory, so the proxy leaves no `.okgate/` in\n * whatever directory the client spawned it in.\n *\n * `undefined` when a policy file exists, or when one was named with `--config` or\n * `OKGATE_CONFIG` / `AGENTGUARD_CONFIG` — a named file that is missing is still an error.\n */\nexport function unconfiguredPolicy(args: ParsedArgs, io: Io): LoadedPolicy | undefined {\n  if (flagString(args, \"config\") !== undefined || envTwin(io.env, \"CONFIG\")) return undefined;\n  const path = policyPathFrom(args, io);\n  if (existsSync(path)) return undefined;\n  return resolveLoadedPolicy(defaultPolicy(), path, {});\n}\n\nasync function serveOverStdio(runtime: ProxyRuntime): Promise<number> {\n  const server = createDownstreamServer(runtime);\n  const stop = async (): Promise<void> => {\n    await runtime.close();\n  };\n  process.once(\"SIGINT\", () => void stop().then(() => process.exit(0)));\n  process.once(\"SIGTERM\", () => void stop().then(() => process.exit(0)));\n  await serveStdio(server);\n  await stop();\n  return 0;\n}\n\nexport async function proxyCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const log = (line: string): void => io.err(`[okgate] ${line}`);\n  const modeOverride = flagString(args, \"mode\");\n  const http = flagBool(args, \"http\") === true;\n\n  // No policy file and none named: serve okgate's own read-only tools over stdio rather than\n  // exit, so a client that installed it from a button or a registry gets a working server that\n  // says how to set it up. `--http` still needs a policy (it writes its control token beside it).\n  const unconfigured = http ? undefined : unconfiguredPolicy(args, io);\n  if (unconfigured) {\n    if (modeOverride === \"dry-run\" || modeOverride === \"enforce\")\n      unconfigured.policy.mode = modeOverride;\n    const runtime = new ProxyRuntime({\n      loaded: unconfigured,\n      guard: new Guard({\n        policy: unconfigured.policy,\n        env: io.env,\n        kill: killSwitchFor(unconfigured),\n      }),\n      configured: false,\n      defaultRunId: flagString(args, \"run-id\") ?? newRunId(),\n      log,\n    });\n    await runtime.start();\n    log(\n      `no policy file at ${unconfigured.path}: serving okgate's own read-only tools only. To guard your MCP servers, run \\`${INIT_COMMAND}\\` in the project directory.`,\n    );\n    return serveOverStdio(runtime);\n  }\n\n  const loaded = loadPolicyFor(args, io);\n  if (modeOverride === \"dry-run\" || modeOverride === \"enforce\") loaded.policy.mode = modeOverride;\n\n  const agentName = flagString(args, \"agent\");\n  let agent = undefined;\n  if (agentName) {\n    const resolved = await resolveAgent(loaded.policy, { name: agentName });\n    if (resolved.error) {\n      io.err(\n        `unknown agent \"${agentName}\" — agents in okgate.yaml: ${loaded.policy.agents.map((a) => a.name).join(\", \") || \"none\"}`,\n      );\n      return 1;\n    }\n    agent = resolved.agent;\n  }\n\n  let approvalBase: { baseUrl: string; token: string } | undefined;\n  const fileGuard = createFileGuard(loaded, {\n    log,\n    env: io.env,\n    approvalUrl: (r) =>\n      approvalBase\n        ? `${approvalBase.baseUrl}/approve/${r.id}?token=${approvalBase.token}`\n        : undefined,\n    onEvent: (e) => {\n      if (e.type === \"APPROVAL_DECIDED\") return;\n      log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : \"\"}`);\n      if (e.type === \"APPROVAL_REQUIRED\" && e.approval)\n        log(`approve with: okgate approve ${e.approval.id}`);\n    },\n  });\n  const runtime = new ProxyRuntime({\n    loaded,\n    guard: fileGuard.guard,\n    agent,\n    defaultRunId: flagString(args, \"run-id\") ?? newRunId(),\n    log,\n  });\n  await runtime.start();\n  const killed = await fileGuard.kill.check();\n  if (killed.killed)\n    log(`kill switch is ON (${killed.reason}); every call returns KILLED until \\`okgate resume\\``);\n  if (runtime.upstreamStatus().length === 0)\n    log(\n      `${loaded.path} lists no upstreams: serving okgate's own read-only tools only. Add servers under \\`upstreams:\\` to guard them.`,\n    );\n\n  if (http) {\n    const server = await startHttpProxy({\n      runtime,\n      port: flagNumber(args, \"port\") ?? 8788,\n      host: flagString(args, \"host\") ?? \"127.0.0.1\",\n      token: envTwin(io.env, \"HTTP_TOKEN\"),\n    });\n    approvalBase = { baseUrl: server.url.replace(/\\/mcp$/, \"\"), token: server.token };\n    log(\n      `Streamable HTTP at ${server.url} · GET ${approvalBase.baseUrl}/health · control token in ${loaded.stateDir}/http.json`,\n    );\n    log(\n      `point your agent at ${server.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`,\n    );\n    const stop = async (): Promise<void> => {\n      await server.close();\n      await runtime.close();\n      process.exit(0);\n    };\n    process.once(\"SIGINT\", () => void stop());\n    process.once(\"SIGTERM\", () => void stop());\n    await new Promise<never>(() => undefined);\n  }\n\n  return serveOverStdio(runtime);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,kBAAkB;AAE3B,SAAS,OAAO,eAAe,SAAS,oBAAoB;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAQA,SAAS,SAAS,MAAY,oBAAI,KAAK,GAAW;AACvD,SAAO,OAAO,IACX,YAAY,EACZ,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC3D;AAYO,SAAS,mBAAmB,MAAkB,IAAkC;AACrF,MAAI,WAAW,MAAM,QAAQ,MAAM,UAAa,QAAQ,GAAG,KAAK,QAAQ,EAAG,QAAO;AAClF,QAAM,OAAO,eAAe,MAAM,EAAE;AACpC,MAAI,WAAW,IAAI,EAAG,QAAO;AAC7B,SAAO,oBAAoB,cAAc,GAAG,MAAM,CAAC,CAAC;AACtD;AAEA,eAAe,eAAe,SAAwC;AACpE,QAAM,SAAS,uBAAuB,OAAO;AAC7C,QAAM,OAAO,YAA2B;AACtC,UAAM,QAAQ,MAAM;AAAA,EACtB;AACA,UAAQ,KAAK,UAAU,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AACpE,UAAQ,KAAK,WAAW,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AACrE,QAAM,WAAW,MAAM;AACvB,QAAM,KAAK;AACX,SAAO;AACT;AAEA,eAAsB,aAAa,MAAkB,IAAyB;AAC5E,QAAM,MAAM,CAAC,SAAuB,GAAG,IAAI,YAAY,IAAI,EAAE;AAC7D,QAAM,eAAe,WAAW,MAAM,MAAM;AAC5C,QAAM,OAAO,SAAS,MAAM,MAAM,MAAM;AAKxC,QAAM,eAAe,OAAO,SAAY,mBAAmB,MAAM,EAAE;AACnE,MAAI,cAAc;AAChB,QAAI,iBAAiB,aAAa,iBAAiB;AACjD,mBAAa,OAAO,OAAO;AAC7B,UAAMA,WAAU,IAAI,aAAa;AAAA,MAC/B,QAAQ;AAAA,MACR,OAAO,IAAI,MAAM;AAAA,QACf,QAAQ,aAAa;AAAA,QACrB,KAAK,GAAG;AAAA,QACR,MAAM,cAAc,YAAY;AAAA,MAClC,CAAC;AAAA,MACD,YAAY;AAAA,MACZ,cAAc,WAAW,MAAM,QAAQ,KAAK,SAAS;AAAA,MACrD;AAAA,IACF,CAAC;AACD,UAAMA,SAAQ,MAAM;AACpB;AAAA,MACE,qBAAqB,aAAa,IAAI,iFAAiF,YAAY;AAAA,IACrI;AACA,WAAO,eAAeA,QAAO;AAAA,EAC/B;AAEA,QAAM,SAAS,cAAc,MAAM,EAAE;AACrC,MAAI,iBAAiB,aAAa,iBAAiB,UAAW,QAAO,OAAO,OAAO;AAEnF,QAAM,YAAY,WAAW,MAAM,OAAO;AAC1C,MAAI,QAAQ;AACZ,MAAI,WAAW;AACb,UAAM,WAAW,MAAM,aAAa,OAAO,QAAQ,EAAE,MAAM,UAAU,CAAC;AACtE,QAAI,SAAS,OAAO;AAClB,SAAG;AAAA,QACD,kBAAkB,SAAS,mCAA8B,OAAO,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,MAAM;AAAA,MACvH;AACA,aAAO;AAAA,IACT;AACA,YAAQ,SAAS;AAAA,EACnB;AAEA,MAAI;AACJ,QAAM,YAAY,gBAAgB,QAAQ;AAAA,IACxC;AAAA,IACA,KAAK,GAAG;AAAA,IACR,aAAa,CAAC,MACZ,eACI,GAAG,aAAa,OAAO,YAAY,EAAE,EAAE,UAAU,aAAa,KAAK,KACnE;AAAA,IACN,SAAS,CAAC,MAAM;AACd,UAAI,EAAE,SAAS,mBAAoB;AACnC,UAAI,GAAG,EAAE,IAAI,IAAI,EAAE,IAAI,SAAS,EAAE,KAAK,IAAI,EAAE,QAAQ,KAAK,EAAE,MAAM,KAAK,KAAK,EAAE,EAAE;AAChF,UAAI,EAAE,SAAS,uBAAuB,EAAE;AACtC,YAAI,gCAAgC,EAAE,SAAS,EAAE,EAAE;AAAA,IACvD;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,aAAa;AAAA,IAC/B;AAAA,IACA,OAAO,UAAU;AAAA,IACjB;AAAA,IACA,cAAc,WAAW,MAAM,QAAQ,KAAK,SAAS;AAAA,IACrD;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,MAAM;AACpB,QAAM,SAAS,MAAM,UAAU,KAAK,MAAM;AAC1C,MAAI,OAAO;AACT,QAAI,sBAAsB,OAAO,MAAM,sDAAsD;AAC/F,MAAI,QAAQ,eAAe,EAAE,WAAW;AACtC;AAAA,MACE,GAAG,OAAO,IAAI;AAAA,IAChB;AAEF,MAAI,MAAM;AACR,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA,MAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAClC,MAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAClC,OAAO,QAAQ,GAAG,KAAK,YAAY;AAAA,IACrC,CAAC;AACD,mBAAe,EAAE,SAAS,OAAO,IAAI,QAAQ,UAAU,EAAE,GAAG,OAAO,OAAO,MAAM;AAChF;AAAA,MACE,sBAAsB,OAAO,GAAG,aAAU,aAAa,OAAO,iCAA8B,OAAO,QAAQ;AAAA,IAC7G;AACA;AAAA,MACE,uBAAuB,OAAO,GAAG;AAAA,IACnC;AACA,UAAM,OAAO,YAA2B;AACtC,YAAM,OAAO,MAAM;AACnB,YAAM,QAAQ,MAAM;AACpB,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,KAAK,UAAU,MAAM,KAAK,KAAK,CAAC;AACxC,YAAQ,KAAK,WAAW,MAAM,KAAK,KAAK,CAAC;AACzC,UAAM,IAAI,QAAe,MAAM,MAAS;AAAA,EAC1C;AAEA,SAAO,eAAe,OAAO;AAC/B;","names":["runtime"]}

package/dist/tools-XS7PMTLT.js

@@ -0,0 +1,15 @@
+import {
+  formatToolTable,
+  probeUpstreams,
+  toolsCommand
+} from "./chunk-DEVXG3IB.js";
+import "./chunk-TJXZBOHL.js";
+import "./chunk-IS3DAHZI.js";
+import "./chunk-4WTFMFRY.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  formatToolTable,
+  probeUpstreams,
+  toolsCommand
+};
+//# sourceMappingURL=tools-XS7PMTLT.js.map

package/dist/tools-XS7PMTLT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/llms.txt

@@ -1,10 +1,16 @@
-# agentguard
+# okgate
 
-> MCP policy proxy for AI agents: hard spend limits, destructive-action gating with approvals, kill switch, scoped agent keys, dry-run writes with mutation diffs, semantic loop breaker, blast-radius caps, hash-chained audit log. CLI `npx @agentwares/agentguard`; SDK `@agentwares/agentguard-sdk`. No LLM calls, no phone-home, no account.
+> Nothing irreversible without an OK. okgate (formerly agentguard) is an MCP policy proxy and coding-agent hook: hard spend limits, destructive-action gating with approvals, kill switch, scoped agent keys, dry-run writes with mutation diffs, semantic loop breaker, blast-radius caps, hash-chained audit log. CLI `npx -p @agentwares/agentguard okgate`; SDK `@agentwares/agentguard-sdk`. No LLM calls, no phone-home, no account.
 
-Set up: `npx -y @agentwares/agentguard init` in the project directory writes agentguard.yaml (dry-run) and routes the project's MCP servers through the proxy. The same command ships as a Claude Code plugin (`/plugin marketplace add agentwares/agentguard`, then `/plugin install agentguard@agentwares`) and a Gemini CLI extension (`gemini extensions install https://github.com/agentwares/agentguard`).
+Set up: `npx -y -p @agentwares/agentguard okgate init` in the project directory writes okgate.yaml (dry-run) and routes the project's MCP servers through the proxy. The same command ships as a Claude Code plugin (`/plugin marketplace add agentwares/agentguard`, then `/plugin install agentguard@agentwares`) and a Gemini CLI extension (`gemini extensions install https://github.com/agentwares/agentguard`).
 
-Started with no agentguard.yaml (an editor install button, a registry install, the repo's Dockerfile), the proxy fronts no servers and serves three read-only tools of its own: `agentguard_get_status` (what it guards, caps used and remaining, kill switch, pending approvals), `agentguard_get_report` (what a run did, or would have done in dry-run) and `agentguard_verify_audit_log` (the hash chain). With upstreams configured, the agent sees only the upstreams' tools.
+Started with no okgate.yaml (an editor install button, a registry install, the repo's Dockerfile), the proxy fronts no servers and serves three read-only tools of its own: `okgate_get_status` (what it guards, caps used and remaining, kill switch, pending approvals), `okgate_get_report` (what a run did, or would have done in dry-run) and `okgate_verify_audit_log` (the hash chain). The agentguard_* names they had before the rename still work until 2027-01-15. With upstreams configured, the agent sees only the upstreams' tools.
+
+Renamed from agentguard on 8 Oct 2026: agentguard.yaml, an existing .agentguard/ directory, AGENTGUARD_* variables, the `agentguard` bin and the agentguard_* tool names keep working; npm serves the `okgate` bin from @agentwares/agentguard until @agentwares/okgate is published.
+
+Hook mode: `npx -y -p @agentwares/agentguard okgate hooks install` (add `--client codex`, `--client gemini` or `--client all`) writes a pre-execution hook (Claude Code PreToolUse, Codex PreToolUse, Gemini CLI BeforeTool) that checks the coding agent's own shell commands, file edits and MCP calls against the same okgate.yaml. Irreversible commands (git push, merges, tag deletion, rm outside the workspace, package publish, sending mail or messages, edits to the guard itself) run only on a recent turn a person typed that names the action; in Claude Code that is read from the session transcript, and text the model writes never counts. Otherwise the agent gets APPROVAL_REQUIRED with an id, and `npx -p @agentwares/agentguard okgate approve <id>` lets the identical command run once. Dry-run (log only) until `hooks.mode: enforce`.
+
+Audit: `npx -y -p @agentwares/agentguard okgate audit [--since 7d|30d|all] [--json]` reads the repository's CLAUDE.md, AGENTS.md, GEMINI.md and .cursor/rules (and `audit.rules` in okgate.yaml) and this machine's Claude Code and Codex sessions in it, and reports per rule how many sessions broke it and when. Rules are recognised by a pattern library with no LLM (never push to main, never force-push, never --no-verify, run X before pushing, use pnpm not npm, do not edit or commit a path, no new dependencies without asking, never rm outside the repo, never publish, never deploy, never run a named command), or stated with an inline `<!-- okgate: <check> -->` (`<!-- agentguard: … -->` still works). It runs locally and sends nothing; `--json` carries counts, rule ids and dates only. `--enforce` writes the checkable rules into okgate.yaml as hook-mode rules in dry-run and installs the hook. The plugin's `/agentguard:audit` has your own agent judge the rules no script can check.
 
 ## Links
 

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@agentwares/agentguard",
-  "version": "0.1.7",
-  "description": "MCP policy proxy for AI agents: hard spend limits, destructive-action gating with approvals, a kill switch, scoped credentials, dry-run writes with mutation diffs, loop breaker, blast-radius caps and a hash-chained audit log. No LLM calls, no phone-home, no account.",
+  "version": "0.1.10",
+  "description": "okgate (formerly agentguard): nothing irreversible without an OK. MCP policy proxy for AI agents: hard spend limits, destructive-action gating with approvals, a kill switch, scoped credentials, dry-run writes with mutation diffs, loop breaker, blast-radius caps and a hash-chained audit log. Hook mode applies the same policy to Claude Code, Codex and Gemini CLI shell commands and file edits, and runs irreversible commands only on a turn a person typed. Audit mode reports which CLAUDE.md / AGENTS.md rules your coding agents broke, from your own sessions, locally. No LLM calls, no phone-home, no account. Runs as `okgate`; the `agentguard` bin, agentguard.yaml, .agentguard/ and AGENTGUARD_* keep working.",
   "license": "MIT",
   "type": "module",
   "bin": {
+    "okgate": "./dist/cli.js",
     "agentguard": "./dist/cli.js"
   },
   "main": "./dist/index.js",
@@ -13,6 +14,9 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./cli": {
+      "import": "./dist/cli.js"
     }
   },
   "files": [
@@ -25,7 +29,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "mcpName": "io.github.agentwares/agentguard",
+  "mcpName": "io.github.agentwares/okgate",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/agentwares/agentguard.git",
@@ -33,6 +37,8 @@
   },
   "homepage": "https://github.com/agentwares/agentguard#readme",
   "keywords": [
+    "okgate",
+    "agentguard",
     "mcp",
     "mcp-proxy",
     "model-context-protocol",
@@ -43,6 +49,12 @@
     "dry-run",
     "audit-log",
     "claude-code",
+    "claude-code-hooks",
+    "claude-md",
+    "agents-md",
+    "codex",
+    "gemini-cli",
+    "coding-agents",
     "cursor",
     "guardrails",
     "mcp-server",
@@ -62,7 +74,7 @@
     "conformance": "node scripts/conformance.mjs"
   },
   "dependencies": {
-    "@agentwares/agentguard-core": "^0.1.3",
+    "@agentwares/agentguard-core": "^0.1.6",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "yaml": "^2.9.0",
     "zod": "^4.5.4"

package/server.json

@@ -1,35 +1,35 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.agentwares/agentguard",
-  "description": "MCP policy proxy: spend caps, approvals for destructive tools, kill switch, dry-run, audit log.",
-  "version": "0.1.7",
+  "name": "io.github.agentwares/okgate",
+  "description": "Nothing irreversible without an OK: MCP policy proxy with spend caps, approvals, kill switch.",
+  "version": "0.1.10",
   "repository": {
     "url": "https://github.com/agentwares/agentguard",
     "source": "github",
     "subfolder": "apps/agentguard-cli"
   },
-  "title": "agentguard",
+  "title": "okgate",
   "websiteUrl": "https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@agentwares/agentguard",
-      "version": "0.1.7",
+      "version": "0.1.10",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
       },
       "environmentVariables": [
         {
-          "name": "AGENTGUARD_CONFIG",
-          "description": "Path to agentguard.yaml (default ./agentguard.yaml). If unset and that file does not exist, agentguard serves only its own read-only tools: agentguard_get_status, agentguard_get_report, agentguard_verify_audit_log",
+          "name": "OKGATE_CONFIG",
+          "description": "Path to okgate.yaml (default ./okgate.yaml, else ./agentguard.yaml; AGENTGUARD_CONFIG also works). With neither file, okgate serves only its own read-only tools: okgate_get_status, okgate_get_report, okgate_verify_audit_log",
           "isRequired": false,
           "format": "filepath"
         },
         {
-          "name": "AGENTGUARD_KILL",
-          "description": "Set to 1 to halt every tool call (kill switch)",
+          "name": "OKGATE_KILL",
+          "description": "Set to 1 to halt every tool call (kill switch); AGENTGUARD_KILL=1 does the same",
           "isRequired": false
         }
       ]