@agentwares/agentguard 0.1.7 → 0.1.9

package/dist/init-CWROGV5I.js

@@ -0,0 +1,15 @@
+import {
+  initCommand,
+  renderStarterPolicy
+} from "./chunk-X4M7YWQA.js";
+import "./chunk-VQWQ5TOM.js";
+import "./chunk-D66U3PVB.js";
+import "./chunk-ZSLWPKXI.js";
+import "./chunk-TW5KJREH.js";
+import "./chunk-SUXQTT3X.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  initCommand,
+  renderStarterPolicy
+};
+//# sourceMappingURL=init-CWROGV5I.js.map

package/dist/init-CWROGV5I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/proxy-3Z5YEZ4R.js

@@ -0,0 +1,154 @@
+import {
+  INIT_COMMAND,
+  createDownstreamServer,
+  startHttpProxy
+} from "./chunk-KRKZGAJ3.js";
+import {
+  ProxyRuntime
+} from "./chunk-D66U3PVB.js";
+import {
+  serveStdio
+} from "./chunk-ZSLWPKXI.js";
+import {
+  createFileGuard,
+  flagBool,
+  flagNumber,
+  flagString,
+  loadPolicyFor,
+  policyPathFrom
+} from "./chunk-SUXQTT3X.js";
+import "./chunk-5WRI5ZAA.js";
+
+// src/commands/proxy.ts
+import { existsSync } from "fs";
+import { dirname } from "path";
+import { Guard, defaultPolicy, resolveAgent } from "@agentwares/agentguard-core";
+import { FileKillSwitch, resolvePath } from "@agentwares/agentguard-core/node";
+function newRunId(now = /* @__PURE__ */ new Date()) {
+  return `run_${now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;
+}
+function unconfiguredPolicy(args, io) {
+  if (flagString(args, "config") !== void 0 || io.env.AGENTGUARD_CONFIG) return void 0;
+  const path = policyPathFrom(args, io);
+  if (existsSync(path)) return void 0;
+  const policy = defaultPolicy();
+  const baseDir = dirname(path);
+  return {
+    policy,
+    path,
+    baseDir,
+    stateDir: resolvePath(policy.state.dir, baseDir),
+    auditPath: resolvePath(policy.audit.path, baseDir),
+    killPath: resolvePath(policy.kill.file, baseDir)
+  };
+}
+async function serveOverStdio(runtime) {
+  const server = createDownstreamServer(runtime);
+  const stop = async () => {
+    await runtime.close();
+  };
+  process.once("SIGINT", () => void stop().then(() => process.exit(0)));
+  process.once("SIGTERM", () => void stop().then(() => process.exit(0)));
+  await serveStdio(server);
+  await stop();
+  return 0;
+}
+async function proxyCommand(args, io) {
+  const log = (line) => io.err(`[agentguard] ${line}`);
+  const modeOverride = flagString(args, "mode");
+  const http = flagBool(args, "http") === true;
+  const unconfigured = http ? void 0 : unconfiguredPolicy(args, io);
+  if (unconfigured) {
+    if (modeOverride === "dry-run" || modeOverride === "enforce")
+      unconfigured.policy.mode = modeOverride;
+    const runtime2 = new ProxyRuntime({
+      loaded: unconfigured,
+      guard: new Guard({
+        policy: unconfigured.policy,
+        env: io.env,
+        kill: new FileKillSwitch(unconfigured.killPath)
+      }),
+      configured: false,
+      defaultRunId: flagString(args, "run-id") ?? newRunId(),
+      log
+    });
+    await runtime2.start();
+    log(
+      `no policy file at ${unconfigured.path}: serving agentguard's own read-only tools only. To guard your MCP servers, run \`${INIT_COMMAND}\` in the project directory.`
+    );
+    return serveOverStdio(runtime2);
+  }
+  const loaded = loadPolicyFor(args, io);
+  if (modeOverride === "dry-run" || modeOverride === "enforce") loaded.policy.mode = modeOverride;
+  const agentName = flagString(args, "agent");
+  let agent = void 0;
+  if (agentName) {
+    const resolved = await resolveAgent(loaded.policy, { name: agentName });
+    if (resolved.error) {
+      io.err(
+        `unknown agent "${agentName}" \u2014 agents in agentguard.yaml: ${loaded.policy.agents.map((a) => a.name).join(", ") || "none"}`
+      );
+      return 1;
+    }
+    agent = resolved.agent;
+  }
+  let approvalBase;
+  const fileGuard = createFileGuard(loaded, {
+    log,
+    env: io.env,
+    approvalUrl: (r) => approvalBase ? `${approvalBase.baseUrl}/approve/${r.id}?token=${approvalBase.token}` : void 0,
+    onEvent: (e) => {
+      if (e.type === "APPROVAL_DECIDED") return;
+      log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : ""}`);
+      if (e.type === "APPROVAL_REQUIRED" && e.approval)
+        log(`approve with: agentguard approve ${e.approval.id}`);
+    }
+  });
+  const runtime = new ProxyRuntime({
+    loaded,
+    guard: fileGuard.guard,
+    agent,
+    defaultRunId: flagString(args, "run-id") ?? newRunId(),
+    log
+  });
+  await runtime.start();
+  const killed = await fileGuard.kill.check();
+  if (killed.killed)
+    log(
+      `kill switch is ON (${killed.reason}); every call returns KILLED until \`agentguard resume\``
+    );
+  if (runtime.upstreamStatus().length === 0)
+    log(
+      `${loaded.path} lists no upstreams: serving agentguard's own read-only tools only. Add servers under \`upstreams:\` to guard them.`
+    );
+  if (http) {
+    const server = await startHttpProxy({
+      runtime,
+      port: flagNumber(args, "port") ?? 8788,
+      host: flagString(args, "host") ?? "127.0.0.1",
+      token: io.env.AGENTGUARD_HTTP_TOKEN
+    });
+    approvalBase = { baseUrl: server.url.replace(/\/mcp$/, ""), token: server.token };
+    log(
+      `Streamable HTTP at ${server.url} \xB7 GET ${approvalBase.baseUrl}/health \xB7 control token in ${loaded.stateDir}/http.json`
+    );
+    log(
+      `point your agent at ${server.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`
+    );
+    const stop = async () => {
+      await server.close();
+      await runtime.close();
+      process.exit(0);
+    };
+    process.once("SIGINT", () => void stop());
+    process.once("SIGTERM", () => void stop());
+    await new Promise(() => void 0);
+  }
+  return serveOverStdio(runtime);
+}
+export {
+  newRunId,
+  proxyCommand,
+  unconfiguredPolicy
+};
+//# sourceMappingURL=proxy-3Z5YEZ4R.js.map

package/dist/proxy-3Z5YEZ4R.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/proxy.ts"],"sourcesContent":["/**\n * `agentguard proxy` — stdio by default (what MCP clients spawn), `--http` for Streamable HTTP\n * with the control endpoints. Logs go to stderr only; stdout is the MCP channel.\n */\nimport { existsSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { serveStdio } from \"@agentwares/mcp-kit\";\nimport { Guard, defaultPolicy, resolveAgent } from \"@agentwares/agentguard-core\";\nimport { FileKillSwitch, resolvePath, type LoadedPolicy } from \"@agentwares/agentguard-core/node\";\nimport { flagBool, flagNumber, flagString, type ParsedArgs } from \"../args.js\";\nimport { createFileGuard, loadPolicyFor, policyPathFrom, type Io } from \"../context.js\";\nimport { startHttpProxy } from \"../proxy/http.js\";\nimport { INIT_COMMAND } from \"../proxy/own-tools.js\";\nimport { ProxyRuntime } from \"../proxy/runtime.js\";\nimport { createDownstreamServer } from \"../proxy/server.js\";\n\nexport function newRunId(now: Date = new Date()): string {\n  return `run_${now\n    .toISOString()\n    .replace(/[-:.TZ]/g, \"\")\n    .slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;\n}\n\n/**\n * The policy agentguard runs on when no `agentguard.yaml` exists and none was named: the\n * defaults, no upstreams, paths resolved where the file would be. It is what an install button\n * or a registry install starts before `init` has run. Nothing is written for it: the guard built\n * on it keeps counters, audit and approvals in memory, so the proxy leaves no `.agentguard/` in\n * whatever directory the client spawned it in.\n *\n * `undefined` when a policy file exists, or when one was named with `--config` or\n * `AGENTGUARD_CONFIG` — a named file that is missing is still an error.\n */\nexport function unconfiguredPolicy(args: ParsedArgs, io: Io): LoadedPolicy | undefined {\n  if (flagString(args, \"config\") !== undefined || io.env.AGENTGUARD_CONFIG) return undefined;\n  const path = policyPathFrom(args, io);\n  if (existsSync(path)) return undefined;\n  const policy = defaultPolicy();\n  const baseDir = dirname(path);\n  return {\n    policy,\n    path,\n    baseDir,\n    stateDir: resolvePath(policy.state.dir, baseDir),\n    auditPath: resolvePath(policy.audit.path, baseDir),\n    killPath: resolvePath(policy.kill.file, baseDir),\n  };\n}\n\nasync function serveOverStdio(runtime: ProxyRuntime): Promise<number> {\n  const server = createDownstreamServer(runtime);\n  const stop = async (): Promise<void> => {\n    await runtime.close();\n  };\n  process.once(\"SIGINT\", () => void stop().then(() => process.exit(0)));\n  process.once(\"SIGTERM\", () => void stop().then(() => process.exit(0)));\n  await serveStdio(server);\n  await stop();\n  return 0;\n}\n\nexport async function proxyCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const log = (line: string): void => io.err(`[agentguard] ${line}`);\n  const modeOverride = flagString(args, \"mode\");\n  const http = flagBool(args, \"http\") === true;\n\n  // No policy file and none named: serve agentguard's own read-only tools over stdio rather than\n  // exit, so a client that installed it from a button or a registry gets a working server that\n  // says how to set it up. `--http` still needs a policy (it writes its control token beside it).\n  const unconfigured = http ? undefined : unconfiguredPolicy(args, io);\n  if (unconfigured) {\n    if (modeOverride === \"dry-run\" || modeOverride === \"enforce\")\n      unconfigured.policy.mode = modeOverride;\n    const runtime = new ProxyRuntime({\n      loaded: unconfigured,\n      guard: new Guard({\n        policy: unconfigured.policy,\n        env: io.env,\n        kill: new FileKillSwitch(unconfigured.killPath),\n      }),\n      configured: false,\n      defaultRunId: flagString(args, \"run-id\") ?? newRunId(),\n      log,\n    });\n    await runtime.start();\n    log(\n      `no policy file at ${unconfigured.path}: serving agentguard's own read-only tools only. To guard your MCP servers, run \\`${INIT_COMMAND}\\` in the project directory.`,\n    );\n    return serveOverStdio(runtime);\n  }\n\n  const loaded = loadPolicyFor(args, io);\n  if (modeOverride === \"dry-run\" || modeOverride === \"enforce\") loaded.policy.mode = modeOverride;\n\n  const agentName = flagString(args, \"agent\");\n  let agent = undefined;\n  if (agentName) {\n    const resolved = await resolveAgent(loaded.policy, { name: agentName });\n    if (resolved.error) {\n      io.err(\n        `unknown agent \"${agentName}\" — agents in agentguard.yaml: ${loaded.policy.agents.map((a) => a.name).join(\", \") || \"none\"}`,\n      );\n      return 1;\n    }\n    agent = resolved.agent;\n  }\n\n  let approvalBase: { baseUrl: string; token: string } | undefined;\n  const fileGuard = createFileGuard(loaded, {\n    log,\n    env: io.env,\n    approvalUrl: (r) =>\n      approvalBase\n        ? `${approvalBase.baseUrl}/approve/${r.id}?token=${approvalBase.token}`\n        : undefined,\n    onEvent: (e) => {\n      if (e.type === \"APPROVAL_DECIDED\") return;\n      log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : \"\"}`);\n      if (e.type === \"APPROVAL_REQUIRED\" && e.approval)\n        log(`approve with: agentguard approve ${e.approval.id}`);\n    },\n  });\n  const runtime = new ProxyRuntime({\n    loaded,\n    guard: fileGuard.guard,\n    agent,\n    defaultRunId: flagString(args, \"run-id\") ?? newRunId(),\n    log,\n  });\n  await runtime.start();\n  const killed = await fileGuard.kill.check();\n  if (killed.killed)\n    log(\n      `kill switch is ON (${killed.reason}); every call returns KILLED until \\`agentguard resume\\``,\n    );\n  if (runtime.upstreamStatus().length === 0)\n    log(\n      `${loaded.path} lists no upstreams: serving agentguard's own read-only tools only. Add servers under \\`upstreams:\\` to guard them.`,\n    );\n\n  if (http) {\n    const server = await startHttpProxy({\n      runtime,\n      port: flagNumber(args, \"port\") ?? 8788,\n      host: flagString(args, \"host\") ?? \"127.0.0.1\",\n      token: io.env.AGENTGUARD_HTTP_TOKEN,\n    });\n    approvalBase = { baseUrl: server.url.replace(/\\/mcp$/, \"\"), token: server.token };\n    log(\n      `Streamable HTTP at ${server.url} · GET ${approvalBase.baseUrl}/health · control token in ${loaded.stateDir}/http.json`,\n    );\n    log(\n      `point your agent at ${server.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`,\n    );\n    const stop = async (): Promise<void> => {\n      await server.close();\n      await runtime.close();\n      process.exit(0);\n    };\n    process.once(\"SIGINT\", () => void stop());\n    process.once(\"SIGTERM\", () => void stop());\n    await new Promise<never>(() => undefined);\n  }\n\n  return serveOverStdio(runtime);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AAExB,SAAS,OAAO,eAAe,oBAAoB;AACnD,SAAS,gBAAgB,mBAAsC;AAQxD,SAAS,SAAS,MAAY,oBAAI,KAAK,GAAW;AACvD,SAAO,OAAO,IACX,YAAY,EACZ,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC3D;AAYO,SAAS,mBAAmB,MAAkB,IAAkC;AACrF,MAAI,WAAW,MAAM,QAAQ,MAAM,UAAa,GAAG,IAAI,kBAAmB,QAAO;AACjF,QAAM,OAAO,eAAe,MAAM,EAAE;AACpC,MAAI,WAAW,IAAI,EAAG,QAAO;AAC7B,QAAM,SAAS,cAAc;AAC7B,QAAM,UAAU,QAAQ,IAAI;AAC5B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,YAAY,OAAO,MAAM,KAAK,OAAO;AAAA,IAC/C,WAAW,YAAY,OAAO,MAAM,MAAM,OAAO;AAAA,IACjD,UAAU,YAAY,OAAO,KAAK,MAAM,OAAO;AAAA,EACjD;AACF;AAEA,eAAe,eAAe,SAAwC;AACpE,QAAM,SAAS,uBAAuB,OAAO;AAC7C,QAAM,OAAO,YAA2B;AACtC,UAAM,QAAQ,MAAM;AAAA,EACtB;AACA,UAAQ,KAAK,UAAU,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AACpE,UAAQ,KAAK,WAAW,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AACrE,QAAM,WAAW,MAAM;AACvB,QAAM,KAAK;AACX,SAAO;AACT;AAEA,eAAsB,aAAa,MAAkB,IAAyB;AAC5E,QAAM,MAAM,CAAC,SAAuB,GAAG,IAAI,gBAAgB,IAAI,EAAE;AACjE,QAAM,eAAe,WAAW,MAAM,MAAM;AAC5C,QAAM,OAAO,SAAS,MAAM,MAAM,MAAM;AAKxC,QAAM,eAAe,OAAO,SAAY,mBAAmB,MAAM,EAAE;AACnE,MAAI,cAAc;AAChB,QAAI,iBAAiB,aAAa,iBAAiB;AACjD,mBAAa,OAAO,OAAO;AAC7B,UAAMA,WAAU,IAAI,aAAa;AAAA,MAC/B,QAAQ;AAAA,MACR,OAAO,IAAI,MAAM;AAAA,QACf,QAAQ,aAAa;AAAA,QACrB,KAAK,GAAG;AAAA,QACR,MAAM,IAAI,eAAe,aAAa,QAAQ;AAAA,MAChD,CAAC;AAAA,MACD,YAAY;AAAA,MACZ,cAAc,WAAW,MAAM,QAAQ,KAAK,SAAS;AAAA,MACrD;AAAA,IACF,CAAC;AACD,UAAMA,SAAQ,MAAM;AACpB;AAAA,MACE,qBAAqB,aAAa,IAAI,qFAAqF,YAAY;AAAA,IACzI;AACA,WAAO,eAAeA,QAAO;AAAA,EAC/B;AAEA,QAAM,SAAS,cAAc,MAAM,EAAE;AACrC,MAAI,iBAAiB,aAAa,iBAAiB,UAAW,QAAO,OAAO,OAAO;AAEnF,QAAM,YAAY,WAAW,MAAM,OAAO;AAC1C,MAAI,QAAQ;AACZ,MAAI,WAAW;AACb,UAAM,WAAW,MAAM,aAAa,OAAO,QAAQ,EAAE,MAAM,UAAU,CAAC;AACtE,QAAI,SAAS,OAAO;AAClB,SAAG;AAAA,QACD,kBAAkB,SAAS,uCAAkC,OAAO,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,MAAM;AAAA,MAC3H;AACA,aAAO;AAAA,IACT;AACA,YAAQ,SAAS;AAAA,EACnB;AAEA,MAAI;AACJ,QAAM,YAAY,gBAAgB,QAAQ;AAAA,IACxC;AAAA,IACA,KAAK,GAAG;AAAA,IACR,aAAa,CAAC,MACZ,eACI,GAAG,aAAa,OAAO,YAAY,EAAE,EAAE,UAAU,aAAa,KAAK,KACnE;AAAA,IACN,SAAS,CAAC,MAAM;AACd,UAAI,EAAE,SAAS,mBAAoB;AACnC,UAAI,GAAG,EAAE,IAAI,IAAI,EAAE,IAAI,SAAS,EAAE,KAAK,IAAI,EAAE,QAAQ,KAAK,EAAE,MAAM,KAAK,KAAK,EAAE,EAAE;AAChF,UAAI,EAAE,SAAS,uBAAuB,EAAE;AACtC,YAAI,oCAAoC,EAAE,SAAS,EAAE,EAAE;AAAA,IAC3D;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,aAAa;AAAA,IAC/B;AAAA,IACA,OAAO,UAAU;AAAA,IACjB;AAAA,IACA,cAAc,WAAW,MAAM,QAAQ,KAAK,SAAS;AAAA,IACrD;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,MAAM;AACpB,QAAM,SAAS,MAAM,UAAU,KAAK,MAAM;AAC1C,MAAI,OAAO;AACT;AAAA,MACE,sBAAsB,OAAO,MAAM;AAAA,IACrC;AACF,MAAI,QAAQ,eAAe,EAAE,WAAW;AACtC;AAAA,MACE,GAAG,OAAO,IAAI;AAAA,IAChB;AAEF,MAAI,MAAM;AACR,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA,MAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAClC,MAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAClC,OAAO,GAAG,IAAI;AAAA,IAChB,CAAC;AACD,mBAAe,EAAE,SAAS,OAAO,IAAI,QAAQ,UAAU,EAAE,GAAG,OAAO,OAAO,MAAM;AAChF;AAAA,MACE,sBAAsB,OAAO,GAAG,aAAU,aAAa,OAAO,iCAA8B,OAAO,QAAQ;AAAA,IAC7G;AACA;AAAA,MACE,uBAAuB,OAAO,GAAG;AAAA,IACnC;AACA,UAAM,OAAO,YAA2B;AACtC,YAAM,OAAO,MAAM;AACnB,YAAM,QAAQ,MAAM;AACpB,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,KAAK,UAAU,MAAM,KAAK,KAAK,CAAC;AACxC,YAAQ,KAAK,WAAW,MAAM,KAAK,KAAK,CAAC;AACzC,UAAM,IAAI,QAAe,MAAM,MAAS;AAAA,EAC1C;AAEA,SAAO,eAAe,OAAO;AAC/B;","names":["runtime"]}

package/dist/tools-3LLDG3XQ.js

@@ -0,0 +1,15 @@
+import {
+  formatToolTable,
+  probeUpstreams,
+  toolsCommand
+} from "./chunk-VQWQ5TOM.js";
+import "./chunk-D66U3PVB.js";
+import "./chunk-ZSLWPKXI.js";
+import "./chunk-SUXQTT3X.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  formatToolTable,
+  probeUpstreams,
+  toolsCommand
+};
+//# sourceMappingURL=tools-3LLDG3XQ.js.map

package/dist/tools-3LLDG3XQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/llms.txt

@@ -6,6 +6,10 @@ Set up: `npx -y @agentwares/agentguard init` in the project directory writes age
 
 Started with no agentguard.yaml (an editor install button, a registry install, the repo's Dockerfile), the proxy fronts no servers and serves three read-only tools of its own: `agentguard_get_status` (what it guards, caps used and remaining, kill switch, pending approvals), `agentguard_get_report` (what a run did, or would have done in dry-run) and `agentguard_verify_audit_log` (the hash chain). With upstreams configured, the agent sees only the upstreams' tools.
 
+Hook mode: `npx -y @agentwares/agentguard hooks install` (add `--client codex`, `--client gemini` or `--client all`) writes a pre-execution hook (Claude Code PreToolUse, Codex PreToolUse, Gemini CLI BeforeTool) that checks the coding agent's own shell commands, file edits and MCP calls against the same agentguard.yaml. Irreversible commands (git push, merges, tag deletion, rm outside the workspace, package publish, sending mail or messages, edits to the guard itself) run only on a recent turn a person typed that names the action; in Claude Code that is read from the session transcript, and text the model writes never counts. Otherwise the agent gets APPROVAL_REQUIRED with an id, and `agentguard approve <id>` lets the identical command run once. Dry-run (log only) until `hooks.mode: enforce`.
+
+Audit: `npx -y @agentwares/agentguard audit [--since 7d|30d|all] [--json]` reads the repository's CLAUDE.md, AGENTS.md, GEMINI.md and .cursor/rules (and `audit.rules` in agentguard.yaml) and this machine's Claude Code and Codex sessions in it, and reports per rule how many sessions broke it and when. Rules are recognised by a pattern library with no LLM (never push to main, never force-push, never --no-verify, run X before pushing, use pnpm not npm, do not edit or commit a path, no new dependencies without asking, never rm outside the repo, never publish, never deploy, never run a named command), or stated with an inline `<!-- agentguard: <check> -->`. It runs locally and sends nothing; `--json` carries counts, rule ids and dates only. `--enforce` writes the checkable rules into agentguard.yaml as hook-mode rules in dry-run and installs the hook. The plugin's `/agentguard:audit` has your own agent judge the rules no script can check.
+
 ## Links
 
 - [README (install in 60 seconds)](https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli#readme)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agentwares/agentguard",
-  "version": "0.1.7",
-  "description": "MCP policy proxy for AI agents: hard spend limits, destructive-action gating with approvals, a kill switch, scoped credentials, dry-run writes with mutation diffs, loop breaker, blast-radius caps and a hash-chained audit log. No LLM calls, no phone-home, no account.",
+  "version": "0.1.9",
+  "description": "MCP policy proxy for AI agents: hard spend limits, destructive-action gating with approvals, a kill switch, scoped credentials, dry-run writes with mutation diffs, loop breaker, blast-radius caps and a hash-chained audit log. Hook mode applies the same policy to Claude Code, Codex and Gemini CLI shell commands and file edits, and runs irreversible commands only on a turn a person typed. Audit mode reports which CLAUDE.md / AGENTS.md rules your coding agents broke, from your own sessions, locally. No LLM calls, no phone-home, no account.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -43,6 +43,12 @@
     "dry-run",
     "audit-log",
     "claude-code",
+    "claude-code-hooks",
+    "claude-md",
+    "agents-md",
+    "codex",
+    "gemini-cli",
+    "coding-agents",
     "cursor",
     "guardrails",
     "mcp-server",
@@ -62,7 +68,7 @@
     "conformance": "node scripts/conformance.mjs"
   },
   "dependencies": {
-    "@agentwares/agentguard-core": "^0.1.3",
+    "@agentwares/agentguard-core": "^0.1.5",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "yaml": "^2.9.0",
     "zod": "^4.5.4"

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.agentwares/agentguard",
   "description": "MCP policy proxy: spend caps, approvals for destructive tools, kill switch, dry-run, audit log.",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "repository": {
     "url": "https://github.com/agentwares/agentguard",
     "source": "github",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@agentwares/agentguard",
-      "version": "0.1.7",
+      "version": "0.1.9",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"