@atbash/atbash-langgraph 0.0.5-dev.3 → 0.0.5-dev.5

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as _langchain_core_messages from '@langchain/core/messages';
 import * as _langchain_langgraph from '@langchain/langgraph';
 import { StateGraph } from '@langchain/langgraph';
-import { Atbash } from '@atbash/sdk';
+import { Atbash, MemoryGuardManager } from '@atbash/sdk';
 import * as _langchain_core_tools from '@langchain/core/tools';
 import { z } from 'zod';
 
@@ -16,6 +16,7 @@ type AtbashState = typeof AtbashStateAnnotation.State;
 
 interface GuardNodeOptions {
     client: Atbash;
+    guardManager?: MemoryGuardManager;
 }
 declare function createGuardNode(opts: GuardNodeOptions): (state: AtbashState) => Promise<Partial<AtbashState>>;
 
@@ -29,6 +30,25 @@ interface AtbashSafetyOptions {
     endpoint?: string;
     toolsNode?: string;
     agentNode?: string;
+    /** Agent workspace directory — `~` is expanded. Defaults to `process.cwd()`. */
+    workspaceDir?: string;
+    /** Explicit MEMORY.md path. Overrides `workspaceDir/MEMORY.md`. */
+    memoryFilePath?: string;
+    /** How long (ms) to trust the local pointer between chain checks. Default 30000. */
+    memorySyncTTLMs?: number;
+    /** Block memory reads when a rolled-back version scores below this (1–10). Default 1 = warn only. */
+    memoryRollbackMinScore?: number;
+    /** Custom memory path patterns. Defaults to SDK built-ins. */
+    memoryPathPatterns?: string[];
+    /** Optional judge endpoint override. */
+    judgeEndpoint?: string;
+    /** Self-hosted judge response-signing pubkey (required when judgeEndpoint uses "self-hosted" policy). */
+    judgeVerifyPubKey?: string;
+    /** Organization name for chain resolution (public vs private chain). */
+    orgName?: string;
+    /** false = monitor mode: log but never block. Default true. */
+    enforce?: boolean;
+    debug?: boolean;
 }
 declare function addAtbashSafety(builder: StateGraph<AtbashState>, opts: AtbashSafetyOptions): StateGraph<_langchain_langgraph.StateType<{
     atbashVerdict: _langchain_langgraph.BaseChannel<string | null, string | _langchain_langgraph.OverwriteValue<string | null> | null, unknown>;

package/dist/index.js

@@ -21,6 +21,7 @@ var AtbashStateAnnotation = Annotation.Root({
 });
 
 // src/nodes/guardNode.ts
+import { MemoryIntegrityError } from "@atbash/sdk";
 import { ToolMessage } from "@langchain/core/messages";
 import { isGraphBubbleUp } from "@langchain/langgraph";
 function createGuardNode(opts) {
@@ -33,11 +34,64 @@ function createGuardNode(opts) {
         atbashReason: "No tool calls detected"
       };
     }
-    const actionText = toolCalls.map((toolCall) => `${toolCall.name}(${JSON.stringify(toolCall.args)})`).join("; ");
+    const memoryHandledIds = /* @__PURE__ */ new Set();
+    if (opts.guardManager) {
+      for (const tc of toolCalls) {
+        let memDecision;
+        try {
+          memDecision = await opts.guardManager.handleBeforeToolCall(
+            { toolName: tc.name, args: tc.args },
+            {}
+          );
+        } catch (err) {
+          const reason = err instanceof Error ? err.message : String(err);
+          const verdict = err instanceof MemoryIntegrityError ? "BLOCK" : "ERROR";
+          return {
+            messages: toolCalls.map(
+              (toolCall) => new ToolMessage({
+                tool_call_id: toolCall.id,
+                content: toolCall.id === tc.id ? `Memory guard error: ${reason}` : "Blocked \u2014 memory safety check failed for another tool call"
+              })
+            ),
+            atbashVerdict: verdict,
+            atbashReason: `Memory guard error: ${reason}`,
+            atbashToolCallId: null,
+            atbashConfidence: null
+          };
+        }
+        if (memDecision !== null) {
+          if (memDecision.block) {
+            return {
+              messages: toolCalls.map(
+                (toolCall) => new ToolMessage({
+                  tool_call_id: toolCall.id,
+                  content: toolCall.id === tc.id ? `Memory write blocked by Atbash: ${memDecision.blockReason ?? ""}` : "Blocked \u2014 another tool call was blocked by memory safety"
+                })
+              ),
+              atbashVerdict: "BLOCK",
+              atbashReason: memDecision.blockReason ?? "memory write blocked",
+              atbashToolCallId: null,
+              atbashConfidence: null
+            };
+          }
+          memoryHandledIds.add(tc.id);
+        }
+      }
+    }
+    const auditCalls = toolCalls.filter((tc) => !memoryHandledIds.has(tc.id));
+    if (auditCalls.length === 0) {
+      return {
+        atbashVerdict: "ALLOW",
+        atbashReason: "Memory operations validated by guard",
+        atbashToolCallId: null,
+        atbashConfidence: null
+      };
+    }
+    const actionText = auditCalls.map((toolCall) => `${toolCall.name}(${JSON.stringify(toolCall.args)})`).join("; ");
     try {
       const decision = await opts.client.auditToolCall({
-        toolName: toolCalls.map((t) => t.name).join(",") || "langgraph_batch",
-        args: toolCalls,
+        toolName: auditCalls.map((t) => t.name).join(",") || "langgraph_batch",
+        args: auditCalls,
         context: `LangGraph agent attempting: ${actionText}`
       });
       if (decision.verdict === "BLOCK" || decision.verdict === "ERROR") {
@@ -126,9 +180,14 @@ function createAuditNode(opts) {
 // src/builder.ts
 import {
   Atbash,
+  createMemoryGuardManager,
   setupTelemetry,
   shutdownTelemetry
 } from "@atbash/sdk";
+import { homedir } from "os";
+function expandHome(p) {
+  return p.replace(/^~(?=\/|$)/, homedir());
+}
 function addAtbashSafety(builder, opts) {
   setupTelemetry({ enabled: true, source: "plugin:langgraph" });
   process.once("beforeExit", () => shutdownTelemetry());
@@ -138,10 +197,26 @@ function addAtbashSafety(builder, opts) {
   const clientOpts = {};
   if (opts.endpoint) clientOpts.endpoint = opts.endpoint;
   const client = new Atbash(privkey, clientOpts);
+  const guard = createMemoryGuardManager({
+    auth: client.auth,
+    workspaceDir: opts.workspaceDir ? expandHome(opts.workspaceDir) : process.cwd(),
+    ...opts.memoryFilePath ? { memoryFilePath: expandHome(opts.memoryFilePath) } : {},
+    ...opts.memorySyncTTLMs !== void 0 ? { ttlMs: opts.memorySyncTTLMs } : {},
+    ...opts.memoryRollbackMinScore !== void 0 ? { rollbackMinScore: opts.memoryRollbackMinScore } : {},
+    ...opts.memoryPathPatterns ? { memoryPathPatterns: opts.memoryPathPatterns } : {},
+    ...opts.judgeEndpoint ? { judgeEndpoint: opts.judgeEndpoint } : {},
+    ...opts.judgeVerifyPubKey ? { judgeVerifyPubKey: opts.judgeVerifyPubKey } : {},
+    ...opts.orgName ? { orgName: opts.orgName } : {},
+    enforce: opts.enforce ?? true,
+    debug: opts.debug ?? false
+  });
+  guard.runBootProbe().catch((err) => {
+    console.warn("[atbash] boot probe failed:", err instanceof Error ? err.message : String(err));
+  });
   const graph = builder;
   const toolsNode = opts.toolsNode ?? "tools";
   const agentNode = opts.agentNode ?? "agent";
-  graph.addNode("atbash_guard", createGuardNode({ client }));
+  graph.addNode("atbash_guard", createGuardNode({ client, guardManager: guard }));
   graph.addNode("atbash_audit", createAuditNode({ client }));
   graph.addConditionalEdges("atbash_guard", (state) => {
     return state.atbashVerdict === "ALLOW" ? toolsNode : agentNode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/atbash-langgraph",
-  "version": "0.0.5-dev.3",
+  "version": "0.0.5-dev.5",
   "description": "Atbash safety guard and audit nodes for LangGraph workflows",
   "type": "module",
   "main": "dist/index.js",
@@ -37,7 +37,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@atbash/sdk": "0.5.3-dev.0",
+    "@atbash/sdk": "0.10.5-dev.0",
     "zod": "^3.25.76"
   },
   "peerDependencies": {