@datalayer/agent-runtimes 1.5.41 → 1.5.43

package/lib/apps/apps/sessionRules.d.ts

@@ -61,8 +61,21 @@ export declare const SESSION_RULES_WORDS: {
     readonly goneWithSession: "In force at once, for this session only; gone when it ends.";
     readonly unavailable: (sentence: string) => string;
 };
-/** A rule in words: *writing, sending: leave it to me*. */
+/** Where a file rule holds, in words (SHIELD decision 5). */
+export declare const WHERE_WORDS: Record<'inside' | 'outside', string>;
+/**
+ * A rule in words: *writing, sending: leave it to me*; with decision 5's file
+ * and shell wording when it says where or what (SHIELD SH-43) — *writing
+ * inside the workspace (src/**): do it*, *running `git push`: ask me first*.
+ */
 export declare function sessionRuleInWords(rule: SessionRule): string;
+/**
+ * Decision 5's file and shell rules, offered on a running session in the
+ * Shield's own words: each one a rule a person adds as it stands, and the
+ * runtime refuses one that would loosen what the organization says
+ * (SHIELD §6.2, §6.3).
+ */
+export declare const FILE_AND_SHELL_RULES: readonly SessionRule[];
 /** What the person typed, as the rule the runtime takes; a sentence when it cannot be one. */
 export declare function sessionRuleOf(input: {
     name: string;

package/lib/apps/apps/sessionRules.js

@@ -54,12 +54,78 @@ export const SESSION_RULES_WORDS = {
     goneWithSession: 'In force at once, for this session only; gone when it ends.',
     unavailable: (sentence) => `Nothing is decided right now: ${sentence}`,
 };
-/** A rule in words: *writing, sending: leave it to me*. */
+/** Where a file rule holds, in words (SHIELD decision 5). */
+export const WHERE_WORDS = {
+    inside: 'inside the workspace',
+    outside: 'outside the workspace',
+};
+/**
+ * A rule in words: *writing, sending: leave it to me*; with decision 5's file
+ * and shell wording when it says where or what (SHIELD SH-43) — *writing
+ * inside the workspace (src/**): do it*, *running `git push`: ask me first*.
+ */
 export function sessionRuleInWords(rule) {
     const classes = (rule.classes ?? []).map(item => SESSION_RULES_WORDS.classes[item] ?? item);
-    const covers = classes.length > 0 ? classes.join(', ') : 'everything';
+    let covers = classes.length > 0 ? classes.join(', ') : 'everything';
+    if (rule.where === 'inside' || rule.where === 'outside') {
+        covers = `${covers} ${WHERE_WORDS[rule.where]}`;
+    }
+    if (rule.paths && rule.paths.length > 0) {
+        covers = `${covers} (${rule.paths.join(', ')})`;
+    }
+    if (rule.commands && rule.commands.length > 0) {
+        covers = `${covers} matching ${rule.commands.map(command => `\`${command}\``).join(' or ')}`;
+    }
     return `${covers}: ${SESSION_RULES_WORDS.decisions[rule.decision]}`;
 }
+/**
+ * Decision 5's file and shell rules, offered on a running session in the
+ * Shield's own words: each one a rule a person adds as it stands, and the
+ * runtime refuses one that would loosen what the organization says
+ * (SHIELD §6.2, §6.3).
+ */
+export const FILE_AND_SHELL_RULES = [
+    {
+        name: 'Edit inside the workspace',
+        decision: 'allow',
+        classes: ['write'],
+        where: 'inside',
+    },
+    {
+        name: 'Ask before deleting a file',
+        decision: 'ask',
+        classes: ['delete'],
+    },
+    {
+        name: 'Ask before running a command',
+        decision: 'ask',
+        classes: ['execute'],
+    },
+    {
+        name: 'Leave files outside the workspace to me',
+        decision: 'deny',
+        classes: ['read', 'write', 'delete'],
+        where: 'outside',
+    },
+    {
+        name: 'Ask before git push',
+        decision: 'ask',
+        classes: ['execute'],
+        commands: ['^git\\s+push\\b'],
+    },
+    {
+        name: 'Ask before installing a package',
+        decision: 'ask',
+        classes: ['execute'],
+        commands: ['\\b(pip|npm|uv|yarn|apt(-get)?)\\s+(install|add)\\b'],
+    },
+    {
+        name: 'Leave sudo to me',
+        decision: 'deny',
+        classes: ['execute'],
+        commands: ['^sudo\\b'],
+    },
+];
 /** What the person typed, as the rule the runtime takes; a sentence when it cannot be one. */
 export function sessionRuleOf(input) {
     const name = input.name.trim();

package/lib/apps/core/canvasParts.d.ts

@@ -1,5 +1,5 @@
 /** The kinds of part an agent is built from on the Canvas. */
-export type CanvasPartKind = 'connection' | 'rule' | 'skill' | 'test' | 'event' | 'model' | 'protocol' | 'ui' | 'character';
+export type CanvasPartKind = 'agent' | 'connection' | 'rule' | 'skill' | 'test' | 'event' | 'model' | 'protocol' | 'ui' | 'character';
 /**
  * A part of an agent the Canvas may place (LOOP C-20): a connection to a
  * server of the catalogue, a skill, a model, a rule, a test, an event, a
@@ -18,6 +18,12 @@ export type CanvasPartContribution = {
     /** One line of what it is. */
     says: string;
     emoji?: string;
+    /**
+     * The harness it runs on, for an agent part (SHIELD SH-43): the catalogue
+     * harness's id, whose terms, credential and what it honours the Properties
+     * panel reads from `specs/harnesses`.
+     */
+    harness?: string;
     /**
      * What it arrives with, spelled as the Appspec's text spells it: a
      * connection's, a rule's, a test's or an event's object, a skill's, a

package/lib/apps/plugins/app-rules/AppRulesCard.js

@@ -5,7 +5,7 @@ import { Box } from '@datalayer/primer-addons';
 import { useIAMStore } from '@datalayer/core/lib/state/substates/IAMState';
 import { agentServerOf } from '../../core';
 import { BEHAVIOUR_WORDS, coverOf } from '../../apps/rules';
-import { SESSION_RULES_WORDS, SESSION_RULE_CLASSES, SESSION_RULE_DECISIONS, addSessionRule, readSessionRules, removeSessionRule, sessionRuleInWords, sessionRuleOf, } from '../../apps/sessionRules';
+import { FILE_AND_SHELL_RULES, SESSION_RULES_WORDS, SESSION_RULE_CLASSES, SESSION_RULE_DECISIONS, addSessionRule, readSessionRules, removeSessionRule, sessionRuleInWords, sessionRuleOf, } from '../../apps/sessionRules';
 import { SAVE_WORDS, draftOfApproval } from '../../apps/saved';
 import { useApproveToolRequest, useRejectToolRequest, useToolApprovalsQuery, } from '../../../hooks/useToolApprovals';
 /** What the card says. */
@@ -105,7 +105,7 @@ export function SessionRules({ agentServerUrl, sessionUid, token, }) {
         }
         void act(() => addSessionRule(agentServerUrl, token, sessionUid, rule)).then(() => setName(''));
     };
-    return (_jsxs(Box, { "data-testid": "session-rules", mt: 3, children: [_jsx(Heading, { as: "h4", sx: { fontSize: 1, mb: 1 }, children: SESSION_RULES_WORDS.title }), inForce?.unavailable ? (_jsx(Text, { as: "p", role: "alert", sx: { fontSize: 0, m: 0, mb: 1 }, children: SESSION_RULES_WORDS.unavailable(inForce.unavailable) })) : null, inForce && inForce.session_rules.length === 0 ? (_jsx(Text, { as: "p", sx: { fontSize: 1, color: 'fg.muted', m: 0 }, children: SESSION_RULES_WORDS.none })) : (_jsx(Box, { as: "ul", listStyle: "none", p: 0, m: 0, children: (inForce?.session_rules ?? []).map(rule => (_jsxs(Box, { as: "li", py: 1, fontSize: 1, display: "flex", gap: 2, alignItems: "center", children: [_jsx(Text, { sx: { fontWeight: 'semibold' }, children: rule.name }), _jsx(Text, { sx: { color: 'fg.muted', fontSize: 0 }, children: sessionRuleInWords(rule) }), _jsx(Button, { size: "small", variant: "invisible", disabled: busy, onClick: () => void act(() => removeSessionRule(agentServerUrl, token, sessionUid, rule.name)), children: SESSION_RULES_WORDS.remove })] }, rule.name))) })), _jsxs(Box, { display: "flex", gap: 1, mt: 1, flexWrap: "wrap", alignItems: "center", children: [_jsx(TextInput, { size: "small", value: name, placeholder: SESSION_RULES_WORDS.namePlaceholder, "aria-label": "The rule's name", onChange: event => setName(event.target.value) }), _jsx(Select, { size: "small", value: kind, "aria-label": "What it covers", onChange: event => setKind(event.target.value), children: SESSION_RULE_CLASSES.map(item => (_jsx(Select.Option, { value: item, children: SESSION_RULES_WORDS.classes[item] }, item))) }), _jsx(Select, { size: "small", value: decision, "aria-label": "What it says", onChange: event => setDecision(event.target.value), children: SESSION_RULE_DECISIONS.map(item => (_jsx(Select.Option, { value: item, children: SESSION_RULES_WORDS.decisions[item] }, item))) }), _jsx(Button, { size: "small", disabled: busy, onClick: add, children: SESSION_RULES_WORDS.add })] }), problem ? (_jsx(Text, { as: "p", role: "alert", sx: { fontSize: 0, m: 0, mt: 1 }, children: problem })) : null, _jsx(Text, { as: "p", sx: { fontSize: 0, color: 'fg.muted', mt: 1, mb: 0 }, children: SESSION_RULES_WORDS.goneWithSession })] }));
+    return (_jsxs(Box, { "data-testid": "session-rules", mt: 3, children: [_jsx(Heading, { as: "h4", sx: { fontSize: 1, mb: 1 }, children: SESSION_RULES_WORDS.title }), inForce?.unavailable ? (_jsx(Text, { as: "p", role: "alert", sx: { fontSize: 0, m: 0, mb: 1 }, children: SESSION_RULES_WORDS.unavailable(inForce.unavailable) })) : null, inForce && inForce.session_rules.length === 0 ? (_jsx(Text, { as: "p", sx: { fontSize: 1, color: 'fg.muted', m: 0 }, children: SESSION_RULES_WORDS.none })) : (_jsx(Box, { as: "ul", listStyle: "none", p: 0, m: 0, children: (inForce?.session_rules ?? []).map(rule => (_jsxs(Box, { as: "li", py: 1, fontSize: 1, display: "flex", gap: 2, alignItems: "center", children: [_jsx(Text, { sx: { fontWeight: 'semibold' }, children: rule.name }), _jsx(Text, { sx: { color: 'fg.muted', fontSize: 0 }, children: sessionRuleInWords(rule) }), _jsx(Button, { size: "small", variant: "invisible", disabled: busy, onClick: () => void act(() => removeSessionRule(agentServerUrl, token, sessionUid, rule.name)), children: SESSION_RULES_WORDS.remove })] }, rule.name))) })), _jsxs(Box, { display: "flex", gap: 1, mt: 1, flexWrap: "wrap", alignItems: "center", children: [_jsx(TextInput, { size: "small", value: name, placeholder: SESSION_RULES_WORDS.namePlaceholder, "aria-label": "The rule's name", onChange: event => setName(event.target.value) }), _jsx(Select, { size: "small", value: kind, "aria-label": "What it covers", onChange: event => setKind(event.target.value), children: SESSION_RULE_CLASSES.map(item => (_jsx(Select.Option, { value: item, children: SESSION_RULES_WORDS.classes[item] }, item))) }), _jsx(Select, { size: "small", value: decision, "aria-label": "What it says", onChange: event => setDecision(event.target.value), children: SESSION_RULE_DECISIONS.map(item => (_jsx(Select.Option, { value: item, children: SESSION_RULES_WORDS.decisions[item] }, item))) }), _jsx(Button, { size: "small", disabled: busy, onClick: add, children: SESSION_RULES_WORDS.add })] }), _jsx(Box, { display: "flex", gap: 1, mt: 1, flexWrap: "wrap", "data-testid": "session-rules-file-and-shell", children: FILE_AND_SHELL_RULES.map(rule => (_jsx(Button, { size: "small", variant: "invisible", disabled: busy, title: sessionRuleInWords(rule), onClick: () => void act(() => addSessionRule(agentServerUrl, token, sessionUid, rule)), children: rule.name }, rule.name))) }), problem ? (_jsx(Text, { as: "p", role: "alert", sx: { fontSize: 0, m: 0, mt: 1 }, children: problem })) : null, _jsx(Text, { as: "p", sx: { fontSize: 0, color: 'fg.muted', mt: 1, mb: 0 }, children: SESSION_RULES_WORDS.goneWithSession })] }));
 }
 export function AppRulesCard({ app, workspace, }) {
     const token = useIAMStore(state => state.token) ?? '';

package/lib/apps/plugins/canvas-parts/index.d.ts

@@ -15,9 +15,17 @@ type PartsReader = {
     }>;
 };
 /** The short ids an organization turns off, and the plugin each names. */
-export declare const CANVAS_PART_SOURCES: readonly ["connections", "skills", "models", "rules", "tests", "events", "protocols", "ui", "characters"];
+export declare const CANVAS_PART_SOURCES: readonly ["agents", "connections", "skills", "models", "rules", "tests", "events", "protocols", "ui", "characters"];
 export type CanvasPartSource = (typeof CANVAS_PART_SOURCES)[number];
 export declare const canvasPartsPluginName: (source: CanvasPartSource) => string;
+/**
+ * The catalogue's harnesses as the agent (SHIELD SH-43): each harness an
+ * agent program over ACP behind the Shield, offered by the catalogue agent
+ * that runs on it — dropped on the surface, it is the application's agent.
+ * A harness no agent of the catalogue runs yet is offered off, and says so;
+ * `custom` is an organization's own and never offered here.
+ */
+export declare const AGENT_PARTS: CanvasPartContribution[];
 /** A connection to each server of the catalogue: read-only, as its owner, every tool. */
 export declare const CONNECTION_PARTS: CanvasPartContribution[];
 /** Each skill of the catalogue. */

package/lib/apps/plugins/canvas-parts/index.js

@@ -13,6 +13,8 @@
  */
 import { buildReactorFromPlugins, contribution, definePlugin, } from '@datalayer/reactor';
 import { MCP_SERVER_LIBRARY } from '../../../specs/mcpServers';
+import { listAgentspecs } from '../../../specs/agents';
+import { listHarnesses } from '../../../specs/harnesses';
 import { listChatModels } from '../../../specs/models';
 import { getSkillSpecs } from '../../../specs/skills';
 import { listProtocolSpecs } from '../../../specs/protocols';
@@ -21,6 +23,7 @@ import { ASSISTANT_CHARACTERS } from '../../../chat/assistant/characters';
 import { LoopCanvasPart, } from '../../core/canvasParts';
 /** The short ids an organization turns off, and the plugin each names. */
 export const CANVAS_PART_SOURCES = [
+    'agents',
     'connections',
     'skills',
     'models',
@@ -39,6 +42,30 @@ const partsPlugin = (source, displayName, parts) => definePlugin({
     octicon: 'package',
     contributes: parts.map(part => contribution(LoopCanvasPart, part, { id: part.id })),
 });
+/**
+ * The catalogue's harnesses as the agent (SHIELD SH-43): each harness an
+ * agent program over ACP behind the Shield, offered by the catalogue agent
+ * that runs on it — dropped on the surface, it is the application's agent.
+ * A harness no agent of the catalogue runs yet is offered off, and says so;
+ * `custom` is an organization's own and never offered here.
+ */
+export const AGENT_PARTS = listHarnesses()
+    .filter(harness => harness.id !== 'custom')
+    .map(harness => {
+    const agent = listAgentspecs().find(spec => spec.harness === harness.id);
+    return {
+        id: `agent:${harness.id}`,
+        kind: 'agent',
+        label: harness.name,
+        says: agent
+            ? `${agent.name}: ${harness.description}`
+            : `${harness.description} No agent of the catalogue runs on it yet.`,
+        emoji: '🛡️',
+        harness: harness.id,
+        example: agent?.id ?? '',
+        enabled: Boolean(agent) && harness.enabled,
+    };
+});
 /** A connection to each server of the catalogue: read-only, as its owner, every tool. */
 export const CONNECTION_PARTS = Object.values(MCP_SERVER_LIBRARY).map(server => ({
     id: `connection:${server.id}`,
@@ -210,6 +237,7 @@ export const CHARACTER_PARTS = ASSISTANT_CHARACTERS.map(character => ({
     enabled: true,
 }));
 export const CANVAS_PART_PLUGINS = [
+    partsPlugin('agents', 'Agents', AGENT_PARTS),
     partsPlugin('connections', 'Connections', CONNECTION_PARTS),
     partsPlugin('skills', 'Skills', SKILL_PARTS),
     partsPlugin('models', 'Models', MODEL_PARTS),

package/lib/examples/ShieldHarnessExample.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A coding agent behind the Shield, in the web chat (SHIELD §4.3, SH-16; SH-23).
+ *
+ * The chat talks AG-UI to a local runtime whose agent is a harness: what the
+ * agent changed is drawn as a **diff** in the file's language, what it ran
+ * as a **terminal** with its output, through the `shield-displays` plugin
+ * the Loop preset mounts (here, registered on its own); an action a rule
+ * asks first about waits in the chat's approval banner, answered there.
+ *
+ * It needs the local runtime with a harness, which this page does not
+ * start. From agent-runtimes' `examples/shield`:
+ *
+ *     python harness_on_the_runtime.py --serve
+ *
+ * serves the fake agent (no model, no key) as the agent `chat` on
+ * http://127.0.0.1:8765, its workspace a fresh directory; with
+ * `--harness claude-code` and a funded `ANTHROPIC_API_KEY`, Claude Code
+ * instead. The openers below are the fake agent's words: `edit` writes
+ * `hello.txt` (do it, shown as a diff), `run echo hello` asks first (the
+ * banner), `outside` reads outside the workspace (refused in a sentence).
+ *
+ * @module examples/ShieldHarnessExample
+ */
+import React from 'react';
+declare const ShieldHarnessExample: React.FC;
+export default ShieldHarnessExample;

package/lib/examples/ShieldHarnessExample.js

@@ -0,0 +1,51 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * A coding agent behind the Shield, in the web chat (SHIELD §4.3, SH-16; SH-23).
+ *
+ * The chat talks AG-UI to a local runtime whose agent is a harness: what the
+ * agent changed is drawn as a **diff** in the file's language, what it ran
+ * as a **terminal** with its output, through the `shield-displays` plugin
+ * the Loop preset mounts (here, registered on its own); an action a rule
+ * asks first about waits in the chat's approval banner, answered there.
+ *
+ * It needs the local runtime with a harness, which this page does not
+ * start. From agent-runtimes' `examples/shield`:
+ *
+ *     python harness_on_the_runtime.py --serve
+ *
+ * serves the fake agent (no model, no key) as the agent `chat` on
+ * http://127.0.0.1:8765, its workspace a fresh directory; with
+ * `--harness claude-code` and a funded `ANTHROPIC_API_KEY`, Claude Code
+ * instead. The openers below are the fake agent's words: `edit` writes
+ * `hello.txt` (do it, shown as a diff), `run echo hello` asks first (the
+ * banner), `outside` reads outside the workspace (refused in a sentence).
+ *
+ * @module examples/ShieldHarnessExample
+ */
+import { useEffect, useMemo } from 'react';
+import { Text } from '@primer/react';
+import { Box } from '@datalayer/primer-addons';
+import { buildReactorFromPlugins } from '@datalayer/reactor';
+import { registerReactor } from '@datalayer/reactor/react';
+import { ThemedProvider } from './utils/themedProvider';
+import { resolveExampleAgentRuntimesUrl } from './utils/useExampleAgentRuntimesUrl';
+import { Chat } from '../chat';
+import { createShieldDisplaysPlugin } from '../apps/plugins/shield-displays';
+import { SHIELD_HARNESS_AGENT, SHIELD_HARNESS_OPENERS, } from './shield/shieldHarness';
+const ShieldHarnessExample = () => {
+    const baseUrl = resolveExampleAgentRuntimesUrl('local');
+    // The diff and terminal renderers, registered for the chat to resolve
+    // `_meta["reactor.ui/display"]` with — what the Loop preset does.
+    const reactor = useMemo(() => buildReactorFromPlugins([createShieldDisplaysPlugin()]), []);
+    useEffect(() => {
+        reactor.start();
+        registerReactor(reactor);
+        return () => registerReactor(null);
+    }, [reactor]);
+    return (_jsx(ThemedProvider, { children: _jsxs(Box, { display: "flex", flexDirection: "column", height: "100vh", minHeight: 0, children: [_jsx(Box, { p: 3, borderBottom: "1px solid", borderColor: "border.default", children: _jsxs(Text, { as: "p", sx: { m: 0, fontSize: 1, color: 'fg.muted' }, children: ["Needs the local runtime with a harness:", ' ', _jsx("code", { children: "python examples/shield/harness_on_the_runtime.py --serve" }), ' ', "(the fake agent on ", baseUrl, ", no key)."] }) }), _jsx(Box, { flex: 1, minHeight: 0, children: _jsx(Chat, { protocol: "ag-ui", baseUrl: baseUrl, agentId: SHIELD_HARNESS_AGENT, title: "A coding agent behind the Shield", description: "Its changes as diffs, its commands as terminals, what a rule asks first in the banner.", showToolApprovalBanner: true, suggestions: SHIELD_HARNESS_OPENERS, height: "100%" }) })] }) }));
+};
+export default ShieldHarnessExample;

package/lib/examples/ShieldPolicyExample.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The Shield's policy, from TypeScript (SHIELD §5.1, SH-53; SH-23).
+ *
+ * An organization's document typed by `@datalayer/agent-shield` (the types
+ * generated from the schema the Python package publishes), what it decides
+ * for each class, how ACP's tool kinds are classed, the limits soft then
+ * hard, and decisions in the words `describeDecision` gives every card and
+ * row. Needs nothing running: it reads the package only.
+ *
+ * `@datalayer/agent-shield` is not on npm yet: the page reads it from the
+ * sibling checkout `ai/agent-shield` beside agent-runtimes (see
+ * `shield/shieldPolicyDemo`), and says so where it is not there.
+ *
+ * @module examples/ShieldPolicyExample
+ */
+import React from 'react';
+declare const ShieldPolicyExample: React.FC;
+export default ShieldPolicyExample;

package/lib/examples/ShieldPolicyExample.js

@@ -0,0 +1,50 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The Shield's policy, from TypeScript (SHIELD §5.1, SH-53; SH-23).
+ *
+ * An organization's document typed by `@datalayer/agent-shield` (the types
+ * generated from the schema the Python package publishes), what it decides
+ * for each class, how ACP's tool kinds are classed, the limits soft then
+ * hard, and decisions in the words `describeDecision` gives every card and
+ * row. Needs nothing running: it reads the package only.
+ *
+ * `@datalayer/agent-shield` is not on npm yet: the page reads it from the
+ * sibling checkout `ai/agent-shield` beside agent-runtimes (see
+ * `shield/shieldPolicyDemo`), and says so where it is not there.
+ *
+ * @module examples/ShieldPolicyExample
+ */
+import { useEffect, useState } from 'react';
+import { Heading, Text } from '@primer/react';
+import { Box } from '@datalayer/primer-addons';
+import { ThemedProvider } from './utils/themedProvider';
+import { AGENT_SHIELD_MISSING, ORGANIZATION_POLICY, classRows, decisionRows, kindRows, limitRows, loadAgentShield, } from './shield/shieldPolicyDemo';
+const cell = {
+    borderBottom: '1px solid',
+    borderColor: 'border.muted',
+    py: 1,
+    pr: 3,
+};
+function Table({ head, rows, }) {
+    return (_jsxs(Box, { as: "table", sx: { borderCollapse: 'collapse', fontSize: 1, mb: 4 }, children: [_jsx("thead", { children: _jsx("tr", { children: head.map(title => (_jsx(Box, { as: "th", sx: { ...cell, textAlign: 'left' }, children: title }, title))) }) }), _jsx("tbody", { children: rows.map(row => (_jsx("tr", { children: row.map((value, index) => (_jsx(Box, { as: "td", sx: cell, children: value }, index))) }, row.join('|')))) })] }));
+}
+function Tables({ shield, }) {
+    return (_jsxs(_Fragment, { children: [_jsx(Heading, { as: "h2", sx: { fontSize: 2, mb: 2 }, children: "By class" }), _jsx(Table, { head: ['Class', `The ${ORGANIZATION_POLICY.scope}'s document says`], rows: classRows(shield).map(row => [row.actionClass, row.says]) }), _jsx(Heading, { as: "h2", sx: { fontSize: 2, mb: 2 }, children: "A coding agent's tool kinds" }), _jsx(Table, { head: ['ACP kind', 'Decided as'], rows: kindRows(shield).map(row => [row.kind, row.actionClass]) }), _jsx(Heading, { as: "h2", sx: { fontSize: 2, mb: 2 }, children: "Limits, soft then hard" }), _jsx(Table, { head: ['Limit', 'Soft: asks once', 'Hard: refuses'], rows: limitRows(shield).map(row => [row.limit, row.soft, row.hard]) }), _jsx(Heading, { as: "h2", sx: { fontSize: 2, mb: 2 }, children: "Decisions, in their words" }), _jsx(Table, { head: ['The Shield said', 'describeDecision'], rows: decisionRows(shield).map(row => [row.sentence, row.words]) })] }));
+}
+const ShieldPolicyExample = () => {
+    // `undefined` while reading, `null` without the sibling checkout.
+    const [shield, setShield] = useState(undefined);
+    useEffect(() => {
+        let live = true;
+        void loadAgentShield().then(loaded => live && setShield(loaded));
+        return () => {
+            live = false;
+        };
+    }, []);
+    return (_jsx(ThemedProvider, { children: _jsxs(Box, { p: 4, maxWidth: "900px", mx: "auto", "data-testid": "shield-policy-example", children: [_jsx(Heading, { as: "h1", sx: { fontSize: 4, mb: 2 }, children: "The Shield's policy, typed" }), _jsx(Text, { as: "p", sx: { color: 'fg.muted', mb: 4 }, children: "An organization's document in `@datalayer/agent-shield`'s shape, and what it decides. Three levels decide every action \u2014 the organization's, the application's, the session's \u2014 strictest first; a lower level only tightens." }), shield === undefined ? (_jsx(Text, { as: "p", children: "Reading @datalayer/agent-shield\u2026" })) : shield === null ? (_jsx(Text, { as: "p", sx: { color: 'attention.fg' }, children: AGENT_SHIELD_MISSING })) : (_jsx(Tables, { shield: shield }))] }) }));
+};
+export default ShieldPolicyExample;

package/lib/examples/example-selector.js

@@ -133,6 +133,9 @@ export const EXAMPLE_ENTRIES = [
     makeEntry('AgentA2ATeamExample', () => import('./AgentA2ATeamExample'), 'Two applications as a team over A2A: Sales in the browser (@a2a-js/sdk) asks Accounting on a runtime (fasta2a, Odoo read only), each an Office Assistant character.'),
     makeEntry('ProtocolSignedRequestsExample', () => import('./ProtocolSignedRequestsExample'), 'Web Bot Auth in the browser: a key made in the page signs a request — its three headers and the signature base — verified, then a replay and a changed path refused.'),
     makeEntry('ProtocolUcpCheckoutExample', () => import('./ProtocolUcpCheckoutExample'), 'A UCP checkout at a test store in the page: the exact purchase proposed, approved on a card once, bought once.'),
+    // The Shield (SHIELD.md SH-23): a coding agent behind it, and its policy's types.
+    makeEntry('ShieldHarnessExample', () => import('./ShieldHarnessExample'), 'A coding agent behind the Shield in the web chat: its changes as diffs, its commands as terminals, what a rule asks first in the approval banner. Needs `python examples/shield/harness_on_the_runtime.py --serve` (the fake agent, no key).', ['example', 'shield', 'harness', 'acp', 'ag-ui', 'chat']),
+    makeEntry('ShieldPolicyExample', () => import('./ShieldPolicyExample'), 'The Shield’s policy from TypeScript: an organization’s document typed by @datalayer/agent-shield, what it decides by class, the tool kinds classed, the limits soft then hard, decisions in describeDecision’s words.', ['example', 'shield', 'policy']),
     makeEntry('PapCompanyDiscoveryExample', () => import('./PapCompanyDiscoveryExample'), 'Validate a PAP company document and reduce it to the public capabilities safe for an agent or UI.'),
     makeEntry('PapAgentIdentityExample', () => import('./PapAgentIdentityExample'), 'Verify personal-agent client metadata and signing policy without exposing JWK coordinates.'),
     makeEntry('PapAuthorizationBoundaryExample', () => import('./PapAuthorizationBoundaryExample'), 'Generate real Session and Direct Sign-In security material while showing only safe policy status.'),

package/lib/examples/exampleGroups.d.ts

@@ -5,5 +5,5 @@
  *
  * @module examples/exampleGroups
  */
-export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "Personal Agent Protocol", "Agent protocols", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
+export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "Personal Agent Protocol", "Agent protocols", "Shield", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
 export declare const getExampleGroup: (id: string) => string;

package/lib/examples/exampleGroups.js

@@ -16,6 +16,7 @@ export const EXAMPLE_GROUP_ORDER = [
     'A2A',
     'Personal Agent Protocol',
     'Agent protocols',
+    'Shield',
     'AG-UI',
     'Chat',
     'Document',
@@ -43,6 +44,9 @@ export const getExampleGroup = (id) => {
     // The other agent protocols' examples: signed requests, commerce (AGENT_PROTOCOLS EX-10).
     if (id.startsWith('Protocol'))
         return 'Agent protocols';
+    // The Shield: a coding agent behind it, and its policy (SHIELD.md SH-23).
+    if (id.startsWith('Shield'))
+        return 'Shield';
     if (id.startsWith('AgUi'))
         return 'AG-UI';
     if (id.startsWith('CopilotKit'))

package/lib/examples/shield/shieldHarness.d.ts

@@ -0,0 +1,14 @@
+/**
+ * What `ShieldHarnessExample` connects to and offers (SHIELD SH-23).
+ *
+ * `examples/shield/harness_on_the_runtime.py --serve` names the harness's
+ * agent `chat`, as `loop --harness` does with `AGENT_RUNTIMES_AGENT_NAME`;
+ * the openers are the fake agent's words (its docstring says what each does).
+ *
+ * @module examples/shield/shieldHarness
+ */
+import type { Suggestion } from '../../types/chat';
+/** The agent the local runtime serves the harness as. */
+export declare const SHIELD_HARNESS_AGENT = "chat";
+/** What to ask the fake agent: one of each decision. */
+export declare const SHIELD_HARNESS_OPENERS: Suggestion[];

package/lib/examples/shield/shieldHarness.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** The agent the local runtime serves the harness as. */
+export const SHIELD_HARNESS_AGENT = 'chat';
+/** What to ask the fake agent: one of each decision. */
+export const SHIELD_HARNESS_OPENERS = [
+    {
+        title: 'Edit a file',
+        message: 'edit and read README.md',
+    },
+    {
+        title: 'Run a command',
+        message: 'run echo hello',
+    },
+    {
+        title: 'Read outside the workspace',
+        message: 'outside',
+    },
+];

package/lib/examples/shield/shieldPolicyDemo.d.ts

@@ -0,0 +1,85 @@
+/**
+ * What `ShieldPolicyExample` draws, as data (SHIELD §5.1, SH-53; SH-23).
+ *
+ * `@datalayer/agent-shield` is the Shield's TypeScript: the policy
+ * document's types generated from the schema the Python package publishes,
+ * the classes and the verdicts, ACP's tool kinds mapped to the classes, the
+ * limits' words, and `describeDecision` — the one place a decision's words
+ * are written. It is not on npm yet (npm's latest is an old scaffold), so
+ * agent-runtimes does not depend on it: this page reads it from the sibling
+ * checkout, `ai/agent-shield/src/policy.ts` beside `ai/agent-runtimes`, the
+ * way the monorepo lays them out — through Vite's `import.meta.glob`, which
+ * finds nothing (and the page says so) where the sibling is not there, as in
+ * agent-runtimes' own CI. The shapes below name only what the page reads;
+ * the types themselves are the package's.
+ *
+ * @module examples/shield/shieldPolicyDemo
+ */
+export type Verdict = 'allow' | 'ask' | 'deny';
+/** A decision as the Shield returns it (the package's `Decision`). */
+export type Decision = {
+    verdict: Verdict;
+    sentence: string;
+    scope?: 'organization' | 'team' | 'session' | null;
+    rule?: string | null;
+    decided_by: 'rule' | 'limit' | 'network' | 'default';
+};
+/** The part of a policy document the page draws (the package's `Policy`). */
+export type PolicyDocument = {
+    scope: 'organization' | 'team' | 'session';
+    rules?: Array<{
+        name: string;
+        decision: Verdict;
+        classes?: string[];
+        commands?: string[];
+        where?: 'inside' | 'outside' | 'any';
+        reason?: string;
+    }>;
+    limits?: Record<string, {
+        soft: number;
+        hard: number;
+    } | null | undefined>;
+    harnesses?: {
+        admit?: string[];
+        credentials?: 'account' | 'platform' | 'either';
+    };
+};
+/** What the page reads from `@datalayer/agent-shield`'s `policy.ts`. */
+export type AgentShieldPolicyModule = {
+    ACTION_CLASSES: readonly string[];
+    TOOL_KINDS: readonly string[];
+    KIND_CLASS: Record<string, string | null>;
+    LIMIT_NAMES: readonly string[];
+    LIMIT_WORDS: Record<string, string>;
+    VERDICT_WORDS: Record<Verdict, string>;
+    describeDecision: (decision: Decision) => string;
+};
+/** What the page says when the sibling checkout is not beside this one. */
+export declare const AGENT_SHIELD_MISSING = "This page reads @datalayer/agent-shield from the sibling checkout ai/agent-shield, which is not beside this one: clone github.com/datalayer/agent-shield next to agent-runtimes (the package is not on npm yet).";
+/** `@datalayer/agent-shield`'s policy module, or `null` without the sibling checkout. */
+export declare function loadAgentShield(): Promise<AgentShieldPolicyModule | null>;
+/** An organization's document, in the package's shape: what an administrator writes. */
+export declare const ORGANIZATION_POLICY: PolicyDocument;
+/** One row per class: what the organization's document decides for it, in words. */
+export declare function classRows(shield: AgentShieldPolicyModule, policy?: PolicyDocument): Array<{
+    actionClass: string;
+    says: string;
+}>;
+/** ACP's tool kinds and the class each is decided as (§4.5). */
+export declare function kindRows(shield: AgentShieldPolicyModule): Array<{
+    kind: string;
+    actionClass: string;
+}>;
+/** The limits a document sets, soft then hard, in the sentences' words. */
+export declare function limitRows(shield: AgentShieldPolicyModule, policy?: PolicyDocument): Array<{
+    limit: string;
+    soft: string;
+    hard: string;
+}>;
+/** Decisions as the Shield returns them. */
+export declare const DECISIONS: Decision[];
+/** Each decision and its words through `describeDecision`. */
+export declare function decisionRows(shield: AgentShieldPolicyModule): Array<{
+    sentence: string;
+    words: string;
+}>;