@decionis/mcp 0.4.0 → 0.6.0

package/README.md

@@ -11,8 +11,9 @@ protocol's own schema-validated bundle ingestion, and evaluates through
 locally is the verdict the platform would produce — with **zero network, zero database,
 zero credentials, and nothing recorded**.
 
-(The protocol service separately exposes a _remote_, authenticated MCP surface for
-org-connected agents; this package is the local, offline complement for repo checkouts.)
+(The protocol service also exposes a remote authenticated MCP surface. The local
+execution path stays offline; optional connected PolicyAgent authoring is described
+below.)
 
 The package now exposes two complementary surfaces:
 
@@ -367,3 +368,48 @@ printf '%s\n' \
   the evaluate tool detects this and tells the agent how to fix the policy.
 - Local evaluations mint no signed Decision Dossier; CI runs through
   [`decionis/govern`](https://github.com/decionis/govern) produce the verifiable record.
+
+## Governed PolicyAgent authoring
+
+The local package can additionally connect to the governed PolicyAgent workspace.
+This is opt-in: set `DECIONIS_POLICY_CONNECTED=1`, your
+`DECIONIS_POLICY_WORKSPACE_ID`, and a private `DECIONIS_POLICY_OAUTH_TOKEN` issued
+through an approved registered OAuth client. Without the opt-in flag the additional
+authoring tools are absent. Existing execution hooks keep their existing behavior.
+The token is read per call; a wrong workspace, expired grant or missing disclosure
+approval fails closed. The package has no OAuth login or refresh-token store.
+
+PolicyAgent reads authorized policy revisions, stores change proposals and requests
+independent review. Human authors accept proposals into drafts and independent
+reviewers attest in the workspace. Assistant confirmation never signs, approves or
+deploys policy. Never put tokens in prompts or checked-in configuration.
+
+### Policy authoring context for your assistant
+
+On connect, the server sends short policy authoring instructions: write each rule as a
+rule card, read it back, and propose it with `decionis.propose_policy_change`. Clients
+that support MCP prompts and resources also get three guides:
+
+| Prompt            | Resource                            | Use it to                                                   |
+| ----------------- | ----------------------------------- | ----------------------------------------------------------- |
+| `policyauthoring` | `decionis://assist/policyauthoring` | Turn plain-English rules into PolicyAgent proposals.        |
+| `agentsafe`       | `decionis://assist/agentsafe`       | Put AgentSafe in front of an agent's writes.                |
+| `workflowsetup`   | `decionis://assist/workflowsetup`   | Set up governed CI and move a policy through its lifecycle. |
+
+To keep the guides in a project as files, install them for one assistant:
+
+```bash
+npx @decionis/mcp context install --client claude    # or codex, copilot, kiro, cursor
+npx @decionis/mcp context install --client cursor --dir ./my-project --dry-run
+```
+
+The command writes the client's skills, agents, rules or steering files and adds the
+Decionis servers to its MCP settings, keeping any other servers there. It updates files
+it wrote before and skips any other existing file unless you pass `--force`. The files
+name environment variables only; keep keys and tokens in your environment.
+
+Provider package sources and installation instructions are under
+`distribution/claude/`. Repository maintainers can run
+`pnpm --filter @decionis/mcp package:policyagent claude` to create reviewable ZIPs.
+See the repository's `docs/marketplace/policyagent/Claude.md` for the full review
+exercise and publication requirements.

package/dist/AgentHookCli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   AgentHookCommand
-} from "./chunk-GCE6PUYD.js";
-import "./chunk-5Q6BCK32.js";
+} from "./chunk-KV4WA4BV.js";
+import "./chunk-XMQRTHQK.js";
 
 // src/AgentHookCli.ts
 void AgentHookCommand.run(process.argv.slice(2)).then((exitCode) => {