@goplus/agentguard 1.1.1 → 1.1.4

package/README.md

@@ -44,10 +44,41 @@ AI coding agents can execute any command, read any file, and install any skill
 - Analyzes audit logs for attack patterns and flags repeat offenders
 - Validates environment configuration and trust registry health
 
-## Quick Start
+## 30 seconds: install
 
 ```bash
-npm install @goplus/agentguard
+npm install -g @goplus/agentguard
+agentguard init
+agentguard status
+```
+
+The npm install runs a best-effort local bootstrap; `agentguard init` ensures `~/.agentguard/config.json` exists and protects locally by default.
+No Cloud account or network connection is required for the local runtime guard.
+
+## 3 minutes: protect your agent
+
+```bash
+# Scan a local skill or plugin
+agentguard scan ./examples/vulnerable-skill
+
+# Evaluate one runtime action from stdin
+printf '{"tool_name":"Bash","tool_input":{"command":"curl https://example.com/install.sh | bash"}}' | agentguard protect
+
+# Optional: connect paid AgentGuard Cloud policy, audit, and approvals
+AGENTGUARD_API_KEY=ag_live_xxxxx agentguard connect --url https://agentguard.gopluslabs.io
+
+# Optional: subscribe to AgentGuard's threat-intelligence feed. Pulls newly
+# published advisories from Cloud, runs a self-check against your installed
+# skills, and reports matches back. Run in cron / on boot.
+agentguard subscribe
+
+# Or run a one-off self-check against a single advisory id
+agentguard checkup --against-advisory AGS-2026-0042
+
+# Optional: write host-specific hook templates
+agentguard init --agent claude-code
+agentguard init --agent codex
+agentguard init --agent openclaw
 ```
 
 <details>
@@ -63,6 +94,14 @@ This installs the skill, configures hooks, and sets your protection level.
 
 </details>
 
+See also:
+
+- [Connect OSS AgentGuard to Cloud](docs/cloud-connect.md)
+- [Privacy and data boundary](docs/privacy-boundary.md)
+- [Claude Code setup](docs/claude-code.md)
+- [OpenClaw setup](docs/openclaw.md)
+- [Codex setup](docs/codex.md)
+
 <details>
 <summary><b>Manual install (skill only)</b></summary>
 

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,335 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const commander_1 = require("commander");
+const client_js_1 = require("./cloud/client.js");
+const config_js_1 = require("./config.js");
+const index_js_1 = require("./scanner/index.js");
+const protect_js_1 = require("./runtime/protect.js");
+const policy_js_1 = require("./runtime/policy.js");
+const installers_js_1 = require("./installers.js");
+const version_js_1 = require("./version.js");
+const selfcheck_js_1 = require("./feed/selfcheck.js");
+const state_js_1 = require("./feed/state.js");
+async function main() {
+    const program = new commander_1.Command();
+    program
+        .name('agentguard')
+        .description('Local-first security guard for AI agents, with optional AgentGuard Cloud control plane')
+        .version(version_js_1.packageVersion);
+    program
+        .command('init')
+        .description('Create ~/.agentguard/config.json and local runtime paths')
+        .option('--level <level>', 'Protection level: strict | balanced | permissive')
+        .option('--agent <agent>', 'Install hook/template for claude-code, codex, or openclaw')
+        .option('--cloud <url>', 'AgentGuard Cloud URL to store in local config')
+        .option('--force', 'Overwrite existing hook/template files')
+        .action((options) => {
+        const config = (0, config_js_1.ensureConfig)();
+        if (options.level) {
+            if (!['strict', 'balanced', 'permissive'].includes(options.level)) {
+                throw new Error('Invalid level. Use strict, balanced, or permissive.');
+            }
+            config.level = options.level;
+            (0, config_js_1.saveConfig)(config);
+        }
+        if (options.cloud) {
+            config.cloudUrl = (0, config_js_1.normalizeCloudUrl)(options.cloud);
+            (0, config_js_1.saveConfig)(config);
+        }
+        const paths = (0, config_js_1.getAgentGuardPaths)();
+        console.log(`AgentGuard initialized at ${paths.home}`);
+        console.log(`Config: ${paths.configPath}`);
+        if (options.agent) {
+            if (!['claude-code', 'codex', 'openclaw'].includes(options.agent)) {
+                throw new Error('Invalid agent. Use claude-code, codex, or openclaw.');
+            }
+            const result = (0, installers_js_1.installAgentTemplates)(options.agent, { force: options.force });
+            console.log(`Installed ${result.agent} template:`);
+            for (const file of result.files)
+                console.log(`- ${file}`);
+        }
+    });
+    program
+        .command('connect')
+        .description('Connect local AgentGuard to AgentGuard Cloud')
+        .option('--key <key>', 'AgentGuard Cloud API key (prefer AGENTGUARD_API_KEY to avoid shell history)')
+        .option('--api-key <key>', 'AgentGuard Cloud API key (prefer AGENTGUARD_API_KEY to avoid shell history)')
+        .option('--url <url>', 'AgentGuard Cloud URL', 'https://agentguard.gopluslabs.io')
+        .option('--cloud <url>', 'AgentGuard Cloud URL')
+        .action(async (options) => {
+        const apiKey = options.key || options.apiKey || process.env.AGENTGUARD_API_KEY;
+        if (!apiKey) {
+            throw new Error('Missing API key. Pass --key, --api-key, or set AGENTGUARD_API_KEY.');
+        }
+        const config = (0, config_js_1.connectCloud)({ apiKey, cloudUrl: options.cloud || options.url });
+        const client = new client_js_1.AgentGuardCloudClient(config);
+        try {
+            const policy = await client.fetchEffectivePolicy();
+            (0, policy_js_1.saveCachedPolicy)(config.policyCachePath, policy);
+            console.log(`Connected to AgentGuard Cloud (${config.cloudUrl}).`);
+            console.log(`Cached policy ${policy.policyVersion} at ${config.policyCachePath}.`);
+        }
+        catch (error) {
+            console.log(`Saved Cloud configuration for ${config.cloudUrl}.`);
+            console.log(`Policy fetch failed; local protection still works offline. ${error instanceof Error ? error.message : ''}`.trim());
+        }
+    });
+    program
+        .command('status')
+        .description('Show local and Cloud connection status')
+        .action(() => {
+        const config = (0, config_js_1.ensureConfig)();
+        const paths = (0, config_js_1.getAgentGuardPaths)();
+        console.log(`Config: ${paths.configPath}`);
+        console.log(`Protection level: ${config.level}`);
+        console.log(`Cloud URL: ${config.cloudUrl || 'not configured'}`);
+        console.log(`API key: ${(0, config_js_1.maskApiKey)(config.apiKey)}`);
+        console.log(`Policy cache: ${config.policyCachePath}`);
+        console.log(`Audit log: ${config.auditPath}`);
+    });
+    program
+        .command('doctor')
+        .description('Check local AgentGuard setup')
+        .action(async () => {
+        const config = (0, config_js_1.ensureConfig)();
+        const paths = (0, config_js_1.getAgentGuardPaths)();
+        console.log(`✓ Home: ${paths.home}`);
+        console.log(`✓ Config: ${paths.configPath}`);
+        console.log(`✓ Node: ${process.version}`);
+        if (config.apiKey) {
+            const client = new client_js_1.AgentGuardCloudClient(config);
+            try {
+                const status = await client.status();
+                console.log(`✓ Cloud: ${status.status}${status.version ? ` (${status.version})` : ''}`);
+            }
+            catch {
+                console.log('! Cloud: unreachable; local protection remains active');
+            }
+        }
+        else {
+            console.log('! Cloud: not connected');
+        }
+    });
+    program
+        .command('scan')
+        .description('Scan a local skill/plugin directory')
+        .argument('<path>', 'Directory to scan')
+        .option('--json', 'Print JSON output')
+        .action(async (path, options) => {
+        const scanner = new index_js_1.SkillScanner({ useExternalScanner: false });
+        const result = await scanner.quickScan(path);
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+        }
+        else {
+            console.log(`${result.risk_level.toUpperCase()}: ${result.summary}`);
+            if (result.risk_tags.length)
+                console.log(`Tags: ${result.risk_tags.join(', ')}`);
+        }
+        process.exitCode = result.risk_level === 'critical' ? 2 : 0;
+    });
+    program
+        .command('protect')
+        .description('Evaluate one runtime action from stdin or hook environment')
+        .option('--agent <agent>', 'Agent host, e.g. claude-code, codex, openclaw')
+        .option('--action-type <type>', 'Runtime action type, e.g. shell, file_read, file_write')
+        .option('--tool-name <name>', 'Tool name from host')
+        .option('--session-id <id>', 'Stable agent session id')
+        .option('--decision-mode <mode>', 'local-first or cloud', 'local-first')
+        .option('--json', 'Print JSON output')
+        .action(async (options) => {
+        const stdinText = readStdinIfAvailable();
+        const result = await (0, protect_js_1.protectAction)({
+            config: (0, config_js_1.ensureConfig)(),
+            stdinText,
+            agentHost: options.agent,
+            actionType: options.actionType,
+            toolName: options.toolName,
+            sessionId: options.sessionId,
+            decisionMode: options.decisionMode,
+        });
+        if (!result)
+            return;
+        console.log((0, protect_js_1.formatProtectResult)(result, Boolean(options.json)));
+        process.exitCode = (0, protect_js_1.exitCodeForDecision)(result.decision);
+    });
+    program
+        .command('subscribe')
+        .description('Pull new threat-feed advisories from AgentGuard Cloud and run a self-check against locally installed skills')
+        .option('--since <iso>', 'Override the persisted last-pulled timestamp')
+        .option('--json', 'Emit machine-readable summary instead of human text')
+        .option('--no-report', 'Skip uploading self-check results back to Cloud')
+        .action(async (options) => {
+        const config = (0, config_js_1.ensureConfig)();
+        const client = new client_js_1.AgentGuardCloudClient(config);
+        const state = (0, state_js_1.loadFeedState)();
+        const since = options.since ?? state.lastPulledAt;
+        let advisories;
+        try {
+            advisories = await client.pullAdvisories(since);
+        }
+        catch (err) {
+            console.error(`! Could not reach AgentGuard Cloud: ${err.message}`);
+            process.exitCode = 1;
+            return;
+        }
+        if (advisories === null) {
+            // 404 — older Cloud build without the feed endpoint. Not an error.
+            if (options.json) {
+                console.log(JSON.stringify({ supported: false, results: [] }));
+            }
+            else {
+                console.log('AgentGuard Cloud does not expose /api/v1/feed/advisories yet — nothing to do.');
+            }
+            return;
+        }
+        const seen = new Set(state.seenAdvisoryIds ?? []);
+        // Process oldest-first so the cursor can advance monotonically and we
+        // never skip over an advisory that failed mid-batch.
+        const fresh = advisories
+            .filter((a) => !seen.has(a.id))
+            .sort((a, b) => (a.publishedAt < b.publishedAt ? -1 : 1));
+        const results = [];
+        let cursorOk = true; // stops advancing on the first hard failure
+        let latestPublishedAt = state.lastPulledAt;
+        let hardFailures = 0;
+        for (const advisory of fresh) {
+            let processed = true;
+            let result;
+            try {
+                result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(advisory);
+            }
+            catch (err) {
+                // runSelfCheck shouldn't throw, but if it does the advisory has
+                // not been evaluated — don't mark it seen and don't advance.
+                console.error(`! Self-check threw for ${advisory.id}: ${err.message}`);
+                hardFailures += 1;
+                cursorOk = false;
+                continue;
+            }
+            results.push(result);
+            if (options.report !== false && client.connected && result.matchedArtifacts.length > 0) {
+                // Report is on the critical path — if Cloud doesn't see the
+                // match, we must NOT mark the advisory seen, otherwise a
+                // transient network blip silently buries a real hit.
+                try {
+                    await client.reportSelfCheck(advisory.id, result.matchedArtifacts, {
+                        elapsedMs: result.elapsedMs,
+                        warnings: result.warnings,
+                    });
+                }
+                catch (err) {
+                    console.error(`! Failed to report self-check for ${advisory.id}: ${err.message}`);
+                    processed = false;
+                    hardFailures += 1;
+                }
+            }
+            if (processed) {
+                Object.assign(state, (0, state_js_1.markAdvisorySeen)(state, advisory.id));
+                if (cursorOk && (!latestPublishedAt || advisory.publishedAt > latestPublishedAt)) {
+                    latestPublishedAt = advisory.publishedAt;
+                }
+            }
+            else {
+                // From this point we no longer advance the pull cursor — the
+                // failed advisory must be re-pulled on the next run.
+                cursorOk = false;
+            }
+        }
+        state.lastPulledAt = latestPublishedAt;
+        (0, state_js_1.saveFeedState)(state);
+        if (options.json) {
+            console.log(JSON.stringify({ supported: true, pulled: advisories.length, fresh: fresh.length, results }, null, 2));
+            return;
+        }
+        const totalMatches = results.reduce((acc, r) => acc + r.matchedArtifacts.length, 0);
+        console.log(`Pulled ${advisories.length} advisory record(s); ${fresh.length} new.`);
+        if (fresh.length === 0)
+            return;
+        console.log(`Self-check found ${totalMatches} match(es) across the new advisories.`);
+        for (const r of results) {
+            if (r.matchedArtifacts.length === 0)
+                continue;
+            console.log(`  - ${r.advisoryId}: ${r.matchedArtifacts.length} match(es)`);
+            for (const m of r.matchedArtifacts) {
+                console.log(`      · ${m.path}  [${m.matchedBy}]`);
+            }
+        }
+        // Exit codes: 2 = matches found, 1 = at least one advisory failed
+        // to evaluate or report (cursor was held back), 0 = clean.
+        if (hardFailures > 0) {
+            console.error(`! ${hardFailures} advisory record(s) failed to process and will be re-pulled next run.`);
+            process.exitCode = 1;
+        }
+        else if (totalMatches > 0) {
+            process.exitCode = 2;
+        }
+        else {
+            process.exitCode = 0;
+        }
+    });
+    program
+        .command('checkup')
+        .description('Run a self-check immediately. Without --against-advisory, scans for everything in the feed cache.')
+        .option('--against-advisory <id>', 'Restrict the check to a single advisory id (fetches it from Cloud if needed)')
+        .option('--json', 'Emit machine-readable result')
+        .action(async (options) => {
+        const config = (0, config_js_1.ensureConfig)();
+        const client = new client_js_1.AgentGuardCloudClient(config);
+        const advisoryId = options.againstAdvisory;
+        if (!advisoryId) {
+            console.log('Tip: pass --against-advisory <id> for now. A broader, full-fleet checkup is coming.');
+            console.log('Meanwhile, run `agentguard subscribe` to pull the feed and self-check new entries.');
+            return;
+        }
+        let advisory = null;
+        try {
+            const all = await client.pullAdvisories();
+            advisory = all?.find((a) => a.id === advisoryId) ?? null;
+        }
+        catch (err) {
+            console.error(`! Could not reach AgentGuard Cloud: ${err.message}`);
+            process.exitCode = 1;
+            return;
+        }
+        if (!advisory) {
+            console.error(`No advisory with id "${advisoryId}" found in the current feed window.`);
+            process.exitCode = 1;
+            return;
+        }
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(advisory);
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+        }
+        else {
+            console.log(`Advisory ${result.advisoryId}: ${result.matchedArtifacts.length} match(es)`);
+            for (const m of result.matchedArtifacts) {
+                console.log(`  · ${m.path}  [${m.matchedBy}]`);
+            }
+            if (result.warnings.length) {
+                console.log('Warnings:');
+                for (const w of result.warnings)
+                    console.log(`  ! ${w}`);
+            }
+        }
+        process.exitCode = result.matchedArtifacts.length > 0 ? 2 : 0;
+    });
+    await program.parseAsync(process.argv);
+}
+function readStdinIfAvailable() {
+    if (process.stdin.isTTY)
+        return '';
+    try {
+        return (0, node_fs_1.readFileSync)(0, 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;AAEA,qCAAuC;AACvC,yCAAoC;AACpC,iDAA0D;AAC1D,2CAQqB;AACrB,iDAAkD;AAClD,qDAA+F;AAC/F,mDAAuD;AAEvD,mDAA6E;AAC7E,6CAA8C;AAC9C,sDAA8D;AAC9D,8CAAiF;AAGjF,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,YAAY,CAAC;SAClB,WAAW,CAAC,wFAAwF,CAAC;SACrG,OAAO,CAAC,2BAAc,CAAC,CAAC;IAE3B,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SAC7E,MAAM,CAAC,iBAAiB,EAAE,2DAA2D,CAAC;SACtF,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACxE,MAAM,CAAC,SAAS,EAAE,wCAAwC,CAAC;SAC3D,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,IAAA,wBAAY,GAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC7B,IAAA,sBAAU,EAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,QAAQ,GAAG,IAAA,6BAAiB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACnD,IAAA,sBAAU,EAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,8BAAkB,GAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,qCAAqB,EAAC,OAAO,CAAC,KAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAChG,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,YAAY,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,aAAa,EAAE,6EAA6E,CAAC;SACpG,MAAM,CAAC,iBAAiB,EAAE,6EAA6E,CAAC;SACxG,MAAM,CAAC,aAAa,EAAE,sBAAsB,EAAE,kCAAkC,CAAC;SACjF,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACnD,IAAA,4BAAgB,EAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,aAAa,OAAO,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,8DAA8D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAClI,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,MAAM,GAAG,IAAA,wBAAY,GAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,8BAAkB,GAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAA,sBAAU,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,IAAA,wBAAY,GAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,8BAAkB,GAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qCAAqC,CAAC;SAClD,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;SACvC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,IAAI,uBAAY,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;SAC1E,MAAM,CAAC,sBAAsB,EAAE,wDAAwD,CAAC;SACxF,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACnD,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;SACtD,MAAM,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,aAAa,CAAC;SACvE,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAa,EAAC;YACjC,MAAM,EAAE,IAAA,wBAAY,GAAE;YACtB,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,KAAqC;YACxD,UAAU,EAAE,OAAO,CAAC,UAA2C;YAC/D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,OAAO,CAAC,GAAG,CAAC,IAAA,gCAAmB,EAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,QAAQ,GAAG,IAAA,gCAAmB,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,6GAA6G,CAAC;SAC1H,MAAM,CAAC,eAAe,EAAE,8CAA8C,CAAC;SACvE,MAAM,CAAC,QAAQ,EAAE,qDAAqD,CAAC;SACvE,MAAM,CAAC,aAAa,EAAE,iDAAiD,CAAC;SACxE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,IAAA,wBAAY,GAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAA,wBAAa,GAAE,CAAC;QAC9B,MAAM,KAAK,GAAI,OAAO,CAAC,KAA4B,IAAI,KAAK,CAAC,YAAY,CAAC;QAE1E,IAAI,UAA6B,CAAC;QAClC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,mEAAmE;YACnE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAClD,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,KAAK,GAAG,UAAU;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,IAAI,QAAQ,GAAG,IAAI,CAAC,CAAC,4CAA4C;QACjE,IAAI,iBAAiB,GAAG,KAAK,CAAC,YAAY,CAAC;QAC3C,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,IAAI,SAAS,GAAG,IAAI,CAAC;YACrB,IAAI,MAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,6DAA6D;gBAC7D,OAAO,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClF,YAAY,IAAI,CAAC,CAAC;gBAClB,QAAQ,GAAG,KAAK,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvF,4DAA4D;gBAC5D,yDAAyD;gBACzD,qDAAqD;gBACrD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,gBAAgB,EAAE;wBACjE,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,QAAQ,CAAC,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC7F,SAAS,GAAG,KAAK,CAAC;oBAClB,YAAY,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,2BAAgB,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3D,IAAI,QAAQ,IAAI,CAAC,CAAC,iBAAiB,IAAI,QAAQ,CAAC,WAAW,GAAG,iBAAiB,CAAC,EAAE,CAAC;oBACjF,iBAAiB,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAC3C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6DAA6D;gBAC7D,qDAAqD;gBACrD,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,YAAY,GAAG,iBAAiB,CAAC;QACvC,IAAA,wBAAa,EAAC,KAAK,CAAC,CAAC;QAErB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,MAAM,wBAAwB,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,OAAO,CAAC,GAAG,CAAC,oBAAoB,YAAY,uCAAuC,CAAC,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC9C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,gBAAgB,CAAC,MAAM,YAAY,CAAC,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,uEAAuE,CAAC,CAAC;YACxG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,mGAAmG,CAAC;SAChH,MAAM,CAAC,yBAAyB,EAAE,8EAA8E,CAAC;SACjH,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;SAChD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,IAAA,wBAAY,GAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAqC,CAAC;QAEjE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;YACnG,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAoB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1C,QAAQ,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,wBAAwB,UAAU,qCAAqC,CAAC,CAAC;YACvF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,gBAAgB,CAAC,MAAM,YAAY,CAAC,CAAC;YAC1F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cloud/client.d.ts

@@ -0,0 +1,41 @@
+import type { AgentGuardConfig } from '../config.js';
+import type { EffectiveRuntimePolicy, RuntimeAction, RuntimeAuditEvent, RuntimeDecision } from '../runtime/types.js';
+import type { Advisory, SelfCheckMatch } from '../feed/types.js';
+export declare class AgentGuardCloudClient {
+    private readonly cloudUrl;
+    private readonly apiKey?;
+    constructor(config: Pick<AgentGuardConfig, 'cloudUrl' | 'apiKey'>);
+    get connected(): boolean;
+    status(): Promise<{
+        status: string;
+        version?: string;
+    }>;
+    fetchEffectivePolicy(): Promise<EffectiveRuntimePolicy>;
+    evaluateAction(action: RuntimeAction): Promise<RuntimeDecision>;
+    ingestEvents(events: RuntimeAuditEvent[]): Promise<void>;
+    createApproval(event: RuntimeAuditEvent): Promise<string | null>;
+    /**
+     * Pull threat-feed advisories newer than `since`. Returns null when the
+     * cloud doesn't expose the endpoint yet (404) — callers should treat null
+     * as "no new advisories" rather than an error, so the subscribe command
+     * works against older AgentGuard Cloud versions too.
+     */
+    pullAdvisories(since?: string): Promise<Advisory[] | null>;
+    /**
+     * Report the outcome of a single advisory self-check. Matches paths are
+     * redacted by the caller before they get here. Tolerates 404 so subscribe
+     * still completes locally even if the report sink is absent server-side.
+     */
+    reportSelfCheck(advisoryId: string, matches: SelfCheckMatch[], options?: {
+        elapsedMs?: number;
+        warnings?: string[];
+    }): Promise<void>;
+    private request;
+    private requireApiKey;
+}
+export declare class CloudRequestError extends Error {
+    readonly status: number;
+    readonly path: string;
+    constructor(status: number, path: string);
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/cloud/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/cloud/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EACV,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOjE,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;gBAErB,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,QAAQ,CAAC;IAKjE,IAAI,SAAS,IAAI,OAAO,CAEvB;IAEK,MAAM,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvD,oBAAoB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAMvD,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAS/D,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxD,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAStE;;;;;OAKG;IACG,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC;IAgBhE;;;;OAIG;IACG,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EAAE,EACzB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACxD,OAAO,CAAC,IAAI,CAAC;YAoBF,OAAO;IAiBrB,OAAO,CAAC,aAAa;CAKtB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM;CAK/B"}

package/dist/cloud/client.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudRequestError = exports.AgentGuardCloudClient = void 0;
+const config_js_1 = require("../config.js");
+const redaction_js_1 = require("../runtime/redaction.js");
+const audit_js_1 = require("../runtime/audit.js");
+class AgentGuardCloudClient {
+    cloudUrl;
+    apiKey;
+    constructor(config) {
+        this.cloudUrl = (0, config_js_1.normalizeCloudUrl)(config.cloudUrl || 'https://agentguard.gopluslabs.io');
+        this.apiKey = config.apiKey;
+    }
+    get connected() {
+        return Boolean(this.apiKey);
+    }
+    async status() {
+        const body = await this.request('/api/v1/status');
+        return body.data;
+    }
+    async fetchEffectivePolicy() {
+        this.requireApiKey();
+        const body = await this.request('/api/v1/policies/effective');
+        return body.data;
+    }
+    async evaluateAction(action) {
+        this.requireApiKey();
+        const body = await this.request('/api/v1/actions/evaluate', {
+            method: 'POST',
+            body: JSON.stringify(sanitizeActionRequest(action)),
+        });
+        return body.data;
+    }
+    async ingestEvents(events) {
+        this.requireApiKey();
+        await this.request('/api/v1/events/ingest', {
+            method: 'POST',
+            body: JSON.stringify({
+                events: events.map((event) => (0, audit_js_1.buildAuditEvent)(event)),
+            }),
+        });
+    }
+    async createApproval(event) {
+        this.requireApiKey();
+        const body = await this.request('/api/v1/approvals', {
+            method: 'POST',
+            body: JSON.stringify((0, audit_js_1.buildAuditEvent)(event)),
+        });
+        return body.data.approvalId || null;
+    }
+    /**
+     * Pull threat-feed advisories newer than `since`. Returns null when the
+     * cloud doesn't expose the endpoint yet (404) — callers should treat null
+     * as "no new advisories" rather than an error, so the subscribe command
+     * works against older AgentGuard Cloud versions too.
+     */
+    async pullAdvisories(since) {
+        const params = new URLSearchParams();
+        if (since)
+            params.set('since', since);
+        const qs = params.toString();
+        const path = `/api/v1/feed/advisories${qs ? `?${qs}` : ''}`;
+        try {
+            const body = await this.request(path);
+            return body.data.advisories ?? [];
+        }
+        catch (err) {
+            if (err instanceof CloudRequestError && err.status === 404) {
+                return null;
+            }
+            throw err;
+        }
+    }
+    /**
+     * Report the outcome of a single advisory self-check. Matches paths are
+     * redacted by the caller before they get here. Tolerates 404 so subscribe
+     * still completes locally even if the report sink is absent server-side.
+     */
+    async reportSelfCheck(advisoryId, matches, options = {}) {
+        this.requireApiKey();
+        try {
+            await this.request('/api/v1/feed/self-check-report', {
+                method: 'POST',
+                body: JSON.stringify({
+                    advisoryId,
+                    matches,
+                    elapsedMs: options.elapsedMs,
+                    warnings: options.warnings,
+                }),
+            });
+        }
+        catch (err) {
+            if (err instanceof CloudRequestError && err.status === 404) {
+                return;
+            }
+            throw err;
+        }
+    }
+    async request(path, init = {}) {
+        const response = await fetch(`${this.cloudUrl}${path}`, {
+            ...init,
+            headers: {
+                'content-type': 'application/json',
+                ...(this.apiKey ? { 'x-api-key': this.apiKey } : {}),
+                ...(init.headers || {}),
+            },
+            signal: AbortSignal.timeout(5000),
+        });
+        const body = (await response.json().catch(() => null));
+        if (!response.ok || !body?.success) {
+            throw new CloudRequestError(response.status, path);
+        }
+        return body;
+    }
+    requireApiKey() {
+        if (!this.apiKey) {
+            throw new Error('AgentGuard Cloud API key is not configured.');
+        }
+    }
+}
+exports.AgentGuardCloudClient = AgentGuardCloudClient;
+class CloudRequestError extends Error {
+    status;
+    path;
+    constructor(status, path) {
+        super(`AgentGuard Cloud request failed: ${status} (${path})`);
+        this.status = status;
+        this.path = path;
+        this.name = 'CloudRequestError';
+    }
+}
+exports.CloudRequestError = CloudRequestError;
+function sanitizeActionRequest(action) {
+    return {
+        sessionId: (0, redaction_js_1.redactPreview)(action.sessionId, 160),
+        agentHost: action.agentHost,
+        actionType: action.actionType,
+        toolName: (0, redaction_js_1.redactPreview)(action.toolName, 160),
+        input: (0, redaction_js_1.redactPreview)(action.input, 64_000),
+        cwd: action.cwd ? (0, redaction_js_1.redactPreview)(action.cwd, 500) : undefined,
+        sourceSkill: action.sourceSkill ? (0, redaction_js_1.redactPreview)(action.sourceSkill, 240) : undefined,
+        metadata: (0, redaction_js_1.redactMetadata)(action.metadata),
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/cloud/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/cloud/client.ts"],"names":[],"mappings":";;;AAAA,4CAAiD;AAQjD,0DAAwE;AACxE,kDAAsD;AAQtD,MAAa,qBAAqB;IACf,QAAQ,CAAS;IACjB,MAAM,CAAU;IAEjC,YAAY,MAAqD;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAA,6BAAiB,EAAC,MAAM,CAAC,QAAQ,IAAI,kCAAkC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAuC,gBAAgB,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,4BAA4B,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAqB;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAkB,0BAA0B,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA2B;QAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;aACtD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,mBAAmB,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,KAAc;QACjC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA6B,IAAI,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,OAAyB,EACzB,UAAuD,EAAE;QAEzD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,gCAAgC,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU;oBACV,OAAO;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAc,IAAY,EAAE,OAAoB,EAAE;QACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,EAAE;YACtD,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF;AA7HD,sDA6HC;AAED,MAAa,iBAAkB,SAAQ,KAAK;IAExB;IACA;IAFlB,YACkB,MAAc,EACd,IAAY;QAE5B,KAAK,CAAC,oCAAoC,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC;QAH9C,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AARD,8CAQC;AAED,SAAS,qBAAqB,CAAC,MAAqB;IAClD,OAAO;QACL,SAAS,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACpF,QAAQ,EAAE,IAAA,6BAAc,EAAC,MAAM,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,31 @@
+export interface AgentGuardConfig {
+    version: 1;
+    level: 'strict' | 'balanced' | 'permissive';
+    cloudUrl?: string;
+    apiKey?: string;
+    connectedAt?: string;
+    policyCachePath: string;
+    auditPath: string;
+    eventSpoolPath: string;
+}
+export interface AgentGuardPaths {
+    home: string;
+    configPath: string;
+    policyCachePath: string;
+    auditPath: string;
+    eventSpoolPath: string;
+}
+export declare function getAgentGuardPaths(): AgentGuardPaths;
+export declare function defaultConfig(): AgentGuardConfig;
+export declare function ensureAgentGuardHome(): AgentGuardPaths;
+export declare function ensureConfig(): AgentGuardConfig;
+export declare function loadConfig(): AgentGuardConfig;
+export declare function saveConfig(config: AgentGuardConfig): void;
+export declare function connectCloud(options: {
+    apiKey: string;
+    cloudUrl?: string;
+}): AgentGuardConfig;
+export declare function maskApiKey(apiKey?: string): string;
+export declare function validateApiKey(apiKey: string): void;
+export declare function normalizeCloudUrl(value: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAKD,wBAAgB,kBAAkB,IAAI,eAAe,CASpD;AAED,wBAAgB,aAAa,IAAI,gBAAgB,CAUhD;AAED,wBAAgB,oBAAoB,IAAI,eAAe,CAKtD;AAED,wBAAgB,YAAY,IAAI,gBAAgB,CAQ/C;AAED,wBAAgB,UAAU,IAAI,gBAAgB,CAkB7C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAKzD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAW7F;AAED,wBAAgB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAevD"}