@hazeljs/cli 1.0.6 → 2.0.0

package/@template-ai-native/README.md

@@ -36,6 +36,25 @@ A complete AI-native backend application with HazelJS, featuring:
    - Inspector: http://localhost:3000/\_\_hazel
    - Health: http://localhost:3000/health
 
+## Skillgate (optional)
+
+Turn selected REST controllers into governed agent skills:
+
+```bash
+npm install @hazeljs/skillgate @hazeljs/swagger
+```
+
+See `src/examples/skillgate.example.ts` and https://hazeljs.ai/docs/guides/skillgate
+
+Tag controllers with `@ApiTags('agent')` or `@AgentSkill`, then:
+
+```ts
+Skillgate.fromModule(AppModule, { invoke: { baseUrl: 'http://127.0.0.1:3000' } }).register(
+  registry,
+  'api-concierge'
+);
+```
+
 ## Available Endpoints
 
 ### AI Chat

package/@template-ai-native/src/examples/skillgate.example.ts

@@ -0,0 +1,29 @@
+/**
+ * Optional Skillgate example (not imported by AppModule).
+ *
+ * Install: npm install @hazeljs/skillgate @hazeljs/swagger
+ * Then wire `registerApiSkills()` from your bootstrap after the HTTP server listens.
+ *
+ * Docs: https://hazeljs.ai/docs/guides/skillgate
+ */
+
+/*
+import { Skillgate } from '@hazeljs/skillgate';
+import { ToolRegistry } from '@hazeljs/agent';
+import { AppModule } from '../app.module';
+
+export function registerApiSkills(registry: ToolRegistry = new ToolRegistry()) {
+  const gate = Skillgate.fromModule(AppModule, {
+    include: { tags: ['agent'] },
+    swagger: {
+      title: 'AI-native API',
+      servers: [{ url: process.env.API_BASE_URL || 'http://127.0.0.1:3000' }],
+    },
+    invoke: { baseUrl: process.env.API_BASE_URL || 'http://127.0.0.1:3000' },
+  });
+  gate.register(registry, 'api-concierge');
+  return { gate, registry };
+}
+*/
+
+export {};

package/cli-manifest.json

@@ -4,7 +4,7 @@
   "description": "Machine-readable manifest of all CLI commands and options for LLM agent tool-use",
   "cli": {
     "name": "hazel",
-    "version": "1.0.6",
+    "version": "2.0.0",
     "description": "CLI for generating HazelJS components and applications"
   },
   "commands": [

package/dist/commands/agent.d.ts

@@ -1,6 +1,8 @@
 import { Command } from 'commander';
 /**
  * `hazel agent install <file.dna.json>` — validate / print marketplace install plan.
- * Live hot-reload happens in-process via AgentRuntime.installAgentPackage().
+ * `hazel agent run` — live execute from DNA (AOS-011).
+ * `hazel agent logs` / `doctor` — timeline + environment checks.
+ * `hazel agent runs list|inspect|cancel|resume|approve` — durable store ops.
  */
 export declare function registerAgentCommand(program: Command): void;

package/dist/commands/agent.js

@@ -35,13 +35,21 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAgentCommand = registerAgentCommand;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const DEFAULT_RUN_STORE = path.join('.hazel', 'agent-runs.json');
+const DEFAULT_DURABLE_DIR = path.join('.hazel', 'runs');
+const DEFAULT_TIMELINE = path.join('.hazel', 'runs', 'timeline.jsonl');
 /**
  * `hazel agent install <file.dna.json>` — validate / print marketplace install plan.
- * Live hot-reload happens in-process via AgentRuntime.installAgentPackage().
+ * `hazel agent run` — live execute from DNA (AOS-011).
+ * `hazel agent logs` / `doctor` — timeline + environment checks.
+ * `hazel agent runs list|inspect|cancel|resume|approve` — durable store ops.
  */
 function registerAgentCommand(program) {
-    const agent = program.command('agent').description('Agent OS DNA / marketplace helpers');
+    const agent = program
+        .command('agent')
+        .description('Agent OS DNA / runtime / marketplace helpers');
     agent
         .command('install')
         .description('Validate a .dna / marketplace JSON package and print install plan')
@@ -91,4 +99,350 @@ function registerAgentCommand(program) {
             process.exitCode = 1;
         }
     });
+    agent
+        .command('run')
+        .description('Execute an agent from DNA / marketplace package (live CLI run, AOS-011)')
+        .argument('<file>', 'Path to .dna.json or marketplace package JSON')
+        .argument('[input...]', 'User input (default: hello)')
+        .option('--dir <path>', 'Durable store directory', DEFAULT_DURABLE_DIR)
+        .option('--mock', 'Use offline mock LLM (no API key)')
+        .option('--model <model>', 'Model id for HTTP LLM', process.env.HAZEL_AGENT_MODEL ?? 'gpt-4o-mini')
+        .option('--base-url <url>', 'OpenAI-compatible base URL', process.env.OPENAI_BASE_URL)
+        .option('--api-key <key>', 'API key (default: OPENAI_API_KEY)')
+        .option('--worker-id <id>', 'Worker id for run leases', `cli-${os.hostname()}`)
+        .option('--max-steps <n>', 'Max agent steps', '8')
+        .option('--json', 'Print full execution result JSON')
+        .action(async (file, inputParts, opts) => {
+        try {
+            const { bootstrapRuntimeFromDna, createHttpLlmProvider, createMockLlmProvider } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent')));
+            const dnaPath = path.resolve(process.cwd(), file);
+            if (!fs.existsSync(dnaPath)) {
+                throw new Error(`DNA file not found: ${dnaPath}`);
+            }
+            const input = inputParts.length ? inputParts.join(' ') : 'hello';
+            const storeDir = path.resolve(process.cwd(), opts.dir);
+            const apiKey = opts.apiKey ?? process.env.OPENAI_API_KEY;
+            const llm = opts.mock || !apiKey
+                ? createMockLlmProvider(opts.mock
+                    ? 'Mock reply from hazel agent run.'
+                    : 'No OPENAI_API_KEY — mock reply. Pass --mock to silence this, or set a key.')
+                : createHttpLlmProvider({
+                    apiKey,
+                    baseUrl: opts.baseUrl,
+                    model: opts.model,
+                });
+            const { runtime, dna, store, timelinePath } = bootstrapRuntimeFromDna(dnaPath, {
+                llmProvider: llm,
+                storeDir,
+                durableSuspend: true,
+                workerId: opts.workerId,
+                stubTools: true,
+            });
+            const result = await runtime.execute(dna.name, input, {
+                maxSteps: Number(opts.maxSteps) || 8,
+            });
+            const run = store ? await store.runRepository.get(result.executionId) : undefined;
+            const summary = {
+                agent: dna.name,
+                executionId: result.executionId,
+                state: result.state,
+                response: result.response,
+                runStatus: run?.status,
+                storeDir,
+                timelinePath,
+                llm: opts.mock || !apiKey ? 'mock' : 'http',
+            };
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify(opts.json ? { ...summary, result, run } : summary, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    agent
+        .command('logs')
+        .description('Show AgentRun timeline JSONL (optionally filter by run id)')
+        .option('--timeline <path>', 'Timeline JSONL path', DEFAULT_TIMELINE)
+        .option('--run <runId>', 'Filter by execution / run id')
+        .option('--agent <name>', 'Filter by agent name')
+        .option('--follow', 'Tail new lines (poll)')
+        .option('--interval <ms>', 'Follow poll interval', '1000')
+        .action(async (opts) => {
+        try {
+            const { FileTimelineStore } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent')));
+            const timelinePath = path.resolve(process.cwd(), opts.timeline);
+            const store = new FileTimelineStore(timelinePath);
+            const print = () => {
+                const steps = store.load({
+                    executionId: opts.run,
+                    agentName: opts.agent,
+                });
+                // eslint-disable-next-line no-console
+                console.log(JSON.stringify(steps, null, 2));
+            };
+            if (!opts.follow) {
+                print();
+                return;
+            }
+            let lastSize = fs.existsSync(timelinePath) ? fs.statSync(timelinePath).size : 0;
+            print();
+            const ms = Math.max(200, Number(opts.interval) || 1000);
+            // eslint-disable-next-line no-console
+            console.error(`Following ${timelinePath} every ${ms}ms (Ctrl+C to stop)…`);
+            setInterval(() => {
+                if (!fs.existsSync(timelinePath))
+                    return;
+                const size = fs.statSync(timelinePath).size;
+                if (size !== lastSize) {
+                    lastSize = size;
+                    print();
+                }
+            }, ms);
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    agent
+        .command('doctor')
+        .description('Check Agent OS CLI environment (peers, store paths, LLM key)')
+        .option('--dir <path>', 'Expected durable store directory', DEFAULT_DURABLE_DIR)
+        .action(async (opts) => {
+        try {
+            const cwd = process.cwd();
+            const storeDir = path.resolve(cwd, opts.dir);
+            const checks = [];
+            checks.push({
+                ok: true,
+                name: 'node',
+                detail: process.version,
+            });
+            try {
+                await Promise.resolve().then(() => __importStar(require('@hazeljs/agent')));
+                checks.push({ ok: true, name: '@hazeljs/agent', detail: 'resolvable' });
+            }
+            catch (e) {
+                checks.push({
+                    ok: false,
+                    name: '@hazeljs/agent',
+                    detail: e instanceof Error ? e.message : String(e),
+                });
+            }
+            const pkgPath = path.join(cwd, 'package.json');
+            checks.push({
+                ok: fs.existsSync(pkgPath),
+                name: 'package.json',
+                detail: fs.existsSync(pkgPath) ? pkgPath : 'missing in cwd',
+            });
+            checks.push({
+                ok: true,
+                name: 'durableStore',
+                detail: fs.existsSync(storeDir)
+                    ? `exists: ${storeDir}`
+                    : `will be created on run: ${storeDir}`,
+            });
+            const key = process.env.OPENAI_API_KEY;
+            checks.push({
+                ok: Boolean(key),
+                name: 'OPENAI_API_KEY',
+                detail: key ? 'set (http LLM available)' : 'unset — use --mock for offline run',
+            });
+            const failed = checks.filter((c) => !c.ok);
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify({
+                ok: failed.length === 0 || (failed.length === 1 && failed[0].name === 'OPENAI_API_KEY'),
+                checks,
+                hints: [
+                    'hazel agent run ./agent.dna.json "hello" --mock',
+                    'hazel agent runs list --dir .hazel/runs',
+                    'hazel agent logs --timeline .hazel/runs/timeline.jsonl',
+                ],
+            }, null, 2));
+            if (failed.some((c) => c.name === '@hazeljs/agent'))
+                process.exitCode = 1;
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    const runs = agent.command('runs').description('Inspect durable AgentRun records (file store)');
+    runs
+        .command('list')
+        .description('List AgentRun records from a FileAgentRunRepository JSON store')
+        .option('--store <path>', 'Path to runs JSON', DEFAULT_RUN_STORE)
+        .option('--dir <path>', 'Durable store directory (uses runs.json inside)')
+        .option('--agent <name>', 'Filter by agent name')
+        .option('--status <status>', 'Filter by status')
+        .action(async (opts) => {
+        try {
+            const { FileAgentRunRepository, AgentRunStatus, createDurableRunStore } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent')));
+            const repo = opts.dir
+                ? createDurableRunStore(path.resolve(process.cwd(), opts.dir))
+                    .runRepository
+                : new FileAgentRunRepository(path.resolve(process.cwd(), opts.store));
+            const filter = {};
+            if (opts.agent)
+                filter.agentName = opts.agent;
+            if (opts.status) {
+                const values = Object.values(AgentRunStatus);
+                if (!values.includes(opts.status)) {
+                    throw new Error(`Unknown status "${opts.status}". Expected one of: ${values.join(', ')}`);
+                }
+                filter.status = opts.status;
+            }
+            const list = await repo.list(filter);
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify(list.map((r) => ({
+                id: r.id,
+                agentName: r.agentName,
+                status: r.status,
+                leaseOwner: r.leaseOwner,
+                updatedAt: r.updatedAt,
+            })), null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    runs
+        .command('inspect')
+        .description('Show one AgentRun by id')
+        .argument('<runId>', 'AgentRun / execution id')
+        .option('--store <path>', 'Path to runs JSON', DEFAULT_RUN_STORE)
+        .option('--dir <path>', 'Durable store directory')
+        .action(async (runId, opts) => {
+        try {
+            const { FileAgentRunRepository, createDurableRunStore } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent')));
+            const repo = opts.dir
+                ? createDurableRunStore(path.resolve(process.cwd(), opts.dir)).runRepository
+                : new FileAgentRunRepository(path.resolve(process.cwd(), opts.store));
+            const run = await repo.get(runId);
+            if (!run) {
+                // eslint-disable-next-line no-console
+                console.error(`Run not found: ${runId}`);
+                process.exitCode = 1;
+                return;
+            }
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify(run, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    runs
+        .command('cancel')
+        .description('Mark an AgentRun CANCELLED in the file store (does not abort a live worker)')
+        .argument('<runId>', 'AgentRun / execution id')
+        .option('--store <path>', 'Path to runs JSON', DEFAULT_RUN_STORE)
+        .option('--dir <path>', 'Durable store directory')
+        .action(async (runId, opts) => {
+        try {
+            const { FileAgentRunRepository, AgentRunStatus, createDurableRunStore } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent')));
+            const repo = opts.dir
+                ? createDurableRunStore(path.resolve(process.cwd(), opts.dir)).runRepository
+                : new FileAgentRunRepository(path.resolve(process.cwd(), opts.store));
+            const run = await repo.updateStatus(runId, AgentRunStatus.CANCELLED, {
+                error: { message: 'Cancelled via hazel agent runs cancel' },
+            });
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify({ id: run.id, status: run.status }, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    const resumeAction = async (runId, opts) => {
+        try {
+            const approved = opts.approve !== false && !opts.reject;
+            const { createDurableRunStore, FileAgentRunRepository, FileHumanTaskService, FileCheckpointService, } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent')));
+            const storePath = path.resolve(process.cwd(), opts.store);
+            const isDir = opts.dir || storePath.endsWith('.hazel') || !storePath.endsWith('.json');
+            let humanTasks;
+            let runsRepo;
+            if (opts.dir) {
+                const store = createDurableRunStore(path.resolve(process.cwd(), opts.dir));
+                humanTasks = store.humanTaskService;
+                runsRepo = store.runRepository;
+            }
+            else if (isDir && !storePath.endsWith('.json')) {
+                const store = createDurableRunStore(storePath);
+                humanTasks = store.humanTaskService;
+                runsRepo = store.runRepository;
+            }
+            else {
+                const dir = path.dirname(storePath);
+                runsRepo = new FileAgentRunRepository(storePath);
+                humanTasks = new FileHumanTaskService(path.join(dir, 'human-tasks.json'));
+                void new FileCheckpointService(path.join(dir, 'checkpoints.json'));
+            }
+            const run = await runsRepo.get(runId);
+            if (!run) {
+                // eslint-disable-next-line no-console
+                console.error(`Run not found: ${runId}`);
+                process.exitCode = 1;
+                return;
+            }
+            const tasks = await humanTasks.listByRun(runId);
+            const pending = tasks.find((t) => t.status === 'pending');
+            if (pending) {
+                await humanTasks.resolve(pending.id, approved ? 'approved' : 'rejected', opts.by);
+            }
+            await runsRepo.updateStatus(runId, run.status, {
+                metadata: {
+                    ...run.metadata,
+                    cliDecision: {
+                        approved,
+                        by: opts.by,
+                        at: new Date().toISOString(),
+                    },
+                },
+            });
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify({
+                runId,
+                decision: approved ? 'approved' : 'rejected',
+                by: opts.by,
+                humanTaskId: pending?.id,
+                note: 'Human task updated. Call runtime.approveAndResume(runId, { approved, approvedBy }) in your app to continue the agent.',
+            }, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    };
+    runs
+        .command('resume')
+        .description('Record HITL approve/reject on file store (in-app approveAndResume still required to continue)')
+        .argument('<runId>', 'AgentRun / execution id')
+        .option('--store <path>', 'Path to runs.json or durable store directory', DEFAULT_RUN_STORE)
+        .option('--dir <path>', 'Durable store directory (runs + human-tasks + checkpoints)')
+        .option('--approve', 'Approve pending human task (default)')
+        .option('--reject', 'Reject pending human task')
+        .option('--by <who>', 'Approver identity', 'cli')
+        .action(resumeAction);
+    runs
+        .command('approve')
+        .description('Alias for runs resume --approve')
+        .argument('<runId>', 'AgentRun / execution id')
+        .option('--store <path>', 'Path to runs.json or durable store directory', DEFAULT_RUN_STORE)
+        .option('--dir <path>', 'Durable store directory')
+        .option('--by <who>', 'Approver identity', 'cli')
+        .action(async (runId, opts) => {
+        await resumeAction(runId, { ...opts, approve: true });
+    });
 }

package/dist/commands/agent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/agent.test.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const agent_1 = require("./agent");
+describe('registerAgentCommand (AOS-011)', () => {
+    it('registers run, logs, and doctor subcommands', () => {
+        const program = new commander_1.Command();
+        (0, agent_1.registerAgentCommand)(program);
+        const agent = program.commands.find((c) => c.name() === 'agent');
+        expect(agent).toBeDefined();
+        const names = agent.commands.map((c) => c.name());
+        expect(names).toEqual(expect.arrayContaining(['install', 'dna', 'run', 'logs', 'doctor', 'runs']));
+    });
+});

package/dist/commands/skillgate.d.ts

@@ -0,0 +1,6 @@
+import { Command } from 'commander';
+/**
+ * `hazel skillgate from-openapi <file>` — preview governed skills from an OpenAPI doc.
+ * `hazel skillgate init` — write a starter skillgate.config.json.
+ */
+export declare function registerSkillgateCommand(program: Command): void;

package/dist/commands/skillgate.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSkillgateCommand = registerSkillgateCommand;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * `hazel skillgate from-openapi <file>` — preview governed skills from an OpenAPI doc.
+ * `hazel skillgate init` — write a starter skillgate.config.json.
+ */
+function registerSkillgateCommand(program) {
+    const skillgate = program
+        .command('skillgate')
+        .description('Skillgate — OpenAPI → curated, governed agent skills');
+    skillgate
+        .command('from-openapi')
+        .description('Parse an OpenAPI JSON file and print the Skillgate report')
+        .argument('<file>', 'Path to OpenAPI JSON')
+        .option('--mode <mode>', 'Include mode: opt-in | all', 'opt-in')
+        .option('--tags <tags>', 'Comma-separated tag allowlist')
+        .option('--allow-destructive', 'Allow DELETE / destructive methods')
+        .option('--allow-admin', 'Allow admin / internal paths')
+        .option('--base-url <url>', 'Override servers[0].url for invokers')
+        .option('--json', 'Print raw JSON report')
+        .action(async (file, opts) => {
+        try {
+            const { Skillgate } = await Promise.resolve().then(() => __importStar(require('@hazeljs/skillgate')));
+            const abs = path.resolve(process.cwd(), file);
+            const raw = fs.readFileSync(abs, 'utf8');
+            const spec = JSON.parse(raw);
+            const gate = Skillgate.fromOpenApi(spec, {
+                include: {
+                    mode: opts.mode === 'all' ? 'all' : 'opt-in',
+                    tags: opts.tags
+                        ? opts.tags
+                            .split(',')
+                            .map((t) => t.trim())
+                            .filter(Boolean)
+                        : undefined,
+                },
+                classify: {
+                    allowDestructive: Boolean(opts.allowDestructive),
+                    allowAdmin: Boolean(opts.allowAdmin),
+                },
+                invoke: opts.baseUrl ? { baseUrl: opts.baseUrl } : undefined,
+                force: true,
+            });
+            const report = gate.report();
+            if (opts.json) {
+                // eslint-disable-next-line no-console
+                console.log(JSON.stringify(report, null, 2));
+                return;
+            }
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify({
+                included: report.included.map((s) => ({
+                    name: s.name,
+                    class: s.class,
+                    method: s.method,
+                    path: s.path,
+                    readOnly: s.readOnly,
+                    requiresApproval: s.requiresApproval,
+                })),
+                denied: report.denied.map((s) => ({
+                    name: s.name,
+                    reason: s.denyReason,
+                })),
+                warnings: report.warnings,
+                next: 'gate.register(toolRegistry, "your-agent")',
+            }, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    skillgate
+        .command('init')
+        .description('Write a starter skillgate.config.json in the current directory')
+        .option('--force', 'Overwrite existing file')
+        .action((opts) => {
+        const out = path.resolve(process.cwd(), 'skillgate.config.json');
+        if (fs.existsSync(out) && !opts.force) {
+            // eslint-disable-next-line no-console
+            console.error(`Refusing to overwrite ${out} (pass --force)`);
+            process.exitCode = 1;
+            return;
+        }
+        const starter = {
+            $schema: 'https://hazeljs.ai/schemas/skillgate.config.json',
+            include: {
+                mode: 'opt-in',
+                tags: ['agent', 'skillgate'],
+            },
+            classify: {
+                writeRequiresApproval: true,
+                allowDestructive: false,
+                allowAdmin: false,
+            },
+            invoke: {
+                baseUrl: 'http://127.0.0.1:3000',
+                headers: {
+                    Authorization: 'Bearer ${API_TOKEN}',
+                },
+            },
+            warnAbove: 12,
+            maxTools: 24,
+            agentName: 'api-concierge',
+        };
+        fs.writeFileSync(out, JSON.stringify(starter, null, 2) + '\n');
+        // eslint-disable-next-line no-console
+        console.log(`Wrote ${out}`);
+    });
+}

package/dist/index.js

@@ -56,6 +56,7 @@ const add_1 = require("./commands/add");
 const eval_1 = require("./commands/eval");
 const benchmark_1 = require("./commands/benchmark");
 const agent_1 = require("./commands/agent");
+const skillgate_1 = require("./commands/skillgate");
 // Read version from package.json to ensure consistency
 const packageJson = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '../package.json'), 'utf8'));
 const program = new commander_1.Command();
@@ -71,6 +72,7 @@ program
 (0, eval_1.registerEvalCommand)(program);
 (0, benchmark_1.registerBenchmarkCommand)(program);
 (0, agent_1.registerAgentCommand)(program);
+(0, skillgate_1.registerSkillgateCommand)(program);
 // Generate command group (unified: hazel g <type> <name> [--path] [--dry-run] [--json], or hazel g --list)
 const generateCommand = program
     .command('generate')

package/dist/utils/packages-registry.js

@@ -234,6 +234,25 @@ export const mlImports = [MLModule.forRoot()];
 // Minimal MCP server example:
 const server = createMcpServer({ name: 'hazel-mcp', version: '0.1.0' });
 server.start();
+`,
+    },
+    {
+        shortName: 'skillgate',
+        npm: '@hazeljs/skillgate',
+        label: 'Skillgate - OpenAPI → governed agent skills (@hazeljs/skillgate)',
+        hint: 'import { Skillgate } from "@hazeljs/skillgate";\n  // Skillgate.fromOpenApi(spec).register(toolRegistry, "api-concierge");',
+        moduleImport: null,
+        moduleExpression: null,
+        setupTemplate: `import { Skillgate } from '@hazeljs/skillgate';
+import { ToolRegistry } from '@hazeljs/agent';
+
+// Opt-in: tags agent|skillgate, x-hazel-skill, or explicit allowlists.
+const gate = Skillgate.fromOpenApi(openApiSpec, {
+  include: { tags: ['agent'] },
+  invoke: { baseUrl: process.env.API_BASE_URL || 'http://127.0.0.1:3000' },
+});
+const registry = new ToolRegistry();
+gate.register(registry, 'api-concierge');
 `,
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hazeljs/cli",
-  "version": "1.0.6",
+  "version": "2.0.0",
   "description": "Command-line interface for scaffolding and generating HazelJS applications and components",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,9 +31,10 @@
     "mustache": "^4.2.0"
   },
   "peerDependencies": {
-    "@hazeljs/eval": "^1.0.6",
-    "@hazeljs/benchmark": "^1.0.6",
-    "@hazeljs/agent": "^1.0.6"
+    "@hazeljs/eval": "^2.0.0",
+    "@hazeljs/benchmark": "^2.0.0",
+    "@hazeljs/agent": "^2.0.0",
+    "@hazeljs/skillgate": "^2.0.0"
   },
   "peerDependenciesMeta": {
     "@hazeljs/eval": {
@@ -44,12 +45,16 @@
     },
     "@hazeljs/agent": {
       "optional": true
+    },
+    "@hazeljs/skillgate": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@hazeljs/eval": "^1.0.6",
-    "@hazeljs/benchmark": "^1.0.6",
-    "@hazeljs/agent": "^1.0.6",
+    "@hazeljs/eval": "^2.0.0",
+    "@hazeljs/benchmark": "^2.0.0",
+    "@hazeljs/agent": "^2.0.0",
+    "@hazeljs/skillgate": "^2.0.0",
     "@types/inquirer": "^8.2.12",
     "@types/jest": "^29.5.14",
     "@types/mustache": "^4.2.6",