@hazeljs/cli 2.0.1 → 2.0.2

package/cli-manifest.json

@@ -4,7 +4,7 @@
   "description": "Machine-readable manifest of all CLI commands and options for LLM agent tool-use",
   "cli": {
     "name": "hazel",
-    "version": "2.0.1",
+    "version": "2.0.2",
     "description": "CLI for generating HazelJS components and applications"
   },
   "commands": [
@@ -943,6 +943,91 @@
         }
       ]
     },
+    {
+      "name": "gatekeeper",
+      "usage": "hazel gatekeeper <command>",
+      "description": "Agent Gatekeeper — validate, simulate, and explain tool authorization policies (never executes tools)",
+      "subcommands": [
+        {
+          "name": "validate",
+          "usage": "hazel gatekeeper validate [--config agent-gatekeeper.yaml] [--json]",
+          "description": "Validate an agent-gatekeeper.yaml policy file",
+          "options": [
+            {
+              "name": "config",
+              "type": "string",
+              "default": "agent-gatekeeper.yaml",
+              "description": "Policy config file"
+            },
+            {
+              "name": "json",
+              "type": "boolean",
+              "description": "Print raw JSON result"
+            }
+          ]
+        },
+        {
+          "name": "simulate",
+          "usage": "hazel gatekeeper simulate --agent <id> --tool <name> [--input input.json]",
+          "description": "Simulate a gatekeeper decision without executing tools or creating approvals",
+          "options": [
+            {
+              "name": "agent",
+              "type": "string",
+              "required": true,
+              "description": "Agent id"
+            },
+            {
+              "name": "tool",
+              "type": "string",
+              "required": true,
+              "description": "Tool name"
+            },
+            {
+              "name": "input",
+              "type": "string",
+              "description": "JSON input file"
+            },
+            {
+              "name": "environment",
+              "type": "string",
+              "default": "development",
+              "description": "Environment"
+            },
+            {
+              "name": "tenant",
+              "type": "string",
+              "description": "Tenant id"
+            },
+            {
+              "name": "config",
+              "type": "string",
+              "description": "Optional policy YAML file"
+            }
+          ]
+        },
+        {
+          "name": "explain",
+          "usage": "hazel gatekeeper explain <file> [--config agent-gatekeeper.yaml]",
+          "description": "Explain a saved invocation JSON file (never executes tools)",
+          "args": [
+            {
+              "name": "file",
+              "type": "string",
+              "required": true,
+              "description": "Invocation context JSON file"
+            }
+          ],
+          "options": [
+            {
+              "name": "config",
+              "type": "string",
+              "description": "Optional policy YAML file"
+            }
+          ]
+        }
+      ]
+    },
     {
       "name": "install",
       "usage": "hazel install <spec> [--cwd <dir>] [--registry <dir>]",

package/dist/commands/gatekeeper.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+/**
+ * `hazel gatekeeper validate --config agent-gatekeeper.yaml`
+ * `hazel gatekeeper simulate --agent refund-agent --tool stripe.refund --input input.json`
+ * `hazel gatekeeper explain --invocation invocation.json`
+ */
+export declare function registerGatekeeperCommand(program: Command): void;

package/dist/commands/gatekeeper.js

@@ -0,0 +1,170 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerGatekeeperCommand = registerGatekeeperCommand;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * `hazel gatekeeper validate --config agent-gatekeeper.yaml`
+ * `hazel gatekeeper simulate --agent refund-agent --tool stripe.refund --input input.json`
+ * `hazel gatekeeper explain --invocation invocation.json`
+ */
+function registerGatekeeperCommand(program) {
+    const gatekeeper = program
+        .command('gatekeeper')
+        .description('Agent Gatekeeper — validate, simulate, and explain tool authorization policies');
+    gatekeeper
+        .command('validate')
+        .description('Validate an agent-gatekeeper.yaml policy file')
+        .option('--config <file>', 'Policy config file', 'agent-gatekeeper.yaml')
+        .option('--json', 'Print raw JSON result')
+        .action(async (opts) => {
+        try {
+            const { loadPoliciesFromFileSync, validatePolicies } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent-gatekeeper')));
+            const abs = path.resolve(process.cwd(), opts.config ?? 'agent-gatekeeper.yaml');
+            const loaded = loadPoliciesFromFileSync(fs, abs);
+            validatePolicies(loaded.policies);
+            const result = {
+                valid: true,
+                config: abs,
+                policyCount: loaded.policies.length,
+                mode: loaded.mode,
+                defaultDecision: loaded.defaultDecision,
+                policies: loaded.policies.map((p) => ({
+                    id: p.id,
+                    version: p.version,
+                    priority: p.priority,
+                })),
+            };
+            // eslint-disable-next-line no-console
+            console.log(opts.json ? JSON.stringify(result, null, 2) : JSON.stringify(result, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    gatekeeper
+        .command('simulate')
+        .description('Simulate gatekeeper decision for an invocation (never executes tools)')
+        .requiredOption('--agent <id>', 'Agent id')
+        .requiredOption('--tool <name>', 'Tool name')
+        .option('--input <file>', 'JSON input file')
+        .option('--environment <env>', 'Environment', 'development')
+        .option('--tenant <id>', 'Tenant id')
+        .option('--config <file>', 'Optional policy YAML file')
+        .option('--json', 'Print raw JSON')
+        .action(async (opts) => {
+        try {
+            const { AgentGatekeeper, loadPoliciesFromFileSync, defaultClock, defaultIdGenerator } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent-gatekeeper')));
+            let policies = [];
+            let mode = 'enforce';
+            let defaultDecision = 'deny';
+            if (opts.config) {
+                const abs = path.resolve(process.cwd(), opts.config);
+                const loaded = loadPoliciesFromFileSync(fs, abs);
+                policies = loaded.policies;
+                mode = loaded.mode ?? mode;
+                defaultDecision = loaded.defaultDecision ?? defaultDecision;
+            }
+            let input = {};
+            if (opts.input) {
+                const raw = fs.readFileSync(path.resolve(process.cwd(), opts.input), 'utf8');
+                input = JSON.parse(raw);
+            }
+            const gk = new AgentGatekeeper({
+                mode,
+                defaultDecision,
+                policies,
+                auditSink: { emit: () => undefined },
+            });
+            const context = {
+                invocationId: defaultIdGenerator()(),
+                runId: 'simulate-run',
+                agentId: opts.agent,
+                tenantId: opts.tenant,
+                toolName: opts.tool,
+                input,
+                environment: opts.environment ?? 'development',
+                timestamp: defaultClock().now(),
+            };
+            const simulation = await gk.simulate(context);
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify(simulation, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+    gatekeeper
+        .command('explain')
+        .description('Explain gatekeeper decision from a saved invocation JSON file')
+        .argument('<file>', 'Invocation context JSON file')
+        .option('--config <file>', 'Optional policy YAML file')
+        .option('--json', 'Print raw JSON')
+        .action(async (file, opts) => {
+        try {
+            const { AgentGatekeeper, loadPoliciesFromFileSync, defaultClock } = await Promise.resolve().then(() => __importStar(require('@hazeljs/agent-gatekeeper')));
+            let policies = [];
+            if (opts.config) {
+                const abs = path.resolve(process.cwd(), opts.config);
+                policies = loadPoliciesFromFileSync(fs, abs).policies;
+            }
+            const raw = fs.readFileSync(path.resolve(process.cwd(), file), 'utf8');
+            const parsed = JSON.parse(raw);
+            const context = {
+                ...parsed,
+                timestamp: parsed.timestamp ? new Date(String(parsed.timestamp)) : defaultClock().now(),
+            };
+            const gk = new AgentGatekeeper({
+                mode: 'enforce',
+                defaultDecision: 'deny',
+                policies,
+                auditSink: { emit: () => undefined },
+            });
+            const simulation = await gk.simulate(context);
+            // eslint-disable-next-line no-console
+            console.log(JSON.stringify(simulation, null, 2));
+        }
+        catch (e) {
+            // eslint-disable-next-line no-console
+            console.error(e);
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/index.js

@@ -57,6 +57,7 @@ const eval_1 = require("./commands/eval");
 const benchmark_1 = require("./commands/benchmark");
 const agent_1 = require("./commands/agent");
 const skillgate_1 = require("./commands/skillgate");
+const gatekeeper_1 = require("./commands/gatekeeper");
 const store_1 = require("./commands/store");
 // Read version from package.json to ensure consistency
 const packageJson = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '../package.json'), 'utf8'));
@@ -74,6 +75,7 @@ program
 (0, benchmark_1.registerBenchmarkCommand)(program);
 (0, agent_1.registerAgentCommand)(program);
 (0, skillgate_1.registerSkillgateCommand)(program);
+(0, gatekeeper_1.registerGatekeeperCommand)(program);
 (0, store_1.registerStoreCommand)(program);
 // Generate command group (unified: hazel g <type> <name> [--path] [--dry-run] [--json], or hazel g --list)
 const generateCommand = program

package/dist/utils/packages-registry.js

@@ -252,7 +252,23 @@ const gate = Skillgate.fromOpenApi(openApiSpec, {
   invoke: { baseUrl: process.env.API_BASE_URL || 'http://127.0.0.1:3000' },
 });
 const registry = new ToolRegistry();
-gate.register(registry, 'api-concierge');
+    gate.register(registry, 'api-concierge');
+`,
+    },
+    {
+        shortName: 'agent-gatekeeper',
+        npm: '@hazeljs/agent-gatekeeper',
+        label: 'Agent Gatekeeper - tool authorization (@hazeljs/agent-gatekeeper)',
+        hint: 'import { AgentGatekeeper } from "@hazeljs/agent-gatekeeper";\n  // new AgentGatekeeper({ mode: "enforce", defaultDecision: "deny", policies })',
+        moduleImport: null,
+        moduleExpression: null,
+        setupTemplate: `import { AgentGatekeeper } from '@hazeljs/agent-gatekeeper';
+
+export const gatekeeper = new AgentGatekeeper({
+  mode: 'enforce',
+  defaultDecision: 'deny',
+  policies: [],
+});
 `,
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hazeljs/cli",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Command-line interface for scaffolding and generating HazelJS applications and components",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,10 +31,11 @@
     "mustache": "^4.2.0"
   },
   "peerDependencies": {
-    "@hazeljs/eval": "^2.0.1",
-    "@hazeljs/benchmark": "^2.0.1",
-    "@hazeljs/agent": "^2.0.1",
-    "@hazeljs/skillgate": "^2.0.1"
+    "@hazeljs/eval": "^2.0.2",
+    "@hazeljs/benchmark": "^2.0.2",
+    "@hazeljs/agent": "^2.0.2",
+    "@hazeljs/skillgate": "^2.0.2",
+    "@hazeljs/agent-gatekeeper": "^2.0.2"
   },
   "peerDependenciesMeta": {
     "@hazeljs/eval": {
@@ -48,23 +49,19 @@
     },
     "@hazeljs/skillgate": {
       "optional": true
+    },
+    "@hazeljs/agent-gatekeeper": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@hazeljs/eval": "^2.0.1",
-    "@hazeljs/benchmark": "^2.0.1",
-    "@hazeljs/agent": "^2.0.1",
-    "@hazeljs/skillgate": "^2.0.1",
-    "@types/inquirer": "^8.2.12",
-    "@types/jest": "^29.5.14",
-    "@types/mustache": "^4.2.6",
-    "@types/node": "^20.19.39",
-    "@typescript-eslint/eslint-plugin": "^8.58.0",
-    "@typescript-eslint/parser": "^8.58.0",
-    "eslint": "^8.57.1",
-    "jest": "^29.7.0",
-    "prettier": "^3.8.1",
-    "ts-jest": "^29.4.9",
+    "@hazeljs/eval": "^2.0.2",
+    "@hazeljs/benchmark": "^2.0.2",
+    "@hazeljs/agent": "^2.0.2",
+    "@hazeljs/skillgate": "^2.0.2",
+    "@hazeljs/agent-gatekeeper": "^2.0.2",
+    "@types/inquirer": "^8.2.10",
+    "@types/mustache": "^4.2.5",
     "typescript": "^5.9.3"
   },
   "engines": {