@idevelopers/agentlock 0.1.3 → 0.1.5

package/.claude-plugin/marketplace.json

@@ -14,7 +14,7 @@
       },
       "category": "development",
       "source": "./",
-      "version": "0.1.3",
+      "version": "0.1.5",
       "homepage": "https://www.npmjs.com/package/@idevelopers/agentlock"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentlock",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Local permission firewall for AI coding agents and MCP tools",
   "author": {
     "name": "iDevelopers",

package/codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentlock",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Local permission firewall for AI coding agents and MCP tools",
   "author": "iDevelopers",
   "license": "MIT",

package/dist/index.js

@@ -5,7 +5,7 @@ import { registerTools } from "./server.js";
 async function main() {
     const server = new McpServer({
         name: "agentlock",
-        version: "0.1.3",
+        version: "0.1.5",
     });
     registerTools(server);
     const transport = new StdioServerTransport();

package/docs/ENTERPRISE_READINESS.md

@@ -37,7 +37,7 @@ AgentLock is live and production-validated. It is not yet independently security
 ## Certification Path
 
 1. Run the CI matrix on every release branch.
-2. Keep `npm audit --audit-level=moderate` clean before publish.
+2. Keep full `npm audit` clean before publish.
 3. Add signed release provenance and npm provenance publishing.
 4. Commission an independent security review focused on MCP boundaries, command execution, redaction, license enforcement, and policy bypasses.
 5. Add a public vulnerability disclosure channel.

package/docs/PRODUCTION_REPLICATION_PLAYBOOK.md

@@ -75,6 +75,23 @@ Validation results:
 - A fresh unlicensed temp HOME remained blocked from Pro tools.
 - After subscription revoke and full refund, the same key returned `tier=free` in a fresh temp HOME and Pro tools were blocked.
 
+## Enterprise Readiness Hardening
+
+Completed on 2026-08-29 and published as public npm version `0.1.5`:
+
+- added `SECURITY.md`
+- added `docs/THREAT_MODEL.md`
+- added `docs/ENTERPRISE_READINESS.md`
+- added `docs/CROSS_PLATFORM_VALIDATION.md`
+- added GitHub Actions CI for Ubuntu, macOS, and Windows on Node 20, 22, and 24
+- added `npm run audit:security`
+- added `npm run validate`
+- added `npm run smoke:public`
+- updated the public package tarball to include the security and readiness docs
+- refreshed dependencies and confirmed `npm audit` reports 0 vulnerabilities
+- confirmed `@idevelopers/agentlock@latest` resolves to `0.1.5`
+- confirmed public npm smoke against `@idevelopers/agentlock@latest`
+
 ## Validation Checklist
 
 Local source:
@@ -105,8 +122,8 @@ Sandbox payment:
 Live payment:
 
 1. Create AgentLock live product and checkout. Completed 2026-08-29.
-2. Publish `@idevelopers/agentlock`. Completed 2026-08-29 with version `0.1.2`.
-3. Install from a clean temp environment. Completed 2026-08-29 against public npm version `0.1.2`.
+2. Publish `@idevelopers/agentlock`. Completed 2026-08-29 with version `0.1.2`; hardening docs and CI published as `0.1.5`.
+3. Install from a clean temp environment. Completed 2026-08-29 against public npm versions `0.1.2`, `0.1.3`, `0.1.4`, and `0.1.5`.
 4. Buy the lowest paid recurring tier with a real test purchase. Completed 2026-08-29.
 5. Activate the issued key locally without pasting it into chat or docs. Completed 2026-08-29.
 6. Confirm Pro behavior works from public npm. Completed 2026-08-29.

package/docs/THREAT_MODEL.md

@@ -45,4 +45,4 @@ AgentLock protects local developer workflows where AI coding agents can request
 
 ## Validation Evidence
 
-The production runbook records the live purchase, Pro activation, public npm smoke, refund, subscription cancellation, and revoked-license validation for AgentLock `0.1.2`.
+The production runbook records the live purchase, Pro activation, public npm smoke, refund, subscription cancellation, and revoked-license validation for AgentLock `0.1.2`. The enterprise-readiness docs, CI matrix, audit gate, and public smoke script are published in AgentLock `0.1.5`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idevelopers/agentlock",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Local permission firewall for AI coding agents and MCP tools.",
   "type": "module",
   "bin": {
@@ -19,6 +19,7 @@
     "README.md",
     "SECURITY.md",
     "docs",
+    "scripts/public-package-smoke.mjs",
     "agentlock.policy.example.json",
     ".mcp.json",
     ".claude-plugin",

package/scripts/public-package-smoke.mjs

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+
+const packageSpec = process.argv[2] ?? "@idevelopers/agentlock@latest";
+const npmCli = process.env.npm_execpath;
+const installDir = await mkdtemp(path.join(os.tmpdir(), "agentlock-smoke-install-"));
+const homeDir = await mkdtemp(path.join(os.tmpdir(), "agentlock-smoke-home-"));
+
+try {
+  await runNpm(["install", "--prefix", installDir, packageSpec, "--prefer-online"]);
+
+  const client = new Client({ name: "agentlock-public-smoke", version: "0.0.0" });
+  const agentlockEntrypoint = path.join(
+    installDir,
+    "node_modules",
+    "@idevelopers",
+    "agentlock",
+    "dist",
+    "index.js",
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [agentlockEntrypoint],
+    env: {
+      ...process.env,
+      HOME: homeDir,
+      USERPROFILE: homeDir,
+    },
+  });
+
+  await client.connect(transport);
+  try {
+    const tools = await client.listTools();
+    const toolNames = tools.tools.map((tool) => tool.name).sort();
+    assertIncludes(toolNames, "agentlock_scan_environment");
+    assertIncludes(toolNames, "agentlock_generate_policy");
+    assertIncludes(toolNames, "agentlock_check_action");
+    assertIncludes(toolNames, "agentlock_run_guarded_command");
+    assertIncludes(toolNames, "agentlock_audit_log");
+    assertIncludes(toolNames, "agentlock_activate_license");
+
+    const scan = await client.callTool({
+      name: "agentlock_scan_environment",
+      arguments: {},
+    });
+    if (scan.isError) {
+      throw new Error("agentlock_scan_environment returned an error");
+    }
+
+    const policy = await client.callTool({
+      name: "agentlock_generate_policy",
+      arguments: {},
+    });
+    if (policy.isError) {
+      throw new Error("agentlock_generate_policy returned an error");
+    }
+
+    const proGate = await client.callTool({
+      name: "agentlock_check_action",
+      arguments: {
+        type: "command",
+        command: "node",
+        args: [],
+      },
+    });
+    const proGateText = proGate.content?.[0]?.text ?? "";
+    if (!proGate.isError || !/Pro license required/.test(proGateText) || !/buy\.polar\.sh/.test(proGateText)) {
+      throw new Error("unlicensed Pro gate did not block with checkout guidance");
+    }
+
+    console.log(
+      JSON.stringify(
+        {
+          packageSpec,
+          platform: process.platform,
+          node: process.version,
+          toolCount: toolNames.length,
+          freeToolsOk: true,
+          unlicensedProGateOk: true,
+        },
+        null,
+        2,
+      ),
+    );
+  } finally {
+    await client.close();
+  }
+} finally {
+  await rm(installDir, { force: true, recursive: true });
+  await rm(homeDir, { force: true, recursive: true });
+}
+
+function assertIncludes(values, expected) {
+  if (!values.includes(expected)) {
+    throw new Error(`Missing expected tool: ${expected}`);
+  }
+}
+
+function runNpm(args) {
+  if (npmCli) {
+    return run(process.execPath, [npmCli, ...args]);
+  }
+
+  const command = process.platform === "win32" ? "npm.cmd" : "npm";
+  return run(command, args, { shell: process.platform === "win32" });
+}
+
+function run(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: "inherit",
+      shell: options.shell ?? false,
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(new Error(`${command} ${args.join(" ")} exited with ${code}`));
+    });
+  });
+}

package/skills/agentlock-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agentlock-workflow
 description: Use when running AI coding work under AgentLock permission capsules, secret-safe scans, command checks, or guarded command execution.
-version: 0.1.3
+version: 0.1.5
 ---
 
 # AgentLock Workflow