@metamynd/agentsafe-guard 0.5.0 → 0.6.1

package/README.md

@@ -25,7 +25,7 @@ re-implement the gate:
 ([markdown](https://metamynd.ai/specs/magp-v1.0.md))
 
 It defines agent identity, the canonical signed message (§8.3), the sixteen-stage order of
-checks (§8.5), all 59 reason codes (Appendix A), delegation narrowing (§5.4), and evidence
+checks (§8.5), all 62 reason codes (Appendix A), delegation narrowing (§5.4), and evidence
 you can verify offline without MetaMynd (§13.4). If you are writing a client in a language
 other than JavaScript, read §8.3.3–8.3.5 first: key encoding, number stringification and
 signed-vs-sent field identity each surface only as `SIGNATURE_INVALID`.
@@ -78,6 +78,12 @@ you state *our agents must carry a merchant allow-list* and find out when one do
 `--json` for machine-readable output. Evaluation is local and pure: no holds are minted, no
 nonces spent, no budget consumed, and a run costs one GET.
 
+**0.6.0 — `amount-unknown`.** The same discipline applied to the amount itself: a spend cap
+is only as good as the number it's checked against, and a signed-transaction or nested x402
+payload can carry its amount somewhere a naive check never looks. `amount-unknown` is a
+deny-by-default atom for exactly that case — an action whose value the gate can't determine
+is blocked, not silently waved through an untested cap.
+
 ```yaml
 # .github/workflows/governance.yml
 name: Governance
@@ -98,6 +104,36 @@ jobs:
 set `AGENT_KEY` in the environment — `AGENT_KEY`, `AGENT_DID` and `METAMYND_API` all
 override the file when present.
 
+### As a packaged Action
+
+Same check, packaged so you don't hand-roll the workflow above — and it writes a
+pass/fail table straight into the PR's checks summary instead of a log a reviewer has to
+open:
+
+```yaml
+# .github/workflows/governance.yml
+name: Governance
+on: [push, pull_request]
+
+jobs:
+  mandate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: Metamynd/agentsafe-guard/packages/agentsafe-guard@v0.6.1
+        with:
+          config: ./agent.metamynd.json
+          require: merchants,perTxn
+        env:
+          AGENT_KEY: ${{ secrets.AGENT_KEY }}
+```
+
+Pinned to a released tag, the same way you'd pin any third-party action — not `@main`,
+which moves under you every time this repository resyncs. Inputs: `config` (default
+`./agent.metamynd.json`), `require`, `version` (the `@metamynd/agentsafe-guard` npm range
+to run, default `latest`), `working-directory`. Output: `ok` (`"true"`/`"false"`), if a
+later step needs to branch on the result.
+
 ## Install
 
 ```bash

package/cli.mjs

@@ -24,11 +24,17 @@ if (cmd === 'demo') {
       require: (flag('require') ?? '').split(',').map((s) => s.trim()).filter(Boolean),
       json: process.argv.includes('--json'),
     });
-    process.exit(result.ok ? 0 : 1);
+    // `process.exitCode`, never `process.exit()`. Calling exit() here aborts while the
+    // fetch keep-alive handle is still closing, which trips a libuv assertion on Windows
+    // (`!(handle->flags & UV_HANDLE_CLOSING)`) and returns 127 — AFTER printing that every
+    // control held. A CI command whose whole job is to fail a build honestly must not fail
+    // it dishonestly, and failing a PASSING agent is the one direction that teaches teams
+    // to delete the check. Setting the code and letting node drain exits cleanly.
+    process.exitCode = result.ok ? 0 : 1;
   } catch (e) {
     // Failing to verify is not the same as verifying a pass, and CI must not read it as one.
     console.error(`verify could not run: ${e.message}`);
-    process.exit(2);
+    process.exitCode = 2;
   }
 } else if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') {
   console.log(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamynd/agentsafe-guard",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Zero-dependency runtime governance for any Node AI agent \u2014 gate tool calls through MetaMynd/AgentSafe (allow / block / escalate) against the agent's mandate, enforced Standards, and SOPs. Ed25519-signed, deterministic, fail-closed.",
   "type": "module",
   "main": "./agentsafe-guard.mjs",

package/policy-core.mjs

@@ -11,6 +11,14 @@ var ATOM_REGISTRY = {
     return have !== void 0 && need !== void 0 && have >= need;
   },
   "amount-over": (c, cfg) => typeof c.amount === "number" && c.amount > Number(cfg?.limit ?? 0),
+  // Deny-by-default primitive for value-moving actions. Fires on ABSENCE (like the
+  // evidence atoms below, and unlike `amount-over`): true when the context carries no
+  // usable amount — the gate cannot tell how much value the call would move, so a
+  // spend cap authored next to it would silently never fire. Author it with BLOCK as
+  // the FIRST rule of a spend policy; the cap that follows then only ever judges a
+  // known number. Opt-in: only a rule that keys it runs it, so actions that carry no
+  // amount by nature are unaffected.
+  "amount-unknown": (c) => !(typeof c.amount === "number" && Number.isFinite(c.amount)),
   // Total budget: cumulativeSpend is a SERVER-derived, signed-last context field (never
   // shadowable by the agent's itinerary), so this compares already-spent + this amount.
   "cumulative-over": (c, cfg) => Number(c.cumulativeSpend ?? 0) + Number(c.amount ?? 0) > Number(cfg?.limit ?? 0),
@@ -58,8 +66,9 @@ ${c.output ?? ""}`.toLowerCase();
 };
 function notInAllowList(value, allowList) {
   const v = value != null ? String(value).toLowerCase().trim() : "";
+  if (v === "") return false;
   const allowed = (Array.isArray(allowList) ? allowList : []).map((x) => String(x).toLowerCase().trim());
-  return v !== "" && allowed.length > 0 && !allowed.includes(v);
+  return !allowed.includes(v);
 }
 
 // src/policy-core/atom-catalog.ts
@@ -71,6 +80,13 @@ var ATOM_SPECS = [
     config: [{ key: "limit", type: "number", required: true, description: "Maximum allowed amount for one transaction" }],
     requiredContext: ["amount"]
   },
+  {
+    predicate: "amount-unknown",
+    label: "Amount not determinable",
+    description: "Fires when the action carries no usable amount \u2014 the gate cannot tell how much value it would move. A deny-by-default control for value-moving actions: author it with BLOCK ahead of a spend cap, otherwise an action whose amount is missing or unparseable passes the cap untested. Fires on ABSENCE, so only attach it to actions that must always carry an amount.",
+    config: [],
+    requiredContext: ["amount"]
+  },
   {
     predicate: "cumulative-over",
     label: "Total budget over limit",
@@ -191,7 +207,7 @@ function requiredContextFor(predicates) {
 }
 
 // src/policy-core/standards-rules.ts
-var PRECEDENCE = { allow: 0, observe: 1, escalate: 2, block: 3, suspend: 4, quarantine: 5 };
+var PRECEDENCE = { allow: 0, observe: 1, escalate: 2, block: 3, suspend: 4, quarantine: 5, decommission: 6 };
 function atomFires(atom, ctx) {
   const pred = ATOM_REGISTRY[atom.predicate];
   if (!pred) return false;
@@ -399,7 +415,7 @@ function sumEventField(events, type, field) {
 }
 
 // src/policy-core/evaluate.ts
-var PRECEDENCE2 = { allow: 0, observe: 1, escalate: 2, block: 3, suspend: 4, quarantine: 5 };
+var PRECEDENCE2 = { allow: 0, observe: 1, escalate: 2, block: 3, suspend: 4, quarantine: 5, decommission: 6 };
 function evaluate(input) {
   let decision = "allow";
   let reasonCode = "AUTHORIZED";