@odingard/guardian-openai-agents 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,166 @@
-# Temporary Holding Version
+# @odingard/guardian-openai-agents
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+OpenAI Agents SDK adapter for Guardian — every tool call goes through a
+deterministic `ALLOW` / `ASK` / `DENY` authority decision before the tool
+runs. The agent proposes; the human decides.
+
+**Tested, but not yet proven against a live Guardian and a live model.** The
+tests run the real Agents SDK runner with a scripted model and a stubbed
+Guardian client.
+
+## Install
+
+```bash
+npm install @odingard/guardian-openai-agents @odingard/guardian-sdk @openai/agents zod
+```
+
+`@openai/agents` (0.21.x) and `@odingard/guardian-sdk` are peer
+dependencies.
+
+## Usage
+
+`guardianTool` takes the same options as the Agents SDK's `tool()`, plus
+the Guardian options. `createGuardianTool` binds the Guardian options once.
+
+```ts
+import { Agent, run } from "@openai/agents";
+import { z } from "zod";
+import { createGuardianClient } from "@odingard/guardian-sdk";
+import {
+  createGuardianTool,
+  findApprovalPending,
+} from "@odingard/guardian-openai-agents";
+
+const guardian = createGuardianClient({
+  baseUrl: "https://guardian-api.odingard.com",
+  credential: process.env.GUARDIAN_AGENT_CREDENTIAL!,
+});
+
+const governed = createGuardianTool({
+  client: guardian,
+  connectionId: "con_…",
+  agentName: "billing-agent",
+});
+
+const refundOrder = governed({
+  name: "refund_order",
+  description: "Refund an order",
+  parameters: z.object({ orderId: z.string(), amount: z.number() }),
+  execute: async ({ orderId, amount }) => refund(orderId, amount),
+});
+
+const agent = new Agent({ name: "Billing", tools: [refundOrder] });
+
+try {
+  const result = await run(agent, "Refund order 42");
+  console.log(result.finalOutput);
+} catch (err) {
+  const pending = findApprovalPending(err);
+  if (!pending) throw err;
+  // Show pending.requestId to a person. Poll until they decide or the
+  // request expires. The tool runs only after approval; a denial or expiry
+  // throws GuardianDenied.
+  for (;;) {
+    await new Promise((resolve) => setTimeout(resolve, 5000));
+    try {
+      const { output, receipt } = await pending.resume();
+      console.log("approved", output, receipt);
+      break;
+    } catch (again) {
+      if (findApprovalPending(again)) continue;
+      console.log("not approved", again);
+      break;
+    }
+  }
+}
+```
+
+`refund` stands for your own code. Nothing here has been run against a
+live Guardian or a live model.
+
+Register each tool once on the connection in the Guardian console
+(Connections → tool server → "My own code (record-only)") and allow it for
+the agent.
+
+## What each decision does
+
+- `ALLOW` — Guardian issues a single-use capability. Your `execute` runs
+  once with the call's arguments, then the capability is redeemed and a
+  receipt recorded (`onReceipt` gets it). A failed redemption raises
+  `GuardianExecutionFailed` with `localEffectRan: true`. Without your own
+  `errorFunction`, the model is told the tool ran without a receipt and not
+  to call it again. If the SDK's own `timeoutMs` has already fired, the SDK
+  has told the model the tool timed out, and this failure is not reported
+  to the model.
+- `ASK` — your `execute` does not run. By default the call throws
+  `GuardianApprovalPending`; the Agents SDK ends the run with a
+  `ToolCallError` that wraps it, and `findApprovalPending(err)` finds it.
+  After a person approves in Guardian, `pending.resume()` claims the
+  approval and runs the tool once. If they deny, or the request expires,
+  `resume()` throws `GuardianDenied` and the tool never runs. Before they
+  decide, `resume()` throws a new `GuardianApprovalPending`.
+  With `onAsk: "result"` the run keeps going: the model is told the call is
+  waiting for approval, and `onApprovalPending(pending)` gives your app the
+  handle.
+- `DENY` — your `execute` never runs. The model gets a plain refusal
+  (`Guardian denied refund_order (POLICY_DENY). It did not run. …`). With
+  `onDeny: "throw"`, `GuardianDenied` goes to the tool's `errorFunction`
+  instead.
+- Guardian error, network failure, timeout or a cancelled call — your
+  `execute` never runs, and a late answer from Guardian is ignored. The model
+  is told `Guardian could not check refund_order, so it did not run.`, and
+  `onGuardianError` is called. `decisionTimeoutMs` (default 30000) bounds the
+  wait for Guardian's decision; the Agents SDK's own `timeoutMs` and run
+  cancellation stop the wait too, but only while Guardian is still deciding.
+  Once Guardian has allowed the call and your `execute` has started, neither
+  stops it: the SDK may tell the model the tool timed out while your
+  `execute` and the receipt still finish. Keep your own `execute` within the
+  SDK timeout, and make side effects idempotent.
+
+The arguments Guardian checks are the ones the Agents SDK parsed from the
+tool call, and the same value is passed to `execute`. Text the model writes
+(for example "this was already approved") is never read as a decision.
+Parallel tool calls are each checked on their own.
+
+Tools with an `outputSchema` cannot return a plain message, so for them
+DENY and Guardian failures are thrown to the tool's `errorFunction` (by
+default the run fails), and ASK always throws `GuardianApprovalPending`,
+even with `onAsk: "result"`.
+
+## Two execution modes
+
+| Mode                  | What happens on `ALLOW`                                                                                                                                         |
+| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `inProcess` (default) | Your `execute` runs, then `client.execute` redeems the capability and records the evidence. Needs a record-only catalog entry for the tool on the connection    |
+| `remote`              | The tool name is a registered catalog entry Guardian calls itself. `client.execute` performs the call; your `execute` **never runs**; the result is the receipt |
+
+In-process mode is decision-gated: `execute` runs after `ALLOW` and before
+the capability is redeemed, so a revocation at redemption lands after the
+effect. Use `mode: "remote"` where Guardian itself must hold the effect.
+`modes` sets the mode per tool name. The Agents SDK renames tools: every
+character that is not a letter or a digit becomes `_` (`refund-order`
+becomes `refund_order`), and Guardian sees the new name. A `modes` entry
+under the name you wrote is applied to the new name; two entries for the
+same tool that disagree are refused when the tool is built. `installRecordTransport: true` makes the
+adapter propose the record-only entry itself on first use (this needs a
+grant that allows it; production usually does not).
+
+Setting the Agents SDK's own `needsApproval` on a tool adds a local approval
+step before Guardian is asked. It never replaces Guardian's decision.
+
+Options: `client`, `connectionId`, `adapterId?`, `agentName?`, `purpose?`
+(string or `(toolName, input) => string`), `mode?`, `modes?`,
+`installRecordTransport?`, `onAsk?` (`"throw"` default, or `"result"`),
+`onDeny?` (`"result"` default, or `"throw"`), `decisionTimeoutMs?`,
+`onApprovalPending?`, `onGuardianError?`, `onReceipt?`.
+
+## Not covered
+
+Only function tools built with `guardianTool` / `createGuardianTool` are
+governed. Hosted tools (web search, file search, code interpreter, hosted
+MCP), computer, shell and apply-patch tools, handoffs and agents used as
+tools are not; put MCP servers behind `guardian-mcp` instead.
+
+## License
+
+Apache-2.0

package/dist/index.js

@@ -0,0 +1,332 @@
+// src/index.ts
+import {
+  tool
+} from "@openai/agents";
+
+// src/core.ts
+import {
+  createGuardianContext,
+  runThroughGuardian,
+  toArgumentsRecord,
+  GuardianApprovalPending,
+  GuardianDenied,
+  GuardianExecutionFailed,
+  GuardianRecordTransportRequired
+} from "@odingard/guardian-sdk";
+
+// src/gate.ts
+var GuardianUnavailable = class extends Error {
+  toolName;
+  reason;
+  constructor(args) {
+    super(
+      `Guardian could not check "${args.toolName}" (${args.reason}); the tool did not run`
+    );
+    this.name = "GuardianUnavailable";
+    this.toolName = args.toolName;
+    this.reason = args.reason;
+  }
+};
+var CallGate = class {
+  client;
+  #state = "deciding";
+  #closedBy;
+  #timer;
+  #signal;
+  #onAbort;
+  #rejecters = /* @__PURE__ */ new Set();
+  #installIds = /* @__PURE__ */ new Set();
+  constructor(args) {
+    const { client, toolName, timeoutMs, signal } = args;
+    this.#timer = setTimeout(
+      () => this.#close(new GuardianUnavailable({ toolName, reason: "timeout" })),
+      timeoutMs
+    );
+    if (signal) {
+      this.#signal = signal;
+      this.#onAbort = () => this.#close(new GuardianUnavailable({ toolName, reason: "cancelled" }));
+      if (signal.aborted) {
+        this.#onAbort();
+      } else {
+        signal.addEventListener("abort", this.#onAbort, { once: true });
+      }
+    }
+    const decide = (fn) => (...a) => {
+      this.assertOpen();
+      if (this.#state !== "deciding") {
+        return fn(...a);
+      }
+      return new Promise((resolve, reject) => {
+        this.#rejecters.add(reject);
+        fn(...a).then(
+          (value) => {
+            this.#rejecters.delete(reject);
+            if (this.#closedBy) reject(this.#closedBy);
+            else resolve(value);
+          },
+          (err) => {
+            this.#rejecters.delete(reject);
+            reject(this.#closedBy ?? err);
+          }
+        );
+      });
+    };
+    const installIds = this.#installIds;
+    const noteInstall = (result) => {
+      const id = result?.requestId;
+      if (typeof id === "string" && id.length > 0) installIds.add(id);
+    };
+    const request = decide(
+      async (i) => {
+        const result = await client.request(i);
+        if (i.action === "mcp.install") noteInstall(result);
+        return result;
+      }
+    );
+    const claim = decide(async (id) => {
+      const result = await client.claim(id);
+      if (installIds.has(id)) noteInstall(result);
+      return result;
+    });
+    const executeInstall = decide(
+      (input) => client.execute(input)
+    );
+    const execute = (input) => {
+      if (installIds.has(input.requestId)) {
+        return executeInstall(input);
+      }
+      this.assertOpen();
+      this.commit();
+      return client.execute(input);
+    };
+    const overrides = { request, claim, execute };
+    this.client = new Proxy(client, {
+      get(target, prop, receiver) {
+        if (Object.prototype.hasOwnProperty.call(overrides, prop)) {
+          return overrides[prop];
+        }
+        const value = Reflect.get(target, prop, receiver);
+        return typeof value === "function" ? value.bind(target) : value;
+      }
+    });
+  }
+  get committed() {
+    return this.#state === "committed";
+  }
+  get closed() {
+    return this.#state === "closed";
+  }
+  /** Throws if the gate closed (timeout or cancel) before the tool started. */
+  assertOpen() {
+    if (this.#state === "closed" && this.#closedBy) {
+      throw this.#closedBy;
+    }
+  }
+  /** The tool (or Guardian's execution of it) is starting. */
+  commit() {
+    this.assertOpen();
+    if (this.#state === "deciding") {
+      this.#state = "committed";
+      this.#disarm();
+    }
+  }
+  /** The call settled; later `resume()` calls pass straight through. */
+  settle() {
+    if (this.#state !== "closed") {
+      this.#state = "settled";
+      this.#disarm();
+    }
+  }
+  #close(reason) {
+    if (this.#state !== "deciding") {
+      return;
+    }
+    this.#state = "closed";
+    this.#closedBy = reason;
+    this.#disarm();
+    for (const reject of this.#rejecters) {
+      reject(reason);
+    }
+    this.#rejecters.clear();
+  }
+  #disarm() {
+    if (this.#timer !== void 0) {
+      clearTimeout(this.#timer);
+      this.#timer = void 0;
+    }
+    if (this.#signal && this.#onAbort) {
+      this.#signal.removeEventListener("abort", this.#onAbort);
+      this.#onAbort = void 0;
+    }
+  }
+};
+
+// src/index.ts
+var DEFAULT_DECISION_TIMEOUT_MS = 3e4;
+var DEFAULT_TOOL_ERROR_MESSAGE = "An error occurred while running the tool. Please try again.";
+function askMessage(toolName, requestId) {
+  return `Guardian is holding ${toolName} for a person to approve (requestId ${requestId}). It has not run. Do not call it again; tell the user it is waiting for approval.`;
+}
+function denyMessage(err) {
+  return `Guardian denied ${err.toolName} (${err.reasonCode}). It did not run. Do not retry the same call.`;
+}
+function unavailableMessage(toolName) {
+  return `Guardian could not check ${toolName}, so it did not run.`;
+}
+function executionFailedMessage(err) {
+  if (err.localEffectRan) {
+    return `${err.toolName} ran, but Guardian could not record it (${err.reasonCode}). Do not call it again; tell the user it ran without a receipt.`;
+  }
+  return `Guardian could not complete ${err.toolName} (${err.reasonCode}). Do not call it again; tell the user so they can check.`;
+}
+function remapModes(modes, writtenName, builtName) {
+  if (!modes || !writtenName || writtenName === builtName) {
+    return modes;
+  }
+  if (!Object.prototype.hasOwnProperty.call(modes, writtenName)) {
+    return modes;
+  }
+  const written = modes[writtenName];
+  const hasBuilt = Object.prototype.hasOwnProperty.call(modes, builtName);
+  if (hasBuilt && modes[builtName] !== written) {
+    throw new Error(
+      `Guardian modes disagree for tool "${writtenName}" (the Agents SDK names it "${builtName}"): set one entry`
+    );
+  }
+  return { ...modes, [builtName]: written };
+}
+function buildTool(shared, toolOptions) {
+  const { options } = shared;
+  const userExecute = toolOptions.execute;
+  const userErrorFunction = toolOptions.errorFunction;
+  const hasOutputSchema = typeof toolOptions.outputSchema !== "undefined";
+  const timeoutMs = options.decisionTimeoutMs ?? DEFAULT_DECISION_TIMEOUT_MS;
+  let coreOptions = {
+    ...options,
+    mode: options.mode ?? "inProcess",
+    installRecordTransport: options.installRecordTransport ?? false,
+    onAsk: "throw",
+    onDeny: "throw"
+  };
+  const onDeny = options.onDeny ?? "result";
+  const onAsk = options.onAsk ?? "throw";
+  let toolName = "";
+  const execute = async (input, runContext, details) => {
+    const gate = new CallGate({
+      client: options.client,
+      toolName,
+      timeoutMs,
+      ...details?.signal ? { signal: details.signal } : {}
+    });
+    const ctx = {
+      options: { ...coreOptions, client: gate.client },
+      ensured: shared.ensured
+    };
+    try {
+      const output = await runThroughGuardian(ctx, toolName, input, () => {
+        gate.commit();
+        return userExecute(input, runContext, details);
+      });
+      gate.settle();
+      return output;
+    } catch (err) {
+      const startedBeforeError = gate.committed;
+      gate.settle();
+      if (err instanceof GuardianApprovalPending) {
+        try {
+          await options.onApprovalPending?.(err);
+        } catch {
+        }
+        if (onAsk === "result" && !hasOutputSchema) {
+          return askMessage(toolName, err.requestId);
+        }
+        throw err;
+      }
+      if (err instanceof GuardianDenied) {
+        if (onDeny === "result" && !hasOutputSchema) {
+          return denyMessage(err);
+        }
+        throw err;
+      }
+      if (err instanceof GuardianExecutionFailed || err instanceof GuardianRecordTransportRequired || startedBeforeError) {
+        throw err;
+      }
+      try {
+        await options.onGuardianError?.({ toolName, error: err });
+      } catch {
+      }
+      const unavailable = err instanceof GuardianUnavailable ? err : new GuardianUnavailable({ toolName, reason: "error" });
+      if (hasOutputSchema) {
+        throw unavailable;
+      }
+      return unavailableMessage(toolName);
+    }
+  };
+  const errorFunction = async (context, error, details) => {
+    if (error instanceof GuardianApprovalPending) {
+      throw error;
+    }
+    if (typeof userErrorFunction === "function") {
+      return userErrorFunction(context, error, details);
+    }
+    if (userErrorFunction === null || hasOutputSchema) {
+      throw error;
+    }
+    if (error instanceof GuardianExecutionFailed) {
+      return executionFailedMessage(error);
+    }
+    if (error instanceof GuardianDenied) {
+      return denyMessage(error);
+    }
+    if (error instanceof GuardianUnavailable) {
+      return unavailableMessage(error.toolName);
+    }
+    return DEFAULT_TOOL_ERROR_MESSAGE;
+  };
+  const name = toolOptions.name ?? userExecute.name;
+  const built = tool({
+    ...toolOptions,
+    ...name ? { name } : {},
+    execute,
+    errorFunction
+  });
+  toolName = built.name;
+  const modes = remapModes(options.modes, name, built.name);
+  if (modes !== options.modes) {
+    coreOptions = { ...coreOptions, ...modes ? { modes } : {} };
+  }
+  return built;
+}
+function guardianTool(toolOptions, options) {
+  return buildTool(
+    { options, ensured: /* @__PURE__ */ new Set() },
+    toolOptions
+  );
+}
+function createGuardianTool(options) {
+  const shared = { options, ensured: /* @__PURE__ */ new Set() };
+  return (toolOptions) => buildTool(shared, toolOptions);
+}
+function findApprovalPending(err) {
+  let current = err;
+  for (let depth = 0; depth < 5 && current; depth += 1) {
+    if (current instanceof GuardianApprovalPending) {
+      return current;
+    }
+    const next = current.error ?? current.cause;
+    current = next;
+  }
+  return void 0;
+}
+export {
+  DEFAULT_DECISION_TIMEOUT_MS,
+  GuardianApprovalPending,
+  GuardianDenied,
+  GuardianExecutionFailed,
+  GuardianRecordTransportRequired,
+  GuardianUnavailable,
+  createGuardianTool,
+  findApprovalPending,
+  guardianTool,
+  toArgumentsRecord
+};

package/dist-dts/core.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The governed-execution triad lives in the core SDK
+ * (`@odingard/guardian-sdk`, src/guard.ts) so every framework adapter, the
+ * MCP proxy and the plain `createGuard` helper share one implementation.
+ * This module re-exports it unchanged for the adapter.
+ */
+export { createGuardianContext, runThroughGuardian, toArgumentsRecord, GuardianApprovalPending, GuardianDenied, GuardianExecutionFailed, GuardianRecordTransportRequired, type GuardianAdapterOptions, type GuardianContext, type GuardianDecisionResult, type GuardianMode, type GuardianResume, type GuardianToolMode, } from "@odingard/guardian-sdk";

package/dist-dts/gate.d.ts

@@ -0,0 +1,46 @@
+import type { GuardianClient } from "@odingard/guardian-sdk";
+/**
+ * Guardian did not answer in time, or the agent run cancelled the call
+ * while Guardian was still deciding. The tool did not run.
+ */
+export declare class GuardianUnavailable extends Error {
+    readonly toolName: string;
+    readonly reason: "timeout" | "cancelled" | "error";
+    constructor(args: {
+        toolName: string;
+        reason: "timeout" | "cancelled" | "error";
+    });
+}
+/**
+ * Per-call gate around the Guardian client.
+ *
+ * While Guardian is deciding, the gate has a deadline and follows the
+ * agent run's abort signal. If either fires first, the gate closes for
+ * good: the pending Guardian call is abandoned, and every later client call
+ * and the tool itself are refused, so a late ALLOW can never run the tool.
+ *
+ * Once the tool starts (or Guardian is asked to execute the tool call) the
+ * gate is committed and stops interfering, so a started action is always
+ * recorded. Executing a record-transport install does not commit the gate:
+ * the deadline and the abort signal still apply to the tool call after it.
+ * Once the call has settled (for example an ASK handed back to the app),
+ * the gate opens so `resume()` can claim the approval later.
+ */
+export declare class CallGate {
+    #private;
+    readonly client: GuardianClient;
+    constructor(args: {
+        client: GuardianClient;
+        toolName: string;
+        timeoutMs: number;
+        signal?: AbortSignal;
+    });
+    get committed(): boolean;
+    get closed(): boolean;
+    /** Throws if the gate closed (timeout or cancel) before the tool started. */
+    assertOpen(): void;
+    /** The tool (or Guardian's execution of it) is starting. */
+    commit(): void;
+    /** The call settled; later `resume()` calls pass straight through. */
+    settle(): void;
+}

package/dist-dts/index.d.ts

@@ -0,0 +1,70 @@
+import { tool, type ToolInputParameters, type ToolOptions, type ToolOutputSchema, type UnknownContext } from "@openai/agents";
+import { GuardianApprovalPending, type GuardianAdapterOptions } from "./core.js";
+export { GuardianApprovalPending, GuardianDenied, GuardianExecutionFailed, GuardianRecordTransportRequired, toArgumentsRecord, type GuardianAdapterOptions, type GuardianDecisionResult, type GuardianMode, type GuardianResume, type GuardianToolMode, } from "./core.js";
+export { GuardianUnavailable } from "./gate.js";
+/** Default time to wait for Guardian's decision before failing closed. */
+export declare const DEFAULT_DECISION_TIMEOUT_MS = 30000;
+export type GuardianOpenAIAgentsOptions = GuardianAdapterOptions & Readonly<{
+    /**
+     * How long to wait for Guardian's decision, in milliseconds. Past it the
+     * call fails closed: the tool does not run, and a late answer is ignored.
+     * Default 30000. Waiting for a person is not part of this: an ASK comes
+     * back from Guardian at once.
+     */
+    decisionTimeoutMs?: number;
+    /**
+     * Called with the pending approval whenever Guardian answers ASK, before
+     * the call throws (onAsk "throw") or returns its message (onAsk
+     * "result"). Show `pending.requestId` to a person; after they approve in
+     * Guardian, `pending.resume()` claims the approval and runs the tool.
+     */
+    onApprovalPending?: (pending: GuardianApprovalPending) => void | PromiseLike<void>;
+    /**
+     * Called when Guardian could not be reached, failed, or did not answer
+     * in time. The tool did not run. For logging only.
+     */
+    onGuardianError?: (event: {
+        toolName: string;
+        error: unknown;
+    }) => void | PromiseLike<void>;
+}>;
+type GuardedTool<TParameters extends ToolInputParameters, Context, Result, TOutputSchema extends ToolOutputSchema | undefined> = ReturnType<typeof tool<TParameters, Context, Result, TOutputSchema>>;
+/**
+ * A drop-in for the Agents SDK's `tool()`: same options, but every call
+ * goes through Guardian before `execute` runs.
+ *
+ * - ALLOW: `execute` runs once (in-process mode, the default) and the
+ *   capability is redeemed to record a receipt. In remote mode Guardian
+ *   performs the registered call itself and `execute` never runs.
+ * - ASK: `execute` does not run. By default the call throws
+ *   `GuardianApprovalPending` out of `run()`; after a person approves,
+ *   `pending.resume()` claims the approval and runs the tool. With
+ *   `onAsk: "result"` the model is told the call is waiting instead.
+ * - DENY: `execute` never runs; the model gets a plain refusal
+ *   (`onDeny: "throw"` throws `GuardianDenied` instead).
+ * - Guardian error, network failure, timeout or cancellation: `execute`
+ *   never runs; the model is told Guardian could not check the call.
+ *
+ * In-process mode is decision-gated: `execute` runs after ALLOW and before
+ * the capability is redeemed, so a revocation at redemption lands after
+ * the effect (reported as `GuardianExecutionFailed` with
+ * `localEffectRan`). Use `mode: "remote"` where Guardian must hold the
+ * effect itself.
+ */
+export declare function guardianTool<TParameters extends ToolInputParameters = undefined, Context = UnknownContext, Result = string, TOutputSchema extends ToolOutputSchema | undefined = undefined>(toolOptions: ToolOptions<TParameters, Context, TOutputSchema>, options: GuardianOpenAIAgentsOptions): GuardedTool<TParameters, Context, Result, TOutputSchema>;
+/**
+ * `guardianTool` with the Guardian options bound once. Tools made by one
+ * factory share the record-transport cache.
+ *
+ * ```ts
+ * const governed = createGuardianTool({ client, connectionId: "con_…" });
+ * const refund = governed({ name: "refund_order", description, parameters, execute });
+ * ```
+ */
+export declare function createGuardianTool(options: GuardianOpenAIAgentsOptions): <TParameters extends ToolInputParameters = undefined, Context = UnknownContext, Result = string, TOutputSchema extends ToolOutputSchema | undefined = undefined>(toolOptions: ToolOptions<TParameters, Context, TOutputSchema>) => GuardedTool<TParameters, Context, Result, TOutputSchema>;
+/**
+ * Find the pending approval behind an error thrown by `run()`. The Agents
+ * SDK may hand the tool's error back as is or wrapped (for example in
+ * `ToolCallError.error`); this looks through both.
+ */
+export declare function findApprovalPending(err: unknown): GuardianApprovalPending | undefined;

package/package.json

@@ -1,6 +1,58 @@
 {
   "name": "@odingard/guardian-openai-agents",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "OpenAI Agents SDK adapter — route an agent's tool calls through Guardian for a deterministic ALLOW/ASK/DENY decision before anything executes.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist-dts/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "dist-dts",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --external:@openai/agents --external:@odingard/guardian-sdk --outfile=dist/index.js && tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "peerDependencies": {
+    "@odingard/guardian-sdk": "^0.3.8",
+    "@openai/agents": ">=0.21.0 <0.22.0"
+  },
+  "devDependencies": {
+    "@odingard/guardian-sdk": "^0.3.8",
+    "@openai/agents": "0.21.0",
+    "@types/node": "^22.20.5",
+    "esbuild": "^0.28.2",
+    "typescript": "^5.9.3",
+    "vitest": "^5.1.0",
+    "zod": "^4.6.7"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "keywords": [
+    "guardian",
+    "ai-agents",
+    "authorization",
+    "authority",
+    "openai-agents",
+    "human-in-the-loop"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Odingard/guardian-sdk.git",
+    "directory": "packages/openai-agents"
+  },
+  "homepage": "https://odingard.com/guardian"
+}