@red-codes/agentguard 1.0.0

package/dist/renderers/tui-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tui-renderer.js","sourceRoot":"","sources":["../../src/renderers/tui-renderer.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,4EAA4E;AAO5E,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AASvB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA8B,EAAE;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAEzC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,sBAAsB;QAE5B,YAAY,CAAC,MAAsB;YACjC,MAAM,CAAC,KAAK,CACV,YAAY,CAAC;gBACX,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,OAAO;aACnC,CAAC,CACH,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,KAAK,WAAW,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;gBACvD,MAAM,CAAC,KAAK,CAAC,wBAAwB,MAAM,CAAC,cAAc,kBAAkB,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,cAAc,CAAC,MAAoB;YACjC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7D,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,eAAe,CAAC,QAAyB;YACvC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QACrD,CAAC;QAED,YAAY,CAAC,UAA4B;YACvC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,gBAAgB,CAAC,MAAgC;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,UAAU,CAAC,OAAmB;YAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,+CAA+C,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC;YAClF,KAAK,CAAC,IAAI,CACR,qBAAqB,OAAO,CAAC,YAAY,eAAe,OAAO,CAAC,OAAO,cAAc,OAAO,CAAC,MAAM,kBAAkB,OAAO,CAAC,UAAU,SAAS,CACjJ,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/renderers/types.d.ts

@@ -0,0 +1,52 @@
+import type { KernelResult } from '../kernel/kernel.js';
+import type { MonitorDecision } from '../kernel/monitor.js';
+import type { GovernanceDecisionRecord } from '../kernel/decisions/types.js';
+import type { SimulationResult } from '../kernel/simulation/types.js';
+/** Configuration passed to renderers at run start */
+export interface RendererConfig {
+    readonly runId: string;
+    readonly policyName?: string;
+    readonly invariantCount?: number;
+    readonly verbose?: boolean;
+    readonly dryRun?: boolean;
+    readonly simulatorCount?: number;
+}
+/** Summary provided to renderers at run end */
+export interface RunSummary {
+    readonly runId: string;
+    readonly totalActions: number;
+    readonly allowed: number;
+    readonly denied: number;
+    readonly violations: number;
+    readonly durationMs: number;
+}
+/**
+ * GovernanceRenderer — the plugin interface for output renderers.
+ *
+ * Renderers receive lifecycle callbacks as actions flow through the kernel.
+ * Multiple renderers can be active simultaneously (e.g., TUI + file report).
+ *
+ * All methods are optional — implement only the hooks you need.
+ * All methods are synchronous to avoid blocking the kernel pipeline.
+ */
+export interface GovernanceRenderer {
+    /** Unique identifier for this renderer */
+    readonly id: string;
+    /** Human-readable name */
+    readonly name: string;
+    /** Called when a governance run starts */
+    onRunStarted?(config: RendererConfig): void;
+    /** Called after each action is evaluated (allowed or denied) */
+    onActionResult?(result: KernelResult): void;
+    /** Called when escalation state changes */
+    onMonitorStatus?(decision: MonitorDecision): void;
+    /** Called when a pre-execution simulation completes */
+    onSimulation?(simulation: SimulationResult): void;
+    /** Called when a governance decision record is persisted */
+    onDecisionRecord?(record: GovernanceDecisionRecord): void;
+    /** Called when a governance run ends */
+    onRunEnded?(summary: RunSummary): void;
+    /** Called to release resources when the renderer is unregistered */
+    dispose?(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/renderers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/renderers/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,+CAA+C;AAC/C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,0CAA0C;IAC1C,YAAY,CAAC,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAE5C,gEAAgE;IAChE,cAAc,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAE5C,2CAA2C;IAC3C,eAAe,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAElD,uDAAuD;IACvD,YAAY,CAAC,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAElD,4DAA4D;IAC5D,gBAAgB,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAE1D,wCAAwC;IACxC,UAAU,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAEvC,oEAAoE;IACpE,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB"}

package/dist/renderers/types.js

@@ -0,0 +1,4 @@
+// Renderer plugin interface — contracts for governance output renderers.
+// Renderers consume kernel results and produce output (terminal, file, etc.).
+export {};
+//# sourceMappingURL=types.js.map

package/dist/renderers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/renderers/types.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,8EAA8E"}

package/dist/telemetry/index.d.ts

@@ -0,0 +1,3 @@
+export type { TelemetryEvent, TelemetryLoggerOptions, TelemetrySink } from './types.js';
+export { buildTelemetryEvent, createTelemetryLogger, createTelemetryDecisionSink, } from './runtimeLogger.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/telemetry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC"}

package/dist/telemetry/index.js

@@ -0,0 +1,2 @@
+export { buildTelemetryEvent, createTelemetryLogger, createTelemetryDecisionSink, } from './runtimeLogger.js';
+//# sourceMappingURL=index.js.map

package/dist/telemetry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC"}

package/dist/telemetry/runtimeLogger.d.ts

@@ -0,0 +1,9 @@
+import type { GovernanceDecisionRecord, DecisionSink } from '../kernel/decisions/types.js';
+import type { TelemetryEvent, TelemetryLoggerOptions, TelemetrySink } from './types.js';
+/** Map a GovernanceDecisionRecord to a flattened TelemetryEvent. */
+export declare function buildTelemetryEvent(record: GovernanceDecisionRecord): TelemetryEvent;
+/** Create a TelemetrySink that appends JSON lines to a single shared log file. */
+export declare function createTelemetryLogger(options?: TelemetryLoggerOptions): TelemetrySink;
+/** Create a DecisionSink adapter that converts decision records to telemetry events. */
+export declare function createTelemetryDecisionSink(options?: TelemetryLoggerOptions): DecisionSink;
+//# sourceMappingURL=runtimeLogger.d.ts.map

package/dist/telemetry/runtimeLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeLogger.d.ts","sourceRoot":"","sources":["../../src/telemetry/runtimeLogger.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKxF,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,wBAAwB,GAAG,cAAc,CAWpF;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,aAAa,CAkCrF;AAED,wFAAwF;AACxF,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,YAAY,CAa1F"}

package/dist/telemetry/runtimeLogger.js

@@ -0,0 +1,68 @@
+// Runtime telemetry logger — persists flattened governance events to
+// logs/runtime-events.jsonl for downstream agents and monitors.
+// Implements DecisionSink so it plugs directly into the kernel pipeline.
+import { mkdirSync, appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+const DEFAULT_LOG_DIR = 'logs';
+const DEFAULT_LOG_FILE = 'runtime-events.jsonl';
+/** Map a GovernanceDecisionRecord to a flattened TelemetryEvent. */
+export function buildTelemetryEvent(record) {
+    return {
+        timestamp: new Date(record.timestamp).toISOString(),
+        agent: record.action.agent,
+        run_id: record.runId,
+        syscall: record.action.type,
+        target: record.action.target,
+        capability: record.policy.matchedPolicyId ?? 'default-allow',
+        policy_result: record.outcome,
+        invariant_result: record.invariants.allHold ? 'pass' : 'fail',
+    };
+}
+/** Create a TelemetrySink that appends JSON lines to a single shared log file. */
+export function createTelemetryLogger(options) {
+    const logDir = options?.logDir ?? DEFAULT_LOG_DIR;
+    const logFile = options?.logFile ?? DEFAULT_LOG_FILE;
+    const filePath = join(logDir, logFile);
+    let initialized = false;
+    function ensureDir() {
+        if (initialized)
+            return;
+        try {
+            mkdirSync(logDir, { recursive: true });
+            initialized = true;
+        }
+        catch {
+            // Directory may already exist
+            initialized = true;
+        }
+    }
+    return {
+        write(event) {
+            ensureDir();
+            const line = JSON.stringify(event) + '\n';
+            try {
+                appendFileSync(filePath, line, 'utf8');
+            }
+            catch {
+                // Swallow write errors — don't crash the kernel
+            }
+        },
+        flush() {
+            // No buffering — writes are immediate for durability
+        },
+    };
+}
+/** Create a DecisionSink adapter that converts decision records to telemetry events. */
+export function createTelemetryDecisionSink(options) {
+    const logger = createTelemetryLogger(options);
+    return {
+        write(record) {
+            const event = buildTelemetryEvent(record);
+            logger.write(event);
+        },
+        flush() {
+            logger.flush?.();
+        },
+    };
+}
+//# sourceMappingURL=runtimeLogger.js.map

package/dist/telemetry/runtimeLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeLogger.js","sourceRoot":"","sources":["../../src/telemetry/runtimeLogger.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,gEAAgE;AAChE,yEAAyE;AAEzE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,MAAgC;IAClE,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QACnD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;QAC1B,MAAM,EAAE,MAAM,CAAC,KAAK;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,eAAe;QAC5D,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;KAC9D,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,eAAe,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,SAAS,SAAS;QAChB,IAAI,WAAW;YAAE,OAAO;QACxB,IAAI,CAAC;YACH,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;YAC9B,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAqB;YACzB,SAAS,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YAE1C,IAAI,CAAC;gBACH,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,KAAK;YACH,qDAAqD;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,2BAA2B,CAAC,OAAgC;IAC1E,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO;QACL,KAAK,CAAC,MAAgC;YACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,KAAK;YACH,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/telemetry/types.d.ts

@@ -0,0 +1,22 @@
+export interface TelemetryEvent {
+    timestamp: string;
+    agent: string;
+    run_id: string;
+    syscall: string;
+    target: string;
+    capability: string;
+    policy_result: 'allow' | 'deny';
+    invariant_result: 'pass' | 'fail';
+    issue_id?: number;
+    diff_size?: number;
+    metadata?: Record<string, unknown>;
+}
+export interface TelemetryLoggerOptions {
+    logDir?: string;
+    logFile?: string;
+}
+export interface TelemetrySink {
+    write(event: TelemetryEvent): void;
+    flush?(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/telemetry/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/telemetry/types.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB"}

package/dist/telemetry/types.js

@@ -0,0 +1,4 @@
+// Telemetry event types — external contract for downstream agents and monitors.
+// Snake_case field names are intentional: this is an external-facing format.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/telemetry/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/telemetry/types.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6EAA6E"}

package/hooks/post-commit

@@ -0,0 +1,57 @@
+#!/bin/sh
+# AgentGuard Git Hook - post-commit
+# Tracks git commits for developer activity events
+# Install: cp hooks/post-commit .git/hooks/post-commit && chmod +x .git/hooks/post-commit
+
+EVENTS_FILE="$(git rev-parse --show-toplevel)/.events.json"
+
+# Initialize events file if it doesn't exist
+if [ ! -f "$EVENTS_FILE" ]; then
+  echo '{"commits":0,"prs_merged":0,"bugs_fixed":0,"tests_passing":0,"refactors":0,"code_reviews":0,"conflicts_resolved":0,"ci_passes":0,"deploys":0,"docs_written":0}' > "$EVENTS_FILE"
+fi
+
+# Increment commit counter
+if command -v python3 > /dev/null 2>&1; then
+  python3 -c "
+import json
+with open('$EVENTS_FILE', 'r') as f:
+    data = json.load(f)
+data['commits'] = data.get('commits', 0) + 1
+
+# Check commit message for keywords
+import subprocess
+msg = subprocess.run(['git', 'log', '-1', '--format=%s'], capture_output=True, text=True).stdout.lower()
+
+if any(word in msg for word in ['fix', 'bug', 'patch', 'resolve']):
+    data['bugs_fixed'] = data.get('bugs_fixed', 0) + 1
+if any(word in msg for word in ['refactor', 'clean', 'restructure']):
+    data['refactors'] = data.get('refactors', 0) + 1
+if any(word in msg for word in ['doc', 'readme', 'comment', 'jsdoc']):
+    data['docs_written'] = data.get('docs_written', 0) + 1
+if any(word in msg for word in ['deploy', 'release', 'publish']):
+    data['deploys'] = data.get('deploys', 0) + 1
+if any(word in msg for word in ['test', 'spec', 'assert']):
+    data['tests_passing'] = data.get('tests_passing', 0) + 1
+
+with open('$EVENTS_FILE', 'w') as f:
+    json.dump(data, f, indent=2)
+print('[AgentGuard] Dev activity logged.')
+"
+elif command -v node > /dev/null 2>&1; then
+  node -e "
+const fs = require('fs');
+const { execSync } = require('child_process');
+const data = JSON.parse(fs.readFileSync('$EVENTS_FILE', 'utf8'));
+data.commits = (data.commits || 0) + 1;
+
+const msg = execSync('git log -1 --format=%s').toString().toLowerCase();
+if (/fix|bug|patch|resolve/.test(msg)) data.bugs_fixed = (data.bugs_fixed || 0) + 1;
+if (/refactor|clean|restructure/.test(msg)) data.refactors = (data.refactors || 0) + 1;
+if (/doc|readme|comment|jsdoc/.test(msg)) data.docs_written = (data.docs_written || 0) + 1;
+if (/deploy|release|publish/.test(msg)) data.deploys = (data.deploys || 0) + 1;
+if (/test|spec|assert/.test(msg)) data.tests_passing = (data.tests_passing || 0) + 1;
+
+fs.writeFileSync('$EVENTS_FILE', JSON.stringify(data, null, 2));
+console.log('[AgentGuard] Dev activity logged.');
+"
+fi

package/hooks/post-merge

@@ -0,0 +1,33 @@
+#!/bin/sh
+# AgentGuard Git Hook - post-merge
+# Tracks merges for developer activity events
+# Install: cp hooks/post-merge .git/hooks/post-merge && chmod +x .git/hooks/post-merge
+
+EVENTS_FILE="$(git rev-parse --show-toplevel)/.events.json"
+
+if [ ! -f "$EVENTS_FILE" ]; then
+  echo '{"commits":0,"prs_merged":0,"bugs_fixed":0,"tests_passing":0,"refactors":0,"code_reviews":0,"conflicts_resolved":0,"ci_passes":0,"deploys":0,"docs_written":0}' > "$EVENTS_FILE"
+fi
+
+# Check if this was a squash merge (from a PR)
+IS_SQUASH="$1"
+
+if command -v python3 > /dev/null 2>&1; then
+  python3 -c "
+import json
+with open('$EVENTS_FILE', 'r') as f:
+    data = json.load(f)
+data['prs_merged'] = data.get('prs_merged', 0) + 1
+with open('$EVENTS_FILE', 'w') as f:
+    json.dump(data, f, indent=2)
+print('[AgentGuard] Merge logged.')
+"
+elif command -v node > /dev/null 2>&1; then
+  node -e "
+const fs = require('fs');
+const data = JSON.parse(fs.readFileSync('$EVENTS_FILE', 'utf8'));
+data.prs_merged = (data.prs_merged || 0) + 1;
+fs.writeFileSync('$EVENTS_FILE', JSON.stringify(data, null, 2));
+console.log('[AgentGuard] Merge logged.');
+"
+fi

package/hooks/pre-commit

@@ -0,0 +1,28 @@
+#!/bin/sh
+# AgentGuard Git Hook - pre-commit
+# Auto-stages telemetry files so governance data rides with every commit.
+# Without this, telemetry JSONL files accumulate as untracked forever.
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+# Stage consolidated telemetry log
+if [ -f "$REPO_ROOT/logs/runtime-events.jsonl" ]; then
+  git add "$REPO_ROOT/logs/runtime-events.jsonl" 2>/dev/null
+fi
+
+# Stage dev activity counters
+if [ -f "$REPO_ROOT/.events.json" ]; then
+  git add "$REPO_ROOT/.events.json" 2>/dev/null
+fi
+
+# Stage governance event JSONL files
+for f in "$REPO_ROOT"/.agentguard/events/*.jsonl; do
+  [ -f "$f" ] && git add "$f" 2>/dev/null
+done
+
+# Stage governance decision records
+for f in "$REPO_ROOT"/.agentguard/decisions/*.jsonl; do
+  [ -f "$f" ] && git add "$f" 2>/dev/null
+done
+
+exit 0

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@red-codes/agentguard",
+  "version": "1.0.0",
+  "description": "Runtime governance for AI coding agents — policy enforcement, invariant checking, and audit trails for agent tool calls.",
+  "type": "module",
+  "bin": {
+    "agentguard": "./dist/cli/bin.js"
+  },
+  "files": [
+    "dist/",
+    "hooks/",
+    "LICENSE",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jpleva91/agent-guard.git"
+  },
+  "homepage": "https://github.com/jpleva91/agent-guard#readme",
+  "bugs": {
+    "url": "https://github.com/jpleva91/agent-guard/issues"
+  },
+  "author": "jpleva91",
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "dev": "node dist/cli/bin.js",
+    "agentguard": "node dist/cli/bin.js",
+    "build:ts": "tsc && tsx esbuild.config.ts",
+    "ts:check": "tsc --noEmit",
+    "test": "node tests/run.js",
+    "ts:test": "vitest run",
+    "ts:test:watch": "vitest",
+    "test:coverage": "c8 --check-coverage --lines 50 node tests/run.js",
+    "lint": "eslint tests/ src/",
+    "lint:fix": "eslint --fix tests/ src/",
+    "format": "prettier --check src/",
+    "format:fix": "prettier --write src/",
+    "prepublishOnly": "npm run build:ts"
+  },
+  "keywords": [
+    "agentguard",
+    "ai-governance",
+    "runtime-guardrails",
+    "agent-safety",
+    "policy-enforcement",
+    "invariants",
+    "canonical-events",
+    "audit-trail",
+    "cli",
+    "developer-tools"
+  ],
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "@types/node": "^25.4.0",
+    "c8": "^11.0.0",
+    "esbuild": "^0.27.3",
+    "eslint": "^10.0.3",
+    "prettier": "^3.8.1",
+    "terser": "^5.46.0",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.1",
+    "vitest": "^4.0.18"
+  },
+  "dependencies": {
+    "chokidar": "^5.0.0",
+    "commander": "^14.0.3",
+    "pino": "^10.3.1"
+  }
+}