@shield-agent/kya 0.1.19 → 0.1.21

package/dist/orr/scorecard.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Optional ORR producer for OpenSSF Scorecard (CLI `scorecard`).
+ * Evidence only — never a PEP. Never --fix, never npx -y.
+ */
+import type { OrrCoverageGap, OrrFinding } from "../commands/orr.js";
+export declare const SCORECARD_PRODUCER_ID = "openssf.scorecard";
+export interface ScorecardSpawnResult {
+    readonly status: number | null;
+    readonly stdout: string | Buffer;
+    readonly stderr: string | Buffer;
+    readonly error?: NodeJS.ErrnoException;
+}
+export type ScorecardSpawnFn = (command: string, args: readonly string[], options: {
+    encoding: "utf8";
+    timeout: number;
+    maxBuffer: number;
+    windowsHide: boolean;
+}) => ScorecardSpawnResult;
+export declare function buildScorecardArgv(absPath: string): {
+    command: string;
+    args: readonly string[];
+};
+/** Map Scorecard JSON dump into observational findings. Never maps to ALLOW. */
+export declare function ingestScorecardJson(parsed: unknown, evidencePath: string): OrrFinding[];
+export declare function tryRunScorecardCli(targetPath: string, spawn?: ScorecardSpawnFn): {
+    findings: OrrFinding[];
+} | {
+    gap: OrrCoverageGap;
+};
+//# sourceMappingURL=scorecard.d.ts.map

package/dist/orr/scorecard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorecard.d.ts","sourceRoot":"","sources":["../../src/orr/scorecard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CACxC;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB,KACE,oBAAoB,CAAC;AAE1B,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB,CAMA;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,MAAM,GACnB,UAAU,EAAE,CAmCd;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,gBAAgB,GACvB;IAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,CA8BtD"}

package/dist/orr/scorecard.js

@@ -0,0 +1,107 @@
+/**
+ * Optional ORR producer for OpenSSF Scorecard (CLI `scorecard`).
+ * Evidence only — never a PEP. Never --fix, never npx -y.
+ */
+import { spawnSync } from "node:child_process";
+export const SCORECARD_PRODUCER_ID = "openssf.scorecard";
+export function buildScorecardArgv(absPath) {
+    const fromEnv = process.env.SCORECARD_BIN?.trim();
+    return {
+        command: fromEnv && fromEnv.length > 0 ? fromEnv : "scorecard",
+        args: ["--local", absPath, "--format", "json"],
+    };
+}
+/** Map Scorecard JSON dump into observational findings. Never maps to ALLOW. */
+export function ingestScorecardJson(parsed, evidencePath) {
+    const obj = parsed && typeof parsed === "object" ? parsed : {};
+    const score = typeof obj.score === "number" ? obj.score : undefined;
+    const checks = Array.isArray(obj.checks) ? obj.checks : [];
+    const findings = [
+        {
+            id: "sa.scorecard.ingested",
+            category: "enterprise_readiness",
+            severity: "info",
+            title: "Scorecard ingested as evidence",
+            detail: score === undefined
+                ? "Scorecard dump loaded. Does not ALLOW side effects."
+                : `Scorecard score=${score} (evidence only — not a PEP).`,
+            evidence: evidencePath,
+            source_tool: SCORECARD_PRODUCER_ID,
+        },
+    ];
+    for (const raw of checks.slice(0, 24)) {
+        if (!raw || typeof raw !== "object")
+            continue;
+        const check = raw;
+        const name = typeof check.name === "string" ? check.name : "check";
+        const checkScore = check.score;
+        findings.push({
+            id: `sa.scorecard.check.${name.toLowerCase().replace(/[^a-z0-9]+/g, "_")}`,
+            category: "enterprise_readiness",
+            severity: "info",
+            title: `Scorecard ${name}`,
+            detail: `score=${String(checkScore ?? "n/a")} — evidence only`,
+            evidence: evidencePath,
+            source_tool: SCORECARD_PRODUCER_ID,
+        });
+    }
+    return findings;
+}
+export function tryRunScorecardCli(targetPath, spawn) {
+    const run = spawn ?? defaultScorecardSpawn;
+    const { command, args } = buildScorecardArgv(targetPath);
+    let result;
+    try {
+        result = run(command, args, {
+            encoding: "utf8",
+            timeout: 120_000,
+            maxBuffer: 8 * 1024 * 1024,
+            windowsHide: true,
+        });
+    }
+    catch (err) {
+        const code = err && typeof err === "object" && "code" in err
+            ? String(err.code)
+            : "";
+        if (code === "ENOENT") {
+            return { gap: { adapter_id: SCORECARD_PRODUCER_ID, reason: "binary_not_found" } };
+        }
+        return { gap: { adapter_id: SCORECARD_PRODUCER_ID, reason: "error_non_fatal" } };
+    }
+    if (result.error?.code === "ENOENT") {
+        return { gap: { adapter_id: SCORECARD_PRODUCER_ID, reason: "binary_not_found" } };
+    }
+    const stdout = bufferToString(result.stdout);
+    const parsed = tryParseJson(stdout);
+    if (parsed === undefined) {
+        return { gap: { adapter_id: SCORECARD_PRODUCER_ID, reason: "error_non_fatal" } };
+    }
+    return { findings: ingestScorecardJson(parsed, `scorecard://local/${targetPath}`) };
+}
+function defaultScorecardSpawn(command, args, options) {
+    return spawnSync(command, [...args], {
+        encoding: options.encoding,
+        timeout: options.timeout,
+        maxBuffer: options.maxBuffer,
+        windowsHide: options.windowsHide,
+        shell: false,
+        env: process.env,
+    });
+}
+function bufferToString(value) {
+    if (typeof value === "string")
+        return value;
+    return Buffer.isBuffer(value) ? value.toString("utf8") : "";
+}
+function tryParseJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return undefined;
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=scorecard.js.map

package/dist/orr/scorecard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorecard.js","sourceRoot":"","sources":["../../src/orr/scorecard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAoBzD,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAIhD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;QAC9D,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CACjC,MAAe,EACf,YAAoB;IAEpB,MAAM,GAAG,GACP,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAiB;QAC7B;YACE,EAAE,EAAE,uBAAuB;YAC3B,QAAQ,EAAE,sBAAsB;YAChC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,gCAAgC;YACvC,MAAM,EACJ,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,qDAAqD;gBACvD,CAAC,CAAC,mBAAmB,KAAK,+BAA+B;YAC7D,QAAQ,EAAE,YAAY;YACtB,WAAW,EAAE,qBAAqB;SACnC;KACF,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,sBAAsB,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE;YAC1E,QAAQ,EAAE,sBAAsB;YAChC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,aAAa,IAAI,EAAE;YAC1B,MAAM,EAAE,SAAS,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,kBAAkB;YAC9D,QAAQ,EAAE,YAAY;YACtB,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,KAAwB;IAExB,MAAM,GAAG,GAAG,KAAK,IAAI,qBAAqB,CAAC;IAC3C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE;YAC1B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;YAC1B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GACR,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC7C,CAAC,CAAC,MAAM,CAAE,GAA0B,CAAC,IAAI,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,UAAU,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAe,EACf,IAAuB,EACvB,OAKC;IAED,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/gemini/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.19", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.21", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/grok/README.md

@@ -40,7 +40,7 @@ chat = client.chat.create(
 There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
 
 ```bash
-npx --no-install @shield-agent/kya@0.1.19 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.1.21 serve-mcp --stdio
 ```
 
 Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "shield-kya",
   "display_name": "Shield KYA",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
   "long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
   "author": {

package/mcp.json

@@ -3,7 +3,7 @@
     "shield-kya": {
       "description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.19", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.21", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "${KYA_BASE_URL}",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/openai/codex.config.example.toml

@@ -11,7 +11,7 @@
 # --- Local stdio (OSS) ---
 [mcp_servers.shield-kya]
 command = "npx"
-args = ["--no-install", "@shield-agent/kya@0.1.19", "serve-mcp", "--stdio"]
+args = ["--no-install", "@shield-agent/kya@0.1.21", "serve-mcp", "--stdio"]
 startup_timeout_sec = 20
 env_vars = ["KYA_BASE_URL", "KYA_API_KEY", "KYA_HOST", "KYA_AGENT_ID"]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shield-agent/kya",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Know Your Agent light CLI + local MCP gate (provider-agnostic, zero vertical packs required).",
   "license": "MIT",
   "type": "module",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/The-Pixel-Boys/shield-kya",
     "source": "github"
   },
-  "version": "0.1.19",
+  "version": "0.1.21",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@shield-agent/kya",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "transport": {
         "type": "stdio"
       },