@shield-agent/kya 0.21.0 → 0.23.0

package/dist/update-check.js

@@ -0,0 +1,134 @@
+/**
+ * Lightweight "new KYA version available" check.
+ *
+ * - Queries npm registry at most once per 24 h and caches the result in
+ *   ~/.kya/update-check.json.
+ * - Never fails a command: network/cache problems return undefined.
+ * - Honors KYA_UPDATE_CHECK=0 and --no-update-check.
+ * - Skips machine-readable/integrated subcommands so hosts aren't confused.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { globalConfigDir } from "./config.js";
+import { CLI_VERSION } from "./version.js";
+const NPM_REGISTRY_URL = "https://registry.npmjs.org/@shield-agent%2Fkya";
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 5000;
+/** Commands whose output is consumed by hosts, scripts, or pipes. */
+const SKIP_COMMANDS = new Set([
+    "serve-mcp",
+    "receipt-serve",
+    "hook",
+    "wrap",
+    "eval-tool",
+    "invoke",
+    "approve",
+    "reject",
+]);
+export function shouldSkipUpdateCheck(command, flags, env) {
+    if (!command)
+        return true;
+    if (SKIP_COMMANDS.has(command))
+        return true;
+    if (flags["no-update-check"] === true || flags["no-update-check"] === "true")
+        return true;
+    if (env.KYA_UPDATE_CHECK === "0" || env.KYA_UPDATE_CHECK === "false")
+        return true;
+    if (env.CI === "true" || env.GITHUB_ACTIONS === "true")
+        return true;
+    if (flags["json"] === true || flags["json"] === "true")
+        return true;
+    return false;
+}
+export function compareVersions(a, b) {
+    const parse = (v) => v.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10));
+    const av = parse(a);
+    const bv = parse(b);
+    for (let i = 0; i < 3; i++) {
+        const an = Number.isFinite(av[i]) ? av[i] : 0;
+        const bn = Number.isFinite(bv[i]) ? bv[i] : 0;
+        if (an !== bn)
+            return an - bn;
+    }
+    return 0;
+}
+function cachePath(env) {
+    return `${globalConfigDir(env)}/update-check.json`;
+}
+function readCache(env) {
+    try {
+        const raw = readFileSync(cachePath(env), "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed.latest === "string" && typeof parsed.checkedAt === "string") {
+            return parsed;
+        }
+    }
+    catch {
+        /* ignore corrupt/missing cache */
+    }
+    return undefined;
+}
+function writeCache(latest, env) {
+    try {
+        const dir = globalConfigDir(env);
+        mkdirSync(dir, { recursive: true });
+        const cache = { latest, checkedAt: new Date().toISOString() };
+        writeFileSync(cachePath(env), `${JSON.stringify(cache, null, 2)}\n`, "utf8");
+    }
+    catch {
+        /* ignore write failures */
+    }
+}
+function cacheFresh(cache) {
+    try {
+        const checked = new Date(cache.checkedAt).getTime();
+        return Number.isFinite(checked) && Date.now() - checked < CACHE_TTL_MS;
+    }
+    catch {
+        return false;
+    }
+}
+async function fetchLatestVersion(env, fetchImpl = fetch) {
+    if (env.KYA_OFFLINE === "1" || env.KYA_OFFLINE === "true")
+        return undefined;
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        const res = await fetchImpl(NPM_REGISTRY_URL, {
+            signal: controller.signal,
+            headers: { Accept: "application/json" },
+        });
+        clearTimeout(timeout);
+        if (!res.ok)
+            return undefined;
+        const data = (await res.json());
+        const latest = data?.["dist-tags"]?.latest;
+        return typeof latest === "string" && latest ? latest : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Returns { current, latest } when a newer version is available on npm,
+ * undefined when already up-to-date, offline, or the check failed.
+ */
+export async function checkForUpdate(deps = {}) {
+    const env = deps.env ?? process.env;
+    const cache = readCache(env);
+    let latest = cache && cacheFresh(cache) ? cache.latest : undefined;
+    if (!latest) {
+        latest = await fetchLatestVersion(env, deps.fetch);
+        if (latest)
+            writeCache(latest, env);
+    }
+    if (!latest)
+        return undefined;
+    const current = CLI_VERSION;
+    if (compareVersions(latest, current) <= 0)
+        return undefined;
+    return { current, latest };
+}
+export function formatUpdateBanner(result) {
+    return `A new version of KYA is available: ${result.latest} (you have ${result.current}).\nRun: kya update\nOr:  npm i -g @shield-agent/kya@latest`;
+}
+//# sourceMappingURL=update-check.js.map

package/dist/update-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../src/update-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;AAC1E,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAY9B,qEAAqE;AACrE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,WAAW;IACX,eAAe;IACf,MAAM;IACN,MAAM;IACN,WAAW;IACX,QAAQ;IACR,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,OAA2B,EAC3B,KAAiD,EACjD,GAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,GAAG,CAAC,gBAAgB,KAAK,GAAG,IAAI,GAAG,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/F,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB;IACvC,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,oBAAoB,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACxF,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,GAAsB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,GAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAChF,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAuB;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,YAAY,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,GAAsB,EACtB,YAA0B,KAAK;IAE/B,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;YAC5C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0C,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAwB,EAAE;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM;YAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,WAAW,CAAC;IAC5B,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC1D,OAAO,sCAAsC,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,OAAO,6DAA6D,CAAC;AACtJ,CAAC"}

package/droid/README.md

@@ -1,6 +1,6 @@
 # Droid (Factory) + Shield KYA
 
-Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.21.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
+Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.23.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
 
 `mcp.example.json` shows the expected on-disk shape (`~/.factory/mcp.json`) — **schema not yet verified against a live Droid install**; treat as a starting point and prefer `droid mcp add`.
 

package/droid/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/gemini/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/grok/README.md

@@ -40,7 +40,7 @@ chat = client.chat.create(
 There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
 
 ```bash
-npx --no-install @shield-agent/kya@0.21.0 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.23.0 serve-mcp --stdio
 ```
 
 Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.

package/kilo/kilo.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/kimi/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/kiro/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "shield-kya",
   "display_name": "Shield KYA",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
   "long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
   "author": {

package/mastracode/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/mcp.json

@@ -3,7 +3,7 @@
     "shield-kya": {
       "description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "${KYA_BASE_URL}",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/openai/codex.config.example.toml

@@ -11,7 +11,7 @@
 # --- Local stdio (OSS) ---
 [mcp_servers.shield-kya]
 command = "npx"
-args = ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"]
+args = ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"]
 startup_timeout_sec = 20
 env_vars = ["KYA_BASE_URL", "KYA_API_KEY", "KYA_HOST", "KYA_AGENT_ID"]
 

package/opencode/opencode.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shield-agent/kya",
-  "version": "0.21.0",
-  "description": "AI agents audit trail & traceability — gate every tool call (Allow / Review / Deny), live activity dashboard, and continuous trust-baseline certification.",
+  "version": "0.23.0",
+  "description": "AI agents audit trail & traceability - gate every tool call (Allow / Review / Deny), live activity dashboard, and continuous trust-baseline certification.",
   "license": "MIT",
   "type": "module",
   "mcpName": "io.github.The-Pixel-Boys/shield-kya",
@@ -104,6 +104,7 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "pack:check": "pnpm run build && pnpm pack --pack-destination /tmp && node dist/cli.js --help",
-    "sync:version": "node scripts/sync-version.mjs"
+    "sync:version": "node scripts/sync-version.mjs",
+    "check:version": "node scripts/check-version-pins.mjs"
   }
 }

package/qwen/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.21.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.23.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/The-Pixel-Boys/shield-kya",
     "source": "github"
   },
-  "version": "0.21.0",
+  "version": "0.23.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@shield-agent/kya",
-      "version": "0.21.0",
+      "version": "0.23.0",
       "transport": {
         "type": "stdio"
       },