@writ-agent/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,182 @@
+# @writ-agent/sdk
+
+TypeScript / Node client for the [writ](https://github.com/writ-agent/writ/blob/main/README.md) hook gateway. Before an
+agent's tool call runs, writ checks it against `writ.yaml` (allow / deny / ask /
+redact) and records it to writ's hash-chained, tamper-evident ledger.
+
+This package talks to writ over its gateway protocol (`writ check --stdio`,
+[INTERFACES.md Contract 6](https://github.com/writ-agent/writ/blob/main/docs/INTERFACES.md)). It spawns one long-lived
+`writ check` child process per `WritClient`, so there is no daemon to run.
+
+- ESM and CommonJS builds, TypeScript types, Node >= 18, no runtime dependencies.
+- `guard()` / `guardTools()`: wrap any tool function or `{ description, parameters, execute }` tool object.
+- `@writ-agent/sdk/claude-agent-sdk`: `hooks` and `canUseTool` for the Claude Agent SDK.
+- **Fails closed.** A missing binary, gateway crash, timeout, malformed line or
+  `error` response rejects with a `WritError`, and the tool does not run.
+
+## Install
+
+> **You also need the `writ` binary.** Until prebuilt releases ship, install it
+> from source: `cargo install --git https://github.com/writ-agent/writ writ-cli`
+> (Rust stable), then check with `writ --version`.
+
+```sh
+npm install @writ-agent/sdk
+# optional, for the Claude Agent SDK integration
+npm install @anthropic-ai/claude-agent-sdk
+```
+
+You also need the `writ` binary. The client looks for it in this order:
+
+1. the `bin` option (a path; `.js`/`.mjs`/`.cjs` paths run under Node),
+2. the `WRIT_BIN` environment variable,
+3. `writ` on `PATH` (`writ.exe` / `writ.com` on Windows; `.cmd` shims are not accepted).
+
+Or pass `command` / `args` to spawn something else entirely (a wrapper, a test gateway).
+
+## Wrap a tool
+
+```ts
+import { WritBlockedError, WritClient, guard } from "@writ-agent/sdk";
+
+const writ = new WritClient({ policy: "writ.yaml", caller: { agent: "my-agent" } });
+
+const runQuery = guard(async (input: { query: string }) => db.query(input.query), {
+  client: writ,
+  tool: "postgres.query", // the name your writ.yaml rules match on
+});
+
+try {
+  const rows = await runQuery({ query: "select email from users" });
+  // With a redact rule, `rows` is writ's redacted output, not the raw result.
+} catch (err) {
+  if (err instanceof WritBlockedError) console.error(err.message); // names rule_id and writ.yaml:LINE
+  else throw err;
+} finally {
+  await writ.close(); // or: await using writ = new WritClient(...)
+}
+```
+
+`guard` runs **decide, then (for a deferred ask) your approver, then the tool,
+then complete**:
+
+| writ verdict | what `guard` does |
+| --- | --- |
+| allow | runs the tool, records it, returns the result |
+| deny | throws `WritBlockedError`; the tool never runs |
+| ask (`ask: "deny"`, default) | throws `WritBlockedError` |
+| ask (`ask: "defer"`) | calls `approver`; only an explicit `true` / `{ approved: true }` runs the tool. No approver, a throw, or no answer within the ask's `timeout_ms` is a rejection, and the rejection is sent to writ (`resolve`) |
+| redact | runs the tool, sends the output to writ, returns writ's redacted output (structured results are re-parsed from the redacted JSON) |
+
+If the gateway fails after the tool ran (the `complete` call), `guard` throws
+instead of returning the result, so an unrecorded or unredacted result never
+reaches the model.
+
+### Tool objects (Vercel AI SDK and similar)
+
+```ts
+import { guardTools } from "@writ-agent/sdk";
+
+const tools = guardTools(myTools, { client: writ, toolName: (key) => key });
+// each tool's execute is wrapped; the AI SDK's toolCallId becomes writ's call_id
+```
+
+## Claude Agent SDK
+
+```ts
+import { query } from "@anthropic-ai/claude-agent-sdk";
+import { WritClient } from "@writ-agent/sdk";
+import { createWritIntegration } from "@writ-agent/sdk/claude-agent-sdk";
+
+await using writ = new WritClient({ ask: "defer" });
+const { hooks, canUseTool } = createWritIntegration({
+  client: writ,
+  approver: async ({ call, decision }) => askAHuman(call, decision), // optional
+});
+
+for await (const msg of query({ prompt: "...", options: { hooks, canUseTool } })) {
+  // ...
+}
+```
+
+What the integration registers (checked against `@anthropic-ai/claude-agent-sdk` 0.3.280 types):
+
+- **`PreToolUse`** sends `decide` and returns
+  `hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision, permissionDecisionReason }`:
+  `allow` for allow / redact, `deny` for deny (the reason names the rule and
+  `writ.yaml:LINE`). Any writ failure also returns `deny`: the hook never throws.
+- **Deferred asks** (`ask: "defer"`): with `approver`, the hook asks it inline
+  and returns `allow` or `deny`. Without `approver` but with your own
+  `canUseTool`, the hook returns `permissionDecision: "ask"`; the SDK then calls
+  the returned `canUseTool`, which asks yours and sends the answer to writ.
+  An approval that edits the tool input is treated as a rejection, and
+  `updatedPermissions` are dropped so an SDK "always allow" rule cannot
+  bypass later writ asks. With neither, deferred asks are denied.
+- **`PostToolUse`** sends `complete` with the tool response. For redact it
+  returns `hookSpecificOutput: { hookEventName: "PostToolUse", updatedToolOutput }`
+  with writ's redacted output. If redaction cannot be applied the output is
+  replaced with a withheld notice.
+- **`PostToolUseFailure`** records the failed execution (`ok: false`).
+
+Use `mergeHooks(hooks, yourHooks)` to combine with your own hooks, and
+`onAllow: "passthrough"` if the SDK's own permission rules should still apply
+after writ allows a call.
+
+Tool names and inputs are mapped to writ's policy vocabulary, the same way as
+`writ check --format claude-code`:
+
+| Claude tool | writ `tool` | policy fields |
+| --- | --- | --- |
+| `Bash`, `PowerShell` | `bash` | `command` |
+| `Read`, `Glob`, `Grep`, `LS`, `NotebookRead` | `fs.read` | `path` (kept, or from `file_path`) |
+| `Write`, `Edit`, `MultiEdit`, `NotebookEdit` | `fs.write` | `path` (from `file_path` / `notebook_path`) |
+| `WebFetch` | `http` | `url` (so `url.host`) |
+| `WebSearch` | `web.search` | `query` |
+| `mcp__<server>__<tool>` | `<tool>` | `server` = `<server>` (`mcp_server.name` if sent) |
+| anything else | unchanged | |
+
+The original input fields are kept alongside the normalized ones. For
+subagent calls the SDK's `agent_id` becomes `caller.non_human_id`. Pass
+`mapTool` to change the mapping.
+
+## Client API
+
+```ts
+const writ = new WritClient({
+  policy, ledger,        // forwarded as --policy / --ledger
+  ask: "deny",           // or "defer"
+  timeoutMs: 30_000,     // per request; a timeout kills the gateway (fail closed)
+  caller, sessionId,     // defaults for calls that do not set them
+  respawn: true,         // start a fresh gateway after a crash (in-flight calls still fail)
+  bin, command, args, cwd, env, onStderr,
+});
+
+await writ.decide(call);                  // -> Decision
+await writ.resolve(ref, approved, who);   // -> final Decision
+await writ.complete(ref, { ok, exit, output }); // -> { recorded, output? }
+await writ.authorize(call, { approver }); // decide + approver + resolve
+await writ.close();
+```
+
+Only `shouldDispatch(decision)` (`dispatch === true` and not `deny`) means the
+tool may run. Responses that contradict themselves (for example `deny` with
+`dispatch: true`, or a dispatching decision without `ref`) are rejected as
+`WritProtocolError`.
+
+Never put credentials in tool `args`: args are recorded in the ledger and
+visible to policy.
+
+## Development
+
+```sh
+npm install
+npm run build      # dist/esm + dist/cjs
+npm run typecheck
+npm run lint
+npm test           # unit tests against a fake gateway (test/fixtures/fake-writ.mjs)
+WRIT_E2E=1 WRIT_BIN=/path/to/writ npm test   # also runs the e2e suite against the real binary
+```
+
+## License
+
+Apache-2.0

package/dist/cjs/claude-agent-sdk.d.ts

@@ -0,0 +1,90 @@
+/**
+ * writ integration for the Claude Agent SDK (`@anthropic-ai/claude-agent-sdk`).
+ *
+ * Plugs into `query({ options: { hooks, canUseTool } })`:
+ * - `PreToolUse` asks writ for a verdict and returns the SDK's
+ *   `permissionDecision` (`allow` / `deny` / `ask`).
+ * - `PostToolUse` / `PostToolUseFailure` record the execution (`complete`)
+ *   and, for a redact verdict, replace the tool output via `updatedToolOutput`.
+ * - `canUseTool` resolves writ asks that were routed to the SDK's own
+ *   permission flow.
+ *
+ * Only SDK *types* are imported; this module has no runtime dependency on the SDK.
+ */
+import type { CanUseTool, HookCallback, HookCallbackMatcher, HookEvent } from "@anthropic-ai/claude-agent-sdk";
+import { type Approver, type WritClient } from "./client.js";
+import type { CallerIdentity, ServerIdentity } from "./protocol.js";
+/** A Claude tool use normalized to writ's vocabulary. */
+export interface MappedToolCall {
+    tool: string;
+    args: Record<string, unknown>;
+    server?: ServerIdentity | null;
+}
+/** MCP server provenance as the SDK reports it (`mcp_server` / `mcpServer`). */
+export interface McpProvenance {
+    name: string;
+    source: string;
+}
+/**
+ * Map a Claude tool name + input to writ's policy vocabulary. Kept identical
+ * to `writ check --format claude-code` (crates/writ-cli/src/hook.rs):
+ * - `Bash` / `PowerShell` → `bash` (with `command`)
+ * - `Read` / `Glob` / `Grep` / `LS` / `NotebookRead` → `fs.read`; `Write` / `Edit` / `MultiEdit` / `NotebookEdit` → `fs.write` (with `path`)
+ * - `WebFetch` → `http` (with `url`); `WebSearch` → `web.search` (with `query`)
+ * - `mcp__<server>__<tool>` → tool `<tool>` with `server: { name: <server> }`
+ * - anything else keeps its SDK name.
+ * The original input fields are kept; normalized keys are added alongside.
+ */
+export declare function mapClaudeTool(toolName: string, input: unknown, mcpServer?: McpProvenance): MappedToolCall;
+export interface WritClaudeOptions {
+    client: WritClient;
+    /**
+     * Decides deferred asks inline, inside the PreToolUse hook (client must use
+     * `ask: "defer"`). Takes precedence over `canUseTool`.
+     */
+    approver?: Approver;
+    /**
+     * Your own SDK permission callback. With `ask: "defer"` and no `approver`,
+     * writ asks are handed to the SDK's permission flow (`permissionDecision:
+     * "ask"`) and this callback decides them; its answer is sent to writ as
+     * `resolve`. It is also consulted for SDK permission prompts that writ did
+     * not raise. Without it, those are denied.
+     */
+    canUseTool?: CanUseTool;
+    /** Default `{ agent: "claude-agent-sdk" }`. */
+    caller?: CallerIdentity;
+    /** Override the tool mapping (default `mapClaudeTool`). */
+    mapTool?: (toolName: string, input: unknown, mcpServer?: McpProvenance) => MappedToolCall;
+    /** Hook matcher (tool name regex); default: every tool. */
+    matcher?: string;
+    /** SDK hook timeout in seconds (covers inline approvals). */
+    hookTimeoutSec?: number;
+    approvalTimeoutMs?: number;
+    /**
+     * What an allow / redact verdict returns to the SDK: `"allow"` (default, as
+     * `writ check --format claude-code`) skips the SDK's own permission prompt;
+     * `"passthrough"` returns no decision, so the SDK's permission rules still
+     * apply on top of writ.
+     */
+    onAllow?: "allow" | "passthrough";
+}
+/** The pieces to spread into the SDK's `query({ options })`. */
+export interface WritClaudeIntegration {
+    hooks: Partial<Record<HookEvent, HookCallbackMatcher[]>>;
+    canUseTool: CanUseTool;
+    preToolUse: HookCallback;
+    postToolUse: HookCallback;
+    postToolUseFailure: HookCallback;
+}
+/**
+ * Build writ hooks and a `canUseTool` callback for the Claude Agent SDK.
+ * Every failure path denies the tool (fail closed): a hook never throws.
+ */
+export declare function createWritIntegration(options: WritClaudeOptions): WritClaudeIntegration;
+/** Just the `hooks` option. Deferred asks need `approver` (or use `createWritIntegration` for `canUseTool`). */
+export declare function writHooks(options: WritClaudeOptions): Partial<Record<HookEvent, HookCallbackMatcher[]>>;
+/**
+ * Merge writ's hooks with your own `hooks` option. writ's matchers come first
+ * for each event; yours are kept.
+ */
+export declare function mergeHooks(...sets: Array<Partial<Record<HookEvent, HookCallbackMatcher[]>> | undefined>): Partial<Record<HookEvent, HookCallbackMatcher[]>>;