agent-control-plane-core 0.11.0 → 0.11.2

package/README.md

@@ -127,7 +127,10 @@ Read `NATIVE_ASK_TIER` instead of keeping a list of which agents to escalate an
 where the flag is `false`, and leaves it alone where the host does the asking.
 `renderEscalated(adapter, verdict, event, { soleGate })` applies that rule: it
 re-renders as a `deny` any non-allow verdict that would render unenforced on a
-vetoable call, except an `ask` on a host whose flag is `true`.
+vetoable call, except an `ask` on a host whose flag is `true`. A non-allow
+verdict on a payload that names no event at all blocks through the host's exit
+code and stderr, since `render` has no channel for it, unless the event parsed
+observe-only (a Codex below its enforcing version), which cannot veto.
 It describes the HOST, not the verdict — `ask` renders as `enforced: false`
 everywhere — and it names the pre-tool gate, since a tool that already ran has
 nothing left to suspend. Conformance probes your real `render` against it, so a
@@ -170,8 +173,9 @@ emit(claudeAdapter.render(verdict, event));
 `agent-control-plane-core/runtime` publishes the rest of the plumbing the four
 hook entries share. `runHookEntry(adapter, judge)` is a whole entry: each
 `bin/<host>-hook.mjs` is that one call. `renderHookResponse` runs parse → judge
-→ render, and returns the failure response THAT host expects when the payload
-does not parse. `emit`
+→ `renderEscalated`, so a judge's `ask` on a host with no ask tier blocks a
+vetoable call instead of running it. It returns the failure response THAT host
+expects when the payload does not parse. `emit`
 drains the whole body before it exits, so a large deny body is never truncated
 on a non-blocking pipe. The entries ship as `acp-claude-hook`, `acp-codex-hook`,
 `acp-amp-hook` and `acp-gemini-hook`. Codex's hook stdin carries no version, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-control-plane-core",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Vendor-neutral control-plane contract for coding agents: a normalized ToolCallEvent/Verdict schema with per-agent adapters (Claude Code, Codex, Amp, Gemini CLI) and a conformance suite.",
   "type": "module",
   "repository": {

package/src/control-plane.mjs

@@ -967,6 +967,13 @@ export function gatedResponse(
  * ({@link Adapter} `NATIVE_ASK_TIER`). Nothing changes for an allow, for a call
  * this guardrail cannot veto (a deny there blocks nothing either), or for a
  * render the host already enforces. The deny keeps the verdict's other fields.
+ *
+ * A payload that names no event at all (`meta.native_event` empty) is the one
+ * exception: `render` has no channel for it, so a non-allow verdict there takes
+ * the host's {@link BLOCK_TRANSPORT} block, which stops whatever call the hook
+ * was run for. An observe-only parse renders that block unenforced (exit 0),
+ * since its host cannot veto. An event the payload names but no adapter models keeps the rule
+ * above: on Claude Code's Stop, a block would keep the agent running.
  * @param {Adapter} adapter
  * @param {Verdict} verdict
  * @param {ToolCallEvent} event
@@ -974,7 +981,18 @@ export function gatedResponse(
  * @returns {NativeResponse}
  */
 export function renderEscalated(adapter, verdict, event, options = {}) {
-  const { decision } = normalizeVerdict(verdict);
+  const { decision, reason } = normalizeVerdict(verdict);
+  // This block is what stops a guardrail's deny on an unreadable payload from
+  // rendering as an empty exit 0, which every host runs.
+  if (event.meta.native_event === "" && decision !== Decision.ALLOW)
+    return gatedResponse(adapter.AGENT, {
+      transport: event.meta.integration_mode,
+      // An observe-only parse (a Codex below its enforcing version) has no
+      // veto, so claiming the block was enforced would report a false block.
+      enforced: event.meta.integration_mode !== IntegrationMode.OBSERVE_ONLY,
+      unblocked_exit_code: 0,
+      reason,
+    });
   const response = adapter.render(verdict, event, options);
   if (
     response.enforced ||

package/src/runtime.mjs

@@ -13,7 +13,12 @@
  * `process.exit` (see {@link writeAllSync}).
  */
 import { writeSync } from "node:fs";
-import { Decision, gatedResponse, sanitizeVerdict } from "./control-plane.mjs";
+import {
+  Decision,
+  gatedResponse,
+  renderEscalated,
+  sanitizeVerdict,
+} from "./control-plane.mjs";
 
 /**
  * Read all of stdin to a string.
@@ -63,7 +68,9 @@ export function demoJudge(event) {
  * A judge that THROWS is not a malformed payload: the call parsed, and the judge
  * failed to answer. That takes the same path as a judge that answers garbage —
  * the clamp's `ask` (see below) — so a crashing guardrail puts the call in front
- * of a human instead of taking an exit-0 fail-safe that runs it.
+ * of a human instead of taking an exit-0 fail-safe that runs it. The verdict
+ * renders through `renderEscalated`, so on a host with no ask tier that ask
+ * blocks a vetoable call rather than running it.
  *
  * Every error is written to STDERR (never stdout, which belongs to the host
  * transport) so a regression that silently disables enforcement leaves a
@@ -107,8 +114,9 @@ export function renderHookResponse(
       report("hook judge error", err);
     }
     // A host-supplied `onFailure` that BLOCKS (see {@link failurePosture}) wins
-    // over the clamp's ask: Codex and Gemini cannot enforce an ask, so the
-    // clamp would run a call no judge approved.
+    // over the clamp's ask. `renderEscalated` keeps an ask on a host that
+    // honours one (Claude, Amp), so without this a fail-closed entry would ask
+    // about a call no judge approved instead of blocking it.
     if (onFailure.enforced && !isDecision(answer)) return onFailure;
     // A judge's answer is clamped, not trusted. `normalizeVerdict` (inside
     // every adapter's render) THROWS on a decision outside allow/deny/ask, and
@@ -118,7 +126,7 @@ export function renderHookResponse(
     // in front of a human. Prose is passed through: scrubbing monitor-authored
     // text needs a scrubber this transport module has no business choosing.
     const verdict = sanitizeVerdict(answer, (text) => text);
-    return adapter.render(verdict, event);
+    return renderEscalated(adapter, verdict, event);
   } catch (err) {
     report("hook pipeline error", err);
     return onFailure;

package/types/control-plane.d.mts

@@ -296,6 +296,13 @@ export function gatedResponse(agent: string, { transport, enforced, unblocked_ex
  * ({@link Adapter} `NATIVE_ASK_TIER`). Nothing changes for an allow, for a call
  * this guardrail cannot veto (a deny there blocks nothing either), or for a
  * render the host already enforces. The deny keeps the verdict's other fields.
+ *
+ * A payload that names no event at all (`meta.native_event` empty) is the one
+ * exception: `render` has no channel for it, so a non-allow verdict there takes
+ * the host's {@link BLOCK_TRANSPORT} block, which stops whatever call the hook
+ * was run for. An observe-only parse renders that block unenforced (exit 0),
+ * since its host cannot veto. An event the payload names but no adapter models keeps the rule
+ * above: on Claude Code's Stop, a block would keep the agent running.
  * @param {Adapter} adapter
  * @param {Verdict} verdict
  * @param {ToolCallEvent} event

package/types/runtime.d.mts

@@ -22,7 +22,9 @@ export function demoJudge(event: import("./control-plane.mjs").ToolCallEvent): i
  * A judge that THROWS is not a malformed payload: the call parsed, and the judge
  * failed to answer. That takes the same path as a judge that answers garbage —
  * the clamp's `ask` (see below) — so a crashing guardrail puts the call in front
- * of a human instead of taking an exit-0 fail-safe that runs it.
+ * of a human instead of taking an exit-0 fail-safe that runs it. The verdict
+ * renders through `renderEscalated`, so on a host with no ask tier that ask
+ * blocks a vetoable call rather than running it.
  *
  * Every error is written to STDERR (never stdout, which belongs to the host
  * transport) so a regression that silently disables enforcement leaves a