agentcheck-sdk 0.9.0 → 1.0.1

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export { TelemetryPlugin } from "./telemetry";
 export { ScopeEngine, buildScope } from "./scope-engine";
 export { SafetyStack, BudgetTracker, PatternMonitor, HumanEscalation } from "./safety";
 export { SemanticVerifier, ClaudeProvider, OpenAIProvider } from "./semantic";
+export { VerificationPipeline } from "./pipeline";
 export type { LLMProvider, SemanticResult } from "./semantic";
 export type { WebhookEvent } from "./webhook";
 export type { ScopeVerifier, DelegationProviderConfig } from "./provider";

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RateLimitError = exports.ValidationError = exports.NotFoundError = exports.AuthenticationError = exports.AgentCheckError = exports.OpenAIProvider = exports.ClaudeProvider = exports.SemanticVerifier = exports.HumanEscalation = exports.PatternMonitor = exports.BudgetTracker = exports.SafetyStack = exports.buildScope = exports.ScopeEngine = exports.TelemetryPlugin = exports.templates = exports.quickStart = exports.DelegationDashboard = exports.AgentToolChecker = exports.delegationGuard = exports.DelegationProvider = exports.WebhookHandler = exports.AgentCheckClient = void 0;
+exports.RateLimitError = exports.ValidationError = exports.NotFoundError = exports.AuthenticationError = exports.AgentCheckError = exports.VerificationPipeline = exports.OpenAIProvider = exports.ClaudeProvider = exports.SemanticVerifier = exports.HumanEscalation = exports.PatternMonitor = exports.BudgetTracker = exports.SafetyStack = exports.buildScope = exports.ScopeEngine = exports.TelemetryPlugin = exports.templates = exports.quickStart = exports.DelegationDashboard = exports.AgentToolChecker = exports.delegationGuard = exports.DelegationProvider = exports.WebhookHandler = exports.AgentCheckClient = void 0;
 // Individual commands (basic menu)
 var client_1 = require("./client");
 Object.defineProperty(exports, "AgentCheckClient", { enumerable: true, get: function () { return client_1.AgentCheckClient; } });
@@ -33,6 +33,8 @@ var semantic_1 = require("./semantic");
 Object.defineProperty(exports, "SemanticVerifier", { enumerable: true, get: function () { return semantic_1.SemanticVerifier; } });
 Object.defineProperty(exports, "ClaudeProvider", { enumerable: true, get: function () { return semantic_1.ClaudeProvider; } });
 Object.defineProperty(exports, "OpenAIProvider", { enumerable: true, get: function () { return semantic_1.OpenAIProvider; } });
+var pipeline_1 = require("./pipeline");
+Object.defineProperty(exports, "VerificationPipeline", { enumerable: true, get: function () { return pipeline_1.VerificationPipeline; } });
 var errors_1 = require("./errors");
 Object.defineProperty(exports, "AgentCheckError", { enumerable: true, get: function () { return errors_1.AgentCheckError; } });
 Object.defineProperty(exports, "AuthenticationError", { enumerable: true, get: function () { return errors_1.AuthenticationError; } });

package/dist/pipeline.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Verification Pipeline - Complete delegation verification flow.
+ *
+ * Connects all modules into a single chain:
+ * delegation check -> scope -> semantic(LLM) -> budget -> pattern -> human -> execute -> log
+ */
+import { AgentCheckClient } from "./client";
+import { BudgetTracker, HumanEscalation, PatternMonitor } from "./safety";
+import { LLMProvider } from "./semantic";
+export interface CheckResult {
+    layer: string;
+    passed: boolean;
+    reason: string;
+    durationMs: number;
+}
+export interface PipelineResult {
+    allowed: boolean;
+    executed: boolean;
+    action: string;
+    agent: string;
+    checks: CheckResult[];
+    executionResult?: unknown;
+    error?: string;
+}
+export interface PipelineConfig {
+    llm?: LLMProvider;
+    budget?: BudgetTracker;
+    pattern?: PatternMonitor;
+    escalation?: HumanEscalation;
+    semanticThreshold?: number;
+}
+export declare class VerificationPipeline {
+    private client;
+    private scopeEngine;
+    private semantic?;
+    private budget?;
+    private pattern;
+    private escalation?;
+    constructor(client: AgentCheckClient, config?: PipelineConfig);
+    verify(agent: string, action: string, opts?: {
+        amount?: number;
+        context?: Record<string, unknown>;
+    }): Promise<PipelineResult>;
+    verifyAndExecute<T>(agent: string, action: string, executeFn: () => Promise<T>, opts?: {
+        amount?: number;
+        context?: Record<string, unknown>;
+    }): Promise<PipelineResult>;
+    private logExecution;
+}

package/dist/pipeline.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * Verification Pipeline - Complete delegation verification flow.
+ *
+ * Connects all modules into a single chain:
+ * delegation check -> scope -> semantic(LLM) -> budget -> pattern -> human -> execute -> log
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerificationPipeline = void 0;
+const safety_1 = require("./safety");
+const scope_engine_1 = require("./scope-engine");
+const semantic_1 = require("./semantic");
+class VerificationPipeline {
+    constructor(client, config = {}) {
+        this.client = client;
+        this.scopeEngine = new scope_engine_1.ScopeEngine();
+        this.semantic = config.llm ? new semantic_1.SemanticVerifier(config.llm) : undefined;
+        this.budget = config.budget;
+        this.pattern = config.pattern || new safety_1.PatternMonitor();
+        this.escalation = config.escalation;
+    }
+    async verify(agent, action, opts = {}) {
+        const checks = [];
+        const amount = opts.amount || 0;
+        // Layer 1: Delegation exists
+        let agreement;
+        let t = Date.now();
+        try {
+            const list = await this.client.list({ agent, status: "approved" });
+            if (!list.records.length) {
+                checks.push({ layer: "delegation_check", passed: false, reason: "No active delegation found", durationMs: Date.now() - t });
+                return { allowed: false, executed: false, action, agent, checks, error: "No active delegation" };
+            }
+            agreement = list.records[0];
+            checks.push({ layer: "delegation_check", passed: true, reason: `Active delegation: ${agreement.id}`, durationMs: Date.now() - t });
+        }
+        catch (e) {
+            checks.push({ layer: "delegation_check", passed: false, reason: `Server error: ${e.message}`, durationMs: Date.now() - t });
+            return { allowed: false, executed: false, action, agent, checks, error: e.message };
+        }
+        // Layer 2: Scope rules
+        t = Date.now();
+        const scope = this.scopeEngine.parse(agreement.scope);
+        const scopeResult = this.scopeEngine.verify(scope, action, { amount });
+        checks.push({ layer: "scope_engine", passed: scopeResult.allowed, reason: scopeResult.reason, durationMs: Date.now() - t });
+        if (!scopeResult.allowed) {
+            return { allowed: false, executed: false, action, agent, checks, error: scopeResult.reason };
+        }
+        // Layer 3: Semantic (LLM) - only for free-text scope
+        if (this.semantic && typeof scope === "string") {
+            t = Date.now();
+            const sem = await this.semantic.verify(agreement.scope, action, opts.context || { amount });
+            const isOk = sem.assessment !== "denied";
+            checks.push({
+                layer: "semantic_verifier",
+                passed: isOk,
+                reason: `[${sem.assessment}] ${sem.reasoning} (confidence: ${(sem.confidence * 100).toFixed(0)}%)`,
+                durationMs: Date.now() - t,
+            });
+            if (sem.assessment === "denied") {
+                return { allowed: false, executed: false, action, agent, checks, error: sem.reasoning };
+            }
+            if (sem.assessment === "suspicious") {
+                checks.push({ layer: "semantic_flag", passed: true, reason: "LLM flagged suspicious - recommend human review", durationMs: 0 });
+            }
+        }
+        // Layer 4: Budget
+        if (this.budget) {
+            t = Date.now();
+            const br = this.budget.check(action, amount);
+            checks.push({ layer: "budget_tracker", passed: br.allowed, reason: br.reason, durationMs: Date.now() - t });
+            if (!br.allowed) {
+                return { allowed: false, executed: false, action, agent, checks, error: br.reason };
+            }
+        }
+        // Layer 5: Pattern
+        t = Date.now();
+        const alerts = this.pattern.check(action, amount);
+        const hasCritical = alerts.some(a => a.level === "critical");
+        const patternMsg = alerts.length ? alerts.map(a => a.message).join("; ") : "Normal pattern";
+        checks.push({ layer: "pattern_monitor", passed: !hasCritical, reason: patternMsg, durationMs: Date.now() - t });
+        if (hasCritical) {
+            return { allowed: false, executed: false, action, agent, checks, error: alerts[0].message };
+        }
+        // Layer 6: Human escalation
+        if (this.escalation) {
+            t = Date.now();
+            const er = this.escalation.check(action, amount);
+            checks.push({ layer: "human_escalation", passed: er.allowed, reason: er.reason, durationMs: Date.now() - t });
+            if (!er.allowed) {
+                return { allowed: false, executed: false, action, agent, checks, error: er.reason };
+            }
+        }
+        return { allowed: true, executed: false, action, agent, checks };
+    }
+    async verifyAndExecute(agent, action, executeFn, opts = {}) {
+        const result = await this.verify(agent, action, opts);
+        if (!result.allowed) {
+            this.logExecution(agent, action, opts.amount || 0, "blocked", result.error);
+            return result;
+        }
+        try {
+            result.executionResult = await executeFn();
+            result.executed = true;
+            result.checks.push({ layer: "execution", passed: true, reason: "Executed successfully", durationMs: 0 });
+        }
+        catch (e) {
+            result.executed = false;
+            result.error = e.message;
+            result.checks.push({ layer: "execution", passed: false, reason: `Failed: ${e.message}`, durationMs: 0 });
+        }
+        this.budget?.recordUsage(action, opts.amount || 0);
+        this.pattern.record(action, opts.amount || 0);
+        this.logExecution(agent, action, opts.amount || 0, result.executed ? "success" : "failed", result.error);
+        return result;
+    }
+    async logExecution(agent, action, amount, outcome, error) {
+        try {
+            await this.client.request("POST", "/api/v1/executions", {
+                agent, action, result: outcome, metadata: { amount, error },
+            });
+        }
+        catch { }
+    }
+}
+exports.VerificationPipeline = VerificationPipeline;

package/dist/safety.js

@@ -26,13 +26,13 @@ class BudgetTracker {
         if (this.dailyCountLimit && (this.dailyCounts[dayKey] || 0) >= this.dailyCountLimit) {
             return { allowed: false, reason: `Daily action count limit reached (${this.dailyCountLimit})` };
         }
-        if (this.dailyLimit && amount > 0) {
+        if (this.dailyLimit !== undefined && amount > 0) {
             const projected = (this.dailyTotals[dayKey] || 0) + amount;
             if (projected > this.dailyLimit) {
                 return { allowed: false, reason: `Daily budget exceeded: ${projected} > ${this.dailyLimit}` };
             }
         }
-        if (this.monthlyLimit && amount > 0) {
+        if (this.monthlyLimit !== undefined && amount > 0) {
             const projected = (this.monthlyTotals[monthKey] || 0) + amount;
             if (projected > this.monthlyLimit) {
                 return { allowed: false, reason: `Monthly budget exceeded: ${projected} > ${this.monthlyLimit}` };
@@ -41,6 +41,8 @@ class BudgetTracker {
         return { allowed: true, reason: "Within budget" };
     }
     recordUsage(action, amount = 0) {
+        if (amount < 0)
+            return; // Prevent budget gaming via negative amounts
         const dayKey = new Date().toISOString().slice(0, 10);
         const monthKey = dayKey.slice(0, 7);
         this.dailyTotals[dayKey] = (this.dailyTotals[dayKey] || 0) + amount;

package/dist/scope-engine.js

@@ -34,8 +34,8 @@ class ScopeEngine {
         if (scope.denied?.includes(action)) {
             return { allowed: false, reason: `Action '${action}' is in denied list` };
         }
-        // Allowed list
-        if (scope.allowed?.length && !scope.allowed.includes(action)) {
+        // Allowed list (empty array = nothing allowed, undefined = no whitelist)
+        if (scope.allowed !== undefined && !scope.allowed.includes(action)) {
             return { allowed: false, reason: `Action '${action}' not in allowed list: ${scope.allowed.join(", ")}` };
         }
         // Amount limits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentcheck-sdk",
-  "version": "0.9.0",
+  "version": "1.0.1",
   "description": "Record what your AI agent is allowed to do",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",