guardrails-ref 1.0.0 → 1.0.2

package/README.md

@@ -0,0 +1,45 @@
+# guardrails-ref
+
+CLI for [Agent Guardrails](https://github.com/9atar6/agent-guardrails) — validate, init, setup, and add GUARDRAIL.md files.
+
+## Install
+
+```bash
+npx guardrails-ref init
+```
+
+No global install needed. Or: `npm install -g guardrails-ref`
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `npx guardrails-ref init [path]` | Create `.agents/guardrails/`, add no-plaintext-secrets, configure Cursor and Claude Code |
+| `npx guardrails-ref add <name> [path]` | Add an example guardrail (e.g. no-destructive-commands, database-migrations) |
+| `npx guardrails-ref remove <name> [path]` | Remove a guardrail from .agents/guardrails/ |
+| `npx guardrails-ref setup [path]` | Add the guardrail rule to Cursor rules and Claude instructions |
+| `npx guardrails-ref validate [path]` | Validate GUARDRAIL.md files |
+| `npx guardrails-ref list [path]` | List discovered guardrails (use `--json` for JSON output) |
+
+## Examples
+
+```bash
+npx guardrails-ref init
+npx guardrails-ref add no-destructive-commands
+npx guardrails-ref add no-new-deps-without-approval
+npx guardrails-ref validate .
+npx guardrails-ref list .
+```
+
+## Available guardrails (add command)
+
+- `no-plaintext-secrets` — Never log or commit credentials
+- `database-migrations` — Always use migration files
+- `no-destructive-commands` — No rm -rf, DROP, TRUNCATE without approval
+- `no-new-deps-without-approval` — No new packages without approval
+- `rate-limiting` — Limit tool calls and API loops
+- `no-console-in-production` — No console.log in production code
+
+## License
+
+MIT — [GitHub](https://github.com/9atar6/agent-guardrails)

package/dist/cli.js

@@ -5,6 +5,7 @@ import { validatePath, listGuardrails } from "./validate.js";
 import { runSetup } from "./setup.js";
 import { runInit } from "./init.js";
 import { runAdd } from "./add.js";
+import { runRemove } from "./remove.js";
 program
     .name("guardrails-ref")
     .description("Validate and list Agent Guardrails (GUARDRAIL.md) files")
@@ -56,6 +57,13 @@ program
     const ok = runAdd(name, path);
     process.exit(ok ? 0 : 1);
 });
+program
+    .command("remove <name> [path]")
+    .description("Remove a guardrail from .agents/guardrails/")
+    .action((name, path = ".") => {
+    const ok = runRemove(name, path);
+    process.exit(ok ? 0 : 1);
+});
 program
     .command("setup [path]")
     .description("Add the guardrail one-liner to Cursor rules and Claude instructions (required until IDEs support guardrails natively)")
@@ -66,8 +74,13 @@ program
 program
     .command("list [path]")
     .description("List discovered guardrails")
-    .action((path = ".") => {
+    .option("-j, --json", "Output as JSON")
+    .action((path = ".", options) => {
     const guardrails = listGuardrails(path);
+    if (options.json) {
+        console.log(JSON.stringify({ guardrails, total: guardrails.length }, null, 2));
+        return;
+    }
     if (guardrails.length === 0) {
         console.log(chalk.yellow("No guardrails found"));
         return;

package/dist/remove.d.ts

@@ -0,0 +1 @@
+export declare function runRemove(name: string, projectPath?: string): boolean;

package/dist/remove.js

@@ -0,0 +1,34 @@
+import { existsSync, readdirSync, rmSync, rmdirSync } from "fs";
+import { resolve } from "path";
+import chalk from "chalk";
+import { listGuardrails } from "./validate.js";
+export function runRemove(name, projectPath = ".") {
+    const normalized = name.toLowerCase().replace(/\s+/g, "-");
+    const root = resolve(projectPath);
+    const guardrailsDir = resolve(root, ".agents", "guardrails");
+    const targetDir = resolve(guardrailsDir, normalized);
+    const targetFile = resolve(targetDir, "GUARDRAIL.md");
+    if (!existsSync(targetFile)) {
+        const guardrails = listGuardrails(projectPath);
+        const names = guardrails.map((g) => g.name);
+        console.log(chalk.red("Guardrail not found:") + " .agents/guardrails/" + normalized);
+        if (names.length > 0) {
+            console.log(chalk.gray("Installed: " + names.join(", ")));
+        }
+        return false;
+    }
+    rmSync(targetDir, { recursive: true });
+    console.log(chalk.green("✓") + " Removed .agents/guardrails/" + normalized);
+    // Remove parent dir if empty
+    try {
+        const remaining = readdirSync(guardrailsDir);
+        if (remaining.length === 0) {
+            rmdirSync(guardrailsDir);
+            console.log(chalk.green("✓") + " Removed empty .agents/guardrails/");
+        }
+    }
+    catch {
+        // Ignore
+    }
+    return true;
+}

package/dist/templates.js

@@ -142,6 +142,34 @@ Debugging API integrations, making repeated external API calls, or when context
 
 ## Reason
 Agent debugging Stripe entered an infinite loop of test calls, resulting in 2000+ requests in 30 minutes, $200 API costs, and account suspension.
+`,
+    "no-console-in-production": `---
+name: no-console-in-production
+description: Never add console.log, console.debug, or console.info in production code. Use a proper logging library. Apply when adding debugging, logging, or trace statements.
+scope: project
+severity: warning
+triggers:
+  - "Adding logging"
+  - "Debugging"
+  - "console.log"
+  - "console.debug"
+  - "Trace statements"
+---
+
+# No Console in Production
+
+## Trigger
+Adding logging, debugging statements, or trace output to application code that ships to production.
+
+## Instruction
+- Never add \`console.log\`, \`console.debug\`, or \`console.info\` in production code paths
+- Use a structured logging library (e.g. pino, winston, log4j) with log levels
+- For temporary debugging: use \`console.warn\` or \`console.error\` and add a TODO to remove before merge
+- Strip or gate console calls in production builds when a logger is not available
+- Prefer environment-based log levels (e.g. DEBUG=true) over hardcoded console statements
+
+## Reason
+console.log in production leaks sensitive data, clutters logs, and impacts performance. Structured loggers support levels, formatting, and safe redaction.
 `,
 };
 export const TEMPLATE_NAMES = Object.keys(TEMPLATES);

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "guardrails-ref",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Validate and manage Agent Guardrails (GUARDRAIL.md) — init, setup, add, validate",
   "type": "module",
   "main": "dist/validate.js",
   "bin": {
-    "guardrails-ref": "./dist/cli.js"
+    "guardrails-ref": "dist/cli.js"
   },
   "scripts": {
     "build": "tsc",
@@ -23,7 +23,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/9atar6/agent-guardrails.git",
+    "url": "git+https://github.com/9atar6/agent-guardrails.git",
     "directory": "guardrails-ref"
   },
   "bugs": "https://github.com/9atar6/agent-guardrails/issues",