yenop 0.0.0 → 0.1.0

package/dist/adapters/mcp/gateway.d.ts

@@ -0,0 +1,64 @@
+import type { Yenop } from "../../core/index.js";
+type JsonId = number | string;
+export type OnAsk = "elicit" | "block" | "allow";
+/** What one message makes the gateway send, and where. */
+export type Effect = {
+    to: "server" | "client";
+    line: string;
+};
+interface Held {
+    line: string;
+    id: JsonId;
+    callId: string;
+    tool: string;
+}
+interface Pending {
+    fingerprint: string;
+    callId: string;
+    tool: string;
+    exp: number;
+}
+export interface GatewayState {
+    /** The client said it can show elicitation forms, in the 2025 handshake. */
+    legacyElicitation: boolean;
+    seq: number;
+    /** 2025 flow: our elicitation id -> the call waiting on the answer. */
+    held: Map<string, Held>;
+    /** 2026 flow: requestState nonce -> the call it belongs to. */
+    pending: Map<string, Pending>;
+    /** Asks that were forwarded: the server's response id -> the ask, so the outcome gets recorded. */
+    awaiting: Map<string, {
+        callId: string;
+        tool: string;
+    }>;
+}
+export declare function newGatewayState(): GatewayState;
+export interface GatewayContext {
+    yenop: Yenop;
+    /** One run per gateway process: one client session with one server. */
+    runId: string;
+    /** The server alias, used to build the tool reference and to name the tool for receipts. */
+    server: string;
+    user: string;
+    client: string;
+    onAsk: OnAsk;
+    state: GatewayState;
+}
+export { mcpToolRef } from "../../core/tools.js";
+/** Decide what one client message causes. Only tools/call is gated; parse failures and other methods pass through. */
+export declare function gateClientMessage(ctx: GatewayContext, line: string): Effect[];
+/** A server message always reaches the client. If it answers a forwarded ask, the outcome is recorded on the way. */
+export declare function gateServerMessage(ctx: GatewayContext, line: string): Effect[];
+/** A newline-delimited-JSON splitter that holds a partial trailing line between chunks. */
+export declare function makeLineSplitter(onLine: (line: string) => void): (chunk: Buffer | string) => void;
+/**
+ * Wire a running gateway: client stdin -> (gate) -> server stdin, and server stdout -> (outcomes) -> client stdout.
+ * Streams are injectable so tests drive it without a subprocess.
+ */
+export interface GatewayStreams {
+    clientIn: NodeJS.ReadableStream;
+    clientOut: NodeJS.WritableStream;
+    serverIn: NodeJS.WritableStream;
+    serverOut: NodeJS.ReadableStream;
+}
+export declare function pumpGateway(ctx: GatewayContext, s: GatewayStreams): void;

package/dist/adapters/mcp/gateway.js

@@ -0,0 +1,205 @@
+/**
+ * The MCP gateway: Yenop between an MCP client and an MCP server.
+ *
+ * An MCP client (Cursor, Claude Desktop, an OpenAI or custom agent) launches a tool server and calls its
+ * tools. Point the client at Yenop instead of at the server; Yenop launches the real server, forwards every
+ * message, and runs a decision on each `tools/call`. Allowed calls go through untouched. Blocked calls never
+ * reach the server: the client gets a tool error carrying the reason. This is the same policy engine, run
+ * state and receipts as the Claude Code hook, so a rule written once covers every MCP-speaking agent.
+ *
+ * This is where the trusted-backend attacks land: an injected instruction telling the agent to dump a
+ * database through a Supabase MCP server, or exfiltrate a repo through a GitHub MCP server. The server would
+ * obey. The gateway does not.
+ *
+ * When a call needs a person, the gateway asks the person through the client, using MCP elicitation. Two
+ * protocol generations exist and the gateway speaks both:
+ *  - 2025-06-18 / 2025-11-25: the client declares `capabilities.elicitation` in `initialize`; the server sends
+ *    an `elicitation/create` request and the client answers it. The gateway holds the call meanwhile.
+ *  - 2026-07-28 (multi round-trip requests): servers no longer send requests. The gateway answers the call
+ *    with `resultType: "input_required"` plus an opaque `requestState`; the client shows the form and retries
+ *    the call with `inputResponses` and the same `requestState`. Nothing is held; the state is one nonce.
+ * A client that supports neither gets the `onAsk` fallback: block (default) or allow.
+ *
+ * stdio transport: newline-delimited JSON-RPC, one message per line. Only `tools/call` is gated; every other
+ * message passes. A blocked call is never written to the server.
+ */
+import { randomBytes } from "node:crypto";
+import { mcpToolRef } from "../../core/tools.js";
+export function newGatewayState() {
+    return { legacyElicitation: false, seq: 0, held: new Map(), pending: new Map(), awaiting: new Map() };
+}
+const ELICIT_KEY = "yenop-approval";
+const ELICIT_PREFIX = "yenop:";
+const PENDING_TTL_MS = 10 * 60 * 1000;
+const CAPS_META = "io.modelcontextprotocol/clientCapabilities";
+export { mcpToolRef } from "../../core/tools.js";
+function canon(v) {
+    if (Array.isArray(v))
+        return `[${v.map(canon).join(",")}]`;
+    if (v && typeof v === "object") {
+        const o = v;
+        return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canon(o[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(v);
+}
+function fingerprint(tool, args) {
+    return `${tool} ${canon(args ?? {})}`;
+}
+function toolError(id, text) {
+    return { to: "client", line: JSON.stringify({ jsonrpc: "2.0", id, result: { content: [{ type: "text", text }], isError: true } }) };
+}
+function short(args) {
+    const s = canon(args ?? {});
+    return s.length > 80 ? s.slice(0, 79) + "…" : s;
+}
+/** The question a person sees. One flat enum, no mode field: readable by every client generation. */
+function approvalRequest(ctx, tool, args, reason) {
+    return {
+        method: "elicitation/create",
+        params: {
+            message: `Yenop: ${reason} Allow ${ctx.server}/${tool} ${short(args)}?`,
+            requestedSchema: {
+                type: "object",
+                properties: { decision: { type: "string", title: "Decision", description: "Allow this call once, or deny it", enum: ["allow", "deny"] } },
+                required: ["decision"],
+            },
+        },
+    };
+}
+function answered(r) {
+    return r?.action === "accept" && r.content?.["decision"] === "allow" ? "allow" : "deny";
+}
+function refuse(ctx, id, callId, tool, why, detail) {
+    ctx.yenop.recordOutcome(ctx.runId, callId, tool, "denied", detail);
+    return toolError(id, `Yenop: ${why} (tool ${ctx.server}/${tool}).`);
+}
+function stripMrtr(msg) {
+    const params = { ...msg.params };
+    delete params.inputResponses;
+    delete params.requestState;
+    return JSON.stringify({ ...msg, params });
+}
+/** Decide what one client message causes. Only tools/call is gated; parse failures and other methods pass through. */
+export function gateClientMessage(ctx, line) {
+    let msg;
+    try {
+        msg = JSON.parse(line);
+    }
+    catch {
+        return [{ to: "server", line }]; // never break the stream on a parse error
+    }
+    const st = ctx.state;
+    // 2025 flow: the client is answering a question the gateway asked. The server never asked, so it never sees this.
+    if (msg.method === undefined && typeof msg.id === "string" && msg.id.startsWith(ELICIT_PREFIX)) {
+        const h = st.held.get(msg.id);
+        st.held.delete(msg.id);
+        if (!h)
+            return [];
+        if (msg.error === undefined && answered(msg.result) === "allow") {
+            st.awaiting.set(String(h.id), { callId: h.callId, tool: h.tool });
+            return [{ to: "server", line: h.line }];
+        }
+        return [refuse(ctx, h.id, h.callId, h.tool, "the person said no", "declined in the client")];
+    }
+    if (msg.method === "initialize") {
+        st.legacyElicitation = !!msg.params?.capabilities?.["elicitation"];
+        return [{ to: "server", line }];
+    }
+    if (msg.method === "notifications/cancelled") {
+        const rid = String(msg.params?.requestId);
+        for (const [k, h] of st.held)
+            if (String(h.id) === rid)
+                st.held.delete(k);
+        return [{ to: "server", line }];
+    }
+    if (msg.method !== "tools/call" || !msg.params || typeof msg.params.name !== "string")
+        return [{ to: "server", line }];
+    const tool = msg.params.name;
+    const args = msg.params.arguments ?? {};
+    // 2026 flow: a retry carrying the person's answer to a question the gateway asked.
+    const rs = msg.params.requestState;
+    if (rs !== undefined && st.pending.has(rs)) {
+        const p = st.pending.get(rs);
+        st.pending.delete(rs); // single use
+        if (p.exp < Date.now() || p.fingerprint !== fingerprint(tool, args)) {
+            return [refuse(ctx, msg.id, p.callId, p.tool, "the approval did not match this call or had expired; ask again", "approval expired or mismatched")];
+        }
+        if (answered(msg.params.inputResponses?.[ELICIT_KEY]) === "allow") {
+            if (msg.id !== undefined)
+                st.awaiting.set(String(msg.id), { callId: p.callId, tool: p.tool });
+            return [{ to: "server", line: stripMrtr(msg) }]; // the real server never asked for these fields
+        }
+        return [refuse(ctx, msg.id, p.callId, p.tool, "the person said no", "declined in the client")];
+    }
+    const req = { runId: ctx.runId, principal: { runtime: "mcp", agent: ctx.client, user: ctx.user }, tool: mcpToolRef(ctx.server, tool), args };
+    if (msg.id !== undefined)
+        req.callId = `mcp:${msg.id}`;
+    const callId = req.callId ?? "";
+    const d = ctx.yenop.decide(req);
+    if (d.mode === "observe" || d.effect === "allow")
+        return [{ to: "server", line }];
+    if (d.effect === "deny")
+        return [toolError(msg.id, `Yenop blocked this: ${d.message} (tool ${ctx.server}/${tool}); receipt ${d.receiptId}.`)];
+    // ask
+    if (ctx.onAsk === "allow") {
+        if (msg.id !== undefined)
+            st.awaiting.set(String(msg.id), { callId, tool });
+        return [{ to: "server", line }];
+    }
+    if (ctx.onAsk === "elicit") {
+        const caps = msg.params._meta?.[CAPS_META];
+        if (caps?.elicitation !== undefined) {
+            const nonce = randomBytes(16).toString("hex");
+            st.pending.set(nonce, { fingerprint: fingerprint(tool, args), callId, tool, exp: Date.now() + PENDING_TTL_MS });
+            const result = { resultType: "input_required", inputRequests: { [ELICIT_KEY]: approvalRequest(ctx, tool, args, d.message) }, requestState: nonce };
+            return [{ to: "client", line: JSON.stringify({ jsonrpc: "2.0", id: msg.id, result }) }];
+        }
+        if (st.legacyElicitation && msg.id !== undefined) {
+            const eid = `${ELICIT_PREFIX}${++st.seq}`;
+            st.held.set(eid, { line, id: msg.id, callId, tool });
+            return [{ to: "client", line: JSON.stringify({ jsonrpc: "2.0", id: eid, ...approvalRequest(ctx, tool, args, d.message) }) }];
+        }
+    }
+    return [refuse(ctx, msg.id, callId, tool, `needs a person, and this client cannot ask one: ${d.message} Adjust policy or run it yourself; receipt ${d.receiptId}`, "blocked at the MCP gateway: client cannot elicit")];
+}
+/** A server message always reaches the client. If it answers a forwarded ask, the outcome is recorded on the way. */
+export function gateServerMessage(ctx, line) {
+    try {
+        const msg = JSON.parse(line);
+        if (msg.id !== undefined && msg.method === undefined) {
+            const a = ctx.state.awaiting.get(String(msg.id));
+            if (a) {
+                ctx.state.awaiting.delete(String(msg.id));
+                const failed = msg.error !== undefined || msg.result?.isError === true;
+                ctx.yenop.recordOutcome(ctx.runId, a.callId, a.tool, failed ? "failed" : "ran", failed ? "the server reported an error" : undefined);
+            }
+        }
+    }
+    catch {
+        /* not JSON: pass it through */
+    }
+    return [{ to: "client", line }];
+}
+/** A newline-delimited-JSON splitter that holds a partial trailing line between chunks. */
+export function makeLineSplitter(onLine) {
+    let buf = "";
+    return (chunk) => {
+        buf += chunk.toString("utf8");
+        let nl;
+        while ((nl = buf.indexOf("\n")) !== -1) {
+            const line = buf.slice(0, nl);
+            buf = buf.slice(nl + 1);
+            if (line.trim().length > 0)
+                onLine(line);
+        }
+    };
+}
+export function pumpGateway(ctx, s) {
+    const apply = (effects) => {
+        for (const e of effects)
+            (e.to === "server" ? s.serverIn : s.clientOut).write(e.line + "\n");
+    };
+    s.clientIn.on("data", makeLineSplitter((line) => apply(gateClientMessage(ctx, line))));
+    s.serverOut.on("data", makeLineSplitter((line) => apply(gateServerMessage(ctx, line))));
+}
+//# sourceMappingURL=gateway.js.map

package/dist/adapters/mcp/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../../src/adapters/mcp/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAgDjD,MAAM,UAAU,eAAe;IAC7B,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AACxG,CAAC;AAcD,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,SAAS,KAAK,CAAC,CAAU;IACvB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3D,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AACD,SAAS,WAAW,CAAC,IAAY,EAAE,IAAa;IAC9C,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AACD,SAAS,SAAS,CAAC,EAAsB,EAAE,IAAY;IACrD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AACtI,CAAC;AACD,SAAS,KAAK,CAAC,IAAa;IAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AACD,qGAAqG;AACrG,SAAS,eAAe,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa,EAAE,MAAc;IACvF,OAAO;QACL,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE;YACN,OAAO,EAAE,UAAU,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG;YACvE,eAAe,EAAE;gBACf,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE;gBACzI,QAAQ,EAAE,CAAC,UAAU,CAAC;aACvB;SACF;KACF,CAAC;AACJ,CAAC;AACD,SAAS,QAAQ,CAAC,CAAqE;IACrF,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1F,CAAC;AACD,SAAS,MAAM,CAAC,GAAmB,EAAE,EAAsB,EAAE,MAAc,EAAE,IAAY,EAAE,GAAW,EAAE,MAAc;IACpH,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC;AACtE,CAAC;AACD,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IACjC,OAAO,MAAM,CAAC,cAAc,CAAC;IAC7B,OAAO,MAAM,CAAC,YAAY,CAAC;IAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,iBAAiB,CAAC,GAAmB,EAAE,IAAY;IACjE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,0CAA0C;IAC7E,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAErB,kHAAkH;IAClH,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/F,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;YAChE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAChC,EAAE,CAAC,iBAAiB,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,CAAC;QACnE,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAE,GAAG,CAAC,MAA6C,EAAE,SAAS,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI;YAAE,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG;gBAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvH,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IAExC,mFAAmF;IACnF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;IACnC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;QAC9B,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa;QACpC,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,gEAAgE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACrJ,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAClE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;gBAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,+CAA+C;QAClG,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,GAAG,GAAoB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9J,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC,OAAO,UAAU,GAAG,CAAC,MAAM,IAAI,IAAI,cAAc,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAE9I,MAAM;IACN,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;YAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,CAA0C,CAAC;QACpF,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;YAChH,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACnJ,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,EAAE,CAAC,iBAAiB,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;YAC1C,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC,OAAO,8CAA8C,CAAC,CAAC,SAAS,EAAE,EAAE,kDAAkD,CAAC,CAAC,CAAC;AAC1N,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,iBAAiB,CAAC,GAAmB,EAAE,IAAY;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACxC,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;gBACvE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvI,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,MAA8B;IAC7D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,EAAU,CAAC;QACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,WAAW,CAAC,GAAmB,EAAE,CAAiB;IAChE,MAAM,KAAK,GAAG,CAAC,OAAiB,EAAE,EAAE;QAClC,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC/F,CAAC,CAAC;IACF,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/adapters/mcp/run.d.ts

@@ -0,0 +1,12 @@
+import { type OnAsk } from "./gateway.js";
+export interface McpOptions {
+    server?: string;
+    command: string;
+    args: string[];
+    onAsk?: OnAsk;
+    cwd?: string;
+    home?: string;
+}
+/** Split `["--server","github","--","npx","-y","pkg"]` into options and the upstream command after `--`. */
+export declare function parseMcpArgs(argv: string[]): McpOptions;
+export declare function runMcpGateway(opts: McpOptions): Promise<number>;

package/dist/adapters/mcp/run.js

@@ -0,0 +1,86 @@
+/**
+ * `yenop mcp --server NAME -- <command> <args...>`
+ * Launch the real MCP server and proxy stdio through the gateway.
+ */
+import { spawn } from "node:child_process";
+import { basename } from "node:path";
+import { userInfo } from "node:os";
+import { openYenop } from "../../core/index.js";
+import { uuidv7 } from "../../core/index.js";
+import { pumpGateway, newGatewayState } from "./gateway.js";
+/** Split `["--server","github","--","npx","-y","pkg"]` into options and the upstream command after `--`. */
+export function parseMcpArgs(argv) {
+    let server;
+    let onAsk;
+    let i = 0;
+    for (; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--") {
+            i++;
+            break;
+        }
+        if (a === "--server")
+            server = argv[++i];
+        else if (a === "--on-ask") {
+            const v = argv[++i];
+            if (v !== "elicit" && v !== "block" && v !== "allow")
+                throw new Error(`yenop mcp: --on-ask must be elicit, block or allow (got ${v})`);
+            onAsk = v;
+        }
+        else
+            break;
+    }
+    const rest = argv.slice(i);
+    if (rest.length === 0)
+        throw new Error('yenop mcp: nothing to launch. Usage: yenop mcp --server NAME -- <command> [args...]');
+    const opts = { command: rest[0], args: rest.slice(1), server: server ?? basename(rest[0]).replace(/\.[^.]+$/, "") };
+    if (onAsk)
+        opts.onAsk = onAsk;
+    return opts;
+}
+export async function runMcpGateway(opts) {
+    const openArgs = {};
+    if (opts.cwd !== undefined)
+        openArgs.cwd = opts.cwd;
+    if (opts.home !== undefined)
+        openArgs.home = opts.home;
+    const yenop = openYenop(openArgs);
+    const child = spawn(opts.command, opts.args, { stdio: ["pipe", "pipe", "inherit"] });
+    const ctx = {
+        yenop,
+        runId: `mcp:${opts.server}:${uuidv7()}`,
+        server: opts.server ?? "mcp",
+        user: safeUser(),
+        client: "mcp-client",
+        onAsk: opts.onAsk ?? "elicit",
+        state: newGatewayState(),
+    };
+    pumpGateway(ctx, {
+        clientIn: process.stdin,
+        clientOut: process.stdout,
+        serverIn: child.stdin,
+        serverOut: child.stdout,
+    });
+    // The gateway's lifetime is the server's. When either end closes, tear down cleanly.
+    return await new Promise((resolve) => {
+        const done = (code) => {
+            yenop.close();
+            resolve(code);
+        };
+        child.on("exit", (code) => done(code ?? 0));
+        child.on("error", (e) => {
+            process.stderr.write(`yenop mcp: cannot launch ${opts.command}: ${e.message}\n`);
+            done(127);
+        });
+        process.stdin.on("end", () => child.stdin?.end());
+    });
+}
+function safeUser() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return "unknown";
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/adapters/mcp/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/adapters/mcp/run.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAmC,MAAM,cAAc,CAAC;AAW7F,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,MAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACpC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,GAAG,CAAC,CAAC;YACvI,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;;YACI,MAAM;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IAClI,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB;IAClD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IACrD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAmB;QAC1B,KAAK;QACL,KAAK,EAAE,OAAO,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,EAAE;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,IAAI,EAAE,QAAQ,EAAE;QAChB,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ;QAC7B,KAAK,EAAE,eAAe,EAAE;KACzB,CAAC;IAEF,WAAW,CAAC,GAAG,EAAE;QACf,QAAQ,EAAE,OAAO,CAAC,KAAK;QACvB,SAAS,EAAE,OAAO,CAAC,MAAM;QACzB,QAAQ,EAAE,KAAK,CAAC,KAAM;QACtB,SAAS,EAAE,KAAK,CAAC,MAAO;KACzB,CAAC,CAAC;IAEH,qFAAqF;IACrF,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;YAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,IAAI,CAAC,OAAO,KAAM,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC;YAC5F,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/adapters/openai-agents/index.d.ts

@@ -0,0 +1,74 @@
+import { type OpenOptions, type Yenop } from "../../core/index.js";
+import type { Decision, ToolRef } from "../../core/types.js";
+/** `protocol.FunctionCallItem`, the part a guardrail reads. */
+export interface ToolCallLike {
+    name: string;
+    /** The model's arguments, as a JSON string. */
+    arguments: string;
+    callId: string;
+}
+/** `ToolInputGuardrailData`: the SDK's run context (one per `run()`), the agent, and the call. */
+export interface GuardrailDataLike {
+    context: object;
+    agent: {
+        name: string;
+    };
+    toolCall: ToolCallLike;
+}
+export interface OutputGuardrailDataLike extends GuardrailDataLike {
+    output: unknown;
+}
+export type GuardrailBehavior = {
+    type: "allow";
+} | {
+    type: "rejectContent";
+    message: string;
+} | {
+    type: "throwException";
+};
+export interface GuardrailOutput {
+    behavior: GuardrailBehavior;
+    outputInfo?: unknown;
+}
+export interface ToolInputGuardrail {
+    type: "tool_input";
+    name: string;
+    run: (data: GuardrailDataLike) => Promise<GuardrailOutput>;
+}
+export interface ToolOutputGuardrail {
+    type: "tool_output";
+    name: string;
+    run: (data: OutputGuardrailDataLike) => Promise<GuardrailOutput>;
+}
+/** What one of the agent's tools can do. */
+export interface ToolSpec {
+    kind: ToolRef["kind"];
+    /** Only reads; default false, the safe direction. */
+    readOnly?: boolean;
+    /** For kind "mcp": the server, so trustedServers/sensitiveServers in config apply. */
+    server?: string;
+}
+export interface YenopGuardrailOptions extends OpenOptions {
+    /** What each tool can do, by name. Unlisted tools are judged as unknown, not read-only. */
+    tools?: Record<string, ToolSpec>;
+    /** Rename or reshape a tool's arguments into what the engine reads (command, file_path, paths, url). */
+    mapArgs?: (name: string, args: Record<string, unknown>) => Record<string, unknown>;
+    /** Route an ask to a person. Resolve true to let the call run. Absent: every ask is refused. */
+    onAsk?: (decision: Decision, data: GuardrailDataLike) => Promise<boolean> | boolean;
+    /** How a deny reaches the agent. "reject" (default) tells it why; "throw" trips the SDK's exception. */
+    onDeny?: "reject" | "throw";
+    /** The runtime name in receipts. Default "openai-agents". */
+    runtime?: string;
+    /** The person the agent acts for, in receipts. Default: the OS user. */
+    user?: string;
+    /** Share an already-open Yenop instead of opening one. */
+    yenop?: Yenop;
+}
+export interface YenopGuardrails {
+    inputGuardrails: ToolInputGuardrail[];
+    outputGuardrails: ToolOutputGuardrail[];
+    /** The run id Yenop is using for an SDK run context, once the first call has been judged. */
+    runIdFor(context: object): string | undefined;
+    close(): void;
+}
+export declare function yenopGuardrails(opts?: YenopGuardrailOptions): YenopGuardrails;

package/dist/adapters/openai-agents/index.js

@@ -0,0 +1,139 @@
+/**
+ * OpenAI Agents SDK adapter: Yenop as tool guardrails, in process.
+ *
+ * The SDK (`@openai/agents`) runs an agent loop in the developer's own process and lets a tool carry
+ * `inputGuardrails`, run before the tool executes, and `outputGuardrails`, run after. Yenop plugs in as one of
+ * each: the input guardrail is the decision, the output guardrail records the outcome. The shapes below are
+ * structural copies of `@openai/agents-core` 0.18.0 (`toolGuardrail.d.ts`); Yenop does not import the SDK,
+ * so the developer's SDK version and Yenop's never have to agree, and the tests need no SDK at all.
+ *
+ *   import { tool } from "@openai/agents";
+ *   import { yenopGuardrails } from "yenop/openai-agents";
+ *   const guard = yenopGuardrails({ tools: { run_shell: { kind: "shell" }, write_file: { kind: "write" } } });
+ *   const runShell = tool({ name: "run_shell", ..., inputGuardrails: guard.inputGuardrails, outputGuardrails: guard.outputGuardrails });
+ *
+ * What the developer must know:
+ *  - Tools here are the developer's own functions, so Yenop cannot know what "run_shell" does by name. `tools`
+ *    says what each tool can do; a tool not listed is judged as unknown and not read-only, which the baseline
+ *    holds for a person. For a shell tool the argument must be named `command`, for file tools `file_path`
+ *    (or several in `paths`), for web tools `url`; `mapArgs` renames anything else.
+ *  - A guardrail cannot ask a person. `onAsk` is where the developer routes an ask (a terminal prompt, a
+ *    Slack message, their approval UI) and answers true or false. Without `onAsk`, an ask is refused, never
+ *    let through: Yenop only ever tightens.
+ *  - A deny becomes `rejectContent` with the reason by default, so the agent learns why and can do something
+ *    else; `onDeny: "throw"` escalates to the SDK's tripwire exception instead.
+ *  - One SDK run is one Yenop run: the run id is bound to the SDK's RunContext object, so run-level facts
+ *    (untrusted content taken in, sensitive data touched) follow the agent across its tool calls.
+ *  - Yenop's own failure is a rejection, not an allow.
+ */
+import { randomUUID } from "node:crypto";
+import { openYenop } from "../../core/index.js";
+import { classifyTool } from "../../core/tools.js";
+import { safeUser } from "../hooks/pipeline.js";
+function parseArgs(text) {
+    if (text === "" || text === undefined)
+        return {};
+    try {
+        const v = JSON.parse(text);
+        return v && typeof v === "object" && !Array.isArray(v) ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function yenopGuardrails(opts = {}) {
+    const { tools, mapArgs, onAsk, onDeny, runtime, user, yenop: shared, ...open } = opts;
+    // The project the agent works in decides the tenant and the policy layers; without an explicit cwd it is the
+    // current directory, the same rule the CLI hooks follow. (Found live: decisions had landed under "local".)
+    const cwd = open.cwd ?? process.cwd();
+    const y = shared ?? openYenop({ ...open, cwd });
+    const owned = shared === undefined;
+    const rt = runtime ?? "openai-agents";
+    const who = user ?? safeUser();
+    const runs = new WeakMap();
+    const runIdOf = (context) => {
+        let id = runs.get(context);
+        if (!id) {
+            id = `${rt}:${randomUUID()}`;
+            runs.set(context, id);
+        }
+        return id;
+    };
+    const toolRef = (name) => {
+        const spec = tools?.[name];
+        if (!spec)
+            return { ...classifyTool(name), kind: "unknown", readOnly: false };
+        const ref = { name, kind: spec.kind, readOnly: spec.readOnly ?? false };
+        if (spec.server !== undefined)
+            ref.server = spec.server;
+        return ref;
+    };
+    const reject = (message) => ({ behavior: { type: "rejectContent", message } });
+    const input = {
+        type: "tool_input",
+        name: "yenop",
+        async run(data) {
+            const { name, callId } = data.toolCall;
+            let request;
+            let d;
+            try {
+                const raw = parseArgs(data.toolCall.arguments);
+                if (raw === undefined)
+                    return reject(`Yenop: the arguments for ${name} are not a JSON object; the call is refused.`);
+                const args = mapArgs ? mapArgs(name, raw) : raw;
+                request = { runId: runIdOf(data.context), principal: { runtime: rt, agent: data.agent.name, user: who }, tool: toolRef(name), args, cwd, callId };
+                d = y.decide(request);
+            }
+            catch (e) {
+                return reject(`Yenop failed and refuses by default: ${e.message}. Run "yenop status".`);
+            }
+            const info = { receiptId: d.receiptId, effect: d.effect, reasons: d.reasons, mode: d.mode };
+            if (d.mode === "observe" || d.effect === "allow")
+                return { behavior: { type: "allow" }, outputInfo: info };
+            if (d.effect === "deny")
+                return onDeny === "throw" ? { behavior: { type: "throwException" }, outputInfo: info } : { ...reject(`Yenop: ${d.message}`), outputInfo: info };
+            // ask
+            if (!onAsk) {
+                y.recordOutcome(request.runId, callId, name, "denied", "no onAsk handler: the agent cannot ask a person");
+                return { ...reject(`Yenop: ${d.message} This agent has no way to ask a person, so the call is refused; give yenopGuardrails an onAsk handler to route approvals.`), outputInfo: info };
+            }
+            let ok = false;
+            try {
+                ok = (await onAsk(d, data)) === true;
+            }
+            catch (e) {
+                y.recordOutcome(request.runId, callId, name, "denied", `onAsk failed: ${e.message}`);
+                return { ...reject(`Yenop: the approval handler failed (${e.message}); the call is refused.`), outputInfo: info };
+            }
+            if (ok)
+                return { behavior: { type: "allow" }, outputInfo: { ...info, approvedBy: "person" } };
+            y.recordOutcome(request.runId, callId, name, "denied", "declined by the person");
+            return { ...reject(`Yenop: a person declined this call. ${d.message}`), outputInfo: info };
+        },
+    };
+    const output = {
+        type: "tool_output",
+        name: "yenop-outcome",
+        async run(data) {
+            try {
+                const runId = runs.get(data.context);
+                if (runId)
+                    y.recordOutcome(runId, data.toolCall.callId, data.toolCall.name, "ran");
+            }
+            catch {
+                /* recording never blocks the output */
+            }
+            return { behavior: { type: "allow" } };
+        },
+    };
+    return {
+        inputGuardrails: [input],
+        outputGuardrails: [output],
+        runIdFor: (context) => runs.get(context),
+        close: () => {
+            if (owned)
+                y.close();
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/adapters/openai-agents/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/openai-agents/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAgC,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAoEhD,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACtC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA8B,EAAE;IAC9D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACtF,6GAA6G;IAC7G,2GAA2G;IAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,IAAI,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,OAAO,IAAI,eAAe,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,OAAO,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,OAAe,EAAU,EAAE;QAC1C,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,GAAG,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAW,EAAE;QACxC,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC9E,MAAM,GAAG,GAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC;QACjF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACxD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAExG,MAAM,KAAK,GAAuB;QAChC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YACvC,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC/C,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC,4BAA4B,IAAI,8CAA8C,CAAC,CAAC;gBACrH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAChD,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;gBAClJ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,wCAAyC,CAAW,CAAC,OAAO,uBAAuB,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC3G,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACzK,MAAM;YACN,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,iDAAiD,CAAC,CAAC;gBAC1G,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,2HAA2H,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YACzL,CAAC;YACD,IAAI,EAAE,GAAG,KAAK,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;YACvC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChG,OAAO,EAAE,GAAG,MAAM,CAAC,uCAAwC,CAAW,CAAC,OAAO,yBAAyB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC/H,CAAC;YACD,IAAI,EAAE;gBAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;YAC9F,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;YACjF,OAAO,EAAE,GAAG,MAAM,CAAC,uCAAuC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC7F,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAwB;QAClC,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,eAAe;QACrB,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,KAAK;oBAAE,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;IAEF,OAAO;QACL,eAAe,EAAE,CAAC,KAAK,CAAC;QACxB,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,KAAK;gBAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/demo.d.ts

@@ -0,0 +1,5 @@
+export interface DemoOptions {
+    color?: boolean;
+    pause?: boolean;
+}
+export declare function runDemo(opts?: DemoOptions): Promise<number>;