agentguardproxy 0.5.1__tar.gz → 0.5.2__tar.gz

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentguardproxy
-Version: 0.5.1
+Version: 0.5.2
 Summary: Python SDK for AgentGuard — the firewall for AI agents
 Author-email: Cauã Ferraz <cauaferrazp@gmail.com>
 License-Expression: Apache-2.0
@@ -12,14 +12,13 @@ Keywords: ai,agents,firewall,policy,guardrails,safety
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Provides-Extra: langchain
 Requires-Dist: langchain-core<2.0,>=0.3; extra == "langchain"

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/agentguard/__init__.py

@@ -47,7 +47,7 @@ DECISION_REQUIRE_APPROVAL = "REQUIRE_APPROVAL"
 
 # API endpoint paths. The leading "/v1" is added by Guard._url so a single
 # code path handles both the legacy /v1/<suffix> URLs and the tenant-aware
-# /v1/t/<tenant>/<suffix> form introduced in v0.5 (worker A7).
+# /v1/t/<tenant>/<suffix> form.
 ENDPOINT_CHECK = "/check"
 ENDPOINT_APPROVE = "/approve/"
 ENDPOINT_DENY = "/deny/"
@@ -61,10 +61,10 @@ ENDPOINT_STATUS = "/status/"
 LOCAL_TENANT_ID = "local"
 
 # Fail-mode values for the Guard() constructor. "deny" fails closed when the
-# AgentGuard proxy is unreachable (the v0.4.0 default and current v0.4.1
-# default). "allow" fails open — permitted as an explicit opt-in for agents
-# whose threat model treats AgentGuard as best-effort; the caller is
-# responsible for any resulting safety implications.
+# AgentGuard proxy is unreachable (the default). "allow" fails open —
+# permitted as an explicit opt-in for agents whose threat model treats
+# AgentGuard as best-effort; the caller is responsible for any resulting
+# safety implications.
 FAIL_MODE_DENY = "deny"
 FAIL_MODE_ALLOW = "allow"
 _VALID_FAIL_MODES = (FAIL_MODE_DENY, FAIL_MODE_ALLOW)
@@ -95,16 +95,16 @@ class CheckResult:
 # --- Typed exceptions raised by the @guarded decorator ---
 #
 # All three extend PermissionError so callers that already catch
-# PermissionError (the v0.4.0/v0.4.1 behavior) keep working unchanged.
-# New callers can catch the specific subclass and read structured fields
-# (result, approval_id, approval_url) instead of parsing error strings.
+# PermissionError keep working. New callers can catch the specific
+# subclass and read structured fields (result, approval_id,
+# approval_url) instead of parsing error strings.
 
 class AgentGuardError(PermissionError):
     """Base class for AgentGuard-raised permission failures.
 
     Carries the originating :class:`CheckResult` (if any) so callers can
     inspect the decision, matched rule, and approval metadata without
-    re-running the check. Messages preserve the v0.4.1 string format so
+    re-running the check. Messages preserve a stable string format so
     existing regex/text matchers continue to work.
     """
 
@@ -156,8 +156,8 @@ class AgentGuardAuthError(AgentGuardError):
     ``/v1/audit``).
 
     Distinguishes "API key wrong / expired" from "approval poll timed
-    out" so callers can surface the right operator-facing error. v0.5
-    addition (R5 P9). Extends :class:`AgentGuardError` so existing
+    out" so callers can surface the right operator-facing error.
+    Extends :class:`AgentGuardError` so existing
     ``except PermissionError:`` handlers still catch it.
     """
 
@@ -171,15 +171,21 @@ class AgentGuardAuthError(AgentGuardError):
         self.status = status
 
 
-# AgentGuardTimeoutError is an alias for AgentGuardApprovalTimeout — the
-# v0.5 plan referred to it by that name, but the v0.4.1 SDK already shipped
-# AgentGuardApprovalTimeout. The alias gives the new name without breaking
-# downstream `except AgentGuardApprovalTimeout:` handlers.
+# AgentGuardTimeoutError is an alias for AgentGuardApprovalTimeout
+# kept for backwards compatibility — `except AgentGuardApprovalTimeout:`
+# handlers still match.
 AgentGuardTimeoutError = AgentGuardApprovalTimeout
 
 
 class Guard:
-    """Client for the AgentGuard proxy."""
+    """Client for the AgentGuard server — the SDK enforcement layer.
+
+    Call ``guard.check(scope, ...)`` before every gated action, or use the
+    ``@guarded`` decorator / framework adapters in ``agentguard.adapters``
+    for higher-level integration. For wire-level enforcement that needs no
+    agent code change, see the ``agentguard-mcp-gateway`` and
+    ``agentguard-llm-proxy`` binaries.
+    """
 
     def __init__(
         self,
@@ -199,26 +205,20 @@ class Guard:
             timeout: HTTP timeout in seconds for individual calls.
             api_key: Bearer token for /v1/approve, /v1/deny, /v1/status.
                 Falls back to AGENTGUARD_API_KEY.
-            fail_mode: Behavior when the proxy is unreachable. "deny" (the
-                v0.4.0 default, current v0.4.1 default) returns a DENY
-                result so the agent fails closed. "allow" returns an ALLOW
-                result — use only when the threat model treats AgentGuard
-                as best-effort and the caller accepts the safety trade-off.
-                An invalid value raises ValueError at construction so the
-                bug surfaces at startup instead of mid-request.
-            tenant_id: Optional tenant identifier (v0.5+). When set to a
+            fail_mode: Behavior when the proxy is unreachable. "deny"
+                (the default) returns a DENY result so the agent fails
+                closed. "allow" returns an ALLOW result — use only when
+                the threat model treats AgentGuard as best-effort and
+                the caller accepts the safety trade-off. An invalid
+                value raises ValueError at construction.
+            tenant_id: Optional tenant identifier. When set to a
                 non-empty value other than ``"local"``, every HTTP call is
                 routed through the tenant-aware ``/v1/t/{tenant_id}/...``
-                URL family instead of the legacy ``/v1/...`` path. ``None``
-                or ``"local"`` selects the legacy URLs and is wire-compatible
-                with v0.4.x servers. Falls back to ``AGENTGUARD_TENANT_ID``.
-                v0.5 servers only recognise the literal ``"local"`` tenant;
-                v0.6 will validate against a configured tenant registry.
-
-        v0.5.0 parity note: the TypeScript SDK already honors `failMode`,
-        default `"deny"`. v0.5.0 will align both SDKs on explicit fail-mode
-        documentation. Adding `fail_mode` now is purely forward-compatible;
-        omitting it preserves v0.4.0 semantics exactly.
+                URL family instead of the legacy ``/v1/...`` path.
+                ``None`` or ``"local"`` selects the legacy URLs. Falls
+                back to ``AGENTGUARD_TENANT_ID``. The bundled
+                FilePolicyProvider only recognises ``"local"``;
+                multi-tenant providers can register others.
         """
         if fail_mode not in _VALID_FAIL_MODES:
             raise ValueError(
@@ -314,13 +314,12 @@ class Guard:
 
         try:
             with request.urlopen(req, timeout=self.timeout) as resp:
-                # --- Honest response validation (R5 E8 / S13) ---
-                # The previous implementation decoded whatever the proxy
-                # returned. A misconfigured reverse proxy serving an HTML
-                # error page or a chunked plaintext body would silently
-                # produce a JSONDecodeError that we *did* catch — but
-                # 200-OK plus a non-JSON body that happened to start with
-                # `{` would slip through. We now positively assert:
+                # --- Honest response validation ---
+                # A misconfigured reverse proxy serving an HTML error
+                # page or a chunked plaintext body would silently produce
+                # a JSONDecodeError that we *do* catch — but 200-OK plus
+                # a non-JSON body that happened to start with `{` would
+                # slip through. We positively assert:
                 #   1. status in 2xx
                 #   2. Content-Type is application/json (charset suffix ok)
                 #   3. body is a dict carrying a `decision` field
@@ -386,9 +385,9 @@ class Guard:
                     approval_url=body.get("approval_url", ""),
                 )
         except (error.URLError, OSError, json.JSONDecodeError) as e:
-            # Transport failure. fail_mode picks the safe default: "deny"
-            # preserves v0.4.0 fail-closed semantics; "allow" is an opt-in
-            # for callers whose threat model treats AgentGuard as advisory.
+            # Transport failure. fail_mode picks the default: "deny"
+            # fails closed; "allow" is an opt-in for callers whose
+            # threat model treats AgentGuard as advisory.
             #
             # We catch three classes here:
             #   - URLError: urlopen() connection-phase failures (connect
@@ -411,7 +410,7 @@ class Guard:
 
         Centralizes the fail-mode dispatch so transport failures and HTTP
         contract violations (bad status, wrong content type, malformed
-        body) all flow through one decision point. v0.5 addition (R5 E8).
+        body) all flow through one decision point.
         """
         decision = DECISION_ALLOW if self.fail_mode == FAIL_MODE_ALLOW else DECISION_DENY
         return CheckResult(decision=decision, reason=reason)
@@ -459,19 +458,17 @@ class Guard:
         Sends the API key on every poll because /v1/status is now auth-gated
         on servers configured with --api-key.
 
-        v0.5 changes (R5 E14, P9):
+        Behavior:
         - Polling is jittered to ``[0.8, 1.2] * poll_interval`` to avoid
           synchronized retries from many clients waiting on the same
           approval bursting the proxy at exact ``poll_interval`` boundaries.
-          ``time.sleep`` is retained — it is the documented pattern for
-          this kind of polling loop and consistent with the v0.4.x SDK.
         - HTTP 401 / 403 from the status endpoint raise
           :class:`AgentGuardAuthError` immediately. Continuing to poll
           would just spin until ``timeout`` elapsed and return a
           synthetic "Approval timed out" DENY, masking the real cause
-          (wrong/expired API key). Other HTTPErrors and URLErrors keep
-          the v0.4.x behavior of swallowing-and-retrying so transient
-          network blips do not abort a long-running approval wait.
+          (wrong/expired API key). Other HTTPErrors and URLErrors are
+          swallowed and retried so transient network blips do not abort
+          a long-running approval wait.
         """
         deadline = time.time() + timeout
         while time.time() < deadline:
@@ -519,9 +516,9 @@ class Guard:
 # ``Guard.check``. Anything outside this set is almost always a typo
 # (e.g. ``agent="x"`` instead of ``meta={"agent":"x"}``) — and silently
 # forwarding it to ``Guard.check`` would either be dropped on the floor
-# (``check`` only inspects keyword args it knows about) or raise a confusing
-# TypeError much later in the call chain. v0.5 R5 E15 closes this footgun
-# at the decorator boundary.
+# (``check`` only inspects keyword args it knows about) or raise a
+# confusing TypeError much later in the call chain. Reject at the
+# decorator boundary so the typo surfaces at definition time.
 _GUARDED_VALID_CHECK_KWARGS = frozenset({
     "action",
     "command",
@@ -570,17 +567,16 @@ def guarded(
     decision: ALLOW runs the function, DENY raises :class:`AgentGuardDenied`,
     a synthetic "Approval timed out" raises :class:`AgentGuardApprovalTimeout`.
     With ``wait_for_approval=False`` (default), the wrapper raises
-    :class:`AgentGuardApprovalRequired` immediately — preserving v0.4.1
-    behavior exactly, because that class extends ``PermissionError``.
-
-    All raised exceptions extend :class:`PermissionError`, so existing
-    ``except PermissionError:`` handlers continue to work unchanged.
+    :class:`AgentGuardApprovalRequired` immediately. That class extends
+    ``PermissionError``, so existing ``except PermissionError:`` handlers
+    continue to work unchanged.
 
-    v0.5 (R5 E15): unknown ``**check_kwargs`` raise ``TypeError`` at
-    decoration time. Only the keyword arguments :meth:`Guard.check`
-    understands (``action``, ``command``, ``path``, ``domain``, ``url``,
+    Unknown ``**check_kwargs`` raise ``TypeError`` at decoration time.
+    Only the keyword arguments :meth:`Guard.check` understands
+    (``action``, ``command``, ``path``, ``domain``, ``url``,
     ``session_id``, ``est_cost``, ``meta``) are accepted; a typo like
-    ``agent="x"`` no longer silently disappears.
+    ``agent="x"`` is rejected at definition time rather than silently
+    dropped.
     """
     unknown = set(check_kwargs) - _GUARDED_VALID_CHECK_KWARGS
     if unknown:
@@ -623,7 +619,8 @@ def guarded(
                         result=resolved,
                     )
                 raise AgentGuardApprovalRequired(
-                    # Preserve v0.4.1 message text so text-matchers still hit.
+                    # Stable message text — text-matchers in caller code
+                    # depend on it.
                     f"Action requires approval. Approve at: {result.approval_url}",
                     result=result,
                     approval_id=result.approval_id,

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/agentguard/adapters/browseruse.py

@@ -34,9 +34,10 @@ Design notes
   the methods listed in :data:`_GATED_METHODS` plus a small allowlist of
   read-only properties via :data:`_ALLOWED_PASSTHROUGH`.
 - **Default deny on attribute access.** Anything not on the allowlist
-  raises ``AttributeError`` with a security explanation. This catches the
-  v0.4.x bypass where ``__getattr__`` silently fell through to
-  ``self._page.click(...)``, leaving every action method un-gated.
+  raises ``AttributeError`` with a security explanation. A permissive
+  ``__getattr__`` would silently fall through to
+  ``self._page.click(...)`` and leave every action method un-gated, so
+  the wrapper never adds one.
 - **Form values are redacted before transmission.** ``check_form_input``
   passes the field NAME through (operators need it for audit context)
   but rewrites long values to ``<redacted; len=N>`` so audit logs do not
@@ -44,9 +45,8 @@ Design notes
   through :func:`agentguard.adapters.mcp._redact` for the standard secret
   patterns (Bearer tokens, AWS keys, ``secret=...`` pairs, etc.).
 
-Closes audit findings R5 E4 (modern-API bypass via __getattr__),
-R5 E5 / R7 E3 (data scope unhandled by the engine — see
-pkg/policy/engine_data_test.go for the engine-side close).
+The data-scope contract is pinned by pkg/policy/engine_data_test.go
+on the engine side.
 """
 
 from typing import Any, Optional
@@ -215,11 +215,10 @@ class GuardedPage:
 
     Gated methods are explicit attributes on this class (see the bodies
     below). Anything else is rejected via ``__getattr__`` against
-    :data:`_ALLOWED_PASSTHROUGH`. This is deliberately stricter than the
-    v0.4.x adapter, which proxied every attribute access — that proxying
-    was the bypass closed by audit finding R5 E4: ``page.click(...)``,
-    ``page.fill(...)``, ``page.evaluate(...)`` all flowed through to the
-    raw Page without ever consulting the policy.
+    :data:`_ALLOWED_PASSTHROUGH`. A permissive ``__getattr__`` that
+    proxied every attribute access would let ``page.click(...)``,
+    ``page.fill(...)``, ``page.evaluate(...)`` flow through to the raw
+    Page without ever consulting the policy — so we never add one.
 
     Read-only properties listed in :data:`_ALLOWED_PASSTHROUGH` (url,
     title, content, viewport_size, is_closed, main_frame, context) are
@@ -529,10 +528,10 @@ class GuardedPage:
 
         Anything else raises ``AttributeError`` with a security
         explanation. The default-deny posture is intentional: silently
-        proxying unknown attributes to ``self._page`` was the v0.4.x
-        bypass that let modern Playwright APIs (route, expose_function,
-        ...) skip every gate. Adding a new method to the gated surface
-        is preferable to widening the allowlist.
+        proxying unknown attributes to ``self._page`` would let modern
+        Playwright APIs (route, expose_function, ...) skip every gate.
+        Adding a new method to the gated surface is preferable to
+        widening the allowlist.
         """
         # Avoid infinite recursion when our own internals are accessed
         # before __init__ completes.

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/agentguard/adapters/crewai.py

@@ -1,67 +1,39 @@
 """
-AgentGuard CrewAI Adapter (v0.5.1 hybrid: subclass + override)
+AgentGuard CrewAI Adapter — subclass + override.
 
 Wraps CrewAI tools so every invocation passes through AgentGuard policy checks.
 
-Why this file changed in v0.5.1
--------------------------------
-v0.5.0 implemented ``GuardedCrewTool`` as a *composition* wrapper that held
-a CrewAI ``BaseTool`` instance and registered itself as a virtual subclass
-via ``BaseTool.register(GuardedCrewTool)``. The composition approach kept
-the gating tight (an explicit ``__getattr__`` allowlist blocked any
-parent-method bypass) but it broke at framework boundaries:
-
-  CrewAI 1.x + pydantic 2.12 emit::
-
-      For performance reasons, virtual subclasses registered using
-      'BaseTool.register()' are not supported in 'isinstance()' and
-      'issubclass()' checks.
-
-  Concretely::
-
-      Agent(tools=[GuardedCrewTool(...)])
-
-  raises::
-
-      pydantic_core._pydantic_core.ValidationError: 1 validation error for
-      Agent tools.0  Input should be a valid dictionary or instance of
-      BaseTool [...] input_type=GuardedCrewTool
-
-That same architectural class affects langgraph 1.0 + langchain_core 1.x
-(``isinstance(thing, Runnable)`` in ``coerce_to_runnable``).
-
-The v0.5.1 fix: actually subclass CrewAI's ``BaseTool`` so isinstance
-passes natively, and preserve the policy-enforcement contract by
-overriding **every** entry point the framework calls. The
-"every-method-is-on-this-class" property substitutes for the
-composition-era ``__getattr__`` allowlist:
-
-  - ``_run`` (abstract on the parent — we MUST override) gates every
-    sync dispatch path the framework drives. CrewAI's ``BaseTool.run``,
-    ``invoke`` (when present on a subclass / wrapper), and
-    ``to_structured_tool`` all read ``_run`` off the instance, so a
-    gated ``_run`` covers the entire sync surface.
+Architecture
+------------
+``GuardedCrewTool`` subclasses CrewAI's ``BaseTool`` directly so
+``isinstance(thing, BaseTool)`` checks succeed natively (CrewAI 1.x +
+pydantic 2.12 reject virtual-subclass registration via
+``BaseTool.register``). To keep the gate tight without an
+``__getattr__`` allowlist, **every** entry point the framework calls is
+explicitly overridden:
+
+  - ``_run`` (abstract on the parent) gates every sync dispatch path
+    CrewAI drives. CrewAI's ``BaseTool.run``, ``invoke`` (when present
+    on a subclass / wrapper), and ``to_structured_tool`` all read
+    ``_run`` off the instance, so a gated ``_run`` covers the entire
+    sync surface.
   - ``_arun`` is overridden because CrewAI's ``arun`` calls ``_arun``.
   - ``run`` / ``arun`` / ``invoke`` / ``ainvoke`` / ``__call__`` are
     overridden explicitly so the gate fires regardless of which entry
-    the agent runtime picks. Each one also runs the tool through the
-    underlying instance's matching method, preserving CrewAI's usage
-    accounting (``_claim_usage`` etc.) when the underlying tool defines
-    those.
+    the agent runtime picks. Each one runs the tool through the
+    underlying instance's matching method to preserve CrewAI's usage
+    accounting (``_claim_usage`` etc.).
   - ``to_structured_tool`` is overridden so CrewAI's
-    ``to_structured_tool`` pipeline (which does ``func=self._run``) ends
-    up calling our gated ``_run``, not the wrapped tool's bare ``_run``.
-
-The new defense contract
-------------------------
-Composition v0.5: "no parent methods are exposed; ``__getattr__`` is the
-single chokepoint."
+    ``to_structured_tool`` pipeline (which does ``func=self._run``)
+    ends up calling our gated ``_run``, not the wrapped tool's bare
+    ``_run``.
 
-Subclass v0.5.1: "every gated method is explicitly overridden on this
-class; the canary integration test (``test_at_real_crewai.py``) trips if
-upstream adds a new dispatch path that bypasses our overrides." Pydantic
-``PrivateAttr`` keeps internal references (``_tool``, ``_guard``,
-``_scope``) off ``model_fields`` and out of ``model_dump`` payloads.
+The defense contract: every gated method is explicitly overridden on
+this class; the canary integration test (``test_at_real_crewai.py``)
+trips if upstream adds a new dispatch path that bypasses our overrides.
+Pydantic ``PrivateAttr`` keeps internal references (``_tool``,
+``_guard``, ``_scope``) off ``model_fields`` and out of ``model_dump``
+payloads.
 
 Lazy framework import
 ---------------------
@@ -174,9 +146,10 @@ def _build_guarded_class() -> type:
         """Hybrid subclass-and-override wrapper around a CrewAI ``BaseTool``.
 
         Subclasses ``BaseTool`` so framework-side ``isinstance`` checks
-        succeed natively (closes the v0.5.0 pydantic-2.12 / CrewAI 1.x
-        regression). Every entry point the framework calls is explicitly
-        overridden to gate via :meth:`Guard.check` before forwarding.
+        succeed natively (pydantic 2.12 / CrewAI 1.x reject virtual-
+        subclass registration). Every entry point the framework calls
+        is explicitly overridden to gate via :meth:`Guard.check` before
+        forwarding.
         """
 
         # Pydantic private attributes — held on the instance but not part

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/agentguard/adapters/langchain.py

@@ -1,31 +1,20 @@
 """
-AgentGuard LangChain Adapter (v0.5.1 hybrid: subclass + override)
+AgentGuard LangChain Adapter — subclass + override.
 
 Wraps LangChain tools so every invocation passes through AgentGuard policy
 checks.
 
-Why this file changed in v0.5.1
--------------------------------
-v0.5.0 implemented ``GuardedTool`` as a *composition* wrapper (the wrapper
-held a wrapped LangChain tool via ``self.__tool`` and forbade attribute
-access through a strict ``__getattr__`` allowlist). That kept the gate
-tight but broke at framework boundaries:
-
-  * langgraph 1.0 + langchain_core 1.x's ``coerce_to_runnable`` runs
-    ``isinstance(thing, Runnable)`` and rejects composition wrappers.
-  * langchain 1.x's ``langchain.agents.create_agent`` (the successor to
-    the deprecated ``create_react_agent``) uses the same isinstance
-    check. The integration test had to wrap GuardedTool in a
-    ``Tool.from_function(func=lambda x: gt.invoke(x))`` to register it
-    with the agent — that workaround is no longer required after v0.5.1.
-
-The v0.5.1 fix: subclass ``langchain_core.tools.BaseTool`` so isinstance
-passes natively, and preserve the policy-enforcement contract by
-overriding **every** entry point the framework calls. The
-"every-method-is-on-this-class" property substitutes for the
-composition-era ``__getattr__`` allowlist.
-
-Gated methods (each calls ``Guard.check`` before forwarding):
+Architecture
+------------
+``GuardedTool`` subclasses ``langchain_core.tools.BaseTool`` directly
+so ``isinstance(thing, Runnable)`` and ``isinstance(thing, BaseTool)``
+checks succeed natively. langgraph 1.0 + langchain_core 1.x's
+``coerce_to_runnable`` and langchain 1.x's
+``langchain.agents.create_agent`` both reject composition wrappers,
+so the subclass approach is the only one that registers cleanly.
+
+To keep the gate tight without an ``__getattr__`` allowlist, **every**
+entry point the framework calls is explicitly overridden:
 
   - ``_run`` (abstract on the parent — required by the subclass) — the
     canonical sync dispatch path; ``BaseTool.run`` calls into ``_run``
@@ -39,19 +28,14 @@ Gated methods (each calls ``Guard.check`` before forwarding):
     gating is a v0.6 issue.
   - ``batch`` / ``abatch`` — gate each input independently; first DENY
     raises for the whole batch (whole-batch-fails-on-first-deny).
-  - ``run`` / ``arun`` — legacy entries; preserve v0.4.x string-on-deny
-    semantics (kept for backward compat).
-
-The new defense contract
-------------------------
-Composition v0.5.0: "no parent methods are exposed; ``__getattr__`` is
-the single chokepoint."
+  - ``run`` / ``arun`` — legacy entries; preserve string-on-deny
+    semantics for callers that depend on it.
 
-Subclass v0.5.1: "every gated method is explicitly overridden on this
-class. Pydantic ``PrivateAttr`` keeps internal references off
+The defense contract: every gated method is explicitly overridden on
+this class. Pydantic ``PrivateAttr`` keeps internal references off
 ``model_fields`` and out of ``model_dump`` payloads. The canary
-integration test (``test_at_real_langchain.py``) trips if upstream adds
-a new dispatch path that bypasses our overrides."
+integration test (``test_at_real_langchain.py``) trips if upstream
+adds a new dispatch path that bypasses our overrides.
 
 Lazy framework import
 ---------------------
@@ -65,10 +49,9 @@ the ``GuardedTool`` symbol is a callable factory that raises a clear
 Stream gating limitation
 ========================
 
-For ``stream``/``astream`` the gate fires **once** at stream open.
-Mid-stream tool calls (rare in v0.4 LangChain, increasingly common in
-agent loops with chunk-driven side-effects) bypass the gate. v0.6 issue
-title: ``langchain: per-chunk policy gating in stream()/astream()``.
+For ``stream`` / ``astream`` the gate fires **once** at stream open.
+Mid-stream tool calls bypass the gate. TODO(v0.6): per-chunk gating
+in ``stream()`` / ``astream()``.
 """
 
 from __future__ import annotations
@@ -143,10 +126,10 @@ def _build_guarded_tool_class() -> type:
         """Hybrid subclass-and-override wrapper around a LangChain ``BaseTool``.
 
         Subclasses ``BaseTool`` so framework-side ``isinstance(thing,
-        Runnable)`` checks succeed natively (closes the v0.5.0 langgraph
-        1.0 / langchain_core 1.x regression). Every entry point the
-        framework calls is explicitly overridden to gate via Guard.check
-        before forwarding.
+        Runnable)`` checks succeed natively (langgraph 1.0 /
+        langchain_core 1.x reject composition wrappers). Every entry
+        point the framework calls is explicitly overridden to gate via
+        Guard.check before forwarding.
         """
 
         # Pydantic private attrs — held on the instance but not part of
@@ -504,7 +487,8 @@ def _build_guarded_tool_class() -> type:
             return await self._tool.abatch(inputs, config=config, **kwargs)
 
         # --------------------------------------------------------------
-        # Legacy API (run / arun) — string-on-deny preserved for v0.4.x
+        # Legacy API (run / arun) — string-on-deny shape preserved for
+        # callers that depend on it; new code should prefer invoke().
         # --------------------------------------------------------------
 
         def run(  # type: ignore[override]
@@ -515,9 +499,9 @@ def _build_guarded_tool_class() -> type:
         ) -> Any:
             """Run the tool (legacy entry).
 
-            Returns a string message on DENY / REQUIRE_APPROVAL to preserve
-            v0.4.x behavior; new code should prefer ``invoke`` so failures
-            surface as exceptions.
+            Returns a string message on DENY / REQUIRE_APPROVAL (legacy
+            shape). New code should prefer ``invoke`` so failures surface
+            as exceptions.
             """
             result = self._gate(tool_input)
             inner = self._tool

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/agentguard/adapters/mcp.py

@@ -76,7 +76,7 @@ def _infer_check_params_for(tool: "ToolDefinition", arguments: dict) -> dict:
     Both the in-process server and the gateway need identical inference +
     redaction. Defining the logic once at module scope keeps the gateway
     from awkwardly invoking the unbound server method on a non-server
-    ``self`` (the v0.5 R7 E6 gateway preview is its own class).
+    ``self`` (the gateway is its own class).
     """
     from urllib.parse import urlparse  # local import — only used here
 
@@ -181,8 +181,8 @@ class GuardedMCPServer:
         """Delegate to :func:`_infer_check_params_for`.
 
         Kept as a method for back-compat with any subclass / test that
-        already binds it; the real logic (and v0.5 R7 T7 redaction) lives
-        in the module-level helper so :class:`GuardedMCPGateway` can
+        binds it; the real logic (including secret redaction) lives in
+        the module-level helper so :class:`GuardedMCPGateway` can
         reuse it without instantiating a server.
         """
         return _infer_check_params_for(tool, arguments)
@@ -194,19 +194,17 @@ class GuardedMCPServer:
         params = request.get("params", {})
 
         if method == "initialize":
-            # MCP clients advertise their protocol version in params. We pin to
-            # MCP_PROTOCOL_VERSION and do not yet negotiate — real negotiation
-            # is a v0.5.0 design item. If the client wants a different version
-            # (usually newer), log a single WARN to stderr so operators can
-            # see version drift, then respond with our pinned version. stdout
-            # is reserved for JSON-RPC on the stdio transport, so the warning
-            # MUST go to stderr.
+            # MCP clients advertise their protocol version in params. We pin
+            # to MCP_PROTOCOL_VERSION and do not yet negotiate. If the client
+            # wants a different version (usually newer), log a single WARN to
+            # stderr so operators can see version drift, then respond with
+            # our pinned version. stdout is reserved for JSON-RPC on the
+            # stdio transport, so the warning MUST go to stderr.
             client_version = params.get("protocolVersion") if isinstance(params, dict) else None
             if client_version and client_version != MCP_PROTOCOL_VERSION:
                 sys.stderr.write(
                     f"WARN agentguard.mcp: client requested protocolVersion "
-                    f"{client_version!r}, pinning to {MCP_PROTOCOL_VERSION!r} "
-                    f"(negotiation is a v0.5.0 design item)\n"
+                    f"{client_version!r}, pinning to {MCP_PROTOCOL_VERSION!r}\n"
                 )
                 sys.stderr.flush()
             return {
@@ -349,15 +347,15 @@ class GuardedMCPServer:
     def run(self):
         """Run the MCP server on stdio (blocking).
 
-        v0.5 (R5 E6, S9): each frame is processed inside a guard so that
-        a single malformed JSON line, a handler exception, or a
-        downstream-side error does not crash the adapter. Claude Desktop
-        (and similar long-lived MCP clients) keep one stdio session open
-        for the whole session — surviving a bad frame means the user
-        does not have to restart their editor every time a tool throws.
+        Each frame is processed inside a guard so a single malformed
+        JSON line, a handler exception, or a downstream-side error does
+        not crash the adapter. Claude Desktop (and similar long-lived
+        MCP clients) keep one stdio session open for the whole session
+        — surviving a bad frame means the user does not have to restart
+        their editor every time a tool throws.
 
         Behavior:
-        - blank / whitespace-only line: dropped silently (back-compat).
+        - blank / whitespace-only line: dropped silently.
         - JSON parse error: log to stderr, drop the frame. Best-effort
           JSON-RPC parse-error response is not emitted because the bad
           frame had no recoverable id.
@@ -431,8 +429,7 @@ class _UpstreamProcess:
     matching the stdio JSON-RPC pattern Claude Desktop and Cursor use.
     Server-initiated notifications (``listChanged`` etc.) are not
     forwarded; capability merging and namespaced tool prefixes are
-    deferred to v0.6's full Gateway implementation. v0.5 is a single
-    upstream, request/response only.
+    deferred. Single upstream, request/response only.
     """
 
     def __init__(self, command: list, env: Optional[dict] = None):
@@ -503,20 +500,21 @@ class _UpstreamProcess:
 class GuardedMCPGateway:
     """Single-upstream MCP gateway with AgentGuard in the middle.
 
-    v0.5 deliverable previewing the full Phase 4B Gateway. Spawns one
-    downstream MCP server (e.g. ``npx -y @modelcontextprotocol/server-filesystem``),
-    answers ``tools/list`` by forwarding to the downstream, and gates
-    every ``tools/call`` through ``Guard.check`` before forwarding.
+    Spawns one downstream MCP server (e.g.
+    ``npx -y @modelcontextprotocol/server-filesystem``), answers
+    ``tools/list`` by forwarding to the downstream, and gates every
+    ``tools/call`` through ``Guard.check`` before forwarding.
 
-    Limitations (closed in v0.6):
+    Limitations:
     - Single upstream — no capability merging.
     - No tool-name prefix / namespace separation.
     - Server-initiated notifications (``notifications/tools/list_changed``)
       are not forwarded.
     - No prompts/resources support — only ``tools/*`` is gated.
 
-    Use :class:`GuardedMCPServer` directly when you want to register
-    tools in code.
+    The full multi-upstream gateway lives in cmd/agentguard-mcp-gateway/
+    + pkg/mcpgw/. Use :class:`GuardedMCPServer` directly when you want
+    to register tools in code.
     """
 
     # Methods we always forward verbatim to the upstream.
@@ -549,7 +547,7 @@ class GuardedMCPGateway:
         Scope defaults to ``"shell"`` for unknown tools; ``_infer_check_params``
         upgrades to ``network`` / ``filesystem`` based on argument keys, so the
         default is mostly cosmetic. We do NOT try to read the description or
-        schema to guess a smarter scope — keep the gateway simple in v0.5.
+        schema to guess a smarter scope — the simple inference is the contract.
         """
         try:
             resp = self._upstream.request({
@@ -699,16 +697,16 @@ def main():
     """Entry point for running as ``python -m agentguard.adapters.mcp``.
 
     Modes:
-      - ``--upstream "<command...>"`` — gateway mode (R7 E6). Spawns the
+      - ``--upstream "<command...>"`` — gateway mode. Spawns the
         downstream MCP server given by the command, bridges JSON-RPC,
         and gates ``tools/call`` through AgentGuard. Example:
         ``python -m agentguard.adapters.mcp --guard-url http://localhost:8080
         --upstream "npx -y @modelcontextprotocol/server-filesystem /tmp"``.
-      - no ``--upstream`` — empty-server mode. The original v0.4.x
-        behavior, retained for back-compat with subclasses that
-        ``register tools in code``. Emits a stderr WARN so an operator
-        following the docs literally sees that no tools are registered
-        (instead of silently exposing a tool-less server to Claude
+      - no ``--upstream`` — empty-server mode. Retained for callers that
+        ``register tools in code`` via subclasses. Emits a stderr WARN
+        so an operator following the docs literally sees that no tools
+        are registered (instead of silently exposing a tool-less server
+        to Claude
         Desktop).
     """
     import argparse

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/agentguardproxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentguardproxy
-Version: 0.5.1
+Version: 0.5.2
 Summary: Python SDK for AgentGuard — the firewall for AI agents
 Author-email: Cauã Ferraz <cauaferrazp@gmail.com>
 License-Expression: Apache-2.0
@@ -12,14 +12,13 @@ Keywords: ai,agents,firewall,policy,guardrails,safety
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Provides-Extra: langchain
 Requires-Dist: langchain-core<2.0,>=0.3; extra == "langchain"

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/pyproject.toml

@@ -4,18 +4,18 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentguardproxy"
-version = "0.5.1"
+version = "0.5.2"
 description = "Python SDK for AgentGuard — the firewall for AI agents"
 readme = "README.md"
 license = "Apache-2.0"
-# requires-python: 3.9 floor.
+# requires-python: 3.10 floor.
 #
-# v0.5 drops 3.8 (R1 E1). 3.8 reached upstream end-of-life in October 2024 and
-# the pinned framework extras (langchain >=0.3, crewai >=0.80, mcp >=0.9) all
-# require 3.9+ themselves; keeping 3.8 in the trove only invited a broken
-# `pip install agentguardproxy[langchain]` resolution. The CI matrix exercises
-# 3.9, 3.10, 3.11, 3.12 on every push.
-requires-python = ">=3.9"
+# 3.8 was dropped in v0.5.0 (upstream EOL October 2024). 3.9 was dropped
+# after upstream EOL (October 2025) — the `mcp` PyPI extra requires >=3.10
+# anyway, so keeping 3.9 in the trove invited a broken
+# `pip install agentguardproxy[mcp]` resolution. The CI matrix exercises
+# 3.10, 3.11, 3.12 on every push.
+requires-python = ">=3.10"
 authors = [
     { name = "Cauã Ferraz", email = "cauaferrazp@gmail.com" },
 ]
@@ -23,7 +23,6 @@ classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/tests/test_adapters_extended.py

@@ -111,11 +111,11 @@ class TestLangChainExtended:
         assert body["action"] == "write"
 
     def test_attribute_proxy_blocked(self, mock_server):
-        """v0.5.1: arbitrary attribute access is blocked.
+        """v0.5.0: arbitrary attribute access is blocked.
 
         v0.5.0 used a composition wrapper with a custom ``__getattr__``
         allowlist that raised AttributeError with a "bypass" message.
-        v0.5.1 switches to subclassing ``langchain_core.tools.BaseTool``,
+        v0.5.0 switches to subclassing ``langchain_core.tools.BaseTool``,
         so unknown attributes raise pydantic's standard "no such field"
         AttributeError instead. The security property is unchanged: the
         wrapper does not proxy arbitrary attributes to the wrapped tool.

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/tests/test_crewai.py

@@ -262,7 +262,7 @@ class TestApprovalPath:
 
 
 # ---------------------------------------------------------------------------
-# Defense contract under the v0.5.1 hybrid pattern.
+# Defense contract under the v0.5.0 hybrid pattern.
 #
 # v0.5.0 used a composition wrapper with a strict ``__getattr__`` allowlist
 # — every parent / unknown attribute access raised AttributeError. That
@@ -270,7 +270,7 @@ class TestApprovalPath:
 # BaseTool)`` failed (virtual-subclass registrations are no longer honored
 # by pydantic).
 #
-# v0.5.1 switches to a hybrid pattern: GuardedCrewTool **subclasses**
+# v0.5.0 switches to a hybrid pattern: GuardedCrewTool **subclasses**
 # CrewAI's ``BaseTool`` so the framework's isinstance check passes, and
 # every dispatch entry point (``run``, ``_run``, ``invoke``, ``ainvoke``,
 # ``__call__``, ``_arun``, ``arun``, ``to_structured_tool``) is explicitly

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/tests/test_guard.py

@@ -134,7 +134,7 @@ class TestGuardCheck:
     def test_check_unreachable_fail_open(self):
         """fail_mode='allow' turns unreachable into ALLOW.
 
-        Locks the Phase-5.1 parity-prep contract: the default is still
+        Locks the Phase-5.0 parity-prep contract: the default is still
         'deny' (see test_check_unreachable_fails_closed), and an explicit
         'allow' is required to opt into fail-open — mirroring the TS SDK
         where `failMode: 'allow'` has always been an explicit opt-in.

{agentguardproxy-0.5.1 → agentguardproxy-0.5.2}/tests/test_langchain.py

@@ -275,8 +275,15 @@ class TestBatch:
 
         out = gt.batch(["a", "b", "c"])
 
+        # `out` order matches input order (LangChain's batch preserves
+        # input/output alignment) but `calls` records execution order,
+        # which is non-deterministic when batch runs concurrently. The
+        # original assertion `calls == ["a","b","c"]` passed by luck on
+        # Python 3.10-3.12 schedulers but flaked on 3.13. Compare sorted
+        # so the assertion captures "all three inputs ran exactly once"
+        # without depending on the scheduler.
         assert out == ["echo:a", "echo:b", "echo:c"]
-        assert calls == ["a", "b", "c"]
+        assert sorted(calls) == ["a", "b", "c"]
 
     def test_guardedtool_batch_denies_first(self, mock_server_indexed):
         """First entry DENY → batch raises with index 0 in the message,
@@ -331,9 +338,9 @@ class TestBatch:
 
 
 # ---------------------------------------------------------------------------
-# Defense contract under the v0.5.1 hybrid pattern.
+# Defense contract under the v0.5.0 hybrid pattern.
 #
-# v0.5.0 used composition + a strict ``__getattr__`` allowlist; v0.5.1
+# v0.5.0 used composition + a strict ``__getattr__`` allowlist; v0.5.0
 # subclasses langchain_core.tools.BaseTool so isinstance(thing, Runnable)
 # succeeds at framework boundaries (langgraph 1.0 / langchain_core 1.x)
 # and overrides every dispatch entry to keep gating tight.