datalayer-agent-shield 0.1.1__tar.gz

datalayer_agent_shield-0.1.1/.gitignore

@@ -0,0 +1,141 @@
+*.egg-info/
+.ipynb_checkpoints
+
+# Node / TypeScript (the @datalayer/agent-shield package)
+node_modules/
+*.tsbuildinfo
+package-lock.json
+
+# Created by https://www.gitignore.io/api/python
+# Edit at https://www.gitignore.io/?templates=python
+
+### Python ###
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+dist/
+downloads/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+.installed.cfg
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Environment variables:
+.env
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# pyenv
+.python-version
+
+# celery beat schedule file
+celerybeat-schedule
+
+# SageMath parsed files
+*.sage.py
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# Mr Developer
+.mr.developer.cfg
+.project
+.pydevproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# ruff
+.ruff_cache
+
+# Pyre type checker
+.pyre/
+
+# End of https://www.gitignore.io/api/python
+
+# OSX files
+.DS_Store
+
+# Include
+!**/.*ignore
+!**/.*rc
+!**/.*rc.js
+!**/.*rc.json
+!**/.*rc.yml
+!**/.*config
+!*.*rc.json
+!.github
+!.devcontainer
+
+untracked_notebooks/*
+.jupyter_ystore
+.jupyter_ystore.db
+docs/.yarn/*
+
+uv.lock
+
+generated
+skills
+examples/agent/*.txt
+
+launcher.py
+
+!docs/docs/skills
+!examples/**/skills
+!skills

datalayer_agent_shield-0.1.1/CHANGELOG.md

@@ -0,0 +1,43 @@
+<!--
+  ~ Copyright (c) 2025-2026 Datalayer, Inc.
+  ~
+  ~ BSD 3-Clause License
+-->
+
+# Changelog
+
+## 0.1.1
+
+The package made real (SHIELD.md Phase 0: SH-07, SH-02, SH-08, SH-09, SH-04).
+
+- `agent_shield.policy`: the policy document (one schema, published as
+  `schema/policy.schema.json`), the six classes of STUDIO F-10, three scopes
+  strictest first, *first decision wins*, stateful limits with soft and hard
+  thresholds, `decide(action, context, policies) -> Decision` pure and tested;
+  the default policy of decision 5.
+- `agent_shield.register`: the harness register read from spec-shaped
+  documents, with `claude-code`, `codex`, `gemini-cli`, `goose`, `opencode`
+  and `openhands`, each with its terms, credential kind, pinned version and
+  where it was checked; a harness without terms is not in the catalogue.
+- `agent_shield.acp`: the stdio and WebSocket `ACPChannel` on the official
+  SDK (protocol version 1), the normaliser of `session/update` into the
+  package's neutral events (a malformed update ends the turn in a sentence),
+  the workspace that answers `fs/*` and `terminal/*`, and the **proxy**:
+  `agent-shield run -- <command>`, an ACP agent in front of the agent it
+  launched, permissions decided by the policy, tool calls classed and
+  limited, files and terminals confined to the workspace, `mcpServers`
+  rewritten to the allow-list, every action in `~/.agent-shield/audit.jsonl`.
+- `agent-shield setup | run | log | policy show | policy schema | policy init |
+  harnesses | upgrade [--check] | uninstall`; `serve` says it is not built.
+- `@datalayer/agent-shield`: the policy types and the decisions' sentences,
+  checked against the same schema in `npm test`.
+- The agent-teams scaffold's leftovers removed (the demo extra, the
+  orchestration extension, the team CI step); the `datalayer.cli` and
+  `datalayer.reactor.cli` entry points real and import-safe.
+
+## 0.1.0
+
+The name reservation: the Python distribution is **`datalayer-agent-shield`**
+(PyPI refused `agent-shield` as too close to an existing project); the import
+stays `agent_shield`, the npm package `@datalayer/agent-shield`, the repository
+`datalayer/agent-shield`. Nothing but the version was in it.

datalayer_agent_shield-0.1.1/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2025, Datalayer
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

datalayer_agent_shield-0.1.1/PKG-INFO

@@ -0,0 +1,225 @@
+Metadata-Version: 2.5
+Name: datalayer-agent-shield
+Version: 0.1.1
+Summary: Datalayer Agent Shield: a runtime firewall for every agent
+Project-URL: Home, https://github.com/datalayer/agent-shield
+Project-URL: Documentation, https://agent-shield.datalayer.tech
+Author-email: Datalayer <info@datalayer.io>
+License: BSD 3-Clause License
+        
+        Copyright (c) 2025, Datalayer
+        All rights reserved.
+        
+        Redistribution and use in source and binary forms, with or without
+        modification, are permitted provided that the following conditions are met:
+        
+        1. Redistributions of source code must retain the above copyright notice, this
+           list of conditions and the following disclaimer.
+        
+        2. Redistributions in binary form must reproduce the above copyright notice,
+           this list of conditions and the following disclaimer in the documentation
+           and/or other materials provided with the distribution.
+        
+        3. Neither the name of the copyright holder nor the names of its
+           contributors may be used to endorse or promote products derived from
+           this software without specific prior written permission.
+        
+        THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+        AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+        IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+        DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+        FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+        DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+        SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+        CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+        OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+        OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+License-File: LICENSE
+Keywords: ACP,AI,Agents,Datalayer,Firewall,Policy,Shield
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.10
+Requires-Dist: agent-client-protocol<0.8,>=0.7.1
+Requires-Dist: agentspecs>=0.0.100
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: typer>=0.9
+Provides-Extra: all
+Requires-Dist: websockets>=13; extra == 'all'
+Provides-Extra: claude-code
+Provides-Extra: codex
+Provides-Extra: gemini-cli
+Provides-Extra: goose
+Provides-Extra: lint
+Requires-Dist: mdformat-gfm>=0.3.5; extra == 'lint'
+Requires-Dist: mdformat>0.7; extra == 'lint'
+Requires-Dist: ruff; extra == 'lint'
+Provides-Extra: opencode
+Provides-Extra: openhands
+Provides-Extra: test
+Requires-Dist: pytest-asyncio>=0.21; extra == 'test'
+Requires-Dist: pytest-timeout>=2.0; extra == 'test'
+Requires-Dist: pytest>=7.0; extra == 'test'
+Requires-Dist: tomli>=2; (python_version < '3.11') and extra == 'test'
+Requires-Dist: websockets>=13; extra == 'test'
+Provides-Extra: typing
+Requires-Dist: mypy>=0.990; extra == 'typing'
+Provides-Extra: websocket
+Requires-Dist: websockets>=13; extra == 'websocket'
+Description-Content-Type: text/markdown
+
+<!--
+  ~ Copyright (c) 2025-2026 Datalayer, Inc.
+  ~
+  ~ BSD 3-Clause License
+-->
+
+[![Datalayer](https://images.datalayer.io/legacy/datalayer-25.svg)](https://datalayer.ai)
+
+[![Become a Sponsor](https://img.shields.io/static/v1?label=Become%20a%20Sponsor&message=%E2%9D%A4&logo=GitHub&style=flat&color=1ABC9C)](https://github.com/sponsors/datalayer)
+
+# 🤖 🛡️ Agent Shield
+
+[![PyPI - Version](https://img.shields.io/pypi/v/datalayer-agent-shield)](https://pypi.org/project/datalayer-agent-shield)
+[![npm](https://img.shields.io/npm/v/%40datalayer%2Fagent-shield)](https://www.npmjs.com/package/@datalayer/agent-shield)
+
+**A runtime firewall for every agent.** Deploy a shield with each agent. Enforce
+permissions before actions execute, manage policies centrally, and retain an
+audit trail.
+
+The Shield stands between an agent and the world. Its first shippable is the
+**proxy**: `agent-shield run -- <an ACP agent's command>` starts the agent as
+its subprocess and stands as an [Agent Client Protocol](https://agentclientprotocol.com)
+agent on its own stdio, so any ACP client — Zed, `vscode-acp`, Marimo,
+Datalayer's runtimes — talks to the Shield and the Shield talks to the agent.
+In between it decides:
+
+- `session/request_permission` by the policy: *do it* is answered without the
+  client, *ask me first* is forwarded with the same options and answered as
+  the person chose, *leave it to me* is refused in a sentence the person sees;
+- the agent's `tool_call` notifications are classed (ACP `kind` → `read`,
+  `write`, `delete`, `execute`; `other` fails closed to `write`) and held to
+  the session's limits; a refusal cancels the turn and says why;
+- `fs/*` and `terminal/*` are answered by the Shield against the **workspace**
+  — a path outside it is refused, a command runs with a trimmed environment
+  — and every one is a tool row the client sees;
+- `mcpServers` are rewritten so the agent gets only what the policy lends;
+- every action and decision is a line of `~/.agent-shield/audit.jsonl`,
+  credentials redacted, a file's content never in it.
+
+## The first five minutes
+
+```bash
+pip install "datalayer-agent-shield[claude-code]"   # one extra per harness
+agent-shield setup        # finds node, the vendor CLIs and the credentials present; installs the pinned adapter into ~/.agent-shield/harnesses/<id>@<version>; writes agent-shield.yaml beside the project
+agent-shield run -- claude-agent-acp               # Claude Code behind the Shield, on this directory, with the default policy
+```
+
+Measured on 15 October 2026 from a clean prefix: `setup` took **27 s**
+(the adapter `@agentclientprotocol/claude-agent-acp@0.91.0`, 325 MB, through
+`npm install --prefix`, never a global `npx`); `run` initialized the adapter
+and opened a session in **1.5 s**; the first decision followed the first tool
+call. The whole, from `pip install` to a decision seen in the terminal, is
+under a minute, five times under the five minutes of SHIELD §5.3.
+
+`setup` asks for nothing it finds: it says which credentials are present by
+name (never a value), which are missing and how to export them, and stores
+no secret. It refuses, in a sentence, a credential the register forbids — a
+Claude Code or ChatGPT subscription login where only an API key serves to
+third parties, a Google login on Gemini's individuals tier.
+
+Then:
+
+```bash
+agent-shield log                 # the audit, one line per action and decision
+agent-shield policy show         # every line of the policy in force, and where it came from
+agent-shield policy schema       # the document's JSON Schema
+agent-shield harnesses           # the register: each harness, its terms, where they were read
+agent-shield upgrade --check     # a newer Shield or adapter?
+agent-shield upgrade             # move the adapters to the register's pinned versions
+agent-shield uninstall           # previews; --yes removes the adapters and the config, keeps the audit and the policy
+```
+
+Zed, `settings.json`:
+
+```json
+"agent_servers": {
+  "Claude Code behind the Shield": { "command": "agent-shield", "args": ["run", "--", "claude-agent-acp"] }
+}
+```
+
+## The policy
+
+One document per scope — `organization`, `team`, `session` — in
+`agent-shield.yaml` beside the project (else `~/.agent-shield/agent-shield.yaml`),
+with the schema in [`schema/policy.schema.json`](schema/policy.schema.json).
+The strictest scope decides first and **the first decision wins**; a scope
+that says nothing passes the action down; nothing a rule names falls to
+*ask me first*, never to *do it*.
+
+The default `setup` writes: read and search inside the workspace — do it;
+edit and move inside it — do it, shown as diffs; delete, run a command, and
+any path outside the workspace — ask me first; a command naming a credential,
+`sudo`, a package install from the network, or `git push` — ask me first with
+the command shown; a fetch — through `network.fetch`'s allow-list, which is
+empty, so refused; send or buy — ask me first. Limits: 100 then 200 tool
+calls, 4 then 8 terminals, 5 then 20 MiB written — a **soft** threshold asks
+once, a **hard** one refuses each call that would cross it and says what would
+let the session go on.
+
+```yaml
+scope: session
+rules:
+  - name: read inside the workspace
+    decision: allow
+    classes: [read]
+    where: inside
+  - name: git push
+    decision: ask
+    classes: [execute]
+    commands: ['\bgit\b[^;&|]*\bpush\b']
+limits:
+  tool_calls: {soft: 100, hard: 200}
+network:
+  fetch: []
+mcp:
+  allow: []
+```
+
+`agent_shield.policy.decide(action, context, policies)` is pure: it answers
+`allow | ask | deny`, the sentence, and the scope and rule that decided.
+
+## What is built, and what is not
+
+Built (0.1.1, SHIELD.md Phase 0): the policy engine and its schema; the
+register read from [agentspecs](https://github.com/datalayer/agentspecs)
+(`claude-code`, `codex`, `gemini-cli`, `goose`, `opencode`, `openhands`,
+`fast-agent`); the stdio and WebSocket client channels on the official
+`agent-client-protocol` SDK (protocol version 1); the proxy, which passes the
+[ACP Test Compatibility Kit](https://github.com/agentclientprotocol/acp-tck)
+in front of the test agent (`VERDICT: CONFORMANT`); the audit; the
+`agent-shield` command; `@datalayer/agent-shield`'s policy types.
+
+Not built: `agent-shield serve` (the proxy over WebSocket, SH-52);
+registration with Datalayer and the policy pulled from IAM (SH-47, SH-50);
+the OTEL export (SH-51); the Shield report and conformance (SH-36, SH-60);
+the TypeScript renderers of diffs and terminals (SH-53).
+
+Claude Code has been run behind the proxy (`claude-agent-acp` 0.91.0:
+initialize, session, modes); a turn needs a funded Anthropic API key.
+
+## Development
+
+```bash
+pip install -e ".[test]"
+pytest tests/ -q
+npm install && npm test            # the TypeScript types against schema/policy.schema.json
+make tck                            # the ACP TCK against the proxy (uv tool install acp-tck first)
+```
+
+## Documentation
+
+[agent-shield.datalayer.tech](https://agent-shield.datalayer.tech)

datalayer_agent_shield-0.1.1/README.md

@@ -0,0 +1,152 @@
+<!--
+  ~ Copyright (c) 2025-2026 Datalayer, Inc.
+  ~
+  ~ BSD 3-Clause License
+-->
+
+[![Datalayer](https://images.datalayer.io/legacy/datalayer-25.svg)](https://datalayer.ai)
+
+[![Become a Sponsor](https://img.shields.io/static/v1?label=Become%20a%20Sponsor&message=%E2%9D%A4&logo=GitHub&style=flat&color=1ABC9C)](https://github.com/sponsors/datalayer)
+
+# 🤖 🛡️ Agent Shield
+
+[![PyPI - Version](https://img.shields.io/pypi/v/datalayer-agent-shield)](https://pypi.org/project/datalayer-agent-shield)
+[![npm](https://img.shields.io/npm/v/%40datalayer%2Fagent-shield)](https://www.npmjs.com/package/@datalayer/agent-shield)
+
+**A runtime firewall for every agent.** Deploy a shield with each agent. Enforce
+permissions before actions execute, manage policies centrally, and retain an
+audit trail.
+
+The Shield stands between an agent and the world. Its first shippable is the
+**proxy**: `agent-shield run -- <an ACP agent's command>` starts the agent as
+its subprocess and stands as an [Agent Client Protocol](https://agentclientprotocol.com)
+agent on its own stdio, so any ACP client — Zed, `vscode-acp`, Marimo,
+Datalayer's runtimes — talks to the Shield and the Shield talks to the agent.
+In between it decides:
+
+- `session/request_permission` by the policy: *do it* is answered without the
+  client, *ask me first* is forwarded with the same options and answered as
+  the person chose, *leave it to me* is refused in a sentence the person sees;
+- the agent's `tool_call` notifications are classed (ACP `kind` → `read`,
+  `write`, `delete`, `execute`; `other` fails closed to `write`) and held to
+  the session's limits; a refusal cancels the turn and says why;
+- `fs/*` and `terminal/*` are answered by the Shield against the **workspace**
+  — a path outside it is refused, a command runs with a trimmed environment
+  — and every one is a tool row the client sees;
+- `mcpServers` are rewritten so the agent gets only what the policy lends;
+- every action and decision is a line of `~/.agent-shield/audit.jsonl`,
+  credentials redacted, a file's content never in it.
+
+## The first five minutes
+
+```bash
+pip install "datalayer-agent-shield[claude-code]"   # one extra per harness
+agent-shield setup        # finds node, the vendor CLIs and the credentials present; installs the pinned adapter into ~/.agent-shield/harnesses/<id>@<version>; writes agent-shield.yaml beside the project
+agent-shield run -- claude-agent-acp               # Claude Code behind the Shield, on this directory, with the default policy
+```
+
+Measured on 15 October 2026 from a clean prefix: `setup` took **27 s**
+(the adapter `@agentclientprotocol/claude-agent-acp@0.91.0`, 325 MB, through
+`npm install --prefix`, never a global `npx`); `run` initialized the adapter
+and opened a session in **1.5 s**; the first decision followed the first tool
+call. The whole, from `pip install` to a decision seen in the terminal, is
+under a minute, five times under the five minutes of SHIELD §5.3.
+
+`setup` asks for nothing it finds: it says which credentials are present by
+name (never a value), which are missing and how to export them, and stores
+no secret. It refuses, in a sentence, a credential the register forbids — a
+Claude Code or ChatGPT subscription login where only an API key serves to
+third parties, a Google login on Gemini's individuals tier.
+
+Then:
+
+```bash
+agent-shield log                 # the audit, one line per action and decision
+agent-shield policy show         # every line of the policy in force, and where it came from
+agent-shield policy schema       # the document's JSON Schema
+agent-shield harnesses           # the register: each harness, its terms, where they were read
+agent-shield upgrade --check     # a newer Shield or adapter?
+agent-shield upgrade             # move the adapters to the register's pinned versions
+agent-shield uninstall           # previews; --yes removes the adapters and the config, keeps the audit and the policy
+```
+
+Zed, `settings.json`:
+
+```json
+"agent_servers": {
+  "Claude Code behind the Shield": { "command": "agent-shield", "args": ["run", "--", "claude-agent-acp"] }
+}
+```
+
+## The policy
+
+One document per scope — `organization`, `team`, `session` — in
+`agent-shield.yaml` beside the project (else `~/.agent-shield/agent-shield.yaml`),
+with the schema in [`schema/policy.schema.json`](schema/policy.schema.json).
+The strictest scope decides first and **the first decision wins**; a scope
+that says nothing passes the action down; nothing a rule names falls to
+*ask me first*, never to *do it*.
+
+The default `setup` writes: read and search inside the workspace — do it;
+edit and move inside it — do it, shown as diffs; delete, run a command, and
+any path outside the workspace — ask me first; a command naming a credential,
+`sudo`, a package install from the network, or `git push` — ask me first with
+the command shown; a fetch — through `network.fetch`'s allow-list, which is
+empty, so refused; send or buy — ask me first. Limits: 100 then 200 tool
+calls, 4 then 8 terminals, 5 then 20 MiB written — a **soft** threshold asks
+once, a **hard** one refuses each call that would cross it and says what would
+let the session go on.
+
+```yaml
+scope: session
+rules:
+  - name: read inside the workspace
+    decision: allow
+    classes: [read]
+    where: inside
+  - name: git push
+    decision: ask
+    classes: [execute]
+    commands: ['\bgit\b[^;&|]*\bpush\b']
+limits:
+  tool_calls: {soft: 100, hard: 200}
+network:
+  fetch: []
+mcp:
+  allow: []
+```
+
+`agent_shield.policy.decide(action, context, policies)` is pure: it answers
+`allow | ask | deny`, the sentence, and the scope and rule that decided.
+
+## What is built, and what is not
+
+Built (0.1.1, SHIELD.md Phase 0): the policy engine and its schema; the
+register read from [agentspecs](https://github.com/datalayer/agentspecs)
+(`claude-code`, `codex`, `gemini-cli`, `goose`, `opencode`, `openhands`,
+`fast-agent`); the stdio and WebSocket client channels on the official
+`agent-client-protocol` SDK (protocol version 1); the proxy, which passes the
+[ACP Test Compatibility Kit](https://github.com/agentclientprotocol/acp-tck)
+in front of the test agent (`VERDICT: CONFORMANT`); the audit; the
+`agent-shield` command; `@datalayer/agent-shield`'s policy types.
+
+Not built: `agent-shield serve` (the proxy over WebSocket, SH-52);
+registration with Datalayer and the policy pulled from IAM (SH-47, SH-50);
+the OTEL export (SH-51); the Shield report and conformance (SH-36, SH-60);
+the TypeScript renderers of diffs and terminals (SH-53).
+
+Claude Code has been run behind the proxy (`claude-agent-acp` 0.91.0:
+initialize, session, modes); a turn needs a funded Anthropic API key.
+
+## Development
+
+```bash
+pip install -e ".[test]"
+pytest tests/ -q
+npm install && npm test            # the TypeScript types against schema/policy.schema.json
+make tck                            # the ACP TCK against the proxy (uv tool install acp-tck first)
+```
+
+## Documentation
+
+[agent-shield.datalayer.tech](https://agent-shield.datalayer.tech)

datalayer_agent_shield-0.1.1/agent_shield/__init__.py

@@ -0,0 +1,15 @@
+# Copyright (c) 2025-2026 Datalayer, Inc.
+#
+# BSD 3-Clause License
+
+"""Datalayer Agent Shield: a runtime firewall for every agent.
+
+The engine of the Shield (SHIELD.md §5.1): ``policy`` decides, ``acp`` runs
+an ACP agent behind the Shield and answers its files and terminals against
+the workspace, ``audit`` writes every action, ``register`` says which
+harnesses are served and on what terms, ``cli`` is ``agent-shield``.
+"""
+
+from .__version__ import __version__
+
+__all__ = ["__version__"]

datalayer_agent_shield-0.1.1/agent_shield/__version__.py

@@ -0,0 +1,7 @@
+# Copyright (c) 2025-2026 Datalayer, Inc.
+#
+# BSD 3-Clause License
+
+"""Agent Shield."""
+
+__version__ = "0.1.1"

datalayer_agent_shield-0.1.1/agent_shield/acp/__init__.py

@@ -0,0 +1,36 @@
+# Copyright (c) 2025-2026 Datalayer, Inc.
+#
+# BSD 3-Clause License
+
+"""ACP: the client-side channels, the normaliser, the workspace and the proxy (SHIELD §5.1)."""
+
+from .channel import (
+    SHIELD_CLIENT_CAPABILITIES,
+    SHIELD_CLIENT_INFO,
+    ACPChannel,
+    ChannelRefused,
+    ConnectionChannel,
+    StdioACPChannel,
+    WebSocketACPChannel,
+    build_handler,
+)
+from .events import Event
+from .normalize import MalformedUpdate, normalize
+from .workspace import OutsideWorkspace, Terminals, Workspace
+
+__all__ = [
+    "SHIELD_CLIENT_CAPABILITIES",
+    "SHIELD_CLIENT_INFO",
+    "ACPChannel",
+    "ChannelRefused",
+    "ConnectionChannel",
+    "Event",
+    "MalformedUpdate",
+    "OutsideWorkspace",
+    "StdioACPChannel",
+    "Terminals",
+    "WebSocketACPChannel",
+    "Workspace",
+    "build_handler",
+    "normalize",
+]