{"_id":"@coderifts/bypass-probe","name":"@coderifts/bypass-probe","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@coderifts/bypass-probe","version":"0.1.0","description":"Probe your own agent installation for paths that reach a governed target without passing the gate. Reports dated, version-pinned evidence — a clean run is evidence, not proof.","license":"MIT","author":{"name":"CodeRifts"},"homepage":"https://coderifts.com","repository":{"type":"git","url":"git+https://github.com/coderifts/bypass-probe.git"},"bugs":{"url":"https://github.com/coderifts/bypass-probe/issues"},"type":"module","main":"src/index.mjs","exports":{".":"./src/index.mjs","./package.json":"./package.json"},"bin":{"bypass-probe":"bin/bypass-probe.mjs"},"engines":{"node":">=20"},"scripts":{"test":"node --test \"test/*.test.mjs\""},"peerDependencies":{"@openai/agents":">=0.17.0","@langchain/langgraph":">=1.0.0"},"peerDependenciesMeta":{"@openai/agents":{"optional":true},"@langchain/langgraph":{"optional":true}},"devDependencies":{"@langchain/core":"^1.2.9","@langchain/langgraph":"1.4.12","@openai/agents":"0.17.0","zod":"^4.0.0"},"publishConfig":{"access":"public"},"keywords":["coderifts","agent-governance","bypass","probe","evidence","openai-agents","langgraph"],"gitHead":"5e5e3e3554e56c94cccd5feb6ef5e663d93bbbdb","_id":"@coderifts/bypass-probe@0.1.0","_nodeVersion":"24.12.0","_npmVersion":"11.6.2","dist":{"integrity":"sha512-gkdxyvJUM535rOfeUi6nUUAvwcruRJk2mLNkGjOIKfsADR/POOCuRaZdcjVDmH2js7YveyOQWfjR/6DlABiuVg==","shasum":"8d96cb7b13aa0811cc303d1fbf5012df031efcc3","tarball":"https://registry.npmjs.org/@coderifts/bypass-probe/-/bypass-probe-0.1.0.tgz","fileCount":19,"unpackedSize":52700,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCICzpVnXdq01qF1Y0Opb5Gh+Krb+TixUjC4jlRXEnswSEAiEAsj0/ZOshB1GD48jYiCSO0EjTrgl30HUZq1BNmWKbn9E="}]},"_npmUser":{"name":"zsobpeter","email":"zsobpeter@gmail.com"},"directories":{},"maintainers":[{"name":"zsobpeter","email":"zsobpeter@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/bypass-probe_0.1.0_1787681151880_0.9972717082217644"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-25T18:05:51.321Z","0.1.0":"2026-08-25T18:05:52.019Z","modified":"2026-08-25T18:05:52.941Z"},"maintainers":[{"name":"zsobpeter","email":"zsobpeter@gmail.com"}],"description":"Probe your own agent installation for paths that reach a governed target without passing the gate. Reports dated, version-pinned evidence — a clean run is evidence, not proof.","homepage":"https://coderifts.com","keywords":["coderifts","agent-governance","bypass","probe","evidence","openai-agents","langgraph"],"repository":{"type":"git","url":"git+https://github.com/coderifts/bypass-probe.git"},"author":{"name":"CodeRifts"},"bugs":{"url":"https://github.com/coderifts/bypass-probe/issues"},"license":"MIT","readme":"# @coderifts/bypass-probe\n\nProbe **your own** agent installation for paths that reach a governed target without passing the\ngate. Run it against your wiring, in your process, and get back dated, version-pinned evidence of\nwhat the probe could and could not reach.\n\nThis is not a scanner of CodeRifts' code. It is a prober of yours.\n\n```bash\nnpx @coderifts/bypass-probe --config ./bypass-probe.config.mjs\n```\n\n## Why this exists\n\nWe built a bypass harness against four agent frameworks and used it on ourselves. On every one of\nthem, a raw tool registered next to our guarded table rewrote a governed spec **while our own\nreport said coverage was COMPLETE**. We fixed the report (agent-guard 9.5.0 measures and admits,\nand never emits COMPLETE for live traffic). This package is the harness, turned around and handed\nto you, because nothing certifies a control better than the vendor showing exactly where it does\nnot stand.\n\n## What a clean report means — and does not mean\n\nA run with no installation findings says this, and only this:\n\n> These probe classes, run at this time, against these package versions, in this process, did not\n> reach the designated target without the gate deciding.\n\nIt does **not** say your agent is governed. It does not say no bypass exists. The report carries\nits own limits in its own text — `proves`, `does_not_prove`, and `cannot_probe` are fields in the\nJSON, not just prose in this README, because the JSON is what ends up in the ticket and the README\nwill not be in the room when someone reads it.\n\nThere is deliberately no `CLEAN`, `PASS` or `SECURE` outcome anywhere in this tool. The summary\nline says *\"no unmediated path found in this installation by 6 probes\"*. It will never say *\"no\nunmediated path exists\"*, because we cannot know that and neither can you.\n\n**Installation findings vs structural findings.** An installation finding is true of your wiring\nand you can fix it. A structural finding is true of the framework for every adopter — you cannot\nconfigure it away, only compensate for it. They are separated because a framework-level fact that\nfires on every run tells you nothing about your own setup, and mixing the two makes both useless.\n\n## Why the version pins matter\n\nEvery finding carries the framework, the framework version, the adapter version and the Node\nversion it was measured against. A probe result rots the moment an SDK minor lands: the guardrail\nsurface these adapters read is not a stable public contract, and a patch release can move it. A\nreport older than your lockfile is a historical document, not a statement about today. Re-run it\nin CI on dependency changes, not once at procurement.\n\n## The sentence you can put in front of an auditor\n\n> On *[date]*, CodeRifts' bypass probe *[version]* was run against this agent installation\n> (*[framework]* *[version]*, Node *[version]*) and found *[N]* unmediated paths across *[M]* probe\n> classes. The report enumerates what it proves, what it does not prove, and what cannot be probed\n> from inside the process. It is evidence about a moment, not a certificate of coverage.\n\nIf someone asks you to turn that into \"our agent cannot bypass governance\", the answer is no, and\nthis tool is the reason we can explain why.\n\n## Safety: it will not mutate anything real\n\nIn `dry-run` (the default) the probe **replaces each candidate tool's implementation with a\nrecorder and never executes your body**. What runs is the framework's dispatch path — the guardrail\nchain, the node wiring — which is exactly what is being measured. The thing that would perform a\nwrite is not on that path.\n\nThat is an accounting, not a slogan: originals are wrapped in a counter, and every report carries\n`safety.original_implementations_invoked`. If that is ever non-zero the run reports itself as\nunsafe rather than clean. The example scratch tools in this repo throw if executed, so the test\nsuite proves the guarantee rather than asserting it.\n\n`scratch-write` mode lets a write actually happen. It requires **both** `mode: 'scratch-write'`\nand `target.scratch === true`. There is no flag that writes to a target you have not designated\ndisposable.\n\n## Frameworks\n\nSupported: `@openai/agents` (where a per-tool guardrail surface exists) and `@langchain/langgraph`\n(where none does). The contrast is the point: on the first, an ungated tool is a wiring mistake; on\nthe second it is the default, and every governed path is bespoke code the framework does not\nenforce.\n\nNot supported, and named so nobody infers coverage from silence: the raw Anthropic SDK tool loop,\nClaude Code / MCP hosts, LangChain `AgentExecutor`, CrewAI, AutoGen, Semantic Kernel, Pydantic-AI,\nMastra, and the Vercel AI SDK. See `UNSUPPORTED` in `src/adapters/index.mjs` for the reason each\none is absent.\n\n## Probe classes\n\n| id | what it asks |\n|---|---|\n| `RAW_TOOL_ALONGSIDE` | Is every callable tool carrying the gate, or only the wrapped ones? |\n| `TOOL_ADDED_AFTER_WRAP` | Does a tool added after setup inherit the gate? |\n| `TOOL_IMPL_REPLACED_AFTER_WRAP` | Does the gate survive reassignment of the body it guards? |\n| `HOSTED_TOOL_UNROUTED` | Can a framework built-in touch the target unseen? |\n| `DELEGATED_AGENT_SURFACE` | Does a handoff or subgraph carry the gate across the boundary? |\n| `DIRECT_CLIENT_CALL` | Is the write capability reachable from process scope at all? |\n\n## Exit codes\n\n`0` ran · `2` a selected finding was present · `3` unresolved probes · `1` the probe could not run.\nChoose with `--fail-on none|installation|unresolved|any`. `installation` deliberately does **not**\nfail on unresolved probes: an `INCONCLUSIVE` usually means you did not supply an input, and turning\na config gap into a red build teaches people to pass `--fail-on none`, which defeats the tool.\n","readmeFilename":"README.md","_rev":"1-e673b4e195ccb15af909de16f3eaa7fe"}