@permaegis/harness-claude

Wire the live PermAegis OCap gate into an Anthropic Claude Agent SDK PreToolUse hook or canUseTool permission callback — in one line.

A thin adapter over @permaegis/harness-core.

• OBSERVE (default): never blocks; the would-be verdict rides in the reason string.
• ENFORCE: a deny becomes a real "deny", and an unreachable gate fails CLOSED (deny).

npm install @permaegis/harness-claude @permaegis/harness-core

Usage

import { PermAegisHarness } from '@permaegis/harness-core';
import { permaegisCanUseTool } from '@permaegis/harness-claude';

const pa = new PermAegisHarness(process.env.PERMAEGIS_API_KEY); // pa_live_…

const options = {
  // grant: observe-first (agent holds the codec) — or grantId for a server-stored grant
  canUseTool: permaegisCanUseTool(pa, { grant: MY_GRANT, tier: 'enforce' }),
};

// for await (const msg of query({ prompt: '…', options })) { … }

Prefer a hook? permaegisPreToolUseHook(pa, { grant: MY_GRANT, tier: 'enforce' }) returns an async PreToolUse hook. The pure mappers toPreToolUseOutput / toCanUseToolResult are also exported for custom wiring.

License

MIT