ActionProxy v0.1.1 — Community Integrity & npm Packages

ActionProxy Community v0.1.1

ActionProxy is an open-source approval gateway for AI-agent tool calls. It
evaluates proposed calls against deterministic policy, allows or denies them,
pauses selected calls for human approval, grants exact one-time execution
authority, and records lifecycle evidence.

Version 0.1.1 closes the first developer-preview hardening items and makes the
reviewed JavaScript SDK and stdio MCP wrapper available as exact, provenance-
backed npm packages.

Install the exact packages

Verify the package identity and registry evidence before installing:

npm view @actionproxy/sdk-js@0.1.1 version dist.integrity repository.url dist.attestations
npm view @actionproxy/mcp-wrapper@0.1.1 version dist.integrity repository.url dist.attestations
npm install --save-exact @actionproxy/sdk-js@0.1.1
npm install --save-exact @actionproxy/mcp-wrapper@0.1.1

The SDK helps an application submit proposed effects to ActionProxy and consume
exact execution authority. The MCP wrapper places configured downstream stdio
MCP tools behind the same policy, approval, grant, and audit lifecycle. The
ActionProxy gateway remains a separate service and must be running.

Coding agents should pin 0.1.1, verify the @actionproxy scope and
ActionProxy/actionproxy repository metadata, and fail closed if either exact
record, its integrity, or its provenance is unavailable. Do not substitute an
unscoped or similarly named package, and do not register a downstream MCP server
alongside the wrapper in a way that bypasses ActionProxy.

See the adoption guide
for SDK, MCP, HTTP, and reviewed source-tarball paths.

Highlights

• Preserved Community single-reviewer edited approvals through both supported
  API forms while re-evaluating policy and binding authorization evidence to
  the approved input.
• Aligned the Community route inventory, OpenAPI surface, and documentation so
  only registered Community endpoints are advertised.
• Made Telegram approval/status links honor the configured public origin and
  synchronized terminal approval-card presentation across Web, API, and
  Telegram decisions on a bounded best-effort basis.
• Closed the generated Community relative-import graph and made unresolved
  imports fail verification.
• Replaced vulnerable trailing-slash regular expressions with linear-time
  normalization, fully redacted public secret-scan diagnostics, reconstructed
  typed Quickstart return URLs, enforced one effective approver identity per
  workspace, and pinned the patched nanoid floor.
• Fixed the protected npm consumer pipeline for pnpm's isolated dependency
  layout and verified the exact package artifacts under Node.js 22 and 24.

See the changelog,
Community capability boundary,
and test-status evidence map.

Source and supply-chain integrity

Protected annotated tag v0.1.1 resolves through tag object
c1e05e8bc51ea1bcace5c861238fde813dfc20b0 to commit
d867b933ed8481d5fe31109bc91a9a8c506f0180
and tree 1480f4069e339418dcac32aac47dd7d652546588. The tag is
annotated but unsigned.

PUBLIC_MANIFEST.json has SHA-256:

086a75c98af62b3b163fda731a314945432b595799be54968d2aa2d09d09876e

Anonymous exact-commit and tagged ZIP/tar downloads each passed safe-layout,
file-count, executable-mode, manifest-byte, strict Community-boundary,
source-closure, secret-scan, and version verification. The attached source ZIP
and tar preserve the exact verified tagged transport bytes. The attached
manifest, CycloneDX 1.7 SBOM, 63-record runtime-license inventory, sanitized
release evidence, and SHA256SUMS form the durable seven-asset evidence set.

The exact release commit's public security workflow
passed all nine required jobs, including public CodeQL analysis, with zero open
CodeQL alerts at release preflight. The protected npm workflow built each
five-file package once, consumed the exact tarballs under Node.js 22 and 24,
byte-compared them with a fresh reviewed build, and successfully published both
under the requested next tag. npm also assigned latest automatically during
these first package publications. Two helper assumptions did not match npm's
behavior: latest was expected to remain absent, and the registry version
documents omitted the packed package.json files field. The built-in
anonymous-verification phase therefore reported failure after the successful
writes. Independent anonymous verification then confirmed both registry
tarballs byte-for-byte, exact package identities and integrity, npm signatures,
SLSA provenance bound to this tag/commit/workflow run, and both next and
latest at 0.1.1; the exact tarballs retain the packed files fields. No
separate promote-latest write was performed.

Important boundaries

• ActionProxy remains an Apache-2.0 developer preview, not a complete production
  authorization or compliance boundary.
• This Release attaches no npm tarball or container image. npm is the canonical
  package transport; the attached assets preserve source and integrity evidence.
• ActionProxy ships no hosted service or native production SaaS connector. Real
  executors and their credentials remain operator-owned, and capabilities that
  bypass configured ActionProxy adapters are not governed.
• Unauthenticated mode is for deliberate loopback development only. Stored
  action and audit payloads can contain sensitive data, and the local audit hash
  chain is not externally anchored.
• The standard /mcp surface remains experimental and requires an
  operator-provided OAuth 2.1 authorization server for public deployment.
• Live entitled ChatGPT Secure MCP Tunnel acceptance, live Google Workspace
  downstream-MCP acceptance, and an uninvolved-user walkthrough remain
  post-release validation. No unrecorded provider-effect or usability-completion
  claim is made.
• The GitHub NPM_BOOTSTRAP_TOKEN environment secret was deleted and a fresh
  readback found zero environment secrets. npm-side revocation of that bootstrap
  token is not yet recorded, and trusted publishing is not yet configured for
  the two packages. These are disclosed release-hardening follow-ups; they do
  not alter the verified package bytes, registry state, or provenance above.

Review the security policy
before exposing ActionProxy beyond local evaluation.