
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@cleocode/lafs-protocol
Advanced tools
LLM-Agent-First Specification — a response envelope contract for AI agent systems.
LAFS defines a standard envelope format for structured responses from LLM-powered agents and tools. It complements transport protocols like MCP and A2A by standardizing what comes back — not how it gets there.
Current version: 1.2.3 | 📚 Documentation | Spec | Migration Guides
| Layer | Files | Description |
|---|---|---|
| Spec | lafs.md | Protocol specification with RFC 2119 language |
| Schemas | schemas/v1/envelope.schema.json | Envelope schema (Draft-07) with conditional pagination validation |
schemas/v1/context-ledger.schema.json | Context ledger for state tracking across request/response cycles | |
schemas/v1/error-registry.json | 12 registered error codes with HTTP/gRPC/CLI transport mappings | |
| Tooling | src/ | TypeScript validation, conformance runner, CLI diagnostic tool |
| Tests | tests/ | 31 tests covering envelope, pagination, strict mode, error handling |
| Fixtures | fixtures/ | 14 JSON fixtures (valid + invalid) for conformance testing |
| Docs | docs/ | GitBook documentation with guides, SDK reference, and specs |
npm install @cleocode/lafs-protocol
import {
validateEnvelope,
runEnvelopeConformance,
isRegisteredErrorCode,
} from "@cleocode/lafs-protocol";
// Validate an envelope against the schema
const result = validateEnvelope(envelope);
if (!result.valid) {
console.error(result.errors);
}
// Run full conformance suite (schema + invariants + error codes + strict mode + pagination)
const report = runEnvelopeConformance(envelope);
console.log(report.ok); // true if all checks pass
# Run conformance checks on a fixture
npm run conformance -- --envelope fixtures/valid-success-envelope.json
# Run tests
npm test
# Type check
npm run typecheck
{
"$schema": "https://lafs.dev/schemas/v1/envelope.schema.json",
"_meta": {
"specVersion": "1.0.0",
"schemaVersion": "1.0.0",
"timestamp": "2026-02-13T00:00:00Z",
"operation": "example.list",
"requestId": "req_01",
"transport": "http",
"strict": true,
"mvi": "standard",
"contextVersion": 1
},
"success": true,
"result": { "items": [{ "id": "1", "title": "Example" }] },
"page": {
"mode": "cursor",
"nextCursor": "eyJpZCI6IjEwIn0=",
"hasMore": true
}
}
strict: true rejects unknown properties; strict: false allows themminimal, standard, full, custom control response verbosity_fields) and expansion (_expand) request parameters_extensions field for vendor metadata (x- prefix convention)| Check | Description | Tier |
|---|---|---|
envelope_schema_valid | Validates against JSON Schema | Core |
envelope_invariants | success/result/error consistency | Core |
error_code_registered | Error code exists in registry | Core |
meta_mvi_present | Valid MVI disclosure level | Standard |
meta_strict_present | Strict mode declared | Standard |
strict_mode_behavior | Optional fields omitted (not null) in strict mode | Standard |
strict_mode_enforced | Additional properties rejected/allowed per mode | Standard |
pagination_mode_consistent | Page fields match declared mode | Standard |
lafs.md # Protocol specification
schemas/v1/
envelope.schema.json # Envelope schema (Draft-07)
context-ledger.schema.json # Context ledger schema
error-registry.json # Error code registry
src/
types.ts # TypeScript types (discriminated unions)
validateEnvelope.ts # Ajv-based schema validator
conformance.ts # Conformance runner (8 checks)
errorRegistry.ts # Error code helpers
flagSemantics.ts # Format flag resolution
cli.ts # CLI diagnostic tool
tests/ # 31 tests (vitest)
fixtures/ # 14 JSON test fixtures
docs/
POSITIONING.md # MCP/A2A complementary positioning
VISION.md # Project vision and primary persona
CONFORMANCE.md # Conformance checks and adoption tiers
migrations/
v0.3.0-to-v0.4.0.md # Envelope rationalization migration
v0.4.0-to-v0.5.0.md # Pagination & MVI schema migration
CONTRIBUTING.md # Contributor guidelines, RFC process
| Version | Phase | Description |
|---|---|---|
| v1.0.0 | 3 | Production release: Token budgets, agent discovery, MCP integration, complete SDKs |
| v0.5.0 | 2B | Conditional pagination, MVI field selection/expansion, context ledger schema |
| v0.4.0 | 2A | Optional page/error, extensions, strict/lenient mode, warnings |
| v0.3.0 | 1 | Strategic positioning, vision alignment, adoption tiers |
| v0.2.0 | 0 | Protocol cleanup, fixtures, governance, security considerations |
| v0.1.1 | — | Initial npm publish |
| v0.1.0 | — | Bootstrap |
MIT
FAQs
LLM-Agent-First Specification schemas and conformance tooling
The npm package @cleocode/lafs-protocol receives a total of 54 weekly downloads. As such, @cleocode/lafs-protocol popularity was classified as not popular.
We found that @cleocode/lafs-protocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.