@trustmodel/sdk

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

@trustmodel/sdk - npm Package Compare versions

Comparing version

0.2.1

0.3.0

+3

dist/cli.d.ts

		#!/usr/bin/env node
		export {};
		//# sourceMappingURL=cli.d.ts.map

+1

dist/cli.d.ts.map

{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

+115

dist/cli.js

		#!/usr/bin/env node
		/** `trustmodel` CLI — the one-command way to evaluate an agent from any TS/JS codebase.
		*
		* npm i @trustmodel/sdk
		* export TRUSTMODEL_API_KEY=tm-...
		* npx trustmodel eval-agent # auto-finds the newest .codenow/runs recording
		* npx trustmodel eval-agent --run run.jsonl # a Claude Agent SDK recorded run
		* npx trustmodel eval-agent --trace t.json # an agentic trace ({ goal, steps })
		* npx trustmodel eval-agent --agent sophia-agent --framework claude-agent-sdk --dry-run
		*/
		import * as fs from "node:fs";
		import { TrustModelClient } from "./client.js";
		import { traceFromRunFile, findNewestRun } from "./traces/claudeAgent.js";
		function flag(name) {
		const i = process.argv.indexOf(`--${name}`);
		return i >= 0 ? process.argv[i + 1] : undefined;
		}
		const has = (name) => process.argv.includes(`--${name}`);
		const HELP = `trustmodel — evaluate an AI agent's trace and get a TrustScore.

		Usage:
		trustmodel eval-agent [options]

		Options:
		--run <file.jsonl> A Claude Agent SDK recorded run to convert + evaluate.
		--trace <file.json> An agentic trace ({ goal, name, agent_framework, steps[] }).
		(neither) Auto-detect the newest .codenow/runs//.jsonl recording.
		--agent <slug> GovernedAgent slug to bind the score to (AGP fleet).
		--framework <name> Agent framework (default: claude-agent-sdk).
		--dry-run Print the trace that would be sent; no API call.
		-h, --help Show this help.

		Env: TRUSTMODEL_API_KEY (required unless --dry-run), TRUSTMODEL_GOVERNED_AGENT,
		TRUSTMODEL_BASE_URL, TRUSTMODEL_ORGANIZATION_ID.`;
		async function evalAgent() {
		// Resolve the trace: explicit --trace, explicit --run, or auto-detect a recording.
		let trace;
		let source;
		const traceFile = flag("trace");
		const runFile = flag("run") ?? (traceFile ? undefined : findNewestRun() ?? undefined);
		if (traceFile) {
		trace = JSON.parse(fs.readFileSync(traceFile, "utf-8"));
		source = traceFile;
		}
		else if (runFile) {
		trace = traceFromRunFile(runFile);
		source = runFile;
		}
		else {
		console.error("No trace found. Pass --trace <file.json> or --run <file.jsonl>, or run from a\n" +
		"project with recorded runs under .codenow/runs/. See `trustmodel eval-agent --help`.");
		return 1;
		}
		const framework = flag("framework") ?? trace.agent_framework ?? "claude-agent-sdk";
		const agent = flag("agent") ?? process.env.TRUSTMODEL_GOVERNED_AGENT;
		const toolCalls = trace.steps.filter((s) => s.step_type === "tool_call").length;
		console.log(`▶ trace: ${source}`);
		console.log(`▶ steps: ${trace.steps.length} (${toolCalls} tool calls)`);
		console.log(`▶ framework: ${framework}`);
		console.log(`▶ governed agent: ${agent ?? "(none — score won't attach to an AGP fleet card)"}`);
		if (has("dry-run")) {
		console.log("\n--dry-run — trace that would be sent:\n" + JSON.stringify(trace, null, 2));
		return 0;
		}
		const apiKey = process.env.TRUSTMODEL_API_KEY;
		if (!apiKey) {
		console.error("\nTRUSTMODEL_API_KEY is required. Create one at app.trustmodel.ai/settings/api-keys.");
		return 1;
		}
		const tm = new TrustModelClient({ apiKey });
		console.log("\n─── Submitting (one call, inline trace) ───");
		const run = await tm.agentic.evaluate({ trace, agentFramework: framework, governedAgent: agent });
		const id = run.evaluation_run_id;
		console.log(` ✓ evaluation_run_id: ${id} (${run.status})`);
		console.log("─── Scoring ───");
		const started = Date.now();
		for (;;) {
		if (Date.now() - started > 15 * 60_000) {
		console.error("\nTimed out waiting for the score.");
		return 1;
		}
		await new Promise((r) => setTimeout(r, 5000));
		const res = (await tm.agentic.get(id));
		const status = res.status ?? res.latest_evaluation?.status;
		if (status === "completed" \|\| status === "COMPLETED") {
		const score = res.overall_score ?? res.latest_evaluation?.overall_score;
		console.log(`\n✅ Agent TrustScore: ${score}`);
		if (agent)
		console.log(` Attached to the AGP fleet for "${agent}".`);
		return 0;
		}
		if (status === "failed" \|\| status === "FAILED") {
		console.error(`\nEvaluation failed (run ${id}).`);
		return 1;
		}
		process.stdout.write(".");
		}
		}
		async function main() {
		const cmd = process.argv[2];
		if (!cmd \|\| has("help") \|\| has("h") \|\| cmd === "-h" \|\| cmd === "--help") {
		console.log(HELP);
		process.exit(cmd && cmd !== "-h" && cmd !== "--help" ? 1 : 0);
		}
		if (cmd === "eval-agent") {
		process.exit(await evalAgent());
		}
		console.error(`Unknown command: ${cmd}\n\n${HELP}`);
		process.exit(1);
		}
		main().catch((e) => {
		console.error("\n✗ " + (e?.message ?? String(e)));
		process.exit(1);
		});
		//# sourceMappingURL=cli.js.map

+1

dist/cli.js.map

+18

dist/traces/claudeAgent.d.ts

		/** Convert a Claude Agent SDK run into a TrustModel agentic trace.
		*
		* The Claude Agent SDK's `query()` yields messages; agent recorders (e.g. CodeNow's
		* `.codenow/runs/<slug>/*.jsonl`) persist each as `{ kind: "message", message }` lines.
		* This turns that into the `{ goal, steps[] }` shape `tm.agentic.evaluate()` wants, so a
		* one-command CLI eval works out of the box. */
		import type { AgenticTrace } from "../types.js";
		/** Convert recorded-run JSONL (one JSON object per line) into an agentic trace. */
		export declare function traceFromClaudeAgentRun(jsonl: string): AgenticTrace;
		/** Read + convert a recorded-run file. */
		export declare function traceFromRunFile(file: string): AgenticTrace;
		/** Newest recorded `.jsonl` run (across all slugs, or a specific `slug`), or null. */
		export declare function findNewestRun(opts?: {
		slug?: string;
		runsDir?: string;
		cwd?: string;
		}): string \| null;
		//# sourceMappingURL=claudeAgent.d.ts.map

+1

dist/traces/claudeAgent.d.ts.map

{"version":3,"file":"claudeAgent.d.ts","sourceRoot":"","sources":["../../src/traces/claudeAgent.ts"],"names":[],"mappings":"AAAA;;;;;gDAKgD;AAIhD,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,aAAa,CAAC;AAE3D,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAkEnE;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAE3D;AAeD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,GAAG,IAAI,CAsBzG"}

+126

dist/traces/claudeAgent.js

		/** Convert a Claude Agent SDK run into a TrustModel agentic trace.
		*
		* The Claude Agent SDK's `query()` yields messages; agent recorders (e.g. CodeNow's
		* `.codenow/runs/<slug>/*.jsonl`) persist each as `{ kind: "message", message }` lines.
		* This turns that into the `{ goal, steps[] }` shape `tm.agentic.evaluate()` wants, so a
		* one-command CLI eval works out of the box. */
		import * as fs from "node:fs";
		import * as path from "node:path";
		/** Convert recorded-run JSONL (one JSON object per line) into an agentic trace. */
		export function traceFromClaudeAgentRun(jsonl) {
		const steps = [];
		let goal = "";
		const toolNameById = new Map();
		for (const line of jsonl.split("\n")) {
		if (!line.trim())
		continue;
		let rec;
		try {
		rec = JSON.parse(line);
		}
		catch {
		continue;
		}
		if (rec.kind === "run.start" \|\| (rec.input && !rec.message)) {
		goal \|\|= String(rec.input ?? rec.opts?.input ?? "");
		continue;
		}
		if (rec.kind && rec.kind !== "message")
		continue;
		const m = rec.message ?? rec;
		if (!m \|\| typeof m !== "object")
		continue;
		if (m.type === "assistant") {
		const content = m.message?.content ?? m.content ?? [];
		for (const b of Array.isArray(content) ? content : []) {
		if (b?.type === "text" && b.text) {
		steps.push({ step_type: "thought", content: String(b.text) });
		}
		else if (b?.type === "tool_use") {
		if (b.id && b.name)
		toolNameById.set(b.id, b.name);
		steps.push({
		step_type: "tool_call",
		content: `Call ${b.name}`,
		tool_name: b.name,
		tool_input: b.input,
		});
		}
		}
		}
		else if (m.type === "user") {
		const content = m.message?.content ?? m.content ?? [];
		for (const b of Array.isArray(content) ? content : []) {
		if (b?.type === "tool_result") {
		steps.push({
		step_type: "tool_result",
		content: "tool result",
		tool_name: toolNameById.get(b.tool_use_id),
		tool_output: b.content,
		});
		}
		}
		}
		else if (m.type === "result") {
		const text = m.result ?? m.message ?? "";
		if (text)
		steps.push({ step_type: "final_answer", content: String(text) });
		}
		}
		if (!steps.some((s) => s.step_type === "final_answer")) {
		const lastThought = [...steps].reverse().find((s) => s.step_type === "thought");
		if (lastThought)
		steps.push({ step_type: "final_answer", content: lastThought.content });
		}
		return {
		goal: goal \|\| "Agent conversation",
		name: "Agent run",
		agent_framework: "claude-agent-sdk",
		steps,
		};
		}
		/** Read + convert a recorded-run file. */
		export function traceFromRunFile(file) {
		return traceFromClaudeAgentRun(fs.readFileSync(file, "utf-8"));
		}
		/** Walk up from `startDir` to find a `.codenow/runs` directory. */
		function findRunsRoot(startDir) {
		let cur = path.resolve(startDir);
		for (let i = 0; i < 12; i++) {
		const candidate = path.join(cur, ".codenow", "runs");
		if (fs.existsSync(candidate))
		return candidate;
		const parent = path.dirname(cur);
		if (parent === cur)
		break;
		cur = parent;
		}
		return null;
		}
		/** Newest recorded `.jsonl` run (across all slugs, or a specific `slug`), or null. */
		export function findNewestRun(opts = {}) {
		const root = opts.runsDir ?? findRunsRoot(opts.cwd ?? process.cwd());
		if (!root \|\| !fs.existsSync(root))
		return null;
		const slugs = opts.slug
		? [opts.slug]
		: fs.readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
		const files = [];
		for (const slug of slugs) {
		const dir = path.join(root, slug);
		let entries = [];
		try {
		entries = fs.readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
		}
		catch {
		continue;
		}
		for (const f of entries) {
		const full = path.join(dir, f);
		files.push({ f: full, t: fs.statSync(full).mtimeMs });
		}
		}
		files.sort((a, b) => b.t - a.t);
		return files[0]?.f ?? null;
		}
		//# sourceMappingURL=claudeAgent.js.map

+1

dist/traces/claudeAgent.js.map

+1

-0

dist/index.d.ts

		@@ -11,2 +11,3 @@ /** @trustmodel/sdk — official TypeScript/Node SDK for TrustModel. */
		export { enableAutoInstrumentation, KNOWN_INSTRUMENTORS, type AutoInstrumentation, type ModuleLoader, } from "./telemetry/instrumentors.js";
		export { traceFromClaudeAgentRun, traceFromRunFile, findNewestRun, } from "./traces/claudeAgent.js";
		//# sourceMappingURL=index.d.ts.map

+1

-1

dist/index.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,OAAO,EACP,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,QAAQ,EACR,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,8BAA8B,CAAC"}
		{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,OAAO,EACP,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,QAAQ,EACR,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,yBAAyB,CAAC"}

+1

-0

dist/index.js

		@@ -9,2 +9,3 @@ /** @trustmodel/sdk — official TypeScript/Node SDK for TrustModel. */
		export { enableAutoInstrumentation, KNOWN_INSTRUMENTORS, } from "./telemetry/instrumentors.js";
		export { traceFromClaudeAgentRun, traceFromRunFile, findNewestRun, } from "./traces/claudeAgent.js";
		//# sourceMappingURL=index.js.map

+1

-1

dist/index.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,gBAAgB,GAKjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAcrB,sFAAsF;AACtF,8CAA8C;AAC9C,OAAO,EACL,QAAQ,EACR,aAAa,GAId,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAGpB,MAAM,8BAA8B,CAAC"}
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,gBAAgB,GAKjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAcrB,sFAAsF;AACtF,8CAA8C;AAC9C,OAAO,EACL,QAAQ,EACR,aAAa,GAId,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAGpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,yBAAyB,CAAC"}

+4

-1

package.json

		{
		"name": "@trustmodel/sdk",
		"version": "0.2.1",
		"version": "0.3.0",
		"description": "Official TypeScript/Node SDK for TrustModel \u2014 AI trust evaluation, OTel telemetry, and agent governance (AGP).",
		@@ -95,3 +95,6 @@ "type": "module",
		"vitest": "^2.1.8"
		},
		"bin": {
		"trustmodel": "./dist/cli.js"
		}
		}

+9

-0

README.md

		@@ -22,2 +22,11 @@ # @trustmodel/sdk

		## One-command agent eval (CLI)

		```bash
		npm i @trustmodel/sdk
		export TRUSTMODEL_API_KEY=tm-...
		npx trustmodel eval-agent # auto-detects .codenow/runs recordings → TrustScore
		# npx trustmodel eval-agent --trace trace.json --agent my-agent
		```

		## Quick start
		@@ -24,0 +33,0 @@

@trustmodel/sdk - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics