Skip to content

feat(examples): migrate unique examples from arcjet-js - #193

Open
davidmytton wants to merge 7 commits into
mainfrom
migrate-examples-from-arcjet-js
Open

feat(examples): migrate unique examples from arcjet-js#193
davidmytton wants to merge 7 commits into
mainfrom
migrate-examples-from-arcjet-js

Conversation

@davidmytton

@davidmytton davidmytton commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Consolidates the remaining unique examples from arcjet/arcjet-js examples/ into this repository, rebuilt to the canonical example pattern (package metadata, templated README, Dockerfile, compose.yaml, devcontainer, LICENSE) with Arcjet packages pinned to published versions.

Paired with the removal PR in arcjet-js: arcjet/arcjet-js#6217. Mastra helpers landed in arcjet/arcjet-js#6226. Claude Agent SDK helpers land in arcjet/arcjet-js#6229.

Examples added (11)

Example Demonstrates Compose/CI Arcjet version
bun Canonical Bun runtime example (mirrors deno) ✅ 1.8.0
express-newman Testing Arcjet-protected Express routes with Newman/Postman ✅ 1.8.0
nextjs-bot-categories Advanced bot category allow/deny + per-bot filtering ✅ 1.8.0
react-router-middleware React Router v8 middleware pattern ✅ 1.8.0
nextjs-ai-agent Arcjet Guard AI agent guardrails standalone 1.10.0-rc.0
nextjs-sensitive-info Sensitive info detection incl. Rampart NER backend + Guard standalone 1.9.1
nextjs-guard-policy Remotely-configured Guard policy for AI tool calls standalone 1.10.0-rc.0
node-guard-policy Guard policy on a plain Node.js server standalone 1.10.0-rc.0
mastra-agent @arcjet/guard/mastra/v1 — processor, tool, hooks (#6226) standalone unpublished
eve-agent @arcjet/guard/vercel-eve/v0 — inbound, approval, tool, hooks (#6208) standalone 1.10.0
claude-agent @arcjet/guard/claude-agent-sdk/v0 — guardTool, guardHooks, canUseTool is not a gate (#6229) standalone unpublished (vendored)

The first four are wired into the root compose.yaml and the Docker build CI matrix. Guard/AI examples are standalone (AI gateway key, dashboard policy, native NER, or unpublished Guard APIs) and stay out of the default compose/CI run.

Pre-release note

nextjs-guard-policy and node-guard-policy need the Guard remote-policy API (policyInput, guardTool actor, launchArcjet({ sensitiveInfoBackend }), decision.policyResults) which is not on npm yet. They are pinned to 1.10.0-rc.0 with a README note that npm ci + build will fail until that API ships.

mastra-agent depends on @arcjet/guard/mastra/v1, which is not published yet (arcjet-js#6226 merged; publish is arcjet-js#6227). eve-agent uses @arcjet/guard/vercel-eve/v0, which shipped in 1.10.0 (arcjet-js#6208). claude-agent depends on @arcjet/guard/claude-agent-sdk/v0 (arcjet-js#6229) and vendors a built @arcjet/guard from adapter SHA 69dd6010 because npm cannot install a monorepo subdir from git.

Review follow-ups (resolved)

  • Lockfiles present for npm ci on the compose/CI examples
  • React Router compose: dev 5173 / prod 3000
  • nextjs-ai-agent: sliding-window (5/60s by IP) + 2,000-char cap before the workflow; 429 on DENY
  • Bot-category diagnostic headers gated on ARCJET_DEMO_BOT_HEADERS=1
  • Guard-policy context endpoint returns labels only
  • Node + Mastra JSON body cap 32 KiB
  • Bun devcontainer uses oven/bun:1 (no pipe-to-bash)
  • Workflow context is a plain serializable { correlationId, metadata } record

Wiring

  • Root compose.yaml — 4 non-AI examples
  • .github/workflows/docker-build.yml — same 4
  • scripts/prepare-to-publish.ts — all 11 registered
  • README.md — all 11 listed

@davidmytton @claude
feat(examples): migrate unique examples from arcjet-js
849ad1b 
Consolidates the remaining unique examples from the `arcjet/arcjet-js`
`examples/` directory into this repository, rebuilt to the canonical
example pattern (canonical metadata, README, Dockerfile, compose.yaml,
devcontainer, LICENSE) with Arcjet packages pinned to published versions.

Examples added:

- bun — canonical Bun runtime example (mirrors the Deno example)
- express-newman — testing Arcjet-protected Express routes with Newman
- nextjs-bot-categories — advanced bot category allow/deny + filtering
- react-router-middleware — React Router v8 middleware pattern
- nextjs-ai-agent — Arcjet Guard AI agent guardrails
- nextjs-sensitive-info — sensitive info detection incl. Rampart NER backend
- nextjs-guard-policy — remotely-configured Guard policy for AI tool calls
- node-guard-policy — Guard policy on a plain Node.js server

The first four are wired into the root `compose.yaml` and the Docker
build CI matrix. The Guard/AI examples are standalone (they need an AI
gateway key, dashboard policy config, or a native NER backend) and are
excluded from the default compose/CI run.

Note: nextjs-guard-policy and node-guard-policy depend on the Arcjet
Guard remote-policy API which is not yet published to npm; they are
pinned to 1.10.0-rc.0 and documented as not building until that API
ships. nextjs-ai-agent is pinned to 1.10.0-rc.0 (first release with the
agent guardrail API) and nextjs-sensitive-info to 1.9.1 (Rampart's
earliest release).

All examples are registered in scripts/prepare-to-publish.ts for
publishing to their own repositories.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@davidmytton davidmytton mentioned this pull request Aug 7, 2026
Merged
@socket-security

socket-security Bot commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​types/​bun@​1.3.141001004887100
Addednpm/​next@​16.2.66460909970
Addednpm/​@​mastra/​core@​1.59.06610093100100
Addednpm/​@​react-router/​serve@​7.16.0991006896100
Addednpm/​@​arcjet/​sensitive-info-rampart@​1.9.1801001008870
Addednpm/​@​arcjet/​sensitive-info-rampart@​1.10.0-rc.0801001009070
Addednpm/​@​anthropic-ai/​claude-agent-sdk@​0.3.2331001009210070
Addednpm/​@​react-router/​node@​7.16.01001007196100
Addednpm/​@​arcjet/​react-router@​1.8.07210010096100
Addednpm/​@​types/​newman@​5.3.6971007380100
Addednpm/​@​arcjet/​bun@​1.8.07310010097100
Addednpm/​react-router@​7.16.094757998100
Addednpm/​@​ai-sdk/​provider-utils@​5.0.12981007698100
Addednpm/​@​react-router/​dev@​7.16.0981007796100
Addednpm/​@​arcjet/​guard@​1.9.17810010096100
Addednpm/​@​arcjet/​guard@​1.10.0-rc.07810010096100
Addednpm/​@​types/​react@​19.2.151001007992100
Addednpm/​eve@​0.31.0991001009880
Addednpm/​@​types/​node@​22.20.01001008196100
Addednpm/​@​types/​node@​24.10.91001008195100
Addednpm/​@​types/​node@​24.13.31001008195100
Addednpm/​@​arcjet/​node@​1.8.08210010097100
Addednpm/​@​langchain/​openai@​1.2.88310010097100
Addednpm/​react@​19.2.61001008497100
Addednpm/​workflow@​4.8.1991008699100
Addednpm/​newman@​6.2.29810010086100
Addednpm/​ai@​7.0.368610010099100
Addednpm/​@​arcjet/​inspect@​1.8.08910010097100
Addednpm/​react-dom@​19.2.61001009298100
Addednpm/​@​langchain/​langgraph@​1.4.10991009297100
Addednpm/​@​arcjet/​next@​1.8.09610010097100
Addednpm/​@​arcjet/​next@​1.9.19610010097100
Addednpm/​isbot@​5.1.4010010010096100
See 2 more rows in the dashboard

View full report

@socket-security

This comment was marked as low quality.

Sign in to view
@davidmytton
davidmytton marked this pull request as ready for review August 7, 2026 19:10
@davidmytton

This comment was marked as resolved.

Sign in to view
arcjet-review[bot]

This comment was marked as resolved.

Sign in to view

davidmytton and others added 3 commits August 7, 2026 15:26
@davidmytton @claude
feat(examples): add eve-agent (Vercel Eve) example
1748c28 
Migrates the Vercel Eve agent example from arcjet-js, demonstrating
Arcjet Guard AI guardrails (guardTool, guardApproval, guardInbound) on a
Vercel Eve agent. Standalone example (not wired into compose/CI).

Pinned to @arcjet/guard@1.10.0-rc.0; the Eve integration subpath
(@arcjet/guard/vercel-eve) is not yet published to npm, so the README
notes it will not build until that API ships.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@cursoragent @davidmytton
feat(examples): add mastra-agent (Mastra Guard) example
d17cc19 
Adds a standalone Mastra agent example demonstrating @arcjet/guard/mastra/v1:
inbound prompt injection via guardProcessor, tool deny via guardTool
(structured result, no throw), PII on args, rate limiting, fail-closed
defaults, correlation via mastraAgentContext (thread → resource → run;
never mint an id), and guardHooks for unwrapped tools (proceed: false
on DENY). Not wired into root compose/CI, matching other Guard/AI examples.

Pinned to @arcjet/guard@1.10.0-rc.0; the Mastra integration subpath
(@arcjet/guard/mastra/v1) is not yet published to npm, so the README
notes it will not build until that API ships.

Co-authored-by: David Mytton <davidmytton@users.noreply.github.com>
@cursoragent @davidmytton
fix(examples): address PR 193 review comments
99a9cf1 
Align the React Router middleware compose/dev port on 5173 and the
production image on 3000. Cap JSON bodies on the Node and Mastra demo
servers. Bound AI question/message length. Replace the Bun
devcontainer pipe-to-bash install with the official oven/bun image.
Document accepted demo risk for unauthenticated AI routes, bot-category
headers, and synthetic policy fixtures.

Co-authored-by: David Mytton <davidmytton@users.noreply.github.com>
@cursor

cursor Bot commented Aug 14, 2026

Copy link
Copy Markdown

Sorted the open review threads on this PR (no new PR). Summary of the High Risk notes that did not have their own inline thread:

  • Bun install-script supply chain: replaced the devcontainer curl | bash installer with the official oven/bun:1 image (same source as the example Dockerfile).
  • Workflow serializability of ArcjetAgentContext: createAgentContext returns a plain { correlationId, metadata } record. Commented that on the workflow input and the route so it stays JSON-safe for Workflow DevKit replay.
  • Mastra example: no later inline threads. Added the same demo-risk README warning as the other AI examples, plus a 32 KiB JSON body cap and a 2,000-character message bound.

All 8 inline threads are replied to and resolved.

@cursoragent @davidmytton
fix(examples): apply remaining PR 193 review fixes
e80581e 
Add an Arcjet sliding-window rate limit and question-length cap before
start(workflow), gate bot diagnostic headers behind ARCJET_DEMO_BOT_HEADERS,
and return labels only from the Guard policy context endpoint.

Co-authored-by: David Mytton <davidmytton@users.noreply.github.com>
@cursor

cursor Bot commented Aug 14, 2026

Copy link
Copy Markdown

Follow-up on the remaining review items (HEAD e80581e, no new PR):

  • AI agent route: Arcjet sliding-window rate limit (5/60s) and 2,000-character question cap now run before start(workflow). DENY returns 429.
  • Bot-categories headers: gated behind ARCJET_DEMO_BOT_HEADERS=1 (default off).
  • Guard policy context: labels only; records/prompts stay server-side.
  • Lockfiles, compose 5173/3000, 32 KiB body cap: confirmed on HEAD.
  • Bun install-script: still using oven/bun:1 (no pipe-to-bash).
  • Workflow serializability: createAgentContext remains a plain { correlationId, metadata } record, commented on the workflow input and route.
  • Mastra: no inline review threads. Existing 32 KiB body cap and 2,000-character message bound remain.

All 8 inline review threads were resolved via resolveReviewThread.

@cursor cursor Bot mentioned this pull request Aug 14, 2026
Merged
arcjet-review[bot]

This comment was marked as outdated.

Sign in to view

arcjet-review[bot]

This comment was marked as duplicate.

Sign in to view

@arcjet-review arcjet-review Bot added the needs review Awaiting human review label Aug 14, 2026
@cursoragent @davidmytton
feat(examples): add claude-agent (Claude Agent SDK Guard example)
b32418a 
Adds a standalone Claude Agent SDK example demonstrating
@arcjet/guard/claude-agent-sdk/v0 (UserPromptSubmit, PreToolUse, guardTool)
from unpublished adapter SHA 69dd6010. Vendors @arcjet/guard via
file:./vendor/arcjet-guard. Not wired into root compose/CI.

Co-authored-by: David Mytton <davidmytton@users.noreply.github.com>
@arcjet-review arcjet-review Bot added needs review Awaiting human review and removed needs review Awaiting human review labels Aug 15, 2026
@arcjet-review arcjet-review Bot added needs review Awaiting human review and removed needs review Awaiting human review labels Aug 15, 2026
This was referenced Aug 15, 2026
Open
Merged
@cursoragent @davidmytton
feat(examples): add langgraph-agent (LangGraph Guard example)
d277757 
Standalone Graph API (StateGraph + ToolNode) demo of unpublished
@arcjet/guard/langgraph/v1: guardTool, guardToolNode, inbound screen
before invoke, interrupt() as HITL not policy, caller-owned thread_id.
Vendored from arcjet-js@baa23e7f (david/cursor/guard-langgraph-v1-e852).

Co-authored-by: David Mytton <davidmytton@users.noreply.github.com>
@arcjet-review arcjet-review Bot added needs review Awaiting human review and removed needs review Awaiting human review labels Aug 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments
@arcjet-review arcjet-review[bot] arcjet-review[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

needs review Awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@davidmytton @cursoragent