integrate-arcjet-guard-strands-agents

Integrate Arcjet Guard into a Strands Agents app

@arcjet/guard's Strands Agents v1 namespace wraps the agent's existing Arcjet client. It never talks to the Arcjet API itself. Three surfaces, one decision rule:

• An authored tool (tool({ callback })) → guardTool(). After tool() the object is a FunctionTool / ZodTool whose runner path is _callback (stream() / invoke()). DENY returns a plain ArcjetDenialResult. Do not throw. Do not fabricate a ToolResultBlock.
• MCP / unwrapped / vended tools → guardHooks(). A Plugin whose initAgent registers BeforeToolCallEvent at HookOrder.SDK_FIRST - 1. On DENY it sets event.cancel to JSON.stringify(ArcjetDenialResult). Already-branded tools are skipped. Do not use BeforeToolsEvent.cancel (that skips per-tool hooks).
• Correlation → strandsAgentContext() reads a field the integrator put on invocationState (correlationId, then sessionId, then requestId). It never mints a new id. It never reads traceId. It never uses SessionManager or agent.id.

This namespace is JS @strands-agents/sdk Agent + tool({ callback }) + Plugin / addHook. Not the Python SDK. Do not also wrap the same tool with @arcjet/guard/vercel-ai/v7, @arcjet/guard/langgraph/v1, or @arcjet/guard/claude-managed-agents/v0. Zod is their peer, not ours.

Screen inbound before invoke() / stream() — there is no inbound hook.

There is no first-class inbound channel, so there is no guardInbound. Put prompt-injection (and other inbound rules) in the application before agent.invoke() / stream(). Middleware / model hooks are not this policy gate.

interrupt() is not a policy gate.

event.interrupt() is human-in-the-loop. Same trap as Mastra requireApproval, Claude canUseTool, LangGraph interrupt(), OpenAI Agents needsApproval, LangChain humanInTheLoopMiddleware, and Google ADK requireConfirmation. There is no guardApproval / guardInterrupt. Do not wrap interrupt() as Guard.