feat: GitHub Pages live demo and PyPI release (sentinel-agent-gateway)

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v5

.github/workflows/pages.yml

@@ -0,0 +1,39 @@
+name: Pages
+
+# The site runs the wheel built from this commit in the browser (Pyodide), so it always matches main.
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Build wheel and assemble site
+        run: |
+          uv build --wheel --out-dir dist
+          mkdir -p _site/wheels
+          cp site/index.html _site/
+          cp dist/*.whl _site/wheels/
+          (cd dist && ls *.whl) > _site/wheels/latest.txt
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: _site
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release
+
+# Publishing a GitHub release uploads that version to PyPI via trusted publishing (no stored token).
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Tag must match the package version
+        run: test "v$(uv version --short)" = "${{ github.event.release.tag_name }}"
+      - run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/sentinel-agent-gateway/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

README.md

@@ -4,10 +4,13 @@
 
 **A deny-by-default security gateway, human-approval sandbox and MCP proxy for AI agents**
 
+[![PyPI](https://img.shields.io/pypi/v/sentinel-agent-gateway.svg)](https://pypi.org/project/sentinel-agent-gateway/)
 [![CI](https://github.com/Chirudeva-Reddy/sentinel-agent/actions/workflows/ci.yml/badge.svg)](https://github.com/Chirudeva-Reddy/sentinel-agent/actions)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue.svg)](https://www.python.org/)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%20%E2%80%93%203.14-blue.svg)](https://www.python.org/)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 
+**[Live demo: runs in your browser](https://chirudeva-reddy.github.io/sentinel-agent/)** · `pip install sentinel-agent-gateway`
+
 [Why](#why) • [Quickstart](#quickstart) • [How it works](#how-it-works) • [Evaluation](#evaluation) • [Architecture](docs/ARCHITECTURE.md)
 
 </div>
@@ -40,8 +43,8 @@ between the agent and its tools and checks **both directions**:
 ## Quickstart
 
 ```bash
-git clone https://github.com/Chirudeva-Reddy/sentinel-agent.git && cd sentinel-agent
-uv sync --all-extras          # or: pip install -e ".[server,dashboard,mcp]"
+pip install "sentinel-agent-gateway[server,dashboard,mcp,demo]"   # the import name is `sentinel`
+# or from source: git clone https://github.com/Chirudeva-Reddy/sentinel-agent.git && cd sentinel-agent && uv sync --all-extras
 ```
 
 ```bash

pyproject.toml

@@ -1,12 +1,19 @@
 [project]
-name = "sentinel-agent"
-version = "0.1.0"
-description = "Zero-Trust Security Gateway & Human-in-the-Loop Sandbox for Autonomous AI Agents"
+name = "sentinel-agent-gateway"
+version = "0.2.0"
+description = "Deny-by-default security gateway, human-approval sandbox and MCP proxy for AI agents"
 readme = "README.md"
 authors = [
     { name = "Chirudeva Reddy", email = "chirudevareddy03@gmail.com" }
 ]
 requires-python = ">=3.10"
+license = "Apache-2.0"
+keywords = ["ai-agents", "llm-security", "prompt-injection", "mcp", "guardrails"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+    "Intended Audience :: Developers",
+]
 dependencies = [
     "pydantic>=2.7.0",
     "typer>=0.12.0",
@@ -42,6 +49,10 @@ dev = [
     "ruff>=0.4.0",
 ]
 
+[project.urls]
+Homepage = "https://chirudeva-reddy.github.io/sentinel-agent/"
+Repository = "https://github.com/Chirudeva-Reddy/sentinel-agent"
+
 [project.scripts]
 sentinel = "sentinel.cli:app"
 

sentinel/detectors/__init__.py

@@ -28,10 +28,11 @@ def analyze(self, call: NormalizedCall) -> DetectorFinding: ...
 
 
 def load_detectors(policy: PolicyEngine) -> list[Detector]:
-    eps = sorted(entry_points(group=GROUP), key=lambda ep: ep.name)
+    # Dedupe by (name, target): stale metadata from an old install would otherwise double-count a detector.
+    eps = sorted({(ep.name, ep.value): ep for ep in entry_points(group=GROUP)}.values(), key=lambda ep: ep.name)
     if not eps:
         # Fail closed: a gateway with no detectors would allow everything.
-        raise RuntimeError(f"No detectors registered under '{GROUP}'. Is sentinel-agent installed (pip install -e .)?")
+        raise RuntimeError(f"No detectors registered under '{GROUP}'. Is sentinel-agent-gateway installed?")
     return [ep.load()(policy) for ep in eps]