@agent-native/core 0.49.11 → 0.49.13

package/dist/extensions/local.js

@@ -0,0 +1,334 @@
+import fs from "node:fs/promises";
+import fsSync from "node:fs";
+import path from "node:path";
+import { loadAgentNativeManifest, resolveAgentNativeDataMode, } from "../local-artifacts/index.js";
+const LOCAL_EXTENSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,79}$/;
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function errorCode(error) {
+    return isRecord(error) && typeof error.code === "string"
+        ? error.code
+        : undefined;
+}
+function asStringArray(value) {
+    if (typeof value === "string" && value.trim())
+        return [value.trim()];
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((item) => typeof item === "string");
+}
+function normalizeSlash(filePath) {
+    return filePath.replace(/\\/g, "/");
+}
+function normalizeRelativePath(filePath, label = "path") {
+    if (!filePath || typeof filePath !== "string") {
+        throw new Error(`${label} is required`);
+    }
+    if (filePath.includes("\0")) {
+        throw new Error(`${label} must not contain null bytes`);
+    }
+    if (path.isAbsolute(filePath)) {
+        throw new Error(`${label} must be relative`);
+    }
+    const normalized = normalizeSlash(path.posix.normalize(normalizeSlash(filePath)));
+    if (!normalized ||
+        normalized === "." ||
+        normalized === ".." ||
+        normalized.startsWith("../") ||
+        normalized.split("/").some((part) => !part || part === "." || part === "..")) {
+        throw new Error(`${label} must be a safe relative path`);
+    }
+    return normalized;
+}
+function resolveInside(basePath, relativePath, label) {
+    const safePath = normalizeRelativePath(relativePath, label);
+    const absolutePath = path.resolve(basePath, safePath);
+    const relative = path.relative(basePath, absolutePath);
+    if (relative === "" ||
+        relative.startsWith("..") ||
+        path.isAbsolute(relative)) {
+        throw new Error(`${label} "${relativePath}" is outside the workspace`);
+    }
+    return { safePath, absolutePath };
+}
+function noFollowOpenFlags() {
+    return fsSync.constants.O_RDONLY | (fsSync.constants.O_NOFOLLOW ?? 0);
+}
+function assertNoSymlinkPathSync(rootPath, absolutePath) {
+    const relative = path.relative(rootPath, absolutePath);
+    const segments = relative.split(path.sep).filter(Boolean);
+    let current = rootPath;
+    const pathsToCheck = [
+        current,
+        ...segments.map((segment) => {
+            current = path.join(current, segment);
+            return current;
+        }),
+    ];
+    for (const candidate of pathsToCheck) {
+        const stat = fsSync.lstatSync(candidate);
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Path "${candidate}" must not traverse a symlink`);
+        }
+    }
+}
+function readTextFileWithoutSymlink(rootPath, filePath) {
+    assertNoSymlinkPathSync(rootPath, filePath);
+    const fd = fsSync.openSync(filePath, noFollowOpenFlags());
+    try {
+        return {
+            content: fsSync.readFileSync(fd, "utf8"),
+            stat: fsSync.fstatSync(fd),
+        };
+    }
+    finally {
+        fsSync.closeSync(fd);
+    }
+}
+function normalizeExtensionId(rawId, manifestPath) {
+    const id = rawId.trim();
+    if (!LOCAL_EXTENSION_ID_RE.test(id)) {
+        throw new Error(`Local extension id in ${manifestPath} must match ${LOCAL_EXTENSION_ID_RE}`);
+    }
+    return id;
+}
+function titleFromId(id) {
+    return (id
+        .replace(/[-_]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .replace(/\b\w/g, (char) => char.toUpperCase()) || id);
+}
+function normalizeActionPermission(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    if (trimmed === "*")
+        return "*";
+    if (/^[A-Za-z0-9_.:-]+$/.test(trimmed))
+        return trimmed;
+    return null;
+}
+function normalizePermissions(value) {
+    const permissions = {
+        appActions: [],
+        extensionData: true,
+        sql: false,
+        externalFetch: false,
+    };
+    const appActions = new Set();
+    const addAction = (action) => {
+        const normalized = normalizeActionPermission(action);
+        if (normalized)
+            appActions.add(normalized);
+    };
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            if (typeof item !== "string")
+                continue;
+            if (item === "extensionData" || item === "storage") {
+                permissions.extensionData = true;
+                continue;
+            }
+            if (item === "sql" || item === "dbQuery" || item === "dbExec") {
+                permissions.sql = true;
+                continue;
+            }
+            if (item === "externalFetch" || item === "extensionFetch") {
+                permissions.externalFetch = true;
+                continue;
+            }
+            const actionMatch = item.match(/^(?:appAction|action):(.+)$/);
+            if (actionMatch?.[1])
+                addAction(actionMatch[1]);
+        }
+    }
+    else if (isRecord(value)) {
+        const rawActions = value.appActions === "*" || value.actions === "*"
+            ? ["*"]
+            : [...asStringArray(value.appActions), ...asStringArray(value.actions)];
+        for (const action of rawActions)
+            addAction(action);
+        if (typeof value.extensionData === "boolean") {
+            permissions.extensionData = value.extensionData;
+        }
+        if (typeof value.storage === "boolean") {
+            permissions.extensionData = value.storage;
+        }
+        if (typeof value.sql === "boolean")
+            permissions.sql = value.sql;
+        if (typeof value.externalFetch === "boolean") {
+            permissions.externalFetch = value.externalFetch;
+        }
+        if (typeof value.extensionFetch === "boolean") {
+            permissions.externalFetch = value.extensionFetch;
+        }
+    }
+    permissions.appActions = [...appActions].sort();
+    return permissions;
+}
+function manifestAppExtensions(app) {
+    return asStringArray(app.extensions);
+}
+function readJsonFile(rootPath, filePath) {
+    try {
+        const { content, stat } = readTextFileWithoutSymlink(rootPath, filePath);
+        return { value: JSON.parse(content), stat };
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function readLocalExtensionFolder(options) {
+    const extensionAbsolutePath = path.join(options.rootAbsolutePath, options.folderName);
+    const extensionRelativePath = normalizeSlash(path.relative(options.workspaceRoot, extensionAbsolutePath));
+    const manifestAbsolutePath = path.join(extensionAbsolutePath, "extension.json");
+    const manifestRead = readJsonFile(extensionAbsolutePath, manifestAbsolutePath);
+    if (!manifestRead)
+        return null;
+    const rawManifest = manifestRead.value;
+    if (!isRecord(rawManifest)) {
+        throw new Error(`Local extension manifest must be an object: ${manifestAbsolutePath}`);
+    }
+    const manifest = rawManifest;
+    const manifestRelativePath = normalizeSlash(path.relative(options.workspaceRoot, manifestAbsolutePath));
+    const id = normalizeExtensionId(typeof manifest.id === "string" ? manifest.id : options.folderName, manifestAbsolutePath);
+    const entry = String(typeof manifest.entry === "string"
+        ? manifest.entry
+        : typeof manifest.main === "string"
+            ? manifest.main
+            : "index.html");
+    const { safePath: entrySafePath, absolutePath: entryAbsolutePath } = resolveInside(extensionAbsolutePath, entry, "entry");
+    const { content, stat: entryStat } = readTextFileWithoutSymlink(extensionAbsolutePath, entryAbsolutePath);
+    const manifestStat = manifestRead.stat;
+    const updatedAt = new Date(Math.max(manifestStat.mtimeMs, entryStat.mtimeMs)).toISOString();
+    const createdAt = new Date(Math.min(manifestStat.birthtimeMs, entryStat.birthtimeMs)).toISOString();
+    const slots = [
+        ...new Set([
+            ...asStringArray(manifest.slots),
+            ...asStringArray(manifest.slot),
+        ]),
+    ].sort();
+    const permissions = normalizePermissions(manifest.permissions);
+    const name = typeof manifest.name === "string" && manifest.name.trim()
+        ? manifest.name.trim()
+        : titleFromId(id);
+    return {
+        id,
+        name,
+        description: typeof manifest.description === "string" ? manifest.description : "",
+        content,
+        icon: typeof manifest.icon === "string" ? manifest.icon : null,
+        createdAt,
+        updatedAt,
+        hiddenAt: null,
+        hiddenBy: null,
+        ownerEmail: "local-files",
+        orgId: null,
+        visibility: "private",
+        source: {
+            mode: "local-files",
+            appId: options.appId,
+            rootPath: options.rootPath,
+            extensionPath: extensionRelativePath,
+            manifestPath: manifestRelativePath,
+            entryPath: normalizeSlash(path.posix.join(extensionRelativePath, entrySafePath)),
+            permissions,
+            slots,
+        },
+    };
+}
+async function listLocalExtensionsForRoot(options) {
+    let rootStat;
+    try {
+        rootStat = await fs.lstat(options.rootAbsolutePath);
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return [];
+        throw error;
+    }
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        return [];
+    const entries = await fs.readdir(options.rootAbsolutePath, {
+        withFileTypes: true,
+    });
+    const rows = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() ||
+            entry.isSymbolicLink() ||
+            entry.name.startsWith(".")) {
+            continue;
+        }
+        const row = await readLocalExtensionFolder({
+            appId: options.appId,
+            workspaceRoot: options.workspaceRoot,
+            rootPath: options.rootPath,
+            rootAbsolutePath: options.rootAbsolutePath,
+            folderName: entry.name,
+        });
+        if (row)
+            rows.push(row);
+    }
+    return rows;
+}
+export async function listLocalExtensions(options = {}) {
+    const loaded = await loadAgentNativeManifest({ ...options, optional: true });
+    if (!loaded)
+        return [];
+    const rows = [];
+    const seenIds = new Map();
+    for (const [appId, app] of Object.entries(loaded.manifest.apps ?? {})) {
+        const extensionRoots = manifestAppExtensions(app);
+        if (extensionRoots.length === 0)
+            continue;
+        const mode = await resolveAgentNativeDataMode({
+            ...options,
+            manifestPath: loaded.path,
+            appId,
+            defaults: { mode: app.mode },
+        });
+        if (mode !== "local-files")
+            continue;
+        for (const root of extensionRoots) {
+            const { safePath, absolutePath } = resolveInside(loaded.rootDir, root, "extensions");
+            rows.push(...(await listLocalExtensionsForRoot({
+                appId,
+                workspaceRoot: loaded.rootDir,
+                rootPath: safePath,
+                rootAbsolutePath: absolutePath,
+            })));
+        }
+    }
+    for (const row of rows) {
+        const existingPath = seenIds.get(row.id);
+        if (existingPath) {
+            throw new Error(`Duplicate local extension id "${row.id}" in ${existingPath} and ${row.source.manifestPath}`);
+        }
+        seenIds.set(row.id, row.source.manifestPath);
+    }
+    return rows.sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id));
+}
+export async function getLocalExtension(id, options = {}) {
+    const rows = await listLocalExtensions(options);
+    return rows.find((row) => row.id === id) ?? null;
+}
+export function isLocalExtensionRow(row) {
+    return (isRecord(row) && isRecord(row.source) && row.source.mode === "local-files");
+}
+export function localExtensionSourceSummary(row) {
+    return {
+        mode: row.source.mode,
+        appId: row.source.appId,
+        rootPath: row.source.rootPath,
+        extensionPath: row.source.extensionPath,
+        manifestPath: row.source.manifestPath,
+        entryPath: row.source.entryPath,
+        slots: row.source.slots,
+        permissions: row.source.permissions,
+    };
+}
+//# sourceMappingURL=local.js.map

package/dist/extensions/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/extensions/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAG3B,MAAM,6BAA6B,CAAC;AAqCrC,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAE5D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,KAAK,GAAG,MAAM;IAC7D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAC/B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAC/C,CAAC;IACF,IACE,CAAC,UAAU;QACX,UAAU,KAAK,GAAG;QAClB,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,YAAoB,EAAE,KAAa;IAC1E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACvD,IACE,QAAQ,KAAK,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,YAAY,4BAA4B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB,EAAE,YAAoB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,MAAM,YAAY,GAAG;QACnB,OAAO;QACP,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1B,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;KACH,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,+BAA+B,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB,EAAE,QAAgB;IACpE,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC;YACxC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;SAC3B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,YAAoB;IAC/D,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yBAAyB,YAAY,eAAe,qBAAqB,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,CACL,EAAE;SACC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAChC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,WAAW,GAA8B;QAC7C,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,IAAI;QACnB,GAAG,EAAE,KAAK;QACV,aAAa,EAAE,KAAK;KACrB,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE;QACnC,MAAM,UAAU,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvC,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACnD,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9D,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC1D,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC9D,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG;YAC/C,CAAC,CAAC,CAAC,GAAG,CAAC;YACP,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,UAAU;YAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,WAAW,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACvC,WAAW,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAChE,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7C,WAAW,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9C,WAAW,CAAC,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC;QACnD,CAAC;IACH,CAAC;IAED,WAAW,CAAC,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA2B;IACxD,OAAO,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CACnB,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,OAMvC;IACC,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CACrC,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,MAAM,qBAAqB,GAAG,cAAc,CAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAC5D,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CACpC,qBAAqB,EACrB,gBAAgB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAC/B,qBAAqB,EACrB,oBAAoB,CACrB,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,+CAA+C,oBAAoB,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,WAAqC,CAAC;IACvD,MAAM,oBAAoB,GAAG,cAAc,CACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAC3D,CAAC;IACF,MAAM,EAAE,GAAG,oBAAoB,CAC7B,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAClE,oBAAoB,CACrB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAClB,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,CAAC,QAAQ,CAAC,KAAK;QAChB,CAAC,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,CAAC,CAAC,QAAQ,CAAC,IAAI;YACf,CAAC,CAAC,YAAY,CACnB,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAChE,aAAa,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,0BAA0B,CAC7D,qBAAqB,EACrB,iBAAiB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAClD,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAC1D,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChC,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;SAChC,CAAC;KACH,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,IAAI,GACR,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAEtB,OAAO;QACL,EAAE;QACF,IAAI;QACJ,WAAW,EACT,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;QACtE,OAAO;QACP,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC9D,SAAS;QACT,SAAS;QACT,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa,EAAE,qBAAqB;YACpC,YAAY,EAAE,oBAAoB;YAClC,SAAS,EAAE,cAAc,CACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,aAAa,CAAC,CACtD;YACD,WAAW;YACX,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,OAKzC;IACC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,OAAO,EAAE,CAAC;IAEpE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE;QACzD,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IACE,CAAC,KAAK,CAAC,WAAW,EAAE;YACpB,KAAK,CAAC,cAAc,EAAE;YACtB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAC1B,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;YACzC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,UAAU,EAAE,KAAK,CAAC,IAAI;SACvB,CAAC,CAAC;QACH,IAAI,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA0C,EAAE;IAE5C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,cAAc,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1C,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;YAC5C,GAAG,OAAO;YACV,YAAY,EAAE,MAAM,CAAC,IAAI;YACzB,KAAK;YACL,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC7B,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,aAAa;YAAE,SAAS;QAErC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,aAAa,CAC9C,MAAM,CAAC,OAAO,EACd,IAAI,EACJ,YAAY,CACb,CAAC;YACF,IAAI,CAAC,IAAI,CACP,GAAG,CAAC,MAAM,0BAA0B,CAAC;gBACnC,KAAK;gBACL,aAAa,EAAE,MAAM,CAAC,OAAO;gBAC7B,QAAQ,EAAE,QAAQ;gBAClB,gBAAgB,EAAE,YAAY;aAC/B,CAAC,CAAC,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,CAAC,EAAE,QAAQ,YAAY,QAAQ,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,UAA0C,EAAE;IAE5C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAwD;IAExD,OAAO,CACL,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,CAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAsB;IAChE,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;QACrB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QACvB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ;QAC7B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa;QACvC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY;QACrC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS;QAC/B,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QACvB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import fs from \"node:fs/promises\";\nimport fsSync from \"node:fs\";\nimport path from \"node:path\";\nimport {\n  loadAgentNativeManifest,\n  resolveAgentNativeDataMode,\n  type AgentNativeManifestApp,\n  type LoadAgentNativeManifestOptions,\n} from \"../local-artifacts/index.js\";\nimport type { ExtensionRow } from \"./store.js\";\n\nexport interface LocalExtensionPermissions {\n  appActions: string[];\n  extensionData: boolean;\n  sql: boolean;\n  externalFetch: boolean;\n}\n\nexport interface LocalExtensionSource {\n  mode: \"local-files\";\n  appId: string;\n  rootPath: string;\n  extensionPath: string;\n  manifestPath: string;\n  entryPath: string;\n  permissions: LocalExtensionPermissions;\n  slots: string[];\n}\n\nexport interface LocalExtensionRow extends ExtensionRow {\n  source: LocalExtensionSource;\n}\n\ninterface LocalExtensionManifest {\n  id?: unknown;\n  name?: unknown;\n  description?: unknown;\n  icon?: unknown;\n  entry?: unknown;\n  main?: unknown;\n  slots?: unknown;\n  slot?: unknown;\n  permissions?: unknown;\n}\n\nconst LOCAL_EXTENSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,79}$/;\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return !!value && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction errorCode(error: unknown): string | undefined {\n  return isRecord(error) && typeof error.code === \"string\"\n    ? error.code\n    : undefined;\n}\n\nfunction asStringArray(value: unknown): string[] {\n  if (typeof value === \"string\" && value.trim()) return [value.trim()];\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is string => typeof item === \"string\");\n}\n\nfunction normalizeSlash(filePath: string): string {\n  return filePath.replace(/\\\\/g, \"/\");\n}\n\nfunction normalizeRelativePath(filePath: string, label = \"path\"): string {\n  if (!filePath || typeof filePath !== \"string\") {\n    throw new Error(`${label} is required`);\n  }\n  if (filePath.includes(\"\\0\")) {\n    throw new Error(`${label} must not contain null bytes`);\n  }\n  if (path.isAbsolute(filePath)) {\n    throw new Error(`${label} must be relative`);\n  }\n  const normalized = normalizeSlash(\n    path.posix.normalize(normalizeSlash(filePath)),\n  );\n  if (\n    !normalized ||\n    normalized === \".\" ||\n    normalized === \"..\" ||\n    normalized.startsWith(\"../\") ||\n    normalized.split(\"/\").some((part) => !part || part === \".\" || part === \"..\")\n  ) {\n    throw new Error(`${label} must be a safe relative path`);\n  }\n  return normalized;\n}\n\nfunction resolveInside(basePath: string, relativePath: string, label: string) {\n  const safePath = normalizeRelativePath(relativePath, label);\n  const absolutePath = path.resolve(basePath, safePath);\n  const relative = path.relative(basePath, absolutePath);\n  if (\n    relative === \"\" ||\n    relative.startsWith(\"..\") ||\n    path.isAbsolute(relative)\n  ) {\n    throw new Error(`${label} \"${relativePath}\" is outside the workspace`);\n  }\n  return { safePath, absolutePath };\n}\n\nfunction noFollowOpenFlags(): number {\n  return fsSync.constants.O_RDONLY | (fsSync.constants.O_NOFOLLOW ?? 0);\n}\n\nfunction assertNoSymlinkPathSync(rootPath: string, absolutePath: string): void {\n  const relative = path.relative(rootPath, absolutePath);\n  const segments = relative.split(path.sep).filter(Boolean);\n  let current = rootPath;\n  const pathsToCheck = [\n    current,\n    ...segments.map((segment) => {\n      current = path.join(current, segment);\n      return current;\n    }),\n  ];\n\n  for (const candidate of pathsToCheck) {\n    const stat = fsSync.lstatSync(candidate);\n    if (stat.isSymbolicLink()) {\n      throw new Error(`Path \"${candidate}\" must not traverse a symlink`);\n    }\n  }\n}\n\nfunction readTextFileWithoutSymlink(rootPath: string, filePath: string) {\n  assertNoSymlinkPathSync(rootPath, filePath);\n  const fd = fsSync.openSync(filePath, noFollowOpenFlags());\n  try {\n    return {\n      content: fsSync.readFileSync(fd, \"utf8\"),\n      stat: fsSync.fstatSync(fd),\n    };\n  } finally {\n    fsSync.closeSync(fd);\n  }\n}\n\nfunction normalizeExtensionId(rawId: string, manifestPath: string): string {\n  const id = rawId.trim();\n  if (!LOCAL_EXTENSION_ID_RE.test(id)) {\n    throw new Error(\n      `Local extension id in ${manifestPath} must match ${LOCAL_EXTENSION_ID_RE}`,\n    );\n  }\n  return id;\n}\n\nfunction titleFromId(id: string): string {\n  return (\n    id\n      .replace(/[-_]+/g, \" \")\n      .replace(/\\s+/g, \" \")\n      .trim()\n      .replace(/\\b\\w/g, (char) => char.toUpperCase()) || id\n  );\n}\n\nfunction normalizeActionPermission(value: string): string | null {\n  const trimmed = value.trim();\n  if (!trimmed) return null;\n  if (trimmed === \"*\") return \"*\";\n  if (/^[A-Za-z0-9_.:-]+$/.test(trimmed)) return trimmed;\n  return null;\n}\n\nfunction normalizePermissions(value: unknown): LocalExtensionPermissions {\n  const permissions: LocalExtensionPermissions = {\n    appActions: [],\n    extensionData: true,\n    sql: false,\n    externalFetch: false,\n  };\n  const appActions = new Set<string>();\n\n  const addAction = (action: string) => {\n    const normalized = normalizeActionPermission(action);\n    if (normalized) appActions.add(normalized);\n  };\n\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      if (typeof item !== \"string\") continue;\n      if (item === \"extensionData\" || item === \"storage\") {\n        permissions.extensionData = true;\n        continue;\n      }\n      if (item === \"sql\" || item === \"dbQuery\" || item === \"dbExec\") {\n        permissions.sql = true;\n        continue;\n      }\n      if (item === \"externalFetch\" || item === \"extensionFetch\") {\n        permissions.externalFetch = true;\n        continue;\n      }\n      const actionMatch = item.match(/^(?:appAction|action):(.+)$/);\n      if (actionMatch?.[1]) addAction(actionMatch[1]);\n    }\n  } else if (isRecord(value)) {\n    const rawActions =\n      value.appActions === \"*\" || value.actions === \"*\"\n        ? [\"*\"]\n        : [...asStringArray(value.appActions), ...asStringArray(value.actions)];\n    for (const action of rawActions) addAction(action);\n    if (typeof value.extensionData === \"boolean\") {\n      permissions.extensionData = value.extensionData;\n    }\n    if (typeof value.storage === \"boolean\") {\n      permissions.extensionData = value.storage;\n    }\n    if (typeof value.sql === \"boolean\") permissions.sql = value.sql;\n    if (typeof value.externalFetch === \"boolean\") {\n      permissions.externalFetch = value.externalFetch;\n    }\n    if (typeof value.extensionFetch === \"boolean\") {\n      permissions.externalFetch = value.extensionFetch;\n    }\n  }\n\n  permissions.appActions = [...appActions].sort();\n  return permissions;\n}\n\nfunction manifestAppExtensions(app: AgentNativeManifestApp): string[] {\n  return asStringArray(app.extensions);\n}\n\nfunction readJsonFile(\n  rootPath: string,\n  filePath: string,\n): { value: unknown; stat: fsSync.Stats } | null {\n  try {\n    const { content, stat } = readTextFileWithoutSymlink(rootPath, filePath);\n    return { value: JSON.parse(content) as unknown, stat };\n  } catch (error) {\n    if (errorCode(error) === \"ENOENT\") return null;\n    throw error;\n  }\n}\n\nasync function readLocalExtensionFolder(options: {\n  appId: string;\n  workspaceRoot: string;\n  rootPath: string;\n  rootAbsolutePath: string;\n  folderName: string;\n}): Promise<LocalExtensionRow | null> {\n  const extensionAbsolutePath = path.join(\n    options.rootAbsolutePath,\n    options.folderName,\n  );\n  const extensionRelativePath = normalizeSlash(\n    path.relative(options.workspaceRoot, extensionAbsolutePath),\n  );\n  const manifestAbsolutePath = path.join(\n    extensionAbsolutePath,\n    \"extension.json\",\n  );\n  const manifestRead = readJsonFile(\n    extensionAbsolutePath,\n    manifestAbsolutePath,\n  );\n  if (!manifestRead) return null;\n  const rawManifest = manifestRead.value;\n  if (!isRecord(rawManifest)) {\n    throw new Error(\n      `Local extension manifest must be an object: ${manifestAbsolutePath}`,\n    );\n  }\n  const manifest = rawManifest as LocalExtensionManifest;\n  const manifestRelativePath = normalizeSlash(\n    path.relative(options.workspaceRoot, manifestAbsolutePath),\n  );\n  const id = normalizeExtensionId(\n    typeof manifest.id === \"string\" ? manifest.id : options.folderName,\n    manifestAbsolutePath,\n  );\n  const entry = String(\n    typeof manifest.entry === \"string\"\n      ? manifest.entry\n      : typeof manifest.main === \"string\"\n        ? manifest.main\n        : \"index.html\",\n  );\n  const { safePath: entrySafePath, absolutePath: entryAbsolutePath } =\n    resolveInside(extensionAbsolutePath, entry, \"entry\");\n  const { content, stat: entryStat } = readTextFileWithoutSymlink(\n    extensionAbsolutePath,\n    entryAbsolutePath,\n  );\n  const manifestStat = manifestRead.stat;\n  const updatedAt = new Date(\n    Math.max(manifestStat.mtimeMs, entryStat.mtimeMs),\n  ).toISOString();\n  const createdAt = new Date(\n    Math.min(manifestStat.birthtimeMs, entryStat.birthtimeMs),\n  ).toISOString();\n  const slots = [\n    ...new Set([\n      ...asStringArray(manifest.slots),\n      ...asStringArray(manifest.slot),\n    ]),\n  ].sort();\n  const permissions = normalizePermissions(manifest.permissions);\n  const name =\n    typeof manifest.name === \"string\" && manifest.name.trim()\n      ? manifest.name.trim()\n      : titleFromId(id);\n\n  return {\n    id,\n    name,\n    description:\n      typeof manifest.description === \"string\" ? manifest.description : \"\",\n    content,\n    icon: typeof manifest.icon === \"string\" ? manifest.icon : null,\n    createdAt,\n    updatedAt,\n    hiddenAt: null,\n    hiddenBy: null,\n    ownerEmail: \"local-files\",\n    orgId: null,\n    visibility: \"private\",\n    source: {\n      mode: \"local-files\",\n      appId: options.appId,\n      rootPath: options.rootPath,\n      extensionPath: extensionRelativePath,\n      manifestPath: manifestRelativePath,\n      entryPath: normalizeSlash(\n        path.posix.join(extensionRelativePath, entrySafePath),\n      ),\n      permissions,\n      slots,\n    },\n  };\n}\n\nasync function listLocalExtensionsForRoot(options: {\n  appId: string;\n  workspaceRoot: string;\n  rootPath: string;\n  rootAbsolutePath: string;\n}): Promise<LocalExtensionRow[]> {\n  let rootStat;\n  try {\n    rootStat = await fs.lstat(options.rootAbsolutePath);\n  } catch (error) {\n    if (errorCode(error) === \"ENOENT\") return [];\n    throw error;\n  }\n  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) return [];\n\n  const entries = await fs.readdir(options.rootAbsolutePath, {\n    withFileTypes: true,\n  });\n  const rows: LocalExtensionRow[] = [];\n  for (const entry of entries) {\n    if (\n      !entry.isDirectory() ||\n      entry.isSymbolicLink() ||\n      entry.name.startsWith(\".\")\n    ) {\n      continue;\n    }\n    const row = await readLocalExtensionFolder({\n      appId: options.appId,\n      workspaceRoot: options.workspaceRoot,\n      rootPath: options.rootPath,\n      rootAbsolutePath: options.rootAbsolutePath,\n      folderName: entry.name,\n    });\n    if (row) rows.push(row);\n  }\n  return rows;\n}\n\nexport async function listLocalExtensions(\n  options: LoadAgentNativeManifestOptions = {},\n): Promise<LocalExtensionRow[]> {\n  const loaded = await loadAgentNativeManifest({ ...options, optional: true });\n  if (!loaded) return [];\n\n  const rows: LocalExtensionRow[] = [];\n  const seenIds = new Map<string, string>();\n  for (const [appId, app] of Object.entries(loaded.manifest.apps ?? {})) {\n    const extensionRoots = manifestAppExtensions(app);\n    if (extensionRoots.length === 0) continue;\n    const mode = await resolveAgentNativeDataMode({\n      ...options,\n      manifestPath: loaded.path,\n      appId,\n      defaults: { mode: app.mode },\n    });\n    if (mode !== \"local-files\") continue;\n\n    for (const root of extensionRoots) {\n      const { safePath, absolutePath } = resolveInside(\n        loaded.rootDir,\n        root,\n        \"extensions\",\n      );\n      rows.push(\n        ...(await listLocalExtensionsForRoot({\n          appId,\n          workspaceRoot: loaded.rootDir,\n          rootPath: safePath,\n          rootAbsolutePath: absolutePath,\n        })),\n      );\n    }\n  }\n\n  for (const row of rows) {\n    const existingPath = seenIds.get(row.id);\n    if (existingPath) {\n      throw new Error(\n        `Duplicate local extension id \"${row.id}\" in ${existingPath} and ${row.source.manifestPath}`,\n      );\n    }\n    seenIds.set(row.id, row.source.manifestPath);\n  }\n\n  return rows.sort(\n    (a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id),\n  );\n}\n\nexport async function getLocalExtension(\n  id: string,\n  options: LoadAgentNativeManifestOptions = {},\n): Promise<LocalExtensionRow | null> {\n  const rows = await listLocalExtensions(options);\n  return rows.find((row) => row.id === id) ?? null;\n}\n\nexport function isLocalExtensionRow(\n  row: ExtensionRow | LocalExtensionRow | null | undefined,\n): row is LocalExtensionRow {\n  return (\n    isRecord(row) && isRecord(row.source) && row.source.mode === \"local-files\"\n  );\n}\n\nexport function localExtensionSourceSummary(row: LocalExtensionRow) {\n  return {\n    mode: row.source.mode,\n    appId: row.source.appId,\n    rootPath: row.source.rootPath,\n    extensionPath: row.source.extensionPath,\n    manifestPath: row.source.manifestPath,\n    entryPath: row.source.entryPath,\n    slots: row.source.slots,\n    permissions: row.source.permissions,\n  };\n}\n"]}

package/dist/extensions/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/extensions/routes.ts"],"names":[],"mappings":"AAwDA,wBAAgB,uBAAuB,2FAuCtC;AA8tBD,eAAO,MAAM,kBAAkB,QACqa,CAAC;AAMrc,eAAO,MAAM,gBAAgB,QACwkB,CAAC;AAMtmB,eAAO,MAAM,oBAAoB,QACgB,CAAC;AAMlD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ/D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/extensions/routes.ts"],"names":[],"mappings":"AA8DA,wBAAgB,uBAAuB,2FAuCtC;AAizBD,eAAO,MAAM,kBAAkB,QACqa,CAAC;AAMrc,eAAO,MAAM,gBAAgB,QACwkB,CAAC;AAMtmB,eAAO,MAAM,oBAAoB,QACgB,CAAC;AAMlD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ/D"}

package/dist/extensions/routes.js

@@ -6,6 +6,7 @@ import { runWithRequestContext, getRequestOrgId, } from "../server/request-conte
 import { getOrgContext } from "../org/context.js";
 import { getDbExec, isPostgres } from "../db/client.js";
 import { listExtensions, getExtension, getExtensionHistoryVersion, listExtensionHistory, createExtension, updateExtension, updateExtensionContent, restoreExtensionHistoryVersion, deleteExtension, hideExtension, unhideExtension, globalHideExtension, globalUnhideExtension, ensureExtensionsTables, } from "./store.js";
+import { getLocalExtension, isLocalExtensionRow, listLocalExtensions, } from "./local.js";
 import { buildExtensionHtml, EXTENSION_IFRAME_CSP } from "./html-shell.js";
 import { getThemeVars } from "./theme.js";
 import { resolveKeyReferencesWithRequestScopes, validateUrlAllowlist, getResolvedKeyAllowlist, } from "../secrets/substitution.js";
@@ -88,7 +89,8 @@ async function dispatch(event, method, parts, userEmail) {
         const includeGloballyHidden = event.url?.searchParams?.get("includeGloballyHidden") === "true";
         const includeContent = event.url?.searchParams?.get("includeContent") === "true";
         const rows = await listExtensions({ includeGloballyHidden });
-        return Promise.all(rows.map((row) => extensionResponse(row, undefined, { includeContent })));
+        const localRows = includeGloballyHidden ? [] : await listLocalExtensions();
+        return Promise.all([...rows, ...localRows].map((row) => extensionResponse(row, undefined, { includeContent })));
     }
     // POST / — create
     if (method === "POST" && parts.length === 0) {
@@ -103,6 +105,25 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // GET /:id/render
     if (method === "GET" && parts.length === 2 && parts[1] === "render") {
+        const localExtension = await getLocalExtension(parts[0]);
+        if (localExtension) {
+            const search = event.url?.search || "";
+            const isDark = search.includes("dark=1") || search.includes("dark=true");
+            const themeVars = getThemeVars(isDark);
+            const html = buildExtensionHtml(localExtension.content, themeVars, isDark, parts[0], {
+                authorEmail: localExtension.ownerEmail,
+                viewerEmail: userEmail,
+                isAuthor: false,
+                role: "viewer",
+                source: "local-files",
+                permissions: localExtension.source.permissions,
+            });
+            setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+            setResponseHeader(event, "Content-Security-Policy", EXTENSION_IFRAME_CSP);
+            setResponseHeader(event, "X-Content-Type-Options", "nosniff");
+            setResponseHeader(event, "Referrer-Policy", "no-referrer");
+            return html;
+        }
         const access = await resolveAccess("extension", parts[0]);
         const extension = access?.resource;
         if (!extension) {
@@ -132,6 +153,9 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // GET /:id/history — list saved snapshots for an extension
     if (method === "GET" && parts.length === 2 && parts[1] === "history") {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const limitParam = event.url?.searchParams?.get("limit");
         const limit = limitParam === null || limitParam === undefined
             ? undefined
@@ -146,6 +170,9 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // GET /:id/history/:version — fetch one snapshot plus its previous-version diff
     if (method === "GET" && parts.length === 3 && parts[1] === "history") {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const detail = await getExtensionHistoryVersion(parts[0], parts[2]);
         if (!detail) {
             setResponseStatus(event, 404);
@@ -158,6 +185,9 @@ async function dispatch(event, method, parts, userEmail) {
         parts.length === 4 &&
         parts[1] === "history" &&
         parts[3] === "restore") {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const restored = await restoreExtensionHistoryVersion(parts[0], parts[2]);
         if (!restored) {
             setResponseStatus(event, 404);
@@ -167,6 +197,10 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // GET /:id
     if (method === "GET" && parts.length === 1) {
+        const localExtension = await getLocalExtension(parts[0]);
+        if (localExtension) {
+            return extensionResponse(localExtension, "viewer");
+        }
         const access = await resolveAccess("extension", parts[0]);
         if (!access) {
             setResponseStatus(event, 404);
@@ -177,6 +211,9 @@ async function dispatch(event, method, parts, userEmail) {
     // POST /:id/hide — remove from the current user's Extensions list/sidebar
     // without deleting the underlying extension for teammates or shared slots.
     if (method === "POST" && parts.length === 2 && parts[1] === "hide") {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const ok = await hideExtension(parts[0]);
         if (!ok) {
             setResponseStatus(event, 404);
@@ -186,6 +223,9 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // POST /:id/unhide — restore an extension hidden by the current user.
     if (method === "POST" && parts.length === 2 && parts[1] === "unhide") {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const ok = await unhideExtension(parts[0]);
         if (!ok) {
             setResponseStatus(event, 404);
@@ -195,6 +235,9 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // POST /:id/global-hide — admin/owner hides the extension from EVERYONE.
     if (method === "POST" && parts.length === 2 && parts[1] === "global-hide") {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const ok = await globalHideExtension(parts[0]);
         if (!ok) {
             setResponseStatus(event, 404);
@@ -204,6 +247,9 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // POST /:id/global-unhide — admin/owner reverses a global hide.
     if (method === "POST" && parts.length === 2 && parts[1] === "global-unhide") {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const ok = await globalUnhideExtension(parts[0]);
         if (!ok) {
             setResponseStatus(event, 404);
@@ -213,6 +259,9 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // PUT /:id
     if (method === "PUT" && parts.length === 1) {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const body = await readBody(event);
         const hasContentUpdate = body.content !== undefined ||
             body.patches !== undefined ||
@@ -245,6 +294,9 @@ async function dispatch(event, method, parts, userEmail) {
     }
     // DELETE /:id
     if (method === "DELETE" && parts.length === 1) {
+        const localResponse = await localExtensionSqlOnlyResponse(event, parts[0]);
+        if (localResponse)
+            return localResponse;
         const ok = await deleteExtension(parts[0]);
         if (!ok) {
             setResponseStatus(event, 404);
@@ -256,27 +308,49 @@ async function dispatch(event, method, parts, userEmail) {
     return { error: "Not found" };
 }
 async function extensionResponse(row, role, options = {}) {
-    const resolvedRole = role ??
-        (await resolveAccess("extension", row.id)
-            .then((access) => access?.role ?? null)
-            .catch(() => null));
+    const local = isLocalExtensionRow(row);
+    const resolvedRole = local
+        ? "viewer"
+        : (role ??
+            (await resolveAccess("extension", row.id)
+                .then((access) => access?.role ?? null)
+                .catch(() => null)));
     const responseRow = options.includeContent === false
         ? (({ content: _content, ...rest }) => rest)(row)
         : row;
     return {
         ...responseRow,
         role: resolvedRole,
-        canEdit: resolvedRole
-            ? ["owner", "admin", "editor"].includes(resolvedRole)
-            : false,
-        canDelete: resolvedRole ? ["owner", "admin"].includes(resolvedRole) : false,
+        canEdit: local
+            ? false
+            : resolvedRole
+                ? ["owner", "admin", "editor"].includes(resolvedRole)
+                : false,
+        canDelete: local
+            ? false
+            : resolvedRole
+                ? ["owner", "admin"].includes(resolvedRole)
+                : false,
         globallyHidden: row.hiddenAt != null,
     };
 }
+async function localExtensionSqlOnlyResponse(event, extensionId) {
+    const localExtension = await getLocalExtension(extensionId);
+    if (!localExtension)
+        return null;
+    setResponseStatus(event, 400);
+    return {
+        error: "This extension is backed by local files. Edit its extension.json or entry file in the workspace; SQL-backed extension history, sharing, hide, update, and delete operations do not apply.",
+        source: localExtension.source,
+    };
+}
 async function handleExtensionDataList(event, extensionId, collection, userEmail) {
     await ensureExtensionsTables();
     const extension = await getExtension(extensionId);
-    if (!extension) {
+    const localExtension = extension
+        ? null
+        : await getLocalExtension(extensionId);
+    if (!extension && !localExtension) {
         setResponseStatus(event, 404);
         return { error: "Extension not found" };
     }
@@ -328,7 +402,10 @@ async function handleExtensionDataList(event, extensionId, collection, userEmail
 async function handleExtensionDataUpsert(event, extensionId, collection, userEmail) {
     await ensureExtensionsTables();
     const extension = await getExtension(extensionId);
-    if (!extension) {
+    const localExtension = extension
+        ? null
+        : await getLocalExtension(extensionId);
+    if (!extension && !localExtension) {
         setResponseStatus(event, 404);
         return { error: "Extension not found" };
     }
@@ -387,7 +464,10 @@ async function handleExtensionDataUpsert(event, extensionId, collection, userEma
 async function handleExtensionDataDelete(event, extensionId, collection, itemId, userEmail) {
     await ensureExtensionsTables();
     const extension = await getExtension(extensionId);
-    if (!extension) {
+    const localExtension = extension
+        ? null
+        : await getLocalExtension(extensionId);
+    if (!extension && !localExtension) {
         setResponseStatus(event, 404);
         return { error: "Extension not found" };
     }