@allin-ai/agent-client 0.1.0

package/dist/logger.js

@@ -0,0 +1,175 @@
+import { appendFile, mkdir, rename, stat, unlink } from "node:fs/promises";
+import path from "node:path";
+const redactKey = /(?:token|secret|password|authorization|credential|api[-_]?key)$/i;
+const bearerValue = /\b(?:bearer|basic)\s+[^\s,;]+/gi;
+const inlineSecret = /\b((?:(?:access|refresh|id)[_-]?token|(?:client)?[_-]?secret|api[-_]?key|token|password|authorization|credential))\s*([:=])\s*[^\s,;]+/gi;
+function redactString(value) {
+    return value
+        .replace(bearerValue, (match) => `${match.split(/\s+/, 1)[0]} [REDACTED]`)
+        .replace(inlineSecret, (_match, key, separator) => `${key}${separator}[REDACTED]`);
+}
+function redactValue(value, seen = new WeakSet()) {
+    if (typeof value === "string")
+        return redactString(value);
+    if (value === null || typeof value !== "object")
+        return value;
+    if (seen.has(value))
+        return "[Circular]";
+    seen.add(value);
+    if (Array.isArray(value))
+        return value.map((item) => redactValue(item, seen));
+    const result = {};
+    for (const [key, nested] of Object.entries(value)) {
+        result[key] = redactKey.test(key)
+            ? "[REDACTED]"
+            : redactValue(nested, seen);
+    }
+    return result;
+}
+/** Serialize one JSONL record after removing credential-shaped values. */
+export function serializeLog(entry) {
+    const redacted = redactValue(entry);
+    try {
+        return `${JSON.stringify(redacted)}\n`;
+    }
+    catch {
+        return `${JSON.stringify({ message: "[Unserializable log entry]" })}\n`;
+    }
+}
+const loggerFs = { mkdir, stat, appendFile, rename, unlink };
+function absent(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+async function sizeOf(fs, file) {
+    try {
+        return (await fs.stat(file)).size;
+    }
+    catch (error) {
+        if (absent(error))
+            return 0;
+        throw error;
+    }
+}
+async function removeIfPresent(fs, file) {
+    try {
+        await fs.unlink(file);
+    }
+    catch (error) {
+        if (!absent(error))
+            throw error;
+    }
+}
+/** JSONL file logger with bounded rotation and no unredacted writes. */
+export function createRotatingJsonlLogger(options) {
+    const fs = options.fileSystem ?? loggerFs;
+    const maxBytes = options.maxBytes ?? 5 * 1024 * 1024;
+    const maxFiles = options.maxFiles ?? 5;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+        throw new RangeError("maxBytes must be a positive integer");
+    }
+    if (!Number.isSafeInteger(maxFiles) || maxFiles < 1) {
+        throw new RangeError("maxFiles must be a positive integer");
+    }
+    const file = path.join(options.logsRoot, "agent.log");
+    let writing = Promise.resolve();
+    async function rotate() {
+        for (let index = maxFiles - 1; index >= 1; index -= 1) {
+            const current = `${file}.${index}`;
+            const next = `${file}.${index + 1}`;
+            await removeIfPresent(fs, next);
+            try {
+                await fs.rename(current, next);
+            }
+            catch (error) {
+                if (!absent(error))
+                    throw error;
+            }
+        }
+        try {
+            await fs.rename(file, `${file}.1`);
+        }
+        catch (error) {
+            if (!absent(error))
+                throw error;
+        }
+    }
+    return {
+        write(entry) {
+            const timestamp = options.now?.().toISOString() ?? new Date().toISOString();
+            const line = serializeLog({ timestamp, ...entry });
+            writing = writing.then(async () => {
+                await fs.mkdir(options.logsRoot, { recursive: true });
+                if ((await sizeOf(fs, file)) > 0 &&
+                    (await sizeOf(fs, file)) + Buffer.byteLength(line) > maxBytes) {
+                    await rotate();
+                }
+                await fs.appendFile(file, line, "utf8");
+            });
+            return writing;
+        },
+    };
+}
+function format(tag, message, meta) {
+    let suffix = "";
+    if (meta && Object.keys(meta).length > 0) {
+        try {
+            suffix = ` ${JSON.stringify(meta)}`;
+        }
+        catch {
+            suffix = ` ${String(meta)}`;
+        }
+    }
+    return `[bridge:${tag}] ${message}${suffix}`;
+}
+export function createConsoleLogger(options) {
+    const showDebug = options?.debug ??
+        (typeof process !== "undefined" &&
+            process.env?.ALLINAI_BRIDGE_DEBUG === "1");
+    return {
+        debug(tag, message, meta) {
+            if (showDebug)
+                console.log(format(tag, message, meta));
+        },
+        info(tag, message, meta) {
+            console.log(format(tag, message, meta));
+        },
+        warn(tag, message, meta) {
+            console.error(format(tag, message, meta));
+        },
+    };
+}
+let current = null;
+let defaultLogger = null;
+/** Replace the process-wide bridge logger (call before creating hub/bridge). */
+export function setBridgeLogger(logger) {
+    current = logger;
+}
+/** Test hook: fall back to the default console logger. */
+export function resetBridgeLogger() {
+    current = null;
+}
+/** Internal facade used by SDK modules. */
+export const bridgeLog = {
+    debug(tag, message, meta) {
+        if (!current) {
+            defaultLogger ??= createConsoleLogger();
+        }
+        (current ?? defaultLogger).debug(tag, message, meta);
+    },
+    info(tag, message, meta) {
+        if (!current) {
+            defaultLogger ??= createConsoleLogger();
+        }
+        (current ?? defaultLogger).info(tag, message, meta);
+    },
+    warn(tag, message, meta) {
+        if (!current) {
+            defaultLogger ??= createConsoleLogger();
+        }
+        (current ?? defaultLogger).warn(tag, message, meta);
+    },
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,IAAI,MAAM,WAAW,CAAC;AAwB7B,MAAM,SAAS,GACb,kEAAkE,CAAC;AACrE,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,MAAM,YAAY,GAChB,0IAA0I,CAAC;AAE7I,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK;SACT,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;SACzE,OAAO,CACN,YAAY,EACZ,CAAC,MAAM,EAAE,GAAW,EAAE,SAAiB,EAAE,EAAE,CACzC,GAAG,GAAG,GAAG,SAAS,YAAY,CACjC,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAO,IAAI,OAAO,EAAU;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,KAAoB;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,IAAI,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAqB,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAE/E,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACd,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAoB,EAAE,IAAY;IACtD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAoB,EACpB,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;IAClC,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhC,KAAK,UAAU,MAAM;QACnB,KAAK,IAAI,KAAK,GAAG,QAAQ,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK;YACT,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YACnD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtD,IACE,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5B,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,EAC7D,CAAC;oBACD,MAAM,MAAM,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAS,MAAM,CACb,GAAW,EACX,OAAe,EACf,IAA8B;IAE9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,WAAW,GAAG,KAAK,OAAO,GAAG,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAEnC;IACC,MAAM,SAAS,GACb,OAAO,EAAE,KAAK;QACd,CAAC,OAAO,OAAO,KAAK,WAAW;YAC7B,OAAO,CAAC,GAAG,EAAE,oBAAoB,KAAK,GAAG,CAAC,CAAC;IAC/C,OAAO;QACL,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI;YACtB,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI;YACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI;YACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,OAAO,GAAwB,IAAI,CAAC;AACxC,IAAI,aAAa,GAAwB,IAAI,CAAC;AAE9C,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,OAAO,GAAG,MAAM,CAAC;AACnB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,SAAS,GAAiB;IACrC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI;QACtB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,aAAa,KAAK,mBAAmB,EAAE,CAAC;QAC1C,CAAC;QACD,CAAC,OAAO,IAAI,aAAa,CAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,aAAa,KAAK,mBAAmB,EAAE,CAAC;QAC1C,CAAC;QACD,CAAC,OAAO,IAAI,aAAa,CAAE,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,aAAa,KAAK,mBAAmB,EAAE,CAAC;QAC1C,CAAC;QACD,CAAC,OAAO,IAAI,aAAa,CAAE,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;CACF,CAAC"}

package/dist/paths.d.ts

@@ -0,0 +1,29 @@
+export type AgentPaths = Readonly<{
+    home: string;
+    configFile: string;
+    stateDb: string;
+    credentialsRoot: string;
+    pluginsRoot: string;
+    runsRoot: string;
+    logsRoot: string;
+    controlSocket: string;
+}>;
+/** Resolve the one local root owned by an Agent Client installation. */
+export declare function resolveAgentHome(homeDir?: string): string;
+/**
+ * Every filesystem path owned by the standalone client derives from one root.
+ * Keeping this construction here makes accidental use of a host application's
+ * data directory straightforward to spot in review.
+ */
+export declare function resolveAgentPaths(homeDir?: string): AgentPaths;
+/** Resolve every owned path when a host supplies an explicit Agent home. */
+export declare function resolveAgentPathsAt(home: string): AgentPaths;
+/**
+ * Windows named pipes cannot be represented below an ordinary user directory.
+ * Derive a stable, opaque name from the Agent home rather than opening TCP.
+ */
+export declare function resolveAgentControlEndpoint(paths: AgentPaths, platform?: NodeJS.Platform): string;
+export declare function isMemoryHookProxyPath(pathname: string): boolean;
+/** Optional W4+ passthrough; not wired in smoke. */
+export declare function isOptionalAgentProxyPath(pathname: string): boolean;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AAEH,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,OAAO,SAAe,GAAG,MAAM,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,SAAe,GAAG,UAAU,CAEpE;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAc5D;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,UAAU,EACjB,QAAQ,kBAAmB,GAC1B,MAAM,CAIR;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKlE"}

package/dist/paths.js

@@ -0,0 +1,50 @@
+import { createHash } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+/** Resolve the one local root owned by an Agent Client installation. */
+export function resolveAgentHome(homeDir = os.homedir()) {
+    return path.join(homeDir, ".allinai", "agent");
+}
+/**
+ * Every filesystem path owned by the standalone client derives from one root.
+ * Keeping this construction here makes accidental use of a host application's
+ * data directory straightforward to spot in review.
+ */
+export function resolveAgentPaths(homeDir = os.homedir()) {
+    return resolveAgentPathsAt(resolveAgentHome(homeDir));
+}
+/** Resolve every owned path when a host supplies an explicit Agent home. */
+export function resolveAgentPathsAt(home) {
+    if (!path.isAbsolute(home)) {
+        throw new TypeError("Agent home must be an absolute path");
+    }
+    return {
+        home,
+        configFile: path.join(home, "config.json"),
+        stateDb: path.join(home, "state.db"),
+        credentialsRoot: path.join(home, "credentials"),
+        pluginsRoot: path.join(home, "plugins"),
+        runsRoot: path.join(home, "runs"),
+        logsRoot: path.join(home, "logs"),
+        controlSocket: path.join(home, "control.sock"),
+    };
+}
+/**
+ * Windows named pipes cannot be represented below an ordinary user directory.
+ * Derive a stable, opaque name from the Agent home rather than opening TCP.
+ */
+export function resolveAgentControlEndpoint(paths, platform = process.platform) {
+    if (platform !== "win32")
+        return paths.controlSocket;
+    const id = createHash("sha256").update(paths.home).digest("hex").slice(0, 24);
+    return `\\\\.\\pipe\\allinai-agent-${id}`;
+}
+export function isMemoryHookProxyPath(pathname) {
+    return pathname.startsWith("/api/memory/hooks/");
+}
+/** Optional W4+ passthrough; not wired in smoke. */
+export function isOptionalAgentProxyPath(pathname) {
+    return (pathname.startsWith("/api/automation/") ||
+        pathname.startsWith("/api/skills/"));
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAa7B,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IACtD,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC1C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC;QACpC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QACvC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACjC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAiB,EACjB,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAE3B,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACrD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,8BAA8B,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AACnD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACvC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CACpC,CAAC;AACJ,CAAC"}

package/dist/plugins/git.d.ts

@@ -0,0 +1,30 @@
+type ExecFileOptions = {
+    cwd?: string;
+    shell: false;
+};
+type ExecFileResult = {
+    stdout: string;
+    stderr: string;
+};
+export type GitClient = {
+    run(args: string[], options?: {
+        cwd?: string;
+    }): Promise<string>;
+};
+export type GitClientOptions = {
+    execFile?: (file: string, args: string[], options: ExecFileOptions) => Promise<ExecFileResult>;
+};
+/** The production installer never accepts local paths or arbitrary protocols. */
+export declare function isProductionGitUrl(value: string): boolean;
+/**
+ * Empty allowlists deny remote activation. Entries may be either a hostname
+ * (`github.com`) or an exact Git authority (`ssh://git@github.com`).
+ */
+export declare function isAllowedGitOrigin(value: string, allowedOrigins: readonly string[]): boolean;
+/**
+ * Git's invocation boundary. All callers supply a fixed argument vector; no
+ * Hub value is interpolated into a shell command.
+ */
+export declare function createGitClient(options?: GitClientOptions): GitClient;
+export {};
+//# sourceMappingURL=git.d.ts.map

package/dist/plugins/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/plugins/git.ts"],"names":[],"mappings":"AAGA,KAAK,eAAe,GAAG;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;CACd,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9B,CAAC;AAyBF,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAiBzD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAMT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS,CAwBzE"}

package/dist/plugins/git.js

@@ -0,0 +1,80 @@
+import { execFile as nodeExecFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFile = promisify(nodeExecFile);
+const SCP_LIKE_SSH = /^[^\s@/:]+@[^\s:/]+:[^\s]+$/;
+function gitOriginForms(value) {
+    if (SCP_LIKE_SSH.test(value)) {
+        const [userAndHost] = value.split(":", 1);
+        const [, host] = userAndHost.split("@", 2);
+        return [
+            `ssh://${userAndHost}`.toLowerCase(),
+            userAndHost.toLowerCase(),
+            host.toLowerCase(),
+        ];
+    }
+    try {
+        const url = new URL(value);
+        const host = url.host.toLowerCase();
+        const authority = `${url.protocol}//${url.username ? `${url.username}@` : ""}${host}`;
+        return [authority.toLowerCase(), host];
+    }
+    catch {
+        return [];
+    }
+}
+/** The production installer never accepts local paths or arbitrary protocols. */
+export function isProductionGitUrl(value) {
+    if (value.length === 0 || /\s/.test(value))
+        return false;
+    if (SCP_LIKE_SSH.test(value))
+        return true;
+    try {
+        const url = new URL(value);
+        if ((url.protocol !== "https:" && url.protocol !== "ssh:") ||
+            url.hostname.length === 0) {
+            return false;
+        }
+        return (url.protocol === "ssh:" || (url.username === "" && url.password === ""));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Empty allowlists deny remote activation. Entries may be either a hostname
+ * (`github.com`) or an exact Git authority (`ssh://git@github.com`).
+ */
+export function isAllowedGitOrigin(value, allowedOrigins) {
+    if (!isProductionGitUrl(value) || allowedOrigins.length === 0)
+        return false;
+    const allowed = new Set(allowedOrigins.map((origin) => origin.trim().toLowerCase()));
+    return gitOriginForms(value).some((form) => allowed.has(form));
+}
+/**
+ * Git's invocation boundary. All callers supply a fixed argument vector; no
+ * Hub value is interpolated into a shell command.
+ */
+export function createGitClient(options = {}) {
+    const execute = options.execFile ??
+        (async (file, args, execOptions) => {
+            const result = await execFile(file, args, {
+                cwd: execOptions.cwd,
+                shell: execOptions.shell,
+                encoding: "utf8",
+            });
+            return {
+                stdout: String(result.stdout),
+                stderr: String(result.stderr),
+            };
+        });
+    return {
+        async run(args, runOptions = {}) {
+            const result = await execute("git", [...args], {
+                cwd: runOptions.cwd,
+                shell: false,
+            });
+            return result.stdout.trim();
+        },
+    };
+}
+//# sourceMappingURL=git.js.map

package/dist/plugins/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/plugins/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAwBtC,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;AACzC,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAEnD,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,WAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5C,OAAO;YACL,SAAS,WAAW,EAAE,CAAC,WAAW,EAAE;YACpC,WAAY,CAAC,WAAW,EAAE;YAC1B,IAAK,CAAC,WAAW,EAAE;SACpB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;QACtF,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EACzB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,cAAiC;IAEjC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC5D,CAAC;IACF,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC5D,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ;QAChB,CAAC,KAAK,EAAE,IAAY,EAAE,IAAc,EAAE,WAA4B,EAAE,EAAE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE;gBACxC,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;IAEL,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,EAAE;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAC7C,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/plugins/manager.d.ts

@@ -0,0 +1,41 @@
+import { type PlatformId } from "../runtime/types.js";
+import { type GitClient } from "./git.js";
+import type { ActivePluginSnapshot, InstalledPlugin, PluginConfig, PluginStateStore } from "./types.js";
+export type PluginManagerOptions = {
+    pluginsRoot: string;
+    git?: GitClient;
+    /** Empty means no remote origin is trusted until the local config names one. */
+    allowedGitOrigins?: readonly string[];
+    /** Tests must inject this to use a local fixture repository. */
+    validateGitUrl?: (gitUrl: string) => boolean;
+    stateStore?: PluginStateStore;
+};
+/**
+ * Reconciles Hub Git desired state into local, immutable plugin revisions.
+ * Activation changes a small same-directory pointer only after the complete
+ * checkout and its manifest have been validated.
+ */
+export declare class PluginManager {
+    private readonly options;
+    private readonly git;
+    private readonly validateGitUrl;
+    private readonly locks;
+    private readonly statuses;
+    private readonly activePlugins;
+    constructor(options: PluginManagerOptions);
+    sync(desired: PluginConfig[]): Promise<InstalledPlugin[]>;
+    active(runtime: PlatformId): InstalledPlugin[];
+    status(id: string): InstalledPlugin | null;
+    snapshotActivePlugins(runtime?: PlatformId): ActivePluginSnapshot[];
+    private syncOne;
+    private checkout;
+    private resolveCommit;
+    private readManifest;
+    private activate;
+    private failed;
+    private deactivate;
+    private save;
+    private createStagingDirectory;
+    private withPluginLock;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/plugins/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/plugins/manager.ts"],"names":[],"mappings":"AASA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,YAAY,EAEZ,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAMpB,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,gEAAgE;IAChE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B,CAAC;AAiGF;;;;GAIG;AACH,qBAAa,aAAa;IAOZ,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;gBAEvC,OAAO,EAAE,oBAAoB;IAWpD,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA0B/D,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,eAAe,EAAE;IAW9C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAI1C,qBAAqB,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,oBAAoB,EAAE;YAWrD,OAAO;YAiDP,QAAQ;YAqCR,aAAa;YAiBb,YAAY;YAgBZ,QAAQ;IA0CtB,OAAO,CAAC,MAAM;YAYA,UAAU;IAgBxB,OAAO,CAAC,IAAI;YASE,sBAAsB;YAOtB,cAAc;CAmB7B"}