@app-vitals/agent-admin 1.3.0 → 1.5.0

package/src/github-enterprise-apps.unit.test.ts

@@ -0,0 +1,42 @@
+/**
+ * Unit tests for the GitHubEnterpriseApp serializer: metadata plus a
+ * "key set" flag only, never the private key (plain or encrypted).
+ */
+
+import { describe, expect, it } from "bun:test";
+import { toGitHubEnterpriseAppMetadata } from "./github-enterprise-apps.ts";
+
+describe("toGitHubEnterpriseAppMetadata", () => {
+  const row = {
+    role: "installer",
+    appId: "123",
+    slug: "my-app",
+    enterpriseSlug: "acme",
+    privateKeyEncrypted: "aa:bb:cc",
+    lastValidationStatus: "ok",
+    lastValidatedAt: new Date("2026-01-01T00:00:00Z"),
+    lastValidationError: null,
+    createdAt: new Date("2026-01-01T00:00:00Z"),
+    updatedAt: new Date("2026-01-02T00:00:00Z"),
+  };
+
+  it("returns metadata and keySet, with no key material", () => {
+    const out = toGitHubEnterpriseAppMetadata(row);
+    expect(out.keySet).toBe(true);
+    expect(out).toMatchObject({
+      role: "installer",
+      appId: "123",
+      slug: "my-app",
+    });
+    expect(Object.keys(out).some((k) => /key/i.test(k) && k !== "keySet")).toBe(
+      false,
+    );
+    expect(JSON.stringify(out)).not.toContain("aa:bb:cc");
+  });
+
+  it("keySet is false when no ciphertext is stored", () => {
+    expect(
+      toGitHubEnterpriseAppMetadata({ ...row, privateKeyEncrypted: "" }).keySet,
+    ).toBe(false);
+  });
+});

package/src/openapi-schemas.ts

@@ -895,6 +895,43 @@ export const PatchAgentPluginBodySchema = z
   })
   .openapi("PatchAgentPluginBody");
 
+// ─── AgentMarketplace ─────────────────────────────────────────────────────────
+
+export const AgentMarketplaceSchema = z
+  .object({
+    id: z.string().openapi({ example: "clx1234567890" }),
+    agentId: z.string().openapi({ example: "clx1234567890" }),
+    name: z.string().openapi({ example: "shipwright" }),
+    source: z.string().openapi({ example: "app-vitals/shipwright" }),
+    ref: z.string().nullable().openapi({ example: "main" }),
+    createdAt: z
+      .string()
+      .datetime()
+      .openapi({ example: "2026-01-01T00:00:00.000Z" }),
+    updatedAt: z
+      .string()
+      .datetime()
+      .openapi({ example: "2026-01-01T00:00:00.000Z" }),
+  })
+  .openapi("AgentMarketplace");
+
+export type AgentMarketplace = z.infer<typeof AgentMarketplaceSchema>;
+
+/**
+ * `source` / `name` / `ref` are validated by AgentMarketplaceService (422), not
+ * here — the Zod layer answers 400.
+ */
+export const UpsertAgentMarketplaceBodySchema = z
+  .object({
+    name: z.string().openapi({ example: "shipwright" }),
+    source: z.string().openapi({
+      description: "GitHub `owner/repo` or an https git URL",
+      example: "app-vitals/shipwright",
+    }),
+    ref: z.string().nullable().optional().openapi({ example: "main" }),
+  })
+  .openapi("UpsertAgentMarketplaceBody");
+
 // ─── Pipeline phases ────────────────────────────────────────────────────────────
 //
 // The six pipeline phases a methodology override can target — the keys of the
@@ -1084,6 +1121,11 @@ export const TokenIdParamSchema = z.object({
   tokenId: z.string().openapi({ example: "clx0987654321" }),
 });
 
+export const MarketplaceIdParamSchema = z.object({
+  id: z.string().openapi({ example: "clx1234567890" }),
+  marketplaceId: z.string().openapi({ example: "clx0987654321" }),
+});
+
 export const EnvKeyParamSchema = z.object({
   id: z.string().openapi({ example: "clx1234567890" }),
   key: z.string().openapi({ example: "MY_VAR" }),
@@ -1298,6 +1340,14 @@ const AgentConfigPluginSchema = z
   })
   .openapi("AgentConfigPlugin");
 
+const AgentConfigMarketplaceSchema = z
+  .object({
+    name: z.string().openapi({ example: "shipwright" }),
+    source: z.string().openapi({ example: "app-vitals/shipwright" }),
+    ref: z.string().nullable().openapi({ example: "main" }),
+  })
+  .openapi("AgentConfigMarketplace");
+
 export const AgentConfigResponseSchema = z
   .object({
     env: z
@@ -1305,6 +1355,12 @@ export const AgentConfigResponseSchema = z
       .openapi({ example: { SLACK_BOT_TOKEN: "xoxb-..." } }),
     allowedTools: z.array(z.string()).openapi({ example: ["Read", "Write"] }),
     plugins: z.array(AgentConfigPluginSchema),
+    /**
+     * PMK-1.2: remote plugin marketplaces to register before plugin install.
+     * Optional so existing fixtures/doubles keep compiling; the handler
+     * always populates it (empty array when the agent has none).
+     */
+    marketplaces: z.array(AgentConfigMarketplaceSchema).optional(),
     repos: z.array(z.string()).openapi({ example: ["org/repo1", "org/repo2"] }),
     reviewAuthorAllowlist: z
       .array(z.string())

package/src/openapi-schemas.unit.test.ts

@@ -10,6 +10,7 @@ import { type AgentRuntimeDeps, createAgentRuntimeApp } from "./api.ts";
 import {
   type AgentCronJob,
   AgentCronJobSchema,
+  AgentMarketplaceSchema,
   type AgentPlugin,
   AgentPluginSchema,
   type AgentToken,
@@ -18,6 +19,7 @@ import {
   AgentToolSchema,
   ErrorSchema,
   PatchAgentBodySchema,
+  UpsertAgentMarketplaceBodySchema,
 } from "./openapi-schemas.ts";
 
 // ─── Fixtures ─────────────────────────────────────────────────────────────────
@@ -381,3 +383,30 @@ describe("PatchAgentBodySchema.podServiceAccountName (COS-49.1)", () => {
     }
   });
 });
+
+// ─── AgentMarketplace (PMK-1.2) ───────────────────────────────────────────────
+
+describe("AgentMarketplace schemas", () => {
+  test("AgentMarketplaceSchema accepts a row with a null ref", () => {
+    const result = AgentMarketplaceSchema.safeParse({
+      id: "m1",
+      agentId: "a1",
+      name: "shipwright",
+      source: "app-vitals/shipwright",
+      ref: null,
+      createdAt: "2026-01-01T00:00:00.000Z",
+      updatedAt: "2026-01-01T00:00:00.000Z",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  test("UpsertAgentMarketplaceBodySchema leaves source validation to the service (422)", () => {
+    expect(
+      UpsertAgentMarketplaceBodySchema.safeParse({ name: "m", source: "bad" })
+        .success,
+    ).toBe(true);
+    expect(
+      UpsertAgentMarketplaceBodySchema.safeParse({ name: "m" }).success,
+    ).toBe(false);
+  });
+});

package/src/token-crypto.ts

@@ -58,3 +58,28 @@ export function makeTokenCrypto(
     },
   };
 }
+
+/**
+ * Strict TokenCrypto for credentials that must never be stored or passed on as
+ * plain text (e.g. GitHub Enterprise App private keys).
+ *
+ * Differences from makeTokenCrypto(): returns null when no key is configured
+ * (callers must refuse to save, not fall back to identity), and decrypt()
+ * throws on any failure instead of returning the stored value as legacy
+ * plain text. A malformed key still throws at construction. Error messages
+ * never include the input value.
+ */
+export function makeStrictTokenCrypto(
+  key = process.env.SHIPWRIGHT_ENCRYPTION_KEY,
+): TokenCrypto | null {
+  if (!key) return null;
+  if (!isValidKeyHex(key)) {
+    throw new Error(
+      `SHIPWRIGHT_ENCRYPTION_KEY must be a 64-character hex string (32 bytes for AES-256-GCM), but got ${key.length} character(s). Generate one with: openssl rand -hex 32`,
+    );
+  }
+  return {
+    encrypt: (token) => encrypt(token, key),
+    decrypt: (encrypted) => decrypt(encrypted, key),
+  };
+}

package/src/token-crypto.unit.test.ts

@@ -6,7 +6,11 @@
 
 import { afterEach, describe, expect, it } from "bun:test";
 import { decrypt, encrypt, isValidKeyHex } from "./crypto.ts";
-import { identityCrypto, makeTokenCrypto } from "./token-crypto.ts";
+import {
+  identityCrypto,
+  makeStrictTokenCrypto,
+  makeTokenCrypto,
+} from "./token-crypto.ts";
 
 // ─── Test key ─────────────────────────────────────────────────────────────────
 // A known 64-char hex key (32 bytes) for deterministic tests.
@@ -180,3 +184,22 @@ describe("identityCrypto", () => {
     expect(identityCrypto.decrypt("hello")).toBe("hello");
   });
 });
+
+describe("makeStrictTokenCrypto", () => {
+  const KEY = "c".repeat(64);
+
+  it("returns null when no key is configured (no identity fallback)", () => {
+    expect(makeStrictTokenCrypto(undefined)).toBeNull();
+    expect(makeStrictTokenCrypto("")).toBeNull();
+  });
+
+  it("throws on a malformed key", () => {
+    expect(() => makeStrictTokenCrypto("short")).toThrow(/64-character/);
+  });
+
+  it("round-trips and throws on non-ciphertext instead of passing it through", () => {
+    const c = makeStrictTokenCrypto(KEY);
+    expect(c?.decrypt(c.encrypt("secret"))).toBe("secret");
+    expect(() => c?.decrypt("legacy-plain-text")).toThrow();
+  });
+});