@app-vitals/agent-admin 1.4.0 → 1.6.0

package/src/api.ts

@@ -44,6 +44,12 @@ export interface AgentConfigResponse {
   env: Record<string, string>;
   allowedTools: string[];
   plugins: AgentPlugin[];
+  /**
+   * PMK-1.2: remote plugin marketplaces to register before plugin install.
+   * Optional so existing fixtures/doubles built against this interface keep
+   * compiling; the live handler always populates it (empty when none).
+   */
+  marketplaces?: Array<{ name: string; source: string; ref: string | null }>;
   repos: string[];
   reviewAuthorAllowlist: string[];
   patchAuthorAllowlist: string[];
@@ -155,6 +161,12 @@ interface AgentPluginServiceLike {
   listEnabled(agentId: string): Promise<Array<{ name: string }>>;
 }
 
+interface AgentMarketplaceServiceLike {
+  list(
+    agentId: string,
+  ): Promise<Array<{ name: string; source: string; ref: string | null }>>;
+}
+
 export interface AgentPhaseMethodologyServiceLike {
   list(
     agentId: string,
@@ -166,6 +178,11 @@ export interface AgentRuntimeDeps {
   agentCronJobService: AgentCronJobServiceLike;
   agentService: AgentServiceLike;
   agentPluginService: AgentPluginServiceLike;
+  /**
+   * PMK-1.2: optional. Absent → GET /agents/:id/config reports
+   * `marketplaces: []`.
+   */
+  agentMarketplaceService?: AgentMarketplaceServiceLike;
   /**
    * Optional: supplied by an AdminExtension (the coding extension). Absent →
    * GET /agents/:id/config omits `phaseMethodology`.
@@ -290,11 +307,13 @@ export function createAgentRuntimeApp(deps: AgentRuntimeDeps): OpenAPIHono {
     }
 
     // Fetch env bundle, plugins, and phase-methodology overrides in parallel
-    const [bundle, plugins, phaseMethodologyRows] = await Promise.all([
-      agentEnvService.getConfigBundle(id),
-      agentPluginService.listEnabled(id),
-      agentPhaseMethodologyService?.list(id),
-    ]);
+    const [bundle, plugins, marketplaceRows, phaseMethodologyRows] =
+      await Promise.all([
+        agentEnvService.getConfigBundle(id),
+        agentPluginService.listEnabled(id),
+        deps.agentMarketplaceService?.list(id),
+        agentPhaseMethodologyService?.list(id),
+      ]);
 
     // WIF-2.1: with federation enabled, a non-self-hosted agent must never be
     // handed Anthropic credentials, even ones already stored in its bundle
@@ -341,6 +360,11 @@ export function createAgentRuntimeApp(deps: AgentRuntimeDeps): OpenAPIHono {
           ? { marketplace: "shipwright", plugin: p.name }
           : { plugin: p.name.slice(0, at), marketplace: p.name.slice(at + 1) };
       }),
+      marketplaces: (marketplaceRows ?? []).map((m) => ({
+        name: m.name,
+        source: m.source,
+        ref: m.ref,
+      })),
       repos: agent.repos,
       reviewAuthorAllowlist: agent.reviewAuthorAllowlist,
       patchAuthorAllowlist: agent.patchAuthorAllowlist,

package/src/openapi-schemas.ts

@@ -895,6 +895,43 @@ export const PatchAgentPluginBodySchema = z
   })
   .openapi("PatchAgentPluginBody");
 
+// ─── AgentMarketplace ─────────────────────────────────────────────────────────
+
+export const AgentMarketplaceSchema = z
+  .object({
+    id: z.string().openapi({ example: "clx1234567890" }),
+    agentId: z.string().openapi({ example: "clx1234567890" }),
+    name: z.string().openapi({ example: "shipwright" }),
+    source: z.string().openapi({ example: "app-vitals/shipwright" }),
+    ref: z.string().nullable().openapi({ example: "main" }),
+    createdAt: z
+      .string()
+      .datetime()
+      .openapi({ example: "2026-01-01T00:00:00.000Z" }),
+    updatedAt: z
+      .string()
+      .datetime()
+      .openapi({ example: "2026-01-01T00:00:00.000Z" }),
+  })
+  .openapi("AgentMarketplace");
+
+export type AgentMarketplace = z.infer<typeof AgentMarketplaceSchema>;
+
+/**
+ * `source` / `name` / `ref` are validated by AgentMarketplaceService (422), not
+ * here — the Zod layer answers 400.
+ */
+export const UpsertAgentMarketplaceBodySchema = z
+  .object({
+    name: z.string().openapi({ example: "shipwright" }),
+    source: z.string().openapi({
+      description: "GitHub `owner/repo` or an https git URL",
+      example: "app-vitals/shipwright",
+    }),
+    ref: z.string().nullable().optional().openapi({ example: "main" }),
+  })
+  .openapi("UpsertAgentMarketplaceBody");
+
 // ─── Pipeline phases ────────────────────────────────────────────────────────────
 //
 // The six pipeline phases a methodology override can target — the keys of the
@@ -1084,6 +1121,11 @@ export const TokenIdParamSchema = z.object({
   tokenId: z.string().openapi({ example: "clx0987654321" }),
 });
 
+export const MarketplaceIdParamSchema = z.object({
+  id: z.string().openapi({ example: "clx1234567890" }),
+  marketplaceId: z.string().openapi({ example: "clx0987654321" }),
+});
+
 export const EnvKeyParamSchema = z.object({
   id: z.string().openapi({ example: "clx1234567890" }),
   key: z.string().openapi({ example: "MY_VAR" }),
@@ -1298,6 +1340,14 @@ const AgentConfigPluginSchema = z
   })
   .openapi("AgentConfigPlugin");
 
+const AgentConfigMarketplaceSchema = z
+  .object({
+    name: z.string().openapi({ example: "shipwright" }),
+    source: z.string().openapi({ example: "app-vitals/shipwright" }),
+    ref: z.string().nullable().openapi({ example: "main" }),
+  })
+  .openapi("AgentConfigMarketplace");
+
 export const AgentConfigResponseSchema = z
   .object({
     env: z
@@ -1305,6 +1355,12 @@ export const AgentConfigResponseSchema = z
       .openapi({ example: { SLACK_BOT_TOKEN: "xoxb-..." } }),
     allowedTools: z.array(z.string()).openapi({ example: ["Read", "Write"] }),
     plugins: z.array(AgentConfigPluginSchema),
+    /**
+     * PMK-1.2: remote plugin marketplaces to register before plugin install.
+     * Optional so existing fixtures/doubles keep compiling; the handler
+     * always populates it (empty array when the agent has none).
+     */
+    marketplaces: z.array(AgentConfigMarketplaceSchema).optional(),
     repos: z.array(z.string()).openapi({ example: ["org/repo1", "org/repo2"] }),
     reviewAuthorAllowlist: z
       .array(z.string())

package/src/openapi-schemas.unit.test.ts

@@ -10,6 +10,7 @@ import { type AgentRuntimeDeps, createAgentRuntimeApp } from "./api.ts";
 import {
   type AgentCronJob,
   AgentCronJobSchema,
+  AgentMarketplaceSchema,
   type AgentPlugin,
   AgentPluginSchema,
   type AgentToken,
@@ -18,6 +19,7 @@ import {
   AgentToolSchema,
   ErrorSchema,
   PatchAgentBodySchema,
+  UpsertAgentMarketplaceBodySchema,
 } from "./openapi-schemas.ts";
 
 // ─── Fixtures ─────────────────────────────────────────────────────────────────
@@ -381,3 +383,30 @@ describe("PatchAgentBodySchema.podServiceAccountName (COS-49.1)", () => {
     }
   });
 });
+
+// ─── AgentMarketplace (PMK-1.2) ───────────────────────────────────────────────
+
+describe("AgentMarketplace schemas", () => {
+  test("AgentMarketplaceSchema accepts a row with a null ref", () => {
+    const result = AgentMarketplaceSchema.safeParse({
+      id: "m1",
+      agentId: "a1",
+      name: "shipwright",
+      source: "app-vitals/shipwright",
+      ref: null,
+      createdAt: "2026-01-01T00:00:00.000Z",
+      updatedAt: "2026-01-01T00:00:00.000Z",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  test("UpsertAgentMarketplaceBodySchema leaves source validation to the service (422)", () => {
+    expect(
+      UpsertAgentMarketplaceBodySchema.safeParse({ name: "m", source: "bad" })
+        .success,
+    ).toBe(true);
+    expect(
+      UpsertAgentMarketplaceBodySchema.safeParse({ name: "m" }).success,
+    ).toBe(false);
+  });
+});