@ashlr/hub 2.2.0

package/dist/core/plugins/integrity.d.ts

@@ -0,0 +1,36 @@
+/**
+ * core/plugins/integrity.ts — M33 plugin entry-file integrity check.
+ *
+ * CONTRACT RULES (non-negotiable):
+ *  - hashEntry NEVER throws; returns null on any read failure.
+ *  - verifyIntegrity NEVER throws; returns { ok: false } on missing pin,
+ *    read failure, or hash mismatch.
+ *  - Hashes are sha256 hex prefixed "sha256:".
+ *  - recordIntegrity is NOT here — config writes are CLI responsibility.
+ *  - Only the entry file is hashed (not the whole plugin directory).
+ */
+import type { AshlrConfig } from '../types.js';
+/**
+ * Compute the sha256 hash of the file at `entryPath`.
+ * Returns the hash as a string prefixed "sha256:<hex>".
+ * Returns null if the file cannot be read (absent, permission denied, etc.).
+ *
+ * NEVER throws.
+ */
+export declare function hashEntry(entryPath: string): string | null;
+/**
+ * Verify that the live hash of `entryPath` matches the hash pinned in
+ * cfg.plugins?.integrity[name].
+ *
+ * Returns { ok: true } when the hashes match.
+ * Returns { ok: false; reason } when:
+ *  - No pin is recorded for this plugin (cfg.plugins?.integrity[name] absent).
+ *  - The entry file cannot be read (hashEntry returns null).
+ *  - The live hash does not match the pinned hash.
+ *
+ * NEVER throws.
+ */
+export declare function verifyIntegrity(cfg: AshlrConfig, name: string, entryPath: string): {
+    ok: boolean;
+    reason?: string;
+};

package/dist/core/plugins/integrity.js

@@ -0,0 +1,73 @@
+/**
+ * core/plugins/integrity.ts — M33 plugin entry-file integrity check.
+ *
+ * CONTRACT RULES (non-negotiable):
+ *  - hashEntry NEVER throws; returns null on any read failure.
+ *  - verifyIntegrity NEVER throws; returns { ok: false } on missing pin,
+ *    read failure, or hash mismatch.
+ *  - Hashes are sha256 hex prefixed "sha256:".
+ *  - recordIntegrity is NOT here — config writes are CLI responsibility.
+ *  - Only the entry file is hashed (not the whole plugin directory).
+ */
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+// ---------------------------------------------------------------------------
+// hashEntry — compute sha256 of an entry file
+// ---------------------------------------------------------------------------
+/**
+ * Compute the sha256 hash of the file at `entryPath`.
+ * Returns the hash as a string prefixed "sha256:<hex>".
+ * Returns null if the file cannot be read (absent, permission denied, etc.).
+ *
+ * NEVER throws.
+ */
+export function hashEntry(entryPath) {
+    try {
+        const bytes = readFileSync(entryPath);
+        const hex = createHash('sha256').update(bytes).digest('hex');
+        return `sha256:${hex}`;
+    }
+    catch {
+        // File not found, permission denied, or other I/O error — return null.
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// verifyIntegrity — compare live hash against pinned hash in cfg
+// ---------------------------------------------------------------------------
+/**
+ * Verify that the live hash of `entryPath` matches the hash pinned in
+ * cfg.plugins?.integrity[name].
+ *
+ * Returns { ok: true } when the hashes match.
+ * Returns { ok: false; reason } when:
+ *  - No pin is recorded for this plugin (cfg.plugins?.integrity[name] absent).
+ *  - The entry file cannot be read (hashEntry returns null).
+ *  - The live hash does not match the pinned hash.
+ *
+ * NEVER throws.
+ */
+export function verifyIntegrity(cfg, name, entryPath) {
+    try {
+        const pinnedHash = cfg.plugins?.integrity?.[name];
+        if (!pinnedHash) {
+            return { ok: false, reason: `no integrity pin recorded for plugin "${name}"` };
+        }
+        const liveHash = hashEntry(entryPath);
+        if (liveHash === null) {
+            return { ok: false, reason: `could not read entry file for plugin "${name}": ${entryPath}` };
+        }
+        if (liveHash !== pinnedHash) {
+            return {
+                ok: false,
+                reason: `integrity mismatch for plugin "${name}": pinned ${pinnedHash}, got ${liveHash}`,
+            };
+        }
+        return { ok: true };
+    }
+    catch {
+        // Belt-and-suspenders: verifyIntegrity must never throw.
+        return { ok: false, reason: `unexpected error verifying integrity for plugin "${name}"` };
+    }
+}
+//# sourceMappingURL=integrity.js.map

package/dist/core/plugins/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../../src/core/plugins/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,IAAY,EACZ,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,IAAI,GAAG,EAAE,CAAC;QACjF,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,IAAI,MAAM,SAAS,EAAE,EAAE,CAAC;QAC/F,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kCAAkC,IAAI,aAAa,UAAU,SAAS,QAAQ,EAAE;aACzF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,IAAI,GAAG,EAAE,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/core/plugins/manifest.d.ts

@@ -0,0 +1,31 @@
+/**
+ * core/plugins/manifest.ts — M33 plugin manifest reader + validator.
+ *
+ * CONTRACT RULES (non-negotiable):
+ *  - readManifest NEVER throws; all errors are returned as { ok: false; reason }.
+ *  - Bounded read: manifests exceeding 64 KB are rejected.
+ *  - Proto-pollution: any object key equal to "__proto__", "constructor", or
+ *    "prototype" anywhere in the parsed object rejects the manifest.
+ *  - name must match ^[a-z][a-z0-9-]{0,39}$ AND equal basename(dir).
+ *  - entry must resolve INSIDE the plugin dir (path-string containment).
+ *    The entry file itself may not exist at discovery time — only the path
+ *    is validated, not its presence.
+ *  - apiVersion is evaluated against PLUGIN_API_VERSION with a hand-rolled
+ *    range matcher (exact, ^, ~, x-wildcards). No runtime deps.
+ */
+import { type PluginManifest } from './types.js';
+/**
+ * Read and fully validate <dir>/manifest.json.
+ *
+ * Returns { ok: true; manifest } on success.
+ * Returns { ok: false; reason } on any validation failure.
+ *
+ * NEVER throws — all errors are caught and returned as { ok: false }.
+ */
+export declare function readManifest(dir: string): {
+    ok: true;
+    manifest: PluginManifest;
+} | {
+    ok: false;
+    reason: string;
+};

package/dist/core/plugins/manifest.js

@@ -0,0 +1,316 @@
+/**
+ * core/plugins/manifest.ts — M33 plugin manifest reader + validator.
+ *
+ * CONTRACT RULES (non-negotiable):
+ *  - readManifest NEVER throws; all errors are returned as { ok: false; reason }.
+ *  - Bounded read: manifests exceeding 64 KB are rejected.
+ *  - Proto-pollution: any object key equal to "__proto__", "constructor", or
+ *    "prototype" anywhere in the parsed object rejects the manifest.
+ *  - name must match ^[a-z][a-z0-9-]{0,39}$ AND equal basename(dir).
+ *  - entry must resolve INSIDE the plugin dir (path-string containment).
+ *    The entry file itself may not exist at discovery time — only the path
+ *    is validated, not its presence.
+ *  - apiVersion is evaluated against PLUGIN_API_VERSION with a hand-rolled
+ *    range matcher (exact, ^, ~, x-wildcards). No runtime deps.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { join, basename, sep, resolve } from 'node:path';
+import { PLUGIN_API_VERSION } from './types.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Maximum allowed manifest.json size in bytes (64 KB). */
+const MAX_MANIFEST_BYTES = 64 * 1024;
+/** Valid plugin name pattern: ^[a-z][a-z0-9-]{0,39}$ */
+const NAME_RE = /^[a-z][a-z0-9-]{0,39}$/;
+/** Valid PluginCapability values. */
+const VALID_CAPABILITIES = new Set([
+    'scanner',
+    'template',
+    'provider',
+    'command',
+]);
+// ---------------------------------------------------------------------------
+// Proto-pollution guard
+// ---------------------------------------------------------------------------
+/**
+ * Recursively scan a parsed JSON value for __proto__, constructor, or
+ * prototype keys. Returns true if any such key is found (poison detected).
+ * Bounded: objects/arrays in a manifest.json are small; no stack overflow risk
+ * in practice, but we cap depth at 8 to be defensive.
+ */
+function hasPoisonKey(value, depth = 0) {
+    if (depth > 8)
+        return false;
+    if (value === null || typeof value !== 'object')
+        return false;
+    const keys = Object.keys(value);
+    for (const key of keys) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            return true;
+        }
+        if (hasPoisonKey(value[key], depth + 1)) {
+            return true;
+        }
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            if (hasPoisonKey(item, depth + 1))
+                return true;
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Hand-rolled semver range matcher
+// ---------------------------------------------------------------------------
+/**
+ * Parse a semver string "MAJOR.MINOR.PATCH" into a numeric triple.
+ * Returns null if the string is not parseable as a 3-part semver.
+ */
+function parseSemver(s) {
+    const parts = s.trim().split('.');
+    if (parts.length !== 3)
+        return null;
+    const nums = parts.map(Number);
+    if (nums.some((n) => !Number.isInteger(n) || n < 0))
+        return null;
+    return nums;
+}
+/**
+ * Evaluate whether `host` (the host's PLUGIN_API_VERSION) satisfies the
+ * plugin's `range` declaration.
+ *
+ * Supported range forms:
+ *  - exact:    "1.0.0"   → host must be exactly 1.0.0
+ *  - caret:    "^1.0.0"  → host major must match, host >= range version
+ *  - tilde:    "~1.0.0"  → host major+minor must match, host >= range version
+ *  - wildcard: "1.x"     → host major must match; minor/patch free
+ *              "1.0.x"   → host major+minor must match; patch free
+ *
+ * Returns true iff host satisfies the range.
+ * Returns false for any unrecognised range form (strict unknown rejection).
+ */
+function semverSatisfies(range, host) {
+    const hostParsed = parseSemver(host);
+    if (!hostParsed)
+        return false;
+    const [hMaj, hMin, hPatch] = hostParsed;
+    const r = range.trim();
+    // Caret: ^MAJOR.MINOR.PATCH
+    if (r.startsWith('^')) {
+        const parsed = parseSemver(r.slice(1));
+        if (!parsed)
+            return false;
+        const [rMaj, rMin, rPatch] = parsed;
+        if (hMaj !== rMaj)
+            return false;
+        if (hMin < rMin)
+            return false;
+        if (hMin === rMin && hPatch < rPatch)
+            return false;
+        return true;
+    }
+    // Tilde: ~MAJOR.MINOR.PATCH
+    if (r.startsWith('~')) {
+        const parsed = parseSemver(r.slice(1));
+        if (!parsed)
+            return false;
+        const [rMaj, rMin, rPatch] = parsed;
+        if (hMaj !== rMaj || hMin !== rMin)
+            return false;
+        if (hPatch < rPatch)
+            return false;
+        return true;
+    }
+    // Wildcard: "1.x" or "1.0.x"
+    if (r.includes('x') || r.includes('X') || r.includes('*')) {
+        const parts = r.split('.');
+        // "1.x" (2 parts with x)
+        if (parts.length === 2) {
+            const maj = Number(parts[0]);
+            if (!Number.isInteger(maj) || maj < 0)
+                return false;
+            const minPart = (parts[1] ?? '').trim().toLowerCase();
+            if (minPart !== 'x' && minPart !== '*')
+                return false;
+            return hMaj === maj;
+        }
+        // "1.0.x" (3 parts with x in last position)
+        if (parts.length === 3) {
+            const maj = Number(parts[0]);
+            const min = Number(parts[1]);
+            const patchPart = (parts[2] ?? '').trim().toLowerCase();
+            if (!Number.isInteger(maj) || maj < 0)
+                return false;
+            if (!Number.isInteger(min) || min < 0)
+                return false;
+            if (patchPart !== 'x' && patchPart !== '*')
+                return false;
+            return hMaj === maj && hMin === min;
+        }
+        return false;
+    }
+    // Exact: "MAJOR.MINOR.PATCH"
+    const parsed = parseSemver(r);
+    if (!parsed)
+        return false;
+    const [rMaj, rMin, rPatch] = parsed;
+    return hMaj === rMaj && hMin === rMin && hPatch === rPatch;
+}
+// ---------------------------------------------------------------------------
+// readManifest — public API
+// ---------------------------------------------------------------------------
+/**
+ * Read and fully validate <dir>/manifest.json.
+ *
+ * Returns { ok: true; manifest } on success.
+ * Returns { ok: false; reason } on any validation failure.
+ *
+ * NEVER throws — all errors are caught and returned as { ok: false }.
+ */
+export function readManifest(dir) {
+    try {
+        const manifestPath = join(dir, 'manifest.json');
+        // --- Bounded read (≤ 64 KB) ---
+        let size;
+        try {
+            const stat = statSync(manifestPath);
+            size = stat.size;
+        }
+        catch {
+            return { ok: false, reason: `manifest.json not found or unreadable in ${dir}` };
+        }
+        if (size > MAX_MANIFEST_BYTES) {
+            return {
+                ok: false,
+                reason: `manifest.json exceeds 64 KB limit (${size} bytes) in ${dir}`,
+            };
+        }
+        // --- Read + parse ---
+        let raw;
+        try {
+            raw = readFileSync(manifestPath, 'utf8');
+        }
+        catch {
+            return { ok: false, reason: `could not read manifest.json in ${dir}` };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return { ok: false, reason: `manifest.json is not valid JSON in ${dir}` };
+        }
+        // --- Proto-pollution guard (before any property access) ---
+        if (hasPoisonKey(parsed)) {
+            return {
+                ok: false,
+                reason: `manifest.json contains forbidden key (__proto__/constructor/prototype) in ${dir}`,
+            };
+        }
+        // --- Top-level must be a plain object ---
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return { ok: false, reason: `manifest.json must be a plain object in ${dir}` };
+        }
+        const obj = parsed;
+        // --- Required string fields ---
+        if (typeof obj['name'] !== 'string' || obj['name'].length === 0) {
+            return { ok: false, reason: `manifest.json: "name" must be a non-empty string in ${dir}` };
+        }
+        if (typeof obj['version'] !== 'string' || obj['version'].length === 0) {
+            return {
+                ok: false,
+                reason: `manifest.json: "version" must be a non-empty string in ${dir}`,
+            };
+        }
+        if (typeof obj['apiVersion'] !== 'string' || obj['apiVersion'].length === 0) {
+            return {
+                ok: false,
+                reason: `manifest.json: "apiVersion" must be a non-empty string in ${dir}`,
+            };
+        }
+        if (typeof obj['entry'] !== 'string' || obj['entry'].length === 0) {
+            return { ok: false, reason: `manifest.json: "entry" must be a non-empty string in ${dir}` };
+        }
+        const name = obj['name'];
+        const version = obj['version'];
+        const apiVersion = obj['apiVersion'];
+        const entry = obj['entry'];
+        // --- name pattern ---
+        if (!NAME_RE.test(name)) {
+            return {
+                ok: false,
+                reason: `manifest.json: name "${name}" does not match ^[a-z][a-z0-9-]{0,39}$ in ${dir}`,
+            };
+        }
+        // --- name === basename(dir) ---
+        const dirBase = basename(resolve(dir));
+        if (name !== dirBase) {
+            return {
+                ok: false,
+                reason: `manifest.json: name "${name}" must equal directory basename "${dirBase}" in ${dir}`,
+            };
+        }
+        // --- apiVersion semver range compatibility ---
+        if (!semverSatisfies(apiVersion, PLUGIN_API_VERSION)) {
+            return {
+                ok: false,
+                reason: `manifest.json: apiVersion range "${apiVersion}" is not satisfied by host version ${PLUGIN_API_VERSION} in ${dir}`,
+            };
+        }
+        // --- capabilities: non-empty array of valid strings ---
+        if (!Array.isArray(obj['capabilities']) || obj['capabilities'].length === 0) {
+            return {
+                ok: false,
+                reason: `manifest.json: "capabilities" must be a non-empty array in ${dir}`,
+            };
+        }
+        const capabilities = obj['capabilities'];
+        for (const cap of capabilities) {
+            if (typeof cap !== 'string' || !VALID_CAPABILITIES.has(cap)) {
+                return {
+                    ok: false,
+                    reason: `manifest.json: invalid capability "${String(cap)}" in ${dir}`,
+                };
+            }
+        }
+        // --- entry: relative, no absolute, no ".." traversal ---
+        // Entry must not be absolute.
+        if (entry.startsWith('/')) {
+            return {
+                ok: false,
+                reason: `manifest.json: entry "${entry}" must be a relative path in ${dir}`,
+            };
+        }
+        // Resolve entry inside dir and verify containment (path-string check).
+        const resolvedDir = resolve(dir) + sep;
+        const resolvedEntry = resolve(dir, entry);
+        // Containment: resolvedEntry must start with resolvedDir (with trailing sep
+        // to prevent "prefix" attacks like /plugins/foo-extra matching /plugins/foo/).
+        if (!resolvedEntry.startsWith(resolvedDir)) {
+            return {
+                ok: false,
+                reason: `manifest.json: entry "${entry}" resolves outside plugin directory in ${dir}`,
+            };
+        }
+        // --- Optional fields ---
+        const description = typeof obj['description'] === 'string' ? obj['description'] : undefined;
+        const homepage = typeof obj['homepage'] === 'string' ? obj['homepage'] : undefined;
+        const manifest = {
+            name,
+            version,
+            apiVersion,
+            entry,
+            capabilities: capabilities,
+            ...(description !== undefined ? { description } : {}),
+            ...(homepage !== undefined ? { homepage } : {}),
+        };
+        return { ok: true, manifest };
+    }
+    catch {
+        // Belt-and-suspenders: readManifest must never throw.
+        return { ok: false, reason: `unexpected error reading manifest in ${dir}` };
+    }
+}
+//# sourceMappingURL=manifest.js.map

package/dist/core/plugins/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/core/plugins/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAA8C,MAAM,YAAY,CAAC;AAE5F,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,wDAAwD;AACxD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAEzC,qCAAqC;AACrC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAmB;IACxE,SAAS;IACT,UAAU;IACV,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC7C,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,YAAY,CAAE,KAAiC,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAkB,EAAE,CAAC;YACtC,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,IAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC;IAExC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAEvB,4BAA4B;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QACpC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QACpC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,MAAM,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,yBAAyB;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACrD,OAAO,IAAI,KAAK,GAAG,CAAC;QACtB,CAAC;QACD,4CAA4C;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACzD,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;QACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6BAA6B;IAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACpC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAEhD,iCAAiC;QACjC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,GAAG,EAAE,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sCAAsC,IAAI,cAAc,GAAG,EAAE;aACtE,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,GAAG,EAAE,EAAE,CAAC;QACzE,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,GAAG,EAAE,EAAE,CAAC;QAC5E,CAAC;QAED,6DAA6D;QAC7D,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6EAA6E,GAAG,EAAE;aAC3F,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,GAAG,EAAE,EAAE,CAAC;QACjF,CAAC;QAED,MAAM,GAAG,GAAG,MAAiC,CAAC;QAE9C,iCAAiC;QACjC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,GAAG,EAAE,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0DAA0D,GAAG,EAAE;aACxE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6DAA6D,GAAG,EAAE;aAC3E,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,GAAG,EAAE,EAAE,CAAC;QAC9F,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAW,CAAC;QACnC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAW,CAAC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAW,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAW,CAAC;QAErC,uBAAuB;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wBAAwB,IAAI,8CAA8C,GAAG,EAAE;aACxF,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wBAAwB,IAAI,oCAAoC,OAAO,QAAQ,GAAG,EAAE;aAC7F,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oCAAoC,UAAU,sCAAsC,kBAAkB,OAAO,GAAG,EAAE;aAC3H,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAK,GAAG,CAAC,cAAc,CAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,8DAA8D,GAAG,EAAE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAc,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,sCAAsC,MAAM,CAAC,GAAG,CAAC,QAAQ,GAAG,EAAE;iBACvE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,8BAA8B;QAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB,KAAK,gCAAgC,GAAG,EAAE;aAC5E,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACvC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE1C,4EAA4E;QAC5E,+EAA+E;QAC/E,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB,KAAK,0CAA0C,GAAG,EAAE;aACtF,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,MAAM,QAAQ,GAAmB;YAC/B,IAAI;YACJ,OAAO;YACP,UAAU;YACV,KAAK;YACL,YAAY,EAAE,YAAkC;YAChD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,GAAG,EAAE,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/core/plugins/registry.d.ts

@@ -0,0 +1,87 @@
+/**
+ * core/plugins/registry.ts — M33 plugin discovery, load, and accessors.
+ *
+ * CONTRACT RULES (non-negotiable):
+ *  - discoverPlugins NEVER imports plugin code. It only reads manifest.json.
+ *  - loadEnabledPlugins gate chain (in order):
+ *      1. ASHLR_NO_PLUGINS=1 → return [] immediately.
+ *      2. killSwitchOn() → return [] + audit 'plugin:load' refused.
+ *      3. Only names in cfg.plugins?.enabled ?? [] (default empty → load NOTHING).
+ *      4. Manifest valid + apiVersion compatible (via readManifest).
+ *      5. verifyIntegrity passes.
+ *      6. await import(pathToFileURL(entry).href) in try/catch.
+ *      7. activate(host) raced against timeout.
+ *      8. Capability filter: drop contributions whose kind is not declared.
+ *  - A failing plugin is skipped (audited), NEVER fatal.
+ *  - Module-level memo cache: one load per process.
+ *  - homedir() re-resolved at call time for test HOME relocation.
+ *
+ * ZERO RUNTIME DEPS: only Node builtins + local imports.
+ */
+import type { AshlrConfig, WorkItem, ProjectTemplate } from '../types.js';
+import type { PluginManifest, PluginContributions, PluginCommandSpec, PluginProviderSpec } from './types.js';
+/**
+ * Override the activate() timeout for tests. Pass undefined to reset to default.
+ * Named with underscore prefix per house test-seam convention.
+ */
+export declare function _setActivateTimeoutForTest(ms: number | undefined): void;
+/**
+ * Reset the plugin cache. For tests only — allows re-loading after config changes.
+ * Named with underscore prefix per house test-seam convention.
+ */
+export declare function _resetPluginCacheForTest(): void;
+/** A fully-loaded, activated plugin with its contributions. */
+export interface LoadedPlugin {
+    name: string;
+    manifest: PluginManifest;
+    contributions: PluginContributions;
+}
+/**
+ * Discover all plugin directories under ~/.ashlr/plugins/.
+ * For each subdirectory, attempts to read and validate manifest.json.
+ *
+ * NEVER imports plugin code — manifest read only.
+ * NEVER throws.
+ *
+ * homedir() is resolved at call time so tests can relocate HOME.
+ */
+export declare function discoverPlugins(): Array<{
+    dir: string;
+    manifest?: PluginManifest;
+    ok: boolean;
+    reason?: string;
+}>;
+/**
+ * Load all enabled plugins per cfg.plugins.enabled gate chain.
+ *
+ * Gate chain (each step audited):
+ *  1. ASHLR_NO_PLUGINS=1 → return [].
+ *  2. killSwitchOn() → return [] + audit refused.
+ *  3. cfg.plugins?.enabled ?? [] (default empty → load NOTHING).
+ *  4. Manifest valid + apiVersion compatible.
+ *  5. verifyIntegrity passes.
+ *  6. await import(pathToFileURL(entry).href).
+ *  7. activate(host) raced against timeout.
+ *  8. Capability filter.
+ *
+ * A failing plugin is skipped (audited), never fatal.
+ * Results are cached per process (keyed on sorted enabled names).
+ */
+export declare function loadEnabledPlugins(cfg: AshlrConfig): Promise<LoadedPlugin[]>;
+/**
+ * Get all plugin scanners, wrapped for safety (timeout, cap, scrub, namespace).
+ * Returns wrapped functions (repo: string) => Promise<WorkItem[]>.
+ */
+export declare function getPluginScanners(cfg: AshlrConfig): Promise<Array<(repo: string) => Promise<WorkItem[]>>>;
+/**
+ * Get all plugin templates, validated (id-prefixed, path-checked).
+ */
+export declare function getPluginTemplates(cfg: AshlrConfig): Promise<ProjectTemplate[]>;
+/**
+ * Get all plugin providers (raw, as contributed after capability filtering).
+ */
+export declare function getPluginProviders(cfg: AshlrConfig): Promise<PluginProviderSpec[]>;
+/**
+ * Get all plugin commands, wrapped for safety (audit, exit-code catch).
+ */
+export declare function getPluginCommands(cfg: AshlrConfig): Promise<PluginCommandSpec[]>;