@bradygaster/squad-sdk 0.7.0 → 0.8.2

package/dist/marketplace/schema.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Marketplace Schema — types and utilities for marketplace entries
+ * Issue #134 (M5-10)
+ */
+import type { SquadConfig } from '../config/schema.js';
+import type { MarketplaceManifest } from './index.js';
+export interface MarketplaceEntryStats {
+    downloads: number;
+    rating: number;
+    reviews: number;
+}
+export interface MarketplaceEntry {
+    id: string;
+    manifest: MarketplaceManifest;
+    stats: MarketplaceEntryStats;
+    verified: boolean;
+    featured: boolean;
+    publishedAt: string;
+    updatedAt: string;
+}
+export interface MarketplaceIndex {
+    entries: MarketplaceEntry[];
+    categories: string[];
+    tags: string[];
+    lastUpdated: string;
+}
+export type MarketplaceSortField = 'downloads' | 'rating' | 'name' | 'recent';
+export interface MarketplaceSearchQuery {
+    query?: string;
+    category?: string;
+    tags?: string[];
+    sort?: MarketplaceSortField;
+    page?: number;
+    perPage?: number;
+}
+export interface MarketplaceSearchResult {
+    entries: MarketplaceEntry[];
+    total: number;
+    page: number;
+    perPage: number;
+    totalPages: number;
+}
+export declare function searchMarketplace(index: MarketplaceIndex, query: MarketplaceSearchQuery): MarketplaceSearchResult;
+export interface EntryValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+export declare function validateEntry(entry: MarketplaceEntry): EntryValidationResult;
+export declare function generateEntryFromConfig(config: SquadConfig): MarketplaceEntry;
+//# sourceMappingURL=schema.d.ts.map

package/dist/marketplace/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/marketplace/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKtD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9E,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,sBAAsB,GAC5B,uBAAuB,CA0DzB;AAID,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,qBAAqB,CAqC5E;AAID,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAwB7E"}

package/dist/marketplace/schema.js

@@ -0,0 +1,120 @@
+/**
+ * Marketplace Schema — types and utilities for marketplace entries
+ * Issue #134 (M5-10)
+ */
+import { ManifestCategory } from './index.js';
+// --- Search ---
+export function searchMarketplace(index, query) {
+    let filtered = [...index.entries];
+    // Text search
+    if (query.query) {
+        const q = query.query.toLowerCase();
+        filtered = filtered.filter((e) => e.manifest.name.toLowerCase().includes(q) ||
+            e.manifest.description.toLowerCase().includes(q) ||
+            e.manifest.tags.some((t) => t.toLowerCase().includes(q)));
+    }
+    // Category filter
+    if (query.category) {
+        const cat = query.category.toLowerCase();
+        filtered = filtered.filter((e) => e.manifest.categories.some((c) => c.toLowerCase() === cat));
+    }
+    // Tags filter
+    if (query.tags && query.tags.length > 0) {
+        const queryTags = query.tags.map((t) => t.toLowerCase());
+        filtered = filtered.filter((e) => queryTags.every((qt) => e.manifest.tags.some((t) => t.toLowerCase() === qt)));
+    }
+    // Sort
+    const sort = query.sort ?? 'downloads';
+    filtered.sort((a, b) => {
+        switch (sort) {
+            case 'downloads':
+                return b.stats.downloads - a.stats.downloads;
+            case 'rating':
+                return b.stats.rating - a.stats.rating;
+            case 'name':
+                return a.manifest.name.localeCompare(b.manifest.name);
+            case 'recent':
+                return new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime();
+            default:
+                return 0;
+        }
+    });
+    // Pagination
+    const page = Math.max(1, query.page ?? 1);
+    const perPage = Math.max(1, Math.min(100, query.perPage ?? 20));
+    const total = filtered.length;
+    const totalPages = Math.max(1, Math.ceil(total / perPage));
+    const start = (page - 1) * perPage;
+    const paged = filtered.slice(start, start + perPage);
+    return { entries: paged, total, page, perPage, totalPages };
+}
+export function validateEntry(entry) {
+    const errors = [];
+    if (!entry.id || typeof entry.id !== 'string') {
+        errors.push('id is required and must be a string');
+    }
+    if (!entry.manifest) {
+        errors.push('manifest is required');
+    }
+    else {
+        if (!entry.manifest.name)
+            errors.push('manifest.name is required');
+        if (!entry.manifest.version)
+            errors.push('manifest.version is required');
+        if (!entry.manifest.description)
+            errors.push('manifest.description is required');
+    }
+    if (!entry.stats || typeof entry.stats !== 'object') {
+        errors.push('stats is required');
+    }
+    else {
+        if (typeof entry.stats.downloads !== 'number' || entry.stats.downloads < 0) {
+            errors.push('stats.downloads must be a non-negative number');
+        }
+        if (typeof entry.stats.rating !== 'number' || entry.stats.rating < 0 || entry.stats.rating > 5) {
+            errors.push('stats.rating must be between 0 and 5');
+        }
+        if (typeof entry.stats.reviews !== 'number' || entry.stats.reviews < 0) {
+            errors.push('stats.reviews must be a non-negative number');
+        }
+    }
+    if (typeof entry.verified !== 'boolean') {
+        errors.push('verified must be a boolean');
+    }
+    if (typeof entry.featured !== 'boolean') {
+        errors.push('featured must be a boolean');
+    }
+    return { valid: errors.length === 0, errors };
+}
+// --- Generate entry from config ---
+export function generateEntryFromConfig(config) {
+    const name = slugify(config.team.name);
+    const now = new Date().toISOString();
+    return {
+        id: name,
+        manifest: {
+            name,
+            version: config.version,
+            description: config.team.description ?? `${config.team.name} — Squad-powered Copilot extension`,
+            author: '',
+            repository: '',
+            categories: [ManifestCategory.Development],
+            tags: config.agents.map((a) => a.role),
+            icon: 'icon.png',
+            screenshots: [],
+            pricing: { model: 'free' },
+        },
+        stats: { downloads: 0, rating: 0, reviews: 0 },
+        verified: false,
+        featured: false,
+        publishedAt: now,
+        updatedAt: now,
+    };
+}
+function slugify(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-|-$/g, '');
+}
+//# sourceMappingURL=schema.js.map

package/dist/marketplace/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/marketplace/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAoD9C,iBAAiB;AAEjB,MAAM,UAAU,iBAAiB,CAC/B,KAAuB,EACvB,KAA6B;IAE7B,IAAI,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAElC,cAAc;IACd,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACpC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CACxB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/B,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED,cAAc;IACd,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACrB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CACpD,CACF,CAAC;IACJ,CAAC;IAED,OAAO;IACP,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,WAAW;gBACd,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,KAAK,QAAQ;gBACX,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YACzC,KAAK,MAAM;gBACT,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxD,KAAK,QAAQ;gBACX,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3E;gBACE,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,aAAa;IACb,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;IAErD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC;AASD,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW;YAAE,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/F,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,qCAAqC;AAErC,MAAM,UAAU,uBAAuB,CAAC,MAAmB;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,IAAI;YACJ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,oCAAoC;YAC/F,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC;YAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtC,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B;QACD,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;QAC9C,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC"}

package/dist/marketplace/security.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Security model — remote agent validation for marketplace entries
+ * Issue #140 (M5-13)
+ */
+import type { AgentConfig } from '../config/schema.js';
+export interface RemoteAgentDefinition extends AgentConfig {
+    charter?: string;
+    tools?: string[];
+}
+export interface SecurityReport {
+    passed: boolean;
+    warnings: string[];
+    blocked: string[];
+    riskScore: number;
+}
+export type SecuritySeverity = 'warning' | 'critical';
+export interface SecurityRule {
+    name: string;
+    severity: SecuritySeverity;
+    check: (agent: RemoteAgentDefinition, source: string) => string | null;
+}
+export declare const SECURITY_RULES: SecurityRule[];
+export declare function validateRemoteAgent(agent: RemoteAgentDefinition, source: string): SecurityReport;
+export declare function quarantineAgent(agent: RemoteAgentDefinition): RemoteAgentDefinition;
+export declare function generateSecurityReport(report: SecurityReport): string;
+//# sourceMappingURL=security.d.ts.map

package/dist/marketplace/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/marketplace/security.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAID,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxE;AA0CD,eAAO,MAAM,cAAc,EAAE,YAAY,EAmFxC,CAAC;AAIF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,MAAM,GACb,cAAc,CA0BhB;AAID,wBAAgB,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,qBAAqB,CA4BnF;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAiCrE"}

package/dist/marketplace/security.js

@@ -0,0 +1,199 @@
+/**
+ * Security model — remote agent validation for marketplace entries
+ * Issue #140 (M5-13)
+ */
+// --- Prompt injection patterns ---
+const INJECTION_PATTERNS = [
+    /ignore\s+(all\s+)?previous\s+instructions/i,
+    /you\s+are\s+now\s+(a\s+)?different/i,
+    /system\s*:\s*override/i,
+    /\bdo\s+not\s+follow\b.*\brules\b/i,
+    /\bdisregard\b.*\binstructions\b/i,
+    /\bact\s+as\b.*\badmin\b/i,
+];
+// --- Suspicious tool patterns ---
+const SUSPICIOUS_TOOLS = [
+    'shell', 'exec', 'eval', 'sudo', 'rm', 'delete',
+    'network_raw', 'http_raw', 'file_write_any',
+];
+// --- PII patterns ---
+const PII_PATTERNS = [
+    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i, // email
+    /\b\d{3}[-.]?\d{2}[-.]?\d{4}\b/, // SSN-like
+    /\b(?:\d{4}[-\s]?){3}\d{4}\b/, // credit card-like
+    /\bghp_[A-Za-z0-9_]{36,}\b/, // GitHub token
+    /\bsk-[A-Za-z0-9]{20,}\b/, // API key pattern
+];
+// --- Overly broad permission patterns ---
+const BROAD_PERMISSION_PATTERNS = [
+    /\ball\s+files\b/i,
+    /\bunrestricted\s+access\b/i,
+    /\bfull\s+system\b/i,
+    /\broot\s+access\b/i,
+    /\bno\s+restrictions\b/i,
+];
+// --- Security Rules ---
+export const SECURITY_RULES = [
+    {
+        name: 'prompt-injection',
+        severity: 'critical',
+        check: (agent) => {
+            const charter = agent.charter ?? '';
+            for (const pattern of INJECTION_PATTERNS) {
+                if (pattern.test(charter)) {
+                    return `Prompt injection pattern detected: ${pattern.source}`;
+                }
+            }
+            return null;
+        },
+    },
+    {
+        name: 'suspicious-tools',
+        severity: 'critical',
+        check: (agent) => {
+            const tools = agent.tools ?? [];
+            const found = tools.filter((t) => SUSPICIOUS_TOOLS.includes(t.toLowerCase()));
+            if (found.length > 0) {
+                return `Suspicious tool requests: ${found.join(', ')}`;
+            }
+            return null;
+        },
+    },
+    {
+        name: 'pii-in-charter',
+        severity: 'warning',
+        check: (agent) => {
+            const charter = agent.charter ?? '';
+            for (const pattern of PII_PATTERNS) {
+                if (pattern.test(charter)) {
+                    return `Potential PII detected in charter: ${pattern.source}`;
+                }
+            }
+            return null;
+        },
+    },
+    {
+        name: 'overly-broad-permissions',
+        severity: 'warning',
+        check: (agent) => {
+            const charter = agent.charter ?? '';
+            for (const pattern of BROAD_PERMISSION_PATTERNS) {
+                if (pattern.test(charter)) {
+                    return `Overly broad permission language: ${pattern.source}`;
+                }
+            }
+            return null;
+        },
+    },
+    {
+        name: 'untrusted-source',
+        severity: 'warning',
+        check: (_agent, source) => {
+            if (!source || source === 'unknown' || source === '') {
+                return 'Agent source is unknown or unverified';
+            }
+            return null;
+        },
+    },
+    {
+        name: 'missing-charter',
+        severity: 'warning',
+        check: (agent) => {
+            if (!agent.charter || agent.charter.trim().length === 0) {
+                return 'Agent has no charter — behavior is unpredictable';
+            }
+            return null;
+        },
+    },
+    {
+        name: 'excessive-tools',
+        severity: 'warning',
+        check: (agent) => {
+            const tools = agent.tools ?? [];
+            if (tools.length > 15) {
+                return `Agent requests ${tools.length} tools — consider reducing scope`;
+            }
+            return null;
+        },
+    },
+];
+// --- Validate remote agent ---
+export function validateRemoteAgent(agent, source) {
+    const warnings = [];
+    const blocked = [];
+    let riskScore = 0;
+    for (const rule of SECURITY_RULES) {
+        const result = rule.check(agent, source);
+        if (result) {
+            if (rule.severity === 'critical') {
+                blocked.push(result);
+                riskScore += 30;
+            }
+            else {
+                warnings.push(result);
+                riskScore += 10;
+            }
+        }
+    }
+    riskScore = Math.min(100, riskScore);
+    return {
+        passed: blocked.length === 0,
+        warnings,
+        blocked,
+        riskScore,
+    };
+}
+// --- Quarantine agent ---
+export function quarantineAgent(agent) {
+    let charter = agent.charter ?? '';
+    // Remove injection patterns
+    for (const pattern of INJECTION_PATTERNS) {
+        charter = charter.replace(pattern, '[REMOVED]');
+    }
+    // Remove PII
+    for (const pattern of PII_PATTERNS) {
+        charter = charter.replace(pattern, '[REDACTED]');
+    }
+    // Remove broad permission language
+    for (const pattern of BROAD_PERMISSION_PATTERNS) {
+        charter = charter.replace(pattern, '[RESTRICTED]');
+    }
+    // Strip suspicious tools
+    const safTools = (agent.tools ?? []).filter((t) => !SUSPICIOUS_TOOLS.includes(t.toLowerCase()));
+    return {
+        ...agent,
+        charter,
+        tools: safTools,
+    };
+}
+// --- Generate human-readable security report ---
+export function generateSecurityReport(report) {
+    const lines = [];
+    lines.push('# Security Report');
+    lines.push('');
+    lines.push(`**Status:** ${report.passed ? '✅ PASSED' : '❌ BLOCKED'}`);
+    lines.push(`**Risk Score:** ${report.riskScore}/100`);
+    lines.push('');
+    if (report.blocked.length > 0) {
+        lines.push('## Critical Issues');
+        lines.push('');
+        for (const issue of report.blocked) {
+            lines.push(`- 🚫 ${issue}`);
+        }
+        lines.push('');
+    }
+    if (report.warnings.length > 0) {
+        lines.push('## Warnings');
+        lines.push('');
+        for (const warning of report.warnings) {
+            lines.push(`- ⚠️ ${warning}`);
+        }
+        lines.push('');
+    }
+    if (report.blocked.length === 0 && report.warnings.length === 0) {
+        lines.push('No issues detected.');
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=security.js.map

package/dist/marketplace/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/marketplace/security.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8BH,oCAAoC;AAEpC,MAAM,kBAAkB,GAAG;IACzB,4CAA4C;IAC5C,qCAAqC;IACrC,wBAAwB;IACxB,mCAAmC;IACnC,kCAAkC;IAClC,0BAA0B;CAC3B,CAAC;AAEF,mCAAmC;AAEnC,MAAM,gBAAgB,GAAG;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ;IAC/C,aAAa,EAAE,UAAU,EAAE,gBAAgB;CAC5C,CAAC;AAEF,uBAAuB;AAEvB,MAAM,YAAY,GAAG;IACnB,4CAA4C,EAAM,QAAQ;IAC1D,+BAA+B,EAAsB,WAAW;IAChE,6BAA6B,EAAyB,mBAAmB;IACzE,2BAA2B,EAA2B,eAAe;IACrE,yBAAyB,EAA6B,kBAAkB;CACzE,CAAC;AAEF,2CAA2C;AAE3C,MAAM,yBAAyB,GAAG;IAChC,kBAAkB;IAClB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;CACzB,CAAC;AAEF,yBAAyB;AAEzB,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBACzC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,OAAO,sCAAsC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,6BAA6B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,OAAO,sCAAsC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;gBAChD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,OAAO,qCAAqC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBACrD,OAAO,uCAAuC,CAAC;YACjD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,kDAAkD,CAAC;YAC5D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACtB,OAAO,kBAAkB,KAAK,CAAC,MAAM,kCAAkC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;CACF,CAAC;AAEF,gCAAgC;AAEhC,MAAM,UAAU,mBAAmB,CACjC,KAA4B,EAC5B,MAAc;IAEd,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,SAAS,IAAI,EAAE,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtB,SAAS,IAAI,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAErC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC5B,QAAQ;QACR,OAAO;QACP,SAAS;KACV,CAAC;AACJ,CAAC;AAED,2BAA2B;AAE3B,MAAM,UAAU,eAAe,CAAC,KAA4B;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IAElC,4BAA4B;IAC5B,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,aAAa;IACb,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,mCAAmC;IACnC,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACnD,CAAC;IAEF,OAAO;QACL,GAAG,KAAK;QACR,OAAO;QACP,KAAK,EAAE,QAAQ;KAChB,CAAC;AACJ,CAAC;AAED,kDAAkD;AAElD,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,MAAM,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/parsers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Parsers barrel — re-exports all parser functions and their result types.
+ * Zero runtime code, just re-exports.
+ *
+ * @module parsers
+ */
+export { parseTeamMarkdown, parseRoutingRulesMarkdown, parseDecisionsMarkdown, generateConfigFromParsed, migrateMarkdownToConfig, } from './config/markdown-migration.js';
+export type { ParsedAgent, ParsedRoutingRule, ParsedDecision, MarkdownParseResult, MarkdownMigrationOptions, MarkdownMigrationResult, } from './config/markdown-migration.js';
+export { parseRoutingMarkdown, compileRoutingRules, matchRoute, matchIssueLabels, } from './config/routing.js';
+export type { CompiledRouter, CompiledWorkTypeRule, CompiledIssueRule, RoutingMatch, } from './config/routing.js';
+export { parseCharterMarkdown, compileCharter, compileCharterFull, } from './agents/charter-compiler.js';
+export type { ParsedCharter, CharterCompileOptions, CharterConfigOverrides, CompiledCharter, } from './agents/charter-compiler.js';
+export { parseFrontmatter, parseSkillFile, loadSkillsFromDirectory, } from './skills/skill-loader.js';
+export type { SkillDefinition } from './skills/skill-loader.js';
+//# sourceMappingURL=parsers.d.ts.map

package/dist/parsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers.d.ts","sourceRoot":"","sources":["../src/parsers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAExC,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/parsers.js

@@ -0,0 +1,15 @@
+/**
+ * Parsers barrel — re-exports all parser functions and their result types.
+ * Zero runtime code, just re-exports.
+ *
+ * @module parsers
+ */
+// --- config/markdown-migration.ts ---
+export { parseTeamMarkdown, parseRoutingRulesMarkdown, parseDecisionsMarkdown, generateConfigFromParsed, migrateMarkdownToConfig, } from './config/markdown-migration.js';
+// --- config/routing.ts ---
+export { parseRoutingMarkdown, compileRoutingRules, matchRoute, matchIssueLabels, } from './config/routing.js';
+// --- agents/charter-compiler.ts ---
+export { parseCharterMarkdown, compileCharter, compileCharterFull, } from './agents/charter-compiler.js';
+// --- skills/skill-loader.ts ---
+export { parseFrontmatter, parseSkillFile, loadSkillsFromDirectory, } from './skills/skill-loader.js';
+//# sourceMappingURL=parsers.js.map

package/dist/parsers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers.js","sourceRoot":"","sources":["../src/parsers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAWxC,4BAA4B;AAC5B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAS7B,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAStC,iCAAiC;AACjC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,uBAAuB,GACxB,MAAM,0BAA0B,CAAC"}

package/dist/ralph/index.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Ralph — Work Monitor (PRD 8)
+ *
+ * Persistent SDK session that monitors agent work in real time.
+ * Replaces ephemeral polling spawns with an event-driven observer
+ * that accumulates knowledge across monitoring cycles.
+ *
+ * Three monitoring layers:
+ *   1. In-session: Event subscriptions via EventBus
+ *   2. Watchdog: Periodic health checks on session pool
+ *   3. Cloud heartbeat: External health signal (future)
+ */
+import type { EventBus } from '../runtime/event-bus.js';
+export interface MonitorConfig {
+    /** Team root directory */
+    teamRoot: string;
+    /** Health check interval (ms, default: 30000) */
+    healthCheckInterval?: number;
+    /** Stale session threshold (ms, default: 300000) */
+    staleSessionThreshold?: number;
+    /** Path to persist monitor state for crash recovery */
+    statePath?: string;
+}
+export interface AgentWorkStatus {
+    agentName: string;
+    sessionId: string;
+    status: 'working' | 'idle' | 'stale' | 'error';
+    lastActivity: Date;
+    currentTask?: string;
+    milestones: string[];
+}
+export interface MonitorState {
+    /** Timestamp of last health check */
+    lastHealthCheck: Date | null;
+    /** Per-agent work status */
+    agents: Map<string, AgentWorkStatus>;
+    /** Accumulated observations across cycles */
+    observations: string[];
+}
+export declare class RalphMonitor {
+    private config;
+    private state;
+    private eventBus;
+    private unsubscribers;
+    private healthCheckTimer;
+    constructor(config: MonitorConfig);
+    /** Start monitoring — subscribe to EventBus and begin health checks */
+    start(eventBus: EventBus): Promise<void>;
+    /** Handle an incoming event from the EventBus */
+    private handleEvent;
+    /** Run a health check across all tracked agent sessions */
+    healthCheck(): Promise<AgentWorkStatus[]>;
+    /** Get current work status for all agents */
+    getStatus(): AgentWorkStatus[];
+    /** Stop monitoring and persist final state */
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/ralph/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ralph/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,yBAAyB,CAAC;AAIpE,MAAM,WAAW,aAAa;IAC5B,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,oDAAoD;IACpD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,YAAY,EAAE,IAAI,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,qCAAqC;IACrC,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,4BAA4B;IAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACrC,6CAA6C;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,QAAQ,CAAyB;IACzC,OAAO,CAAC,aAAa,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAA+C;gBAE3D,MAAM,EAAE,aAAa;IASjC,uEAAuE;IACjE,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB9C,iDAAiD;IACjD,OAAO,CAAC,WAAW;IA6CnB,2DAA2D;IACrD,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAc/C,6CAA6C;IAC7C,SAAS,IAAI,eAAe,EAAE;IAI9B,8CAA8C;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAyB5B"}

package/dist/ralph/index.js

@@ -0,0 +1,128 @@
+/**
+ * Ralph — Work Monitor (PRD 8)
+ *
+ * Persistent SDK session that monitors agent work in real time.
+ * Replaces ephemeral polling spawns with an event-driven observer
+ * that accumulates knowledge across monitoring cycles.
+ *
+ * Three monitoring layers:
+ *   1. In-session: Event subscriptions via EventBus
+ *   2. Watchdog: Periodic health checks on session pool
+ *   3. Cloud heartbeat: External health signal (future)
+ */
+import { writeFile } from 'node:fs/promises';
+// --- Ralph Monitor ---
+export class RalphMonitor {
+    config;
+    state;
+    eventBus = null;
+    unsubscribers = [];
+    healthCheckTimer = null;
+    constructor(config) {
+        this.config = config;
+        this.state = {
+            lastHealthCheck: null,
+            agents: new Map(),
+            observations: [],
+        };
+    }
+    /** Start monitoring — subscribe to EventBus and begin health checks */
+    async start(eventBus) {
+        this.eventBus = eventBus;
+        // Subscribe to session lifecycle events
+        this.unsubscribers.push(eventBus.subscribe('session:created', (event) => this.handleEvent(event)));
+        this.unsubscribers.push(eventBus.subscribe('session:destroyed', (event) => this.handleEvent(event)));
+        this.unsubscribers.push(eventBus.subscribe('session:error', (event) => this.handleEvent(event)));
+        this.unsubscribers.push(eventBus.subscribe('agent:milestone', (event) => this.handleEvent(event)));
+        // Start periodic health check
+        const interval = this.config.healthCheckInterval ?? 30_000;
+        this.healthCheckTimer = setInterval(() => {
+            void this.healthCheck();
+        }, interval);
+    }
+    /** Handle an incoming event from the EventBus */
+    handleEvent(event) {
+        const agentName = event.agentName ?? 'unknown';
+        const sessionId = event.sessionId ?? 'unknown';
+        switch (event.type) {
+            case 'session:created': {
+                this.state.agents.set(agentName, {
+                    agentName,
+                    sessionId,
+                    status: 'working',
+                    lastActivity: event.timestamp,
+                    milestones: [],
+                });
+                break;
+            }
+            case 'session:destroyed': {
+                this.state.agents.delete(agentName);
+                break;
+            }
+            case 'session:error': {
+                const existing = this.state.agents.get(agentName);
+                if (existing) {
+                    existing.status = 'error';
+                    existing.lastActivity = event.timestamp;
+                }
+                break;
+            }
+            case 'agent:milestone': {
+                const agent = this.state.agents.get(agentName);
+                if (agent) {
+                    const payload = event.payload;
+                    if (payload?.milestone) {
+                        agent.milestones.push(payload.milestone);
+                    }
+                    if (payload?.task) {
+                        agent.currentTask = payload.task;
+                    }
+                    agent.lastActivity = event.timestamp;
+                    agent.status = 'working';
+                }
+                break;
+            }
+        }
+    }
+    /** Run a health check across all tracked agent sessions */
+    async healthCheck() {
+        const now = new Date();
+        const staleThreshold = this.config.staleSessionThreshold ?? 300_000;
+        for (const agent of this.state.agents.values()) {
+            if (agent.status === 'error')
+                continue;
+            const elapsed = now.getTime() - agent.lastActivity.getTime();
+            agent.status = elapsed > staleThreshold ? 'stale' : agent.status === 'stale' ? 'idle' : agent.status;
+        }
+        this.state.lastHealthCheck = now;
+        return Array.from(this.state.agents.values());
+    }
+    /** Get current work status for all agents */
+    getStatus() {
+        return Array.from(this.state.agents.values());
+    }
+    /** Stop monitoring and persist final state */
+    async stop() {
+        // Unsubscribe from EventBus
+        for (const unsub of this.unsubscribers) {
+            unsub();
+        }
+        this.unsubscribers = [];
+        // Stop health check timer
+        if (this.healthCheckTimer !== null) {
+            clearInterval(this.healthCheckTimer);
+            this.healthCheckTimer = null;
+        }
+        // Persist state if statePath is configured
+        if (this.config.statePath) {
+            const serializable = {
+                lastHealthCheck: this.state.lastHealthCheck?.toISOString() ?? null,
+                agents: Array.from(this.state.agents.entries()),
+                observations: this.state.observations,
+            };
+            await writeFile(this.config.statePath, JSON.stringify(serializable, null, 2), 'utf-8');
+        }
+        this.eventBus = null;
+    }
+}
+//# sourceMappingURL=index.js.map