@elizaos/agent 2.0.0-alpha.97 → 2.0.0-beta.1

package/dist/packages/agent/src/services/plugin-manager-types.d.ts

@@ -0,0 +1,114 @@
+import type { AppUiExtensionConfig, RegistryAppMeta, RegistryAppSessionFeature, RegistryAppSessionMeta, RegistryAppSessionMode, RegistryAppViewerMeta, RegistryPluginInfo as RegistryClientPluginInfo, RegistrySearchResult as RegistryClientSearchResult } from "./registry-client-types.ts";
+export type { AppUiExtensionConfig };
+export type RegistryVersionSupport = RegistryClientPluginInfo["supports"];
+export type RegistryPluginNpmInfo = RegistryClientPluginInfo["npm"];
+export type RegistryPluginViewerInfo = RegistryAppViewerMeta;
+export type RegistryPluginAppSessionMode = RegistryAppSessionMode;
+export type RegistryPluginAppSessionFeature = RegistryAppSessionFeature;
+export type RegistryPluginAppSessionInfo = RegistryAppSessionMeta;
+export type RegistryPluginAppMeta = RegistryAppMeta;
+export interface RegistryPluginInfo extends RegistryClientPluginInfo {
+    displayName?: string;
+    launchType?: string;
+    launchUrl?: string | null;
+    viewer?: RegistryPluginViewerInfo;
+    uiExtension?: AppUiExtensionConfig;
+    category?: string;
+    capabilities?: string[];
+    icon?: string | null;
+    heroImage?: string | null;
+    runtimePlugin?: string;
+    session?: RegistryPluginAppSessionInfo;
+}
+export interface RegistrySearchResult extends RegistryClientSearchResult {
+    version?: string | null;
+    npmPackage?: string;
+}
+export interface InstalledPluginInfo {
+    name: string;
+    version?: string;
+    installedAt?: string;
+    releaseStream?: "latest" | "beta";
+    requestedVersion?: string;
+    latestVersion?: string | null;
+    betaVersion?: string | null;
+}
+export interface PluginInstallOptionsLike {
+    version?: string;
+    releaseStream?: "latest" | "beta";
+}
+export interface InstallProgressLike {
+    phase: string;
+    message: string;
+    pluginName?: string;
+}
+export interface PluginInstallResult {
+    success: boolean;
+    pluginName: string;
+    version: string;
+    installPath: string;
+    requiresRestart: boolean;
+    requestedVersion?: string;
+    releaseStream?: "latest" | "beta";
+    latestVersion?: string | null;
+    betaVersion?: string | null;
+    error?: string;
+}
+export interface PluginUninstallResult {
+    success: boolean;
+    pluginName: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface EjectResult {
+    success: boolean;
+    pluginName: string;
+    ejectedPath: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface SyncResult {
+    success: boolean;
+    pluginName: string;
+    ejectedPath: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface ReinjectResult {
+    success: boolean;
+    pluginName: string;
+    removedPath: string;
+    requiresRestart: boolean;
+    error?: string;
+}
+export interface PluginManagerLike {
+    refreshRegistry(): Promise<Map<string, RegistryPluginInfo>>;
+    listInstalledPlugins(): Promise<InstalledPluginInfo[]>;
+    getRegistryPlugin(name: string): Promise<RegistryPluginInfo | null>;
+    searchRegistry(query: string, limit?: number): Promise<RegistrySearchResult[]>;
+    installPlugin(pluginName: string, onProgress?: (progress: InstallProgressLike) => void, options?: PluginInstallOptionsLike): Promise<PluginInstallResult>;
+    updatePlugin?(pluginName: string, onProgress?: (progress: InstallProgressLike) => void, options?: PluginInstallOptionsLike): Promise<PluginInstallResult>;
+    uninstallPlugin(pluginName: string): Promise<PluginUninstallResult>;
+    listEjectedPlugins(): Promise<InstalledPluginInfo[]>;
+    ejectPlugin(pluginName: string): Promise<EjectResult>;
+    syncPlugin(pluginName: string): Promise<SyncResult>;
+    reinjectPlugin(pluginName: string): Promise<ReinjectResult>;
+}
+export interface CoreStatusLike {
+    ejected: boolean;
+    ejectedPath: string;
+    monorepoPath: string;
+    corePackagePath: string;
+    coreDistPath: string;
+    version: string;
+    npmVersion: string;
+    commitHash: string | null;
+    localChanges: boolean;
+    upstream: unknown;
+}
+export interface CoreManagerLike {
+    getCoreStatus(): Promise<CoreStatusLike>;
+}
+export declare function isPluginManagerLike(candidate: unknown): candidate is PluginManagerLike;
+export declare function isCoreManagerLike(candidate: unknown): candidate is CoreManagerLike;
+//# sourceMappingURL=plugin-manager-types.d.ts.map

package/dist/packages/agent/src/services/plugin-manager-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manager-types.d.ts","sourceRoot":"","sources":["../../../../../src/services/plugin-manager-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,IAAI,wBAAwB,EAC9C,oBAAoB,IAAI,0BAA0B,EACnD,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACpE,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAClE,MAAM,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;AACxE,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAEpD,MAAM,WAAW,kBAAmB,SAAQ,wBAAwB;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,4BAA4B,CAAC;CACxC;AAED,MAAM,WAAW,oBAAqB,SAAQ,0BAA0B;IACtE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,oBAAoB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpE,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,EACpD,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,YAAY,CAAC,CACX,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,EACpD,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpE,kBAAkB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACrD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1C;AAMD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,OAAO,GACjB,SAAS,IAAI,iBAAiB,CAWhC;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,OAAO,GACjB,SAAS,IAAI,eAAe,CAG9B"}

package/dist/packages/agent/src/services/registry-client-app-meta.d.ts

@@ -0,0 +1,6 @@
+import type { RegistryAppMeta } from "./registry-client-types.ts";
+export declare const LOCAL_APP_DEFAULT_SANDBOX = "allow-scripts allow-same-origin allow-popups";
+export declare function sanitizeSandbox(rawSandbox?: string): string;
+export declare function mergeAppMeta(base: RegistryAppMeta | undefined, patch: RegistryAppMeta | undefined): RegistryAppMeta | undefined;
+export declare function resolveAppOverride(packageName: string, appMeta: RegistryAppMeta | undefined): RegistryAppMeta | undefined;
+//# sourceMappingURL=registry-client-app-meta.d.ts.map

package/dist/packages/agent/src/services/registry-client-app-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-app-meta.d.ts","sourceRoot":"","sources":["../../../../../src/services/registry-client-app-meta.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,eAAe,EAGhB,MAAM,4BAA4B,CAAC;AAEpC,eAAO,MAAM,yBAAyB,iDACU,CAAC;AAuDjD,wBAAgB,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAwB3D;AA8CD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,eAAe,GAAG,SAAS,EACjC,KAAK,EAAE,eAAe,GAAG,SAAS,GACjC,eAAe,GAAG,SAAS,CAkB7B;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,GAAG,SAAS,GACnC,eAAe,GAAG,SAAS,CAgD7B"}

package/dist/packages/agent/src/services/registry-client-app-meta.js

@@ -0,0 +1,168 @@
+import { logger } from "@elizaos/core";
+import { packageNameToAppDisplayName } from "@elizaos/shared";
+export const LOCAL_APP_DEFAULT_SANDBOX = "allow-scripts allow-same-origin allow-popups";
+const ALLOWED_SANDBOX_TOKENS = new Set([
+    "allow-downloads",
+    "allow-forms",
+    "allow-modals",
+    "allow-orientation-lock",
+    "allow-pointer-lock",
+    "allow-popups",
+    "allow-popups-to-escape-sandbox",
+    "allow-presentation",
+    "allow-same-origin",
+    "allow-scripts",
+    "allow-storage-access-by-user-activation",
+    "allow-top-navigation-by-user-activation",
+]);
+const LOCAL_APP_OVERRIDES = {
+    "@hyperscape/plugin-hyperscape": {
+        launchUrl: "{HYPERSCAPE_CLIENT_URL}",
+        viewer: {
+            url: "{HYPERSCAPE_CLIENT_URL}",
+            postMessageAuth: true,
+            sandbox: "allow-scripts allow-same-origin allow-popups allow-forms",
+        },
+        uiExtension: {
+            detailPanelId: "hyperscape-embedded-agents",
+        },
+        session: {
+            mode: "spectate-and-steer",
+            features: ["commands", "telemetry", "pause", "resume", "suggestions"],
+        },
+    },
+    "@elizaos/app-hyperfy": {
+        launchType: "connect",
+        launchUrl: "http://localhost:3003",
+        viewer: {
+            url: "http://localhost:3003",
+            sandbox: LOCAL_APP_DEFAULT_SANDBOX,
+        },
+    },
+};
+export function sanitizeSandbox(rawSandbox) {
+    if (!rawSandbox?.trim()) {
+        return LOCAL_APP_DEFAULT_SANDBOX;
+    }
+    const tokens = rawSandbox
+        .split(/\s+/)
+        .map((token) => token.trim())
+        .filter((token) => token.length > 0);
+    if (tokens.length === 0) {
+        return LOCAL_APP_DEFAULT_SANDBOX;
+    }
+    for (const token of tokens) {
+        if (!ALLOWED_SANDBOX_TOKENS.has(token)) {
+            logger.warn(`[registry-client] rejecting untrusted sandbox token: ${token}`);
+            return LOCAL_APP_DEFAULT_SANDBOX;
+        }
+    }
+    return Array.from(new Set(tokens)).join(" ");
+}
+function normalizeViewer(viewer) {
+    if (!viewer)
+        return undefined;
+    return {
+        ...viewer,
+        sandbox: sanitizeSandbox(viewer.sandbox),
+    };
+}
+function mergeViewer(base, patch) {
+    if (!base && !patch)
+        return undefined;
+    if (!base)
+        return normalizeViewer(patch);
+    if (!patch)
+        return normalizeViewer(base);
+    return normalizeViewer({
+        ...base,
+        ...patch,
+        embedParams: {
+            ...(base.embedParams ?? {}),
+            ...(patch.embedParams ?? {}),
+        },
+    });
+}
+function mergeSession(base, patch) {
+    if (!base && !patch)
+        return undefined;
+    if (!base)
+        return patch;
+    if (!patch)
+        return base;
+    return {
+        ...base,
+        ...patch,
+        features: patch.features && patch.features.length > 0
+            ? patch.features
+            : base.features,
+    };
+}
+export function mergeAppMeta(base, patch) {
+    if (!base && !patch)
+        return undefined;
+    if (!base)
+        return patch;
+    if (!patch)
+        return base;
+    return {
+        ...base,
+        ...patch,
+        capabilities: patch.capabilities.length > 0 ? patch.capabilities : base.capabilities,
+        runtimePlugin: patch.runtimePlugin ?? base.runtimePlugin,
+        bridgeExport: patch.bridgeExport ?? base.bridgeExport,
+        uiExtension: patch.uiExtension ?? base.uiExtension,
+        viewer: mergeViewer(base.viewer, patch.viewer),
+        session: mergeSession(base.session, patch.session),
+        developerOnly: patch.developerOnly ?? base.developerOnly,
+        visibleInAppStore: patch.visibleInAppStore ?? base.visibleInAppStore,
+        mainTab: patch.mainTab ?? base.mainTab,
+    };
+}
+export function resolveAppOverride(packageName, appMeta) {
+    const override = LOCAL_APP_OVERRIDES[packageName];
+    if (!override)
+        return appMeta;
+    const hasStandaloneMetadata = Object.values({
+        displayName: override.displayName,
+        category: override.category,
+        launchType: override.launchType,
+        launchUrl: override.launchUrl,
+        capabilities: override.capabilities,
+        runtimePlugin: override.runtimePlugin,
+        viewer: override.viewer,
+    }).some((value) => value !== undefined);
+    if (!appMeta && !hasStandaloneMetadata) {
+        return undefined;
+    }
+    const base = appMeta ?? {
+        displayName: override.displayName ?? packageNameToAppDisplayName(packageName),
+        category: override.category ?? "game",
+        launchType: override.launchType ?? "url",
+        launchUrl: override.launchUrl ?? null,
+        icon: null,
+        heroImage: null,
+        capabilities: override.capabilities ?? [],
+        minPlayers: null,
+        maxPlayers: null,
+        runtimePlugin: override.runtimePlugin,
+        uiExtension: override.uiExtension,
+        viewer: override.viewer,
+        session: override.session,
+    };
+    return {
+        ...base,
+        displayName: override.displayName ?? base.displayName,
+        category: override.category ?? base.category,
+        launchType: override.launchType ?? base.launchType,
+        launchUrl: override.launchUrl !== undefined ? override.launchUrl : base.launchUrl,
+        capabilities: override.capabilities !== undefined
+            ? override.capabilities
+            : base.capabilities,
+        runtimePlugin: override.runtimePlugin ?? base.runtimePlugin,
+        bridgeExport: base.bridgeExport,
+        uiExtension: override.uiExtension ?? base.uiExtension,
+        viewer: mergeViewer(base.viewer, override.viewer),
+        session: mergeSession(base.session, override.session),
+    };
+}

package/dist/packages/agent/src/services/registry-client-endpoints.d.ts

@@ -0,0 +1,7 @@
+import type { RegistryEndpoint } from "../config/types.eliza.ts";
+import type { RegistryPluginInfo } from "./registry-client-types.ts";
+export declare function normaliseEndpointUrl(url: string): string;
+export declare function isDefaultEndpoint(url: string, defaultUrl: string): boolean;
+export declare function parseRegistryEndpointUrl(rawUrl: string): URL;
+export declare function mergeCustomEndpoints(plugins: Map<string, RegistryPluginInfo>, endpoints: RegistryEndpoint[]): Promise<void>;
+//# sourceMappingURL=registry-client-endpoints.d.ts.map

package/dist/packages/agent/src/services/registry-client-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-endpoints.d.ts","sourceRoot":"","sources":["../../../../../src/services/registry-client-endpoints.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAkBrE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CA4B5D;AA8KD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACxC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/packages/agent/src/services/registry-client-endpoints.js

@@ -0,0 +1,190 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import net from "node:net";
+import { logger } from "@elizaos/core";
+import { isBlockedPrivateOrLinkLocalIp, normalizeHostLike, } from "../security/network-policy.js";
+const BLOCKED_REGISTRY_HOST_LITERALS = new Set([
+    "localhost",
+    "127.0.0.1",
+    "::1",
+    "0.0.0.0",
+    "169.254.169.254",
+]);
+const REGISTRY_ENDPOINT_FETCH_TIMEOUT_MS = 2_500;
+function createRegistryEndpointFetchInit() {
+    return {
+        redirect: "error",
+        signal: AbortSignal.timeout(REGISTRY_ENDPOINT_FETCH_TIMEOUT_MS),
+    };
+}
+export function normaliseEndpointUrl(url) {
+    return url.replace(/\/{1,1024}$/, "");
+}
+export function isDefaultEndpoint(url, defaultUrl) {
+    return normaliseEndpointUrl(url) === normaliseEndpointUrl(defaultUrl);
+}
+export function parseRegistryEndpointUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error("Endpoint URL must be a valid absolute URL");
+    }
+    if (parsed.protocol !== "https:") {
+        throw new Error("Endpoint URL must use https://");
+    }
+    const hostname = normalizeHostLike(parsed.hostname);
+    if (!hostname)
+        throw new Error("Endpoint URL hostname is required");
+    if (BLOCKED_REGISTRY_HOST_LITERALS.has(hostname) ||
+        hostname.endsWith(".localhost") ||
+        hostname.endsWith(".local")) {
+        throw new Error(`Endpoint host "${hostname}" is blocked`);
+    }
+    if (net.isIP(hostname) && isBlockedPrivateOrLinkLocalIp(hostname)) {
+        throw new Error(`Endpoint host "${hostname}" is blocked`);
+    }
+    return parsed;
+}
+async function resolveRegistryEndpointUrlRejection(rawUrl) {
+    let parsed;
+    try {
+        parsed = parseRegistryEndpointUrl(rawUrl);
+    }
+    catch (error) {
+        return {
+            rejection: String(error),
+            endpoint: null,
+        };
+    }
+    const hostname = normalizeHostLike(parsed.hostname);
+    if (!hostname) {
+        return {
+            rejection: "Endpoint URL hostname is required",
+            endpoint: null,
+        };
+    }
+    if (net.isIP(hostname)) {
+        return {
+            rejection: null,
+            endpoint: { parsed, hostname, pinnedAddress: hostname },
+        };
+    }
+    let addresses;
+    try {
+        const resolved = await dnsLookup(hostname, { all: true });
+        addresses = Array.isArray(resolved) ? resolved : [resolved];
+    }
+    catch {
+        return {
+            rejection: `Could not resolve endpoint host "${hostname}"`,
+            endpoint: null,
+        };
+    }
+    if (addresses.length === 0) {
+        return {
+            rejection: `Could not resolve endpoint host "${hostname}"`,
+            endpoint: null,
+        };
+    }
+    for (const entry of addresses) {
+        if (isBlockedPrivateOrLinkLocalIp(entry.address)) {
+            return {
+                rejection: `Endpoint host "${hostname}" resolves to blocked address ${entry.address}`,
+                endpoint: null,
+            };
+        }
+    }
+    return {
+        rejection: null,
+        endpoint: {
+            parsed,
+            hostname,
+            pinnedAddress: addresses[0]?.address ?? null,
+        },
+    };
+}
+async function fetchSingleEndpoint(url, label) {
+    const { rejection, endpoint } = await resolveRegistryEndpointUrlRejection(url);
+    if (rejection || !endpoint) {
+        logger.warn(`[registry-client] Endpoint "${label}" (${url}) blocked: ${rejection ?? "validation failed"}`);
+        return null;
+    }
+    try {
+        if (endpoint.pinnedAddress && !net.isIP(endpoint.hostname)) {
+            const refreshed = await dnsLookup(endpoint.hostname, { all: true });
+            const refreshedAddresses = new Set((Array.isArray(refreshed) ? refreshed : [refreshed]).map((entry) => normalizeHostLike(entry.address)));
+            if (!refreshedAddresses.has(normalizeHostLike(endpoint.pinnedAddress))) {
+                logger.warn(`[registry-client] Endpoint "${label}" (${url}) blocked: host resolution changed before fetch`);
+                return null;
+            }
+            for (const address of refreshedAddresses) {
+                if (isBlockedPrivateOrLinkLocalIp(address)) {
+                    logger.warn(`[registry-client] Endpoint "${label}" (${url}) blocked: host resolves to blocked address ${address}`);
+                    return null;
+                }
+            }
+        }
+        const resp = await fetch(url, createRegistryEndpointFetchInit());
+        if (!resp.ok) {
+            logger.warn(`[registry-client] Endpoint "${label}" (${url}): ${resp.status} ${resp.statusText}`);
+            return null;
+        }
+        const data = (await resp.json());
+        if (!data.registry || typeof data.registry !== "object") {
+            logger.warn(`[registry-client] Endpoint "${label}" (${url}): missing registry field`);
+            return null;
+        }
+        const plugins = new Map();
+        for (const [name, raw] of Object.entries(data.registry)) {
+            const e = raw;
+            const git = (e.git ?? {});
+            const npm = (e.npm ?? {});
+            const supports = (e.supports ?? { v0: false, v1: false, v2: false });
+            plugins.set(name, {
+                name,
+                gitRepo: git.repo ?? "unknown/unknown",
+                gitUrl: `https://github.com/${git.repo ?? "unknown/unknown"}.git`,
+                description: e.description ?? "",
+                homepage: e.homepage ?? null,
+                topics: e.topics ?? [],
+                stars: e.stargazers_count ?? 0,
+                language: e.language ?? "TypeScript",
+                npm: {
+                    package: npm.repo ?? name,
+                    v0Version: npm.v0 ?? null,
+                    v1Version: npm.v1 ?? null,
+                    v2Version: npm.v2 ?? null,
+                },
+                git: {
+                    v0Branch: git.v0?.branch ?? null,
+                    v1Branch: git.v1?.branch ?? null,
+                    v2Branch: git.v2?.branch ?? null,
+                },
+                supports,
+            });
+        }
+        return plugins;
+    }
+    catch (err) {
+        logger.warn(`[registry-client] Endpoint "${label}" (${url}) failed: ${String(err)}`);
+        return null;
+    }
+}
+export async function mergeCustomEndpoints(plugins, endpoints) {
+    const enabledEndpoints = endpoints.filter((ep) => ep.enabled !== false);
+    if (enabledEndpoints.length === 0)
+        return;
+    const results = await Promise.allSettled(enabledEndpoints.map((ep) => fetchSingleEndpoint(ep.url, ep.label)));
+    for (const result of results) {
+        if (result.status === "fulfilled" && result.value) {
+            for (const [name, info] of result.value) {
+                if (plugins.has(name)) {
+                    logger.warn(`[registry-client] Ignoring custom endpoint override for ${name}`);
+                    continue;
+                }
+                plugins.set(name, info);
+            }
+        }
+    }
+}

package/dist/packages/agent/src/services/registry-client-local.d.ts

@@ -0,0 +1,4 @@
+import type { RegistryPluginInfo } from "./registry-client-types.ts";
+export declare function applyNodeModulePlugins(plugins: Map<string, RegistryPluginInfo>): Promise<void>;
+export declare function applyLocalWorkspaceApps(plugins: Map<string, RegistryPluginInfo>): Promise<void>;
+//# sourceMappingURL=registry-client-local.d.ts.map

package/dist/packages/agent/src/services/registry-client-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-local.d.ts","sourceRoot":"","sources":["../../../../../src/services/registry-client-local.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAKV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAgqBpC,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CA8Bf"}