@evo-dev/core 0.0.1-alpha

package/dist/plugins/index.js

@@ -0,0 +1,265 @@
+// packages/core/src/plugins/capabilities.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+function createUnknownNegotiatedCapabilities(pluginId) {
+  return {
+    pluginId,
+    skills: "unsupported",
+    agents: "unsupported",
+    hooks: "unsupported",
+    canPlanWrites: false,
+    warnings: [],
+    blockers: [`Plugin ${pluginId} capabilities are unknown and unsupported.`]
+  };
+}
+function isCapabilityUsable(state) {
+  return state === "enabled";
+}
+function assertNoUnverifiedWrites(negotiation) {
+  if (!negotiation.canPlanWrites) {
+    throw new Error(`Plugin ${negotiation.pluginId} has no verified enabled write capabilities.`);
+  }
+}
+function negotiatePluginCapabilities(input) {
+  if (input.pluginId === "codex") {
+    const declaredSupport = [
+      input.declared.skills.supported ? "skills" : null,
+      input.declared.agents.supported ? "agents" : null,
+      input.declared.hooks.supported ? "hooks" : null
+    ].filter(Boolean);
+    const blockers = ["Codex capabilities are unverified; writes are unsupported in I10."];
+    const warnings = [
+      input.verified ? "Codex readonly verification artifact exists; sync remains no-write until formats are verified." : null,
+      declaredSupport.length > 0 ? `Codex declares ${declaredSupport.join(", ")} support, but declared support alone cannot authorize writes.` : null
+    ].filter((warning) => warning !== null);
+    return {
+      pluginId: input.pluginId,
+      skills: input.declared.skills.supported ? "unverified" : "unsupported",
+      agents: input.declared.agents.supported ? "unverified" : "unsupported",
+      hooks: input.declared.hooks.supported ? "unverified" : "unsupported",
+      canPlanWrites: false,
+      warnings,
+      blockers
+    };
+  }
+  return {
+    pluginId: input.pluginId,
+    skills: resolveNonCodexCapabilityState(input.declared.skills.supported, input.enabled),
+    agents: resolveNonCodexCapabilityState(input.declared.agents.supported, input.enabled),
+    hooks: resolveNonCodexCapabilityState(input.declared.hooks.supported, input.enabled),
+    canPlanWrites: input.enabled && input.declared.skills.supported && input.declared.agents.supported,
+    warnings: input.enabled ? [] : [
+      `Plugin ${input.pluginId} has declared capabilities but is not enabled; writes are not authorized.`
+    ],
+    blockers: []
+  };
+}
+function resolveNonCodexCapabilityState(supported, enabled) {
+  if (!supported)
+    return "unsupported";
+  return enabled ? "enabled" : "declared";
+}
+async function createCodexCapabilityVerificationArtifact(input) {
+  const timestamp = input.createdAt ?? new Date().toISOString();
+  const detectionMessage = sanitizeText(input.detection.message);
+  const diagnostics = [
+    "Codex remains no-write until concrete user-level paths and formats are verified."
+  ];
+  return {
+    version: 1,
+    pluginId: "codex",
+    status: "verified-readonly",
+    verifiedAt: timestamp,
+    createdAt: timestamp,
+    metadataOnly: true,
+    rawOutputStored: false,
+    sourceContentStored: false,
+    promptHistoryStored: false,
+    promptStored: false,
+    secretsStored: false,
+    externalUpload: false,
+    networkUsed: false,
+    toolSummary: { tool: "codex", detectionStatus: input.detection.status, version: null },
+    capabilities: { skills: "unverified", agents: "unverified", hooks: "unverified" },
+    writeBoundary: {
+      writesAllowed: false,
+      allowedPaths: [],
+      userLevelOnly: true,
+      noOverwrite: true,
+      projectWritesAllowed: false,
+      codeAgentWritesAllowed: false
+    },
+    privacy: {
+      classification: "local-private",
+      metadataOnly: true,
+      rawOutputStored: false,
+      sourceContentStored: false,
+      promptHistoryStored: false,
+      secretsStored: false,
+      externalUpload: false
+    },
+    blockers: ["Codex asset capabilities are unverified and unsupported for writes in I10."],
+    diagnostics,
+    evidenceRefs: [],
+    evidence: {
+      detectionStatus: input.detection.status,
+      detectionMessage,
+      writesAllowed: false,
+      notes: [
+        "Metadata-only readonly artifact; no Codex paths, formats, hooks, or writes verified."
+      ]
+    }
+  };
+}
+function resolveCodexCapabilityArtifactPath(homeDir) {
+  return join(homeDir, ".evodev", "STATE", "plugins", "codex", "capability-verification.json");
+}
+async function writeCodexCapabilityVerificationArtifact(homeDir, artifact) {
+  validateCodexCapabilityVerificationArtifact(artifact);
+  const path = resolveCodexCapabilityArtifactPath(homeDir);
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(artifact, null, 2)}
+`, { encoding: "utf8", flag: "wx" });
+  return path;
+}
+async function readCodexCapabilityVerificationArtifact(homeDir) {
+  try {
+    const artifact = JSON.parse(await readFile(resolveCodexCapabilityArtifactPath(homeDir), "utf8"));
+    validateCodexCapabilityVerificationArtifact(artifact);
+    return artifact;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+function validateCodexCapabilityVerificationArtifact(artifact) {
+  if (artifact.version !== 1 || artifact.pluginId !== "codex")
+    throw new Error("Invalid Codex artifact identity.");
+  if (artifact.metadataOnly !== true || artifact.rawOutputStored !== false || artifact.sourceContentStored !== false || artifact.promptStored !== false || artifact.promptHistoryStored !== false || artifact.secretsStored !== false || artifact.externalUpload !== false || artifact.networkUsed !== false || artifact.privacy?.metadataOnly !== true || artifact.privacy.rawOutputStored !== false || artifact.privacy.sourceContentStored !== false || artifact.privacy.promptHistoryStored !== false || artifact.privacy.secretsStored !== false || artifact.privacy.externalUpload !== false || artifact.writeBoundary?.writesAllowed !== false || artifact.writeBoundary.allowedPaths.length !== 0 || artifact.writeBoundary.userLevelOnly !== true || artifact.writeBoundary.noOverwrite !== true || artifact.writeBoundary.projectWritesAllowed !== false || artifact.writeBoundary.codeAgentWritesAllowed !== false) {
+    throw new Error("Codex artifact must be metadata-only and local-only.");
+  }
+  assertNoSensitiveContent(artifact);
+}
+function formatCodexCapabilityVerificationArtifact(artifact, path) {
+  return [
+    "EvoDev Codex capability verification",
+    "",
+    `Status: ${artifact.status}`,
+    `Artifact: ${path ?? "dry-run only"}`,
+    `Verified at: ${artifact.verifiedAt}`,
+    "Capabilities: skills=unverified agents=unverified hooks=unverified",
+    "Writes allowed: false",
+    "Allowed paths: none",
+    "User-level write paths verified: false",
+    "Project writes allowed: false",
+    "No-overwrite verified: false",
+    `External upload: ${artifact.externalUpload}`,
+    `Detection: ${artifact.evidence.detectionStatus}`,
+    ...artifact.evidence.notes.map((note) => `Note: ${note}`)
+  ].join(`
+`);
+}
+async function runPluginConformance(plugin) {
+  const findings = [];
+  try {
+    await plugin.detect();
+    await plugin.getCapabilities();
+  } catch (error) {
+    findings.push(`Plugin ${plugin.id} threw during detect/capabilities: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (plugin.id === "codex") {
+    const capabilities = await plugin.getCapabilities();
+    if (capabilities.skills.supported || capabilities.agents.supported || capabilities.hooks.supported) {
+      findings.push("Codex must not declare verified runtime support in I10.");
+    }
+  }
+  return { ok: findings.length === 0, findings };
+}
+function sanitizeText(value) {
+  return value.replace(/https?:\/\/\S+|\b(secret|token|password|private|internal|api[_-]?key)\b/gi, "[redacted]").slice(0, 300);
+}
+function assertNoSensitiveContent(value) {
+  if (typeof value === "string") {
+    if (value === "local-private")
+      return;
+    if (/https?:\/\/\S+|\b(secret|token|password|private|internal|api[_-]?key|raw output|raw source|raw prompt)\b/i.test(value)) {
+      throw new Error("Codex artifact contains sensitive content.");
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value)
+      assertNoSensitiveContent(item);
+    return;
+  }
+  if (typeof value !== "object" || value === null)
+    return;
+  for (const [key, child] of Object.entries(value)) {
+    if (/raw|prompt|source|secret|token|password|memorybody/i.test(key) && child !== false) {
+      throw new Error(`Codex artifact contains forbidden field: ${key}`);
+    }
+    assertNoSensitiveContent(child);
+  }
+}
+// packages/core/src/plugins/registry.ts
+class PluginRegistryError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PluginRegistryError";
+  }
+}
+
+class PluginRegistry {
+  #plugins = new Map;
+  register(plugin) {
+    if (this.#plugins.has(plugin.id)) {
+      throw new PluginRegistryError(`Plugin already registered: ${plugin.id}`);
+    }
+    this.#plugins.set(plugin.id, plugin);
+  }
+  get(pluginId) {
+    return this.#plugins.get(pluginId);
+  }
+  require(pluginId) {
+    const plugin = this.get(pluginId);
+    if (plugin === undefined) {
+      throw new PluginRegistryError(`Plugin not registered: ${pluginId}`);
+    }
+    return plugin;
+  }
+  list() {
+    return [...this.#plugins.values()].sort((left, right) => left.id.localeCompare(right.id));
+  }
+  getEnabled(settings) {
+    return getEnabledPluginIds(settings).map((pluginId) => this.require(pluginId));
+  }
+}
+function createPluginRegistry(plugins = []) {
+  const registry = new PluginRegistry;
+  for (const plugin of plugins) {
+    registry.register(plugin);
+  }
+  return registry;
+}
+function getEnabledPluginIds(settings) {
+  return Object.entries(settings.plugins).filter(([, pluginSettings]) => pluginSettings.enabled).map(([pluginId]) => pluginId).sort((left, right) => left.localeCompare(right));
+}
+export {
+  writeCodexCapabilityVerificationArtifact,
+  validateCodexCapabilityVerificationArtifact,
+  runPluginConformance,
+  resolveCodexCapabilityArtifactPath,
+  readCodexCapabilityVerificationArtifact,
+  negotiatePluginCapabilities,
+  isCapabilityUsable,
+  getEnabledPluginIds,
+  formatCodexCapabilityVerificationArtifact,
+  createUnknownNegotiatedCapabilities,
+  createPluginRegistry,
+  createCodexCapabilityVerificationArtifact,
+  assertNoUnverifiedWrites,
+  PluginRegistryError,
+  PluginRegistry
+};

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@evo-dev/core",
+  "version": "0.0.1-alpha",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/limerickgds/evodev.git",
+    "directory": "packages/core"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "import": "./dist/index.js"
+    },
+    "./assets": {
+      "types": "./src/assets/index.ts",
+      "import": "./dist/assets/index.js"
+    },
+    "./config": {
+      "types": "./src/config/index.ts",
+      "import": "./dist/config/index.js"
+    },
+    "./plugins": {
+      "types": "./src/plugins/index.ts",
+      "import": "./dist/plugins/index.js"
+    }
+  },
+  "files": ["dist", "src", "assets", "package.json"],
+  "license": "MIT"
+}