@jstn-sdk/ma 0.1.13 → 0.14.0

package/plugins/meta-architect/obsidian/main.js

@@ -1,4 +1,5 @@
 const { MarkdownView, Modal, Notice, Plugin, PluginSettingTab, Setting } = require("obsidian");
+const { createHash, randomUUID } = require("node:crypto");
 
 const DEFAULT_SETTINGS = {
   projectName: "Meta-Architect",
@@ -6,13 +7,29 @@ const DEFAULT_SETTINGS = {
   queuePath: "Meta-Architect/Plugin Requests/request-queue.json",
   attachmentDir: "Meta-Architect/Attachments",
   sourceWorkspace: "",
+  protocolToken: "",
 };
 
 const FORBIDDEN_TARGETS = [".ma/release.json", ".ma/decisions.json", ".ma/plans/", ".ma/specs/"];
+const MAX_ATTACHMENT_BYTES = 1_048_576;
+const ALLOWED_ATTACHMENT_TYPES = new Set([
+  "application/octet-stream",
+  "application/json",
+  "text/plain",
+  "text/markdown",
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+]);
 
 module.exports = class MetaArchitectPlugin extends Plugin {
   async onload() {
     this.settings = Object.assign({}, DEFAULT_SETTINGS, (await this.loadData()) || {});
+    this.queueBusy = Promise.resolve();
+    if (!this.settings.protocolToken) {
+      this.settings.protocolToken = randomUUID();
+      await this.saveSettings();
+    }
     this.addRibbonIcon("network", "Send current note/selection to MA", async () => {
       await this.captureActiveNote();
     });
@@ -164,9 +181,15 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
         return;
       }
       if (params.action === "capture" || params.open === "active") {
+        if (!hasProtocolAuthority(params, this.settings)) {
+          throw new Error("obsidian_protocol_authority_required");
+        }
         await this.captureActiveNote();
         return;
       }
+      if (!hasProtocolAuthority(params, this.settings)) {
+        throw new Error("obsidian_protocol_authority_required");
+      }
       await this.openNote(params.path || "Meta-Architect/Map of Content.md");
     });
   }
@@ -196,14 +219,22 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
   }
 
   async queueRequest(params) {
+    return this.withQueueLock(() => this.queueRequestUnlocked(params));
+  }
+
+  async queueRequestUnlocked(params) {
+    if (!hasProtocolAuthority(params, this.settings)) {
+      throw new Error("obsidian_protocol_queue_authority_required");
+    }
     await this.ensureFolder(this.pathParent(this.settings.queuePath));
     const file = this.app.vault.getAbstractFileByPath(this.settings.queuePath);
     const queue = file ? JSON.parse(await this.app.vault.read(file)) : [];
     queue.push({
-      ...params,
+      ...Object.fromEntries(Object.entries(params).filter(([key]) => key !== "protocol_token")),
       id: params.id || `ma-${Date.now()}`,
       queued_at: new Date().toISOString(),
       records_as: "vault_context",
+      protocol_token_hash: params.protocol_token_hash || tokenHash(params.protocol_token),
     });
     const payload = `${JSON.stringify(queue, null, 2)}\n`;
     if (file) await this.app.vault.modify(file, payload);
@@ -211,12 +242,29 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
   }
 
   async drainRequestQueue() {
+    return this.withQueueLock(() => this.drainRequestQueueUnlocked());
+  }
+
+  async drainRequestQueueUnlocked() {
     const file = this.app.vault.getAbstractFileByPath(this.settings.queuePath);
     const queue = file ? JSON.parse(await this.app.vault.read(file)) : [];
     const processed = [];
     const refused = [];
+    const refusedQueueItems = [];
     for (const request of queue) {
       try {
+        const mutating = [
+          "capture_active_note",
+          "create_note",
+          "rename_note",
+          "write_attachment",
+        ].includes(request.action);
+        if (
+          (mutating && !hasProtocolAuthority(request, this.settings)) ||
+          (!mutating && !hasVaultContextAuthority(request, this.settings))
+        ) {
+          throw new Error("obsidian_queue_authority_required");
+        }
         const target = request.note_path || request.path || "";
         if (target) assertSafeVaultPath(target);
         if (request.action === "capture_active_note") {
@@ -224,6 +272,7 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
         } else if (request.action === "create_note") {
           processed.push(await this.writeVaultContextNote(target, request.content, true));
         } else if (request.action === "rename_note") {
+          assertSafeVaultPath(request.from);
           assertSafeVaultPath(request.to);
           const fileToRename = this.app.vault.getAbstractFileByPath(request.from);
           await this.app.fileManager.renameFile(fileToRename, request.to);
@@ -236,6 +285,7 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
           throw new Error(`unsupported_action:${request.action}`);
         }
       } catch (error) {
+        refusedQueueItems.push(request);
         refused.push({
           action: request?.action || null,
           reason: error.message,
@@ -244,7 +294,11 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
         });
       }
     }
-    if (file && queue.length > 0) await this.app.vault.modify(file, "[]\n");
+    if (file && queue.length > 0) {
+      const nextQueue = `${JSON.stringify(refusedQueueItems, null, 2)}\n`;
+      const currentQueue = await this.app.vault.read(file);
+      if (currentQueue !== nextQueue) await this.app.vault.modify(file, nextQueue);
+    }
     return {
       record_type: "obsidian_plugin_queue_drain",
       records_as: "vault_context",
@@ -254,8 +308,18 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
     };
   }
 
+  withQueueLock(task) {
+    const previous = this.queueBusy;
+    let release;
+    this.queueBusy = new Promise((resolve) => {
+      release = resolve;
+    });
+    return previous.then(task).finally(release);
+  }
+
   async writeVaultContextNote(notePath, content, overwrite) {
     assertSafeVaultPath(notePath);
+    assertMaOwnedPath(notePath, "Meta-Architect/");
     if (!content?.trim()) throw new Error("vault_context note content required");
     await this.ensureFolder(this.pathParent(notePath));
     const file = this.app.vault.getAbstractFileByPath(notePath);
@@ -273,8 +337,18 @@ ${JSON.stringify(context.pane_state || {}, null, 2)}
 
   async writeBinaryAttachment(attachmentPath, data, contentType) {
     assertSafeVaultPath(attachmentPath);
+    assertMaOwnedPath(attachmentPath, "Meta-Architect/Attachments/");
+    if (!ALLOWED_ATTACHMENT_TYPES.has(contentType)) {
+      throw new Error(`attachment_type_forbidden:${contentType}`);
+    }
     await this.ensureFolder(this.pathParent(attachmentPath));
     const bytes = new TextEncoder().encode(String(data || ""));
+    if (bytes.byteLength > MAX_ATTACHMENT_BYTES) {
+      throw new Error(`attachment_too_large:${attachmentPath}:${bytes.byteLength}`);
+    }
+    if (this.app.vault.getAbstractFileByPath(attachmentPath)) {
+      throw new Error(`attachment_exists:${attachmentPath}`);
+    }
     if (this.app.vault.createBinary) {
       await this.app.vault.createBinary(attachmentPath, bytes.buffer);
     } else {
@@ -369,7 +443,21 @@ class MetaArchitectSettingTab extends PluginSettingTab {
 
 function withVaultContextFrontmatter(content) {
   if (content.trimStart().startsWith("---")) {
-    return content;
+    const start = content.indexOf("---");
+    const end = content.indexOf("\n---", start + 3);
+    if (end > start) {
+      let frontmatter = content.slice(start + 4, end);
+      for (const [key, value] of [
+        ["ma_records_as", "vault_context"],
+        ["ma_project", "Meta-Architect"],
+      ]) {
+        const pattern = new RegExp(`^${key}:.*$`, "m");
+        frontmatter = pattern.test(frontmatter)
+          ? frontmatter.replace(pattern, `${key}: ${value}`)
+          : `${key}: ${value}\n${frontmatter}`;
+      }
+      return `---\n${frontmatter}\n---${content.slice(end + 4)}`;
+    }
   }
   return `---
 ma_records_as: vault_context
@@ -382,9 +470,13 @@ ${content}`;
 }
 
 function assertSafeVaultPath(targetPath) {
-  const normalized = String(targetPath || "")
+  const raw = String(targetPath || "")
     .replaceAll("\\", "/")
     .replace(/^\/+/, "");
+  if (raw === ".." || raw.startsWith("../") || raw.includes("/../")) {
+    throw new Error("path_traversal_forbidden");
+  }
+  const normalized = pathNormalize(raw);
   if (
     !normalized ||
     normalized === ".." ||
@@ -393,9 +485,50 @@ function assertSafeVaultPath(targetPath) {
   ) {
     throw new Error("path_traversal_forbidden");
   }
+  if ([".obsidian/", ".trash/", ".git/"].some((prefix) => normalized.startsWith(prefix))) {
+    throw new Error("vault_control_path_forbidden");
+  }
   for (const forbidden of FORBIDDEN_TARGETS) {
     if (normalized === forbidden || normalized.startsWith(forbidden)) {
       throw new Error(`forbidden_authoritative_mutation:${forbidden}`);
     }
   }
 }
+
+function assertMaOwnedPath(targetPath, prefix) {
+  const normalized = pathNormalize(String(targetPath || "").replaceAll("\\", "/"));
+  if (!normalized.startsWith(prefix)) throw new Error(`ma_owned_path_required:${prefix}`);
+}
+
+function pathNormalize(value) {
+  const parts = [];
+  for (const part of value.split("/")) {
+    if (!part || part === ".") continue;
+    if (part === "..") {
+      parts.pop();
+    } else {
+      parts.push(part);
+    }
+  }
+  return parts.join("/");
+}
+
+function hasVaultContextAuthority(params, settings) {
+  const requiredAuthority = settings.protocolAuthority || "vault_context";
+  return params?.authority === requiredAuthority;
+}
+
+function tokenHash(value) {
+  return createHash("sha256")
+    .update(String(value || ""))
+    .digest("hex");
+}
+
+function hasProtocolAuthority(params, settings) {
+  return (
+    Boolean(settings.protocolToken) &&
+    (params?.protocol_token === settings.protocolToken ||
+      params?.protocol_token_hash === tokenHash(settings.protocolToken)) &&
+    hasVaultContextAuthority(params, settings)
+  );
+}

package/plugins/meta-architect/obsidian/manifest.json

@@ -1,7 +1,7 @@
 {
   "id": "meta-architect",
   "name": "Meta-Architect",
-  "version": "0.1.13",
+  "version": "0.14.0",
   "minAppVersion": "1.5.0",
   "description": "Connects active Obsidian notes, selections, graph metadata, canvases, attachments, and request queues to Meta-Architect vault context.",
   "author": "JustineDevs",

package/schemas/autonomous-task-queue.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meta-architect.dev/schemas/autonomous-task-queue.schema.json",
+  "title": "Meta-Architect Autonomous Task Queue",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "record_type", "tasks"],
+  "properties": {
+    "schemaVersion": { "const": "0.1.0" },
+    "record_type": { "const": "autonomous_task_queue" },
+    "tasks": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "id",
+          "goal",
+          "priority",
+          "dependencies",
+          "labels",
+          "status",
+          "attempts",
+          "maxAttempts",
+          "contract",
+          "createdAt",
+          "updatedAt"
+        ],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "goal": { "type": "string", "minLength": 1 },
+          "priority": { "enum": ["low", "normal", "high", "critical"] },
+          "dependencies": { "type": "array", "items": { "type": "string" } },
+          "labels": { "type": "array", "items": { "type": "string" } },
+          "deadline": { "type": ["string", "null"], "format": "date-time" },
+          "status": {
+            "enum": ["queued", "running", "completed", "failed", "blocked", "cancelled"]
+          },
+          "attempts": { "type": "integer", "minimum": 0 },
+          "maxAttempts": { "type": "integer", "minimum": 1 },
+          "vendor": { "type": ["string", "null"] },
+          "contract": { "$ref": "task-contract.schema.json" },
+          "createdAt": { "type": "string", "format": "date-time" },
+          "updatedAt": { "type": "string", "format": "date-time" },
+          "startedAt": { "type": ["string", "null"], "format": "date-time" },
+          "completedAt": { "type": ["string", "null"], "format": "date-time" },
+          "error": { "type": ["string", "null"] },
+          "blocker": { "type": ["string", "null"] },
+          "evidence": { "type": "array", "items": {} },
+          "selectedCapabilities": { "type": "array", "items": { "type": "object" } },
+          "invocation": { "type": ["string", "null"] }
+        }
+      }
+    }
+  }
+}

package/schemas/handoff-packet.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meta-architect.dev/schemas/handoff-packet.schema.json",
+  "title": "Meta-Architect Handoff Packet",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "record_type",
+    "goal",
+    "current_state",
+    "context_used",
+    "decisions",
+    "blockers",
+    "risks",
+    "changed_files",
+    "verification",
+    "next_action",
+    "status"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "0.1.0" },
+    "record_type": { "const": "handoff_packet" },
+    "goal": { "type": "string", "minLength": 1 },
+    "current_state": { "type": "string", "minLength": 1 },
+    "context_used": { "type": "array", "items": { "type": "string" } },
+    "decisions": { "type": "array", "items": { "type": "string" } },
+    "blockers": { "type": "array", "items": { "type": "string" } },
+    "risks": { "type": "array", "items": { "type": "string" } },
+    "changed_files": { "type": "array", "items": { "type": "string" } },
+    "verification": { "type": "array", "items": { "type": "string" } },
+    "next_action": { "type": "string", "minLength": 1 },
+    "status": { "enum": ["active", "blocked", "verified"] },
+    "created_at": { "type": "string", "format": "date-time" }
+  }
+}

package/schemas/setup-receipt.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "required": ["schemaVersion", "record_type", "generatedAt", "managedBy", "artifacts"],
+  "properties": {
+    "schemaVersion": { "const": "0.1.0" },
+    "record_type": { "const": "setup_receipt" },
+    "generatedAt": { "type": "string", "format": "date-time" },
+    "managedBy": { "const": "@jstn-sdk/ma" },
+    "artifacts": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["path", "kind", "status", "created"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1 },
+          "kind": { "enum": ["file", "directory"] },
+          "status": {
+            "enum": ["created", "existing", "refreshed", "skipped", "warning", "failed"]
+          },
+          "created": { "type": "boolean" }
+        },
+        "additionalProperties": true
+      }
+    }
+  },
+  "additionalProperties": true
+}

package/schemas/skill-frontmatter.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meta-architect.jstn.site/schemas/skill-frontmatter.schema.json",
+  "$comment": "Schema version: 1.0.0",
+  "title": "Meta-Architect skill frontmatter",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["name", "description"],
+  "properties": {
+    "name": {
+      "type": "string",
+      "pattern": "^[a-z0-9-]+$",
+      "minLength": 1
+    },
+    "description": {
+      "type": "string",
+      "minLength": 10
+    }
+  }
+}

package/schemas/support-bundle.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meta-architect.dev/schemas/support-bundle.schema.json",
+  "type": "object",
+  "required": ["schemaVersion", "bundleVersion", "assets", "compatibility"],
+  "properties": {
+    "schemaVersion": { "const": "1.0.0" },
+    "bundleVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "compatibility": {
+      "type": "object",
+      "required": ["node", "managedBy"],
+      "properties": {
+        "node": { "type": "string", "minLength": 1 },
+        "managedBy": { "const": "@jstn-sdk/ma" }
+      },
+      "additionalProperties": false
+    },
+    "assets": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["name", "class", "source", "destination", "type", "required"],
+        "properties": {
+          "name": { "type": "string", "pattern": "^[a-z0-9-]+$" },
+          "class": { "enum": ["runtime", "guidance", "plugin", "documentation"] },
+          "source": { "type": "string", "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+" },
+          "destination": { "type": "string", "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+" },
+          "type": { "enum": ["file", "directory"] },
+          "required": { "type": "boolean" }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/task-contract.schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meta-architect.dev/schemas/task-contract.schema.json",
+  "title": "Meta-Architect Task Contract",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "record_type",
+    "goal",
+    "context_used",
+    "assumptions",
+    "constraints",
+    "risk",
+    "verification",
+    "stop_condition"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "0.1.0" },
+    "record_type": { "const": "task_contract" },
+    "goal": { "type": "string", "minLength": 1 },
+    "context_used": { "type": "array", "items": { "type": "string" } },
+    "assumptions": { "type": "array", "items": { "type": "string" } },
+    "constraints": { "type": "array", "items": { "type": "string" } },
+    "risk": { "enum": ["low", "medium", "high"] },
+    "verification": { "type": "array", "items": { "type": "string" } },
+    "stop_condition": { "type": "string", "minLength": 1 },
+    "persist": { "type": "boolean" },
+    "created_at": { "type": "string", "format": "date-time" }
+  }
+}