@lotagate/cli 0.1.23 → 0.1.25

package/dist/infrastructure/clipboard/clipboard-adapter-factory.d.ts

@@ -0,0 +1,11 @@
+import type { ClipboardAdapter, ClipboardImage } from '../../ports/clipboard-adapter.js';
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export declare function createClipboardAdapter(platform?: HostPlatformContext): ClipboardAdapter;
+export declare class ProcessClipboardAdapter implements ClipboardAdapter {
+    private readonly command;
+    private readonly args;
+    private readonly mimeType;
+    private readonly platform;
+    constructor(command: string, args: readonly string[], mimeType: string, platform?: HostPlatformContext);
+    readImage(): Promise<ClipboardImage | undefined>;
+}

package/dist/infrastructure/clipboard/clipboard-adapter-factory.js

@@ -0,0 +1 @@
+import{CliError as f}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as b}from"../../domain/errors/error-codes.js";import{WindowsClipboardAdapter as h}from"./windows-clipboard-adapter.js";import{detectHostPlatform as c}from"../platform/host-platform.js";import{spawnPlatformProcess as w}from"../platform/host-process.js";import{CLIPBOARD_POLICY as d,clipboardUnavailableError as m,isClipboardUnavailableError as C}from"./clipboard-policy.js";function O(r=c()){return r.id==="windows"?new h(r):r.id==="macos"?new u([new p("pbpaste",["-Prefer","png"],"image/png",r)]):r.id==="linux"||r.id==="bsd"?new u([new p("wl-paste",["--no-newline","--type","image/png"],"image/png",r),new p("xclip",["-selection","clipboard","-target","image/png","-out"],"image/png",r)]):new y}class p{command;args;mimeType;platform;constructor(t,i,e,o=c()){this.command=t,this.args=i,this.mimeType=e,this.platform=o}async readImage(){return new Promise((t,i)=>{const e=w(this.command,this.args,this.platform,{stdio:["ignore","pipe","pipe"]}),o=[];let l=0,n=!1;const s=a=>{n||(n=!0,clearTimeout(g),a())},g=setTimeout(()=>{e.kill(),s(()=>i(m(`Clipboard image read timed out after ${d.timeoutMs}ms.`)))},d.timeoutMs);e.stdout?.on("data",a=>{if(!n){if(l+=a.byteLength,l>d.maxImageBytes){e.kill(),s(()=>i(new f(b.ATTACHMENT_TOO_LARGE,"Clipboard image is too large.",{category:"attachment",userMessage:"Clipboard image exceeds the maximum allowed size."})));return}o.push(a)}}),e.once("error",()=>s(()=>t(void 0))),e.once("close",a=>{s(()=>{a!==0||o.length===0?t(void 0):t({bytes:Buffer.concat(o),mimeType:this.mimeType})})})})}}class u{adapters;constructor(t){this.adapters=t}async readImage(){let t;for(const i of this.adapters)try{const e=await i.readImage();if(e!==void 0)return e}catch(e){if(!C(e))throw e;t=e}throw t??m("No supported clipboard image provider was found.")}}class y{async readImage(){throw m("Clipboard image support is unavailable on this platform.")}}export{p as ProcessClipboardAdapter,O as createClipboardAdapter};

package/dist/infrastructure/clipboard/clipboard-policy.d.ts

@@ -0,0 +1,8 @@
+import { CliError } from '../../domain/errors/cli-error.js';
+export declare const CLIPBOARD_POLICY: {
+    readonly maxImageBytes: number;
+    readonly maxTextBytes: number;
+    readonly timeoutMs: 15000;
+};
+export declare function clipboardUnavailableError(message: string, cause?: unknown): CliError;
+export declare function isClipboardUnavailableError(error: unknown): error is CliError;

package/dist/infrastructure/clipboard/clipboard-policy.js

@@ -0,0 +1 @@
+import{CliError as o}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as a}from"../../domain/errors/error-codes.js";import{RESOURCE_LIMITS as e}from"../../domain/runtime/resource-limits.js";const A={maxImageBytes:e.maxAttachmentBytes,maxTextBytes:e.clipboardTextBytes,timeoutMs:e.clipboardTimeoutMs};function c(t,r){return new o(a.ATTACHMENT_CLIPBOARD_UNAVAILABLE,t,{category:"attachment",userMessage:"Unable to read from the clipboard. Copy the content again and retry.",retryable:!0,...r===void 0?{}:{cause:r}})}function l(t){return t instanceof o&&t.code===a.ATTACHMENT_CLIPBOARD_UNAVAILABLE}export{A as CLIPBOARD_POLICY,c as clipboardUnavailableError,l as isClipboardUnavailableError};

package/dist/infrastructure/clipboard/clipboard-text-adapter-factory.d.ts

@@ -0,0 +1,10 @@
+import type { ClipboardTextAdapter } from '../../ports/clipboard-text-adapter.js';
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export declare function createClipboardTextAdapter(platform?: HostPlatformContext): ClipboardTextAdapter;
+export declare class ProcessClipboardTextAdapter implements ClipboardTextAdapter {
+    private readonly command;
+    private readonly args;
+    private readonly platform;
+    constructor(command: string, args: readonly string[], platform?: HostPlatformContext);
+    readText(): Promise<string | undefined>;
+}

package/dist/infrastructure/clipboard/clipboard-text-adapter-factory.js

@@ -0,0 +1 @@
+import{CliError as f}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as x}from"../../domain/errors/error-codes.js";import{WindowsClipboardTextAdapter as b}from"./windows-clipboard-text-adapter.js";import{detectHostPlatform as u}from"../platform/host-platform.js";import{spawnPlatformProcess as h}from"../platform/host-process.js";import{CLIPBOARD_POLICY as d,clipboardUnavailableError as l,isClipboardUnavailableError as w}from"./clipboard-policy.js";function L(e=u()){return e.id==="windows"?new b(e):e.id==="macos"?new p("pbpaste",[],e):e.id==="linux"||e.id==="bsd"?new C([new p("wl-paste",["--no-newline"],e),new p("xclip",["-selection","clipboard","-out"],e)]):new T}class p{command;args;platform;constructor(r,o,t=u()){this.command=r,this.args=o,this.platform=t}async readText(){return new Promise((r,o)=>{const t=h(this.command,this.args,this.platform,{stdio:["ignore","pipe","pipe"]}),s=[];let c=0,n=!1;const a=i=>{n||(n=!0,clearTimeout(m),i())},m=setTimeout(()=>{t.kill(),a(()=>o(l(`Clipboard text read timed out after ${d.timeoutMs}ms.`)))},d.timeoutMs);t.stdout?.on("data",i=>{if(!n){if(c+=i.byteLength,c>d.maxTextBytes){t.kill(),a(()=>o(new f(x.ATTACHMENT_TOO_LARGE,"Clipboard text is too large.",{category:"attachment",userMessage:"Clipboard text exceeds the maximum allowed size."})));return}s.push(i)}}),t.once("error",()=>a(()=>r(void 0))),t.once("close",i=>a(()=>{i!==0||s.length===0?r(void 0):r(Buffer.concat(s).toString("utf8"))}))})}}class C{adapters;constructor(r){this.adapters=r}async readText(){let r;for(const o of this.adapters)try{const t=await o.readText();if(t!==void 0)return t}catch(t){if(!w(t))throw t;r=t}throw r??l("No supported clipboard text provider was found.")}}class T{async readText(){throw l("Clipboard text support is unavailable on this platform.")}}export{p as ProcessClipboardTextAdapter,L as createClipboardTextAdapter};

package/dist/infrastructure/clipboard/image-normalizer.d.ts

@@ -0,0 +1,12 @@
+import type { Attachment, AttachmentPayload, AttachmentSource } from '../../domain/session/attachment.js';
+import type { TextFileContentPart, TextImageContentPart, TextMessage } from '@lotagate/sdk';
+export declare const DEFAULT_MAX_IMAGE_BYTES: number;
+export interface NormalizedImage {
+    bytes: Buffer;
+    mimeType: string;
+}
+export declare function normalizeImage(bytes: Uint8Array, declaredMimeType?: string, maxBytes?: number): NormalizedImage;
+export declare function createImageAttachment(image: NormalizedImage, source: AttachmentSource, id: string, storagePath?: string): Attachment;
+export declare function toImageContentPart(payload: AttachmentPayload): TextImageContentPart;
+export declare function toAttachmentContentPart(payload: AttachmentPayload): TextImageContentPart | TextFileContentPart;
+export declare function buildUserMessage(prompt: string, attachments?: readonly AttachmentPayload[]): TextMessage;

package/dist/infrastructure/clipboard/image-normalizer.js

@@ -0,0 +1 @@
+import{CliError as a}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as o}from"../../domain/errors/error-codes.js";import{RESOURCE_LIMITS as m}from"../../domain/runtime/resource-limits.js";const s=m.maxAttachmentBytes,f=new Map([["89504e470d0a1a0a","image/png"],["ffd8ff","image/jpeg"],["47494638","image/gif"],["424d","image/bmp"]]);function d(e,t,n=s){if(e.byteLength===0||e.byteLength>n)throw new a(o.ATTACHMENT_TOO_LARGE,"Image size is outside the allowed range.",{category:"attachment",userMessage:`Image size must be between 1 byte and ${n} bytes.`});const r=g(e),i=r??t;if(i===void 0||!i.startsWith("image/"))throw new a(o.ATTACHMENT_FORMAT_UNSUPPORTED,"Clipboard content is not a supported image.",{category:"attachment",userMessage:"The clipboard does not contain a supported image format."});if(r!==void 0&&t!==void 0&&t!==r)throw new a(o.ATTACHMENT_INVALID_IMAGE,"Declared image type does not match its bytes.",{category:"attachment",userMessage:"The image format does not match its actual content."});return{bytes:Buffer.from(e),mimeType:i}}function A(e,t,n,r){const i=n.trim();if(i.length===0)throw new a(o.ATTACHMENT_INVALID_IMAGE,"Attachment id is required.",{category:"attachment"});return{id:i,name:i,mimeType:e.mimeType,sizeBytes:e.bytes.byteLength,source:t,...r===void 0?{}:{storagePath:r}}}function c(e){const t=Buffer.from(e.bytes).toString("base64");return{type:"image_url",image_url:{url:`data:${e.attachment.mimeType};base64,${t}`,detail:"auto"}}}function u(e){if(e.attachment.mimeType.startsWith("image/"))return c(e);const t=Buffer.from(e.bytes).toString("base64");return{type:"input_file",file_data:`data:${e.attachment.mimeType};base64,${t}`,filename:e.attachment.name,media_type:e.attachment.mimeType}}function _(e,t=[]){return t.length===0?{role:"user",content:e}:{role:"user",content:[{type:"text",text:e},...t.map(u)]}}function g(e){const t=[...e.slice(0,8)].map(n=>n.toString(16).padStart(2,"0")).join("");for(const[n,r]of f)if(t.startsWith(n))return r;if(e.length>=12&&Buffer.from(e.slice(0,12)).toString("ascii",0,4)==="RIFF"&&Buffer.from(e.slice(8,12)).toString("ascii")==="WEBP")return"image/webp"}export{s as DEFAULT_MAX_IMAGE_BYTES,_ as buildUserMessage,A as createImageAttachment,d as normalizeImage,u as toAttachmentContentPart,c as toImageContentPart};

package/dist/infrastructure/clipboard/windows-clipboard-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { ClipboardAdapter, ClipboardImage } from '../../ports/clipboard-adapter.js';
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export declare class WindowsClipboardAdapter implements ClipboardAdapter {
+    private readonly platform;
+    constructor(platform?: HostPlatformContext);
+    readImage(): Promise<ClipboardImage | undefined>;
+}

package/dist/infrastructure/clipboard/windows-clipboard-adapter.js

@@ -0,0 +1 @@
+import g from"node:crypto";import u from"node:fs/promises";import h from"node:os";import w from"node:path";import{CliError as l}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as T}from"../../domain/errors/error-codes.js";import{DEFAULT_MAX_IMAGE_BYTES as P}from"./image-normalizer.js";import{readFileBounded as A}from"../filesystem/bounded-file-reader.js";import{detectHostPlatform as b}from"../platform/host-platform.js";import{spawnPlatformProcess as C}from"../platform/host-process.js";import{CLIPBOARD_POLICY as c,clipboardUnavailableError as m}from"./clipboard-policy.js";class B{platform;constructor(o=b()){this.platform=o}async readImage(){if(!this.platform.isWindows)throw m("Windows clipboard image adapter cannot run on this platform.");const o=w.join(h.tmpdir(),`lotagate-clipboard-${process.pid}-${g.randomUUID()}.png`);try{await E(o,this.platform);const r=await A(o,P);if(r.truncated)throw new l(T.ATTACHMENT_TOO_LARGE,"Clipboard image exceeds the configured size limit.",{category:"attachment",userMessage:"The clipboard image is too large to attach."});return{bytes:r.bytes,mimeType:"image/png"}}catch(r){throw r instanceof l?r:m("Unable to read an image from the clipboard.",r)}finally{await u.rm(o,{force:!0})}}}function E(n,o){const r="$ErrorActionPreference='Stop'; $image=Get-Clipboard -Format Image; if ($null -eq $image) { exit 3 }; $image.Save($env:LOTAGATE_CLIPBOARD_OUTPUT, [System.Drawing.Imaging.ImageFormat]::Png)";return new Promise((f,i)=>{const e=C("powershell.exe",["-NoProfile","-NonInteractive","-Command",r],o,{env:{...process.env,LOTAGATE_CLIPBOARD_OUTPUT:n},stdio:["ignore","ignore","pipe"]}),s=[];let p=!1;const a=t=>{p||(p=!0,clearTimeout(d),t())},d=setTimeout(()=>{e.kill(),a(()=>i(m(`Clipboard image read timed out after ${c.timeoutMs}ms.`)))},c.timeoutMs);e.stderr?.on("data",t=>s.push(t)),e.once("error",t=>a(()=>i(t))),e.once("close",t=>a(()=>t===0?f():i(new Error(Buffer.concat(s).toString("utf8").trim()||`PowerShell exited with code ${String(t)}.`))))})}export{B as WindowsClipboardAdapter};

package/dist/infrastructure/clipboard/windows-clipboard-text-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { ClipboardTextAdapter } from '../../ports/clipboard-text-adapter.js';
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export declare class WindowsClipboardTextAdapter implements ClipboardTextAdapter {
+    private readonly platform;
+    constructor(platform?: HostPlatformContext);
+    readText(): Promise<string | undefined>;
+}

package/dist/infrastructure/clipboard/windows-clipboard-text-adapter.js

@@ -0,0 +1 @@
+import{CliError as p}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as h}from"../../domain/errors/error-codes.js";import{detectHostPlatform as x}from"../platform/host-platform.js";import{spawnPlatformProcess as w}from"../platform/host-process.js";import{CLIPBOARD_POLICY as a,clipboardUnavailableError as s}from"./clipboard-policy.js";class O{platform;constructor(e=x()){this.platform=e}async readText(){if(!this.platform.isWindows)throw s("Windows clipboard text adapter cannot run on this platform.");try{return await C(this.platform)}catch(e){throw e instanceof p?e:s("Unable to read text from the clipboard.",e)}}}function C(l){const e="$ErrorActionPreference='Stop'; [Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $text=Get-Clipboard -Raw; if ($null -eq $text) { exit 3 }; [Console]::Out.Write($text)";return new Promise((f,o)=>{const r=w("powershell.exe",["-NoProfile","-NonInteractive","-Command",e],l,{stdio:["ignore","pipe","pipe"]}),m=[];let c=0,n=!1;const i=t=>{n||(n=!0,clearTimeout(u),t())},u=setTimeout(()=>{r.kill(),i(()=>o(s(`Clipboard text read timed out after ${a.timeoutMs}ms.`)))},a.timeoutMs);r.stdout?.on("data",t=>{if(!n){if(c+=t.byteLength,c>a.maxTextBytes){r.kill(),i(()=>o(new p(h.ATTACHMENT_TOO_LARGE,"Clipboard text is too large.",{category:"attachment",userMessage:"Clipboard text exceeds the maximum allowed size."})));return}m.push(t)}});const d=[];r.stderr?.on("data",t=>d.push(t)),r.once("error",t=>i(()=>o(t))),r.once("close",t=>i(()=>{t===3?f(void 0):t!==0?o(new Error(Buffer.concat(d).toString("utf8").trim()||`PowerShell exited with code ${String(t)}.`)):f(Buffer.concat(m).toString("utf8"))}))})}export{O as WindowsClipboardTextAdapter};

package/dist/infrastructure/config/config-loader.d.ts

@@ -0,0 +1,19 @@
+import { type CliConfig, type ConfigurableKey } from '../../domain/config/config-schema.js';
+import type { Logger } from '../../ports/logger.js';
+import { type PlatformPaths } from '../platform/platform-paths.js';
+export interface ConfigLoadResult {
+    config: CliConfig;
+    sources: readonly string[];
+}
+export declare class ConfigLoader {
+    private readonly logger;
+    private readonly paths;
+    constructor(logger: Logger, paths?: PlatformPaths);
+    get platformPaths(): PlatformPaths;
+    load(cwd: string, options?: {
+        includeProject?: boolean;
+    }): Promise<ConfigLoadResult>;
+    setGlobal(key: ConfigurableKey, value: unknown): Promise<void>;
+    private readOptional;
+    private readDocumentOptional;
+}

package/dist/infrastructure/config/config-loader.js

@@ -0,0 +1,2 @@
+import{CliError as n}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as s}from"../../domain/errors/error-codes.js";import{DEFAULT_CONFIG as g,mergeConfig as h}from"../../domain/config/config-schema.js";import{resolvePlatformPaths as m,resolveProjectConfigPaths as c}from"../platform/platform-paths.js";import{atomicWriteFile as p,withFileLock as d}from"../filesystem/atomic-file-store.js";import{isFileNotFound as u}from"../filesystem/fs-errors.js";import{readJsonFileBounded as O}from"../filesystem/bounded-json-reader.js";import{RESOURCE_LIMITS as F}from"../../domain/runtime/resource-limits.js";import{validateSettingsDocument as l}from"../../domain/settings/settings-document.js";class L{logger;paths;constructor(o,t=m()){this.logger=o,this.paths=t}get platformPaths(){return this.paths}async load(o,t={}){const i=[],e=[],f=t.includeProject===!1?[this.paths.globalConfigFile]:[this.paths.globalConfigFile,c(o).settings,c(o).localSettings];for(const a of f){const r=await this.readOptional(a);r!==void 0&&(i.push(r),e.push(a))}return{config:h(g,...i),sources:e}}async setGlobal(o,t){await d(this.paths.globalConfigFile,async()=>{const i=await this.readDocumentOptional(this.paths.globalConfigFile),e={...i?.config??{},...i?.permissions===void 0?{}:{permissions:i.permissions},[o]:t,schemaVersion:1};l(e),await p(this.paths.globalConfigFile,`${JSON.stringify(e,null,2)}
+`)}),this.logger.info("Global configuration updated.",{key:o})}async readOptional(o){return(await this.readDocumentOptional(o))?.config}async readDocumentOptional(o){try{try{return l(await O(o,F.configFileBytes))}catch(t){if(u(t))return;throw t instanceof n?t:new n(s.CONFIG_INVALID_JSON,`Invalid JSON in ${o}.`,{category:"config",userMessage:`Unable to parse JSON in ${o}.`,cause:t})}}catch(t){throw t instanceof n?t:new n(s.CONFIG_NOT_FOUND,`Unable to read config ${o}.`,{category:"config",userMessage:`Unable to read configuration file ${o}.`,cause:t})}}}export{L as ConfigLoader};

package/dist/infrastructure/config/environment-values.d.ts

@@ -0,0 +1,2 @@
+/** Reads an integer environment value without allowing invalid settings to disable a safe default. */
+export declare function readBoundedEnvironmentInteger(value: string | undefined, fallback: number, minimum: number, maximum: number): number;

package/dist/infrastructure/config/environment-values.js

@@ -0,0 +1 @@
+function u(n,r,t,d){if(n===void 0)return r;const e=Number(n);return Number.isSafeInteger(e)&&e>=t&&e<=d?e:r}export{u as readBoundedEnvironmentInteger};

package/dist/infrastructure/credentials/composite-credential-store.d.ts

@@ -0,0 +1,11 @@
+import type { AuthProfile, StoredCredential } from '../../domain/auth/auth-profile.js';
+import type { CredentialStore } from '../../ports/credential-store.js';
+export declare class CompositeCredentialStore implements CredentialStore {
+    private readonly stores;
+    private readonly writableStore;
+    constructor(stores: readonly CredentialStore[], writableStore: CredentialStore);
+    list(): Promise<readonly AuthProfile[]>;
+    get(profileName: string): Promise<StoredCredential | undefined>;
+    set(credential: StoredCredential): Promise<void>;
+    delete(profileName: string): Promise<boolean>;
+}

package/dist/infrastructure/credentials/composite-credential-store.js

@@ -0,0 +1 @@
+class r{stores;writableStore;constructor(t,e){this.stores=t,this.writableStore=e}async list(){const t=new Map;for(const e of this.stores)for(const s of await e.list())t.set(s.name,s);return[...t.values()].sort((e,s)=>e.name.localeCompare(s.name))}async get(t){for(const e of this.stores){const s=await e.get(t);if(s!==void 0)return s}}async set(t){await this.writableStore.set(t)}async delete(t){let e=!1;for(const s of this.stores)e=await s.delete(t)||e;return e}}export{r as CompositeCredentialStore};

package/dist/infrastructure/credentials/encrypted-file-credential-store.d.ts

@@ -0,0 +1,17 @@
+import { type AuthProfile, type StoredCredential } from '../../domain/auth/auth-profile.js';
+import type { CredentialStore } from '../../ports/credential-store.js';
+import type { PlatformPaths } from '../platform/platform-paths.js';
+export declare class EncryptedFileCredentialStore implements CredentialStore {
+    private readonly paths;
+    private readonly secret;
+    constructor(paths: PlatformPaths, secret?: string | undefined);
+    list(): Promise<readonly AuthProfile[]>;
+    get(profileName: string): Promise<StoredCredential | undefined>;
+    set(credential: StoredCredential): Promise<void>;
+    delete(profileName: string): Promise<boolean>;
+    private readPayload;
+    private writePayload;
+    private readFile;
+    private deriveKey;
+    private resolveSecret;
+}

package/dist/infrastructure/credentials/encrypted-file-credential-store.js

@@ -0,0 +1,3 @@
+import o from"node:crypto";import n from"node:fs/promises";import g from"node:path";import{CliError as s}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as l}from"../../domain/errors/error-codes.js";import{validateApiKey as w,validateBaseUrl as E,validateProfileName as d}from"../../domain/auth/auth-profile.js";import{withFileLock as f}from"../filesystem/atomic-file-store.js";import{isAlreadyExists as m,isFileNotFound as y}from"../filesystem/fs-errors.js";class R{paths;secret;constructor(e,t=process.env.LOTAGATE_CREDENTIAL_SECRET){this.paths=e,this.secret=t}async list(){return(await this.readPayload()).credentials.map(({profile:t})=>t)}async get(e){const t=d(e);return(await this.readPayload()).credentials.find(a=>a.profile.name===t)}async set(e){const t={profile:{...e.profile,name:d(e.profile.name),baseUrl:E(e.profile.baseUrl),credentialRef:`file:${d(e.profile.name)}`},apiKey:w(e.apiKey)};await f(this.paths.credentialsFile,async()=>{const a=(await this.readPayload()).credentials.filter(({profile:i})=>i.name!==t.profile.name);a.push(t),await this.writePayload({version:1,credentials:a})})}async delete(e){const t=d(e);return f(this.paths.credentialsFile,async()=>{const r=await this.readPayload(),a=r.credentials.filter(({profile:i})=>i.name!==t);return a.length===r.credentials.length?!1:(await this.writePayload({version:1,credentials:a}),!0)})}async readPayload(){const e=await this.readFile();if(e===void 0)return{version:1,credentials:[]};const t=await this.deriveKey(e.salt);try{const r=o.createDecipheriv("aes-256-gcm",t,Buffer.from(e.iv,"base64"));r.setAuthTag(Buffer.from(e.authTag,"base64"));const a=Buffer.concat([r.update(Buffer.from(e.ciphertext,"base64")),r.final()]).toString("utf8"),i=JSON.parse(a);if(!T(i))throw new Error("Invalid credential payload.");return i}catch(r){throw new s(l.AUTH_CREDENTIAL_STORE_UNAVAILABLE,"Credential file cannot be decrypted.",{category:"auth",userMessage:"Unable to decrypt the credential store. Check LOTAGATE_CREDENTIAL_SECRET.",cause:r})}}async writePayload(e){const t=o.randomBytes(16),r=o.randomBytes(12),a=await this.deriveKey(t.toString("base64")),i=o.createCipheriv("aes-256-gcm",a,r),u=Buffer.concat([i.update(JSON.stringify(e),"utf8"),i.final()]),p={version:1,salt:t.toString("base64"),iv:r.toString("base64"),authTag:i.getAuthTag().toString("base64"),ciphertext:u.toString("base64")};await n.mkdir(this.paths.globalConfigDir,{recursive:!0});const h=g.join(this.paths.globalConfigDir,`.credentials.${process.pid}.${o.randomUUID()}.tmp`);try{await n.writeFile(h,`${JSON.stringify(p,null,2)}
+`,{encoding:"utf8",mode:384}),await n.rename(h,this.paths.credentialsFile)}finally{await n.rm(h,{force:!0})}}async readFile(){try{return A(await n.readFile(this.paths.credentialsFile,"utf8"))}catch(e){if(y(e))return;throw e instanceof s?e:new s(l.AUTH_CREDENTIAL_STORE_UNAVAILABLE,"Credential file cannot be read.",{category:"auth",userMessage:"Unable to read the credential store.",cause:e})}}async deriveKey(e){return o.scryptSync(await this.resolveSecret(),e,32)}async resolveSecret(){if(this.secret!==void 0&&this.secret.length>=16)return this.secret;await n.mkdir(this.paths.globalConfigDir,{recursive:!0});try{const t=(await n.readFile(this.paths.credentialKeyFile,"utf8")).trim();if(t.length>=16)return t;throw new Error("Credential key file is invalid.")}catch(t){if(!y(t))throw new s(l.AUTH_CREDENTIAL_STORE_UNAVAILABLE,"Credential key cannot be read.",{category:"auth",userMessage:"Unable to read the local credential key.",cause:t})}const e=o.randomBytes(32).toString("base64url");try{return await n.writeFile(this.paths.credentialKeyFile,`${e}
+`,{encoding:"utf8",mode:384,flag:"wx"}),e}catch(t){if(!m(t))throw new s(l.AUTH_CREDENTIAL_STORE_UNAVAILABLE,"Credential key cannot be created.",{category:"auth",userMessage:"Unable to initialize secure local credential storage.",cause:t});try{const r=(await n.readFile(this.paths.credentialKeyFile,"utf8")).trim();if(r.length>=16)return r}catch(r){throw new s(l.AUTH_CREDENTIAL_STORE_UNAVAILABLE,"Credential key cannot be read after initialization.",{category:"auth",userMessage:"Unable to initialize secure local credential storage.",cause:r})}throw new s(l.AUTH_CREDENTIAL_STORE_UNAVAILABLE,"Credential key file is invalid.",{category:"auth",userMessage:"Unable to initialize secure local credential storage."})}}}function A(c){try{const e=JSON.parse(c);if(typeof e!="object"||e===null)throw new Error("Expected object.");const t=e;if(t.version!==1||typeof t.salt!="string"||typeof t.iv!="string"||typeof t.authTag!="string"||typeof t.ciphertext!="string")throw new Error("Invalid encrypted credential file.");return{version:1,salt:t.salt,iv:t.iv,authTag:t.authTag,ciphertext:t.ciphertext}}catch(e){throw e instanceof s?e:new s(l.AUTH_CREDENTIAL_STORE_UNAVAILABLE,"Credential file is invalid.",{category:"auth",userMessage:"Credential store is corrupted or has an invalid format.",cause:e})}}function T(c){if(typeof c!="object"||c===null)return!1;const e=c;return e.version===1&&Array.isArray(e.credentials)}export{R as EncryptedFileCredentialStore};

package/dist/infrastructure/credentials/environment-credential-store.d.ts

@@ -0,0 +1,11 @@
+import { type AuthProfile, type StoredCredential } from '../../domain/auth/auth-profile.js';
+import type { CredentialStore } from '../../ports/credential-store.js';
+export declare class EnvironmentCredentialStore implements CredentialStore {
+    private readonly env;
+    constructor(env?: Readonly<Record<string, string | undefined>>);
+    list(): Promise<readonly AuthProfile[]>;
+    get(profileName: string): Promise<StoredCredential | undefined>;
+    set(): Promise<void>;
+    delete(): Promise<boolean>;
+    private read;
+}

package/dist/infrastructure/credentials/environment-credential-store.js

@@ -0,0 +1 @@
+import{DEFAULT_CONFIG as a}from"../../domain/config/config-schema.js";import{validateApiKey as i,validateBaseUrl as s,validateProfileName as r}from"../../domain/auth/auth-profile.js";class c{env;constructor(e=process.env){this.env=e}async list(){const e=this.read();return e===void 0?[]:[e.profile]}async get(e){const n=this.read();return n?.profile.name===r(e)?n:void 0}async set(){throw new Error("Environment credentials are read-only.")}async delete(){return!1}read(){const e=this.env.LOTAGATE_API_KEY;if(e===void 0||e.trim().length===0)return;const n=r(this.env.LOTAGATE_PROFILE??"default"),t=new Date().toISOString();return{apiKey:i(e),profile:{name:n,baseUrl:s(this.env.LOTAGATE_BASE_URL??a.baseUrl),credentialRef:"env:LOTAGATE_API_KEY",createdAt:t,updatedAt:t}}}}export{c as EnvironmentCredentialStore};

package/dist/infrastructure/credentials/secret-input.d.ts

@@ -0,0 +1,7 @@
+import type { Readable, Writable } from 'node:stream';
+interface RawInput extends Readable {
+    isTTY?: boolean;
+    setRawMode?: (mode: boolean) => void;
+}
+export declare function readSecret(prompt: string, input?: RawInput, output?: Writable): Promise<string>;
+export {};

package/dist/infrastructure/credentials/secret-input.js

@@ -0,0 +1,3 @@
+async function l(o,e=process.stdin,r=process.stderr){if(e.isTTY!==!0||e.setRawMode===void 0)return w(e);const s=e.setRawMode;return new Promise((c,u)=>{let n="";const f=i=>{const d=i.toString("utf8");for(const t of d){if(t===""){a(),u(new Error("Input interrupted."));return}if(t==="\r"||t===`
+`){a(),r.write(`
+`),c(n);return}if(t==="\b"||t==="\x7F"){n=n.slice(0,-1);continue}n+=t}},a=()=>{s(!1),e.pause(),e.off("data",f)};r.write(o),s(!0),e.resume(),e.on("data",f)})}async function w(o){const e=[];for await(const r of o)e.push(Buffer.isBuffer(r)?r:Buffer.from(String(r)));return Buffer.concat(e).toString("utf8").trim()}export{l as readSecret};

package/dist/infrastructure/extensions/composite-mcp-config-store.d.ts

@@ -0,0 +1,9 @@
+import type { CliMcpConfig } from '../../domain/extensions/mcp-config.js';
+export interface McpConfigReader {
+    list(): Promise<CliMcpConfig>;
+}
+export declare class CompositeMcpConfigStore implements McpConfigReader {
+    private readonly stores;
+    constructor(stores: readonly McpConfigReader[]);
+    list(): Promise<CliMcpConfig>;
+}

package/dist/infrastructure/extensions/composite-mcp-config-store.js

@@ -0,0 +1 @@
+import{mergeMcpConfigsWithOverride as t}from"../../domain/extensions/mcp-config.js";class e{stores;constructor(s){this.stores=s}async list(){return t(...await Promise.all(this.stores.map(s=>s.list())))}}export{e as CompositeMcpConfigStore};

package/dist/infrastructure/extensions/extension-directory-reader.d.ts

@@ -0,0 +1,2 @@
+/** Lists direct extension directories while keeping missing optional roots harmless. */
+export declare function listExtensionDirectories(root: string): Promise<readonly string[]>;

package/dist/infrastructure/extensions/extension-directory-reader.js

@@ -0,0 +1 @@
+import e from"node:fs/promises";import o from"node:path";import{isFileNotFound as n}from"../filesystem/fs-errors.js";async function c(i){try{return(await e.readdir(i,{withFileTypes:!0})).filter(t=>t.isDirectory()).map(t=>o.join(i,t.name))}catch(r){if(n(r))return[];throw r}}export{c as listExtensionDirectories};

package/dist/infrastructure/extensions/extension-integrity.d.ts

@@ -0,0 +1,7 @@
+export interface ExtensionIntegrityOptions {
+    sha256?: string;
+    signature?: string;
+    publicKeyPem?: string;
+}
+/** Verifies the caller's authenticity constraints before installing any extension. */
+export declare function verifyExtensionIntegrity(integrity: string, options: ExtensionIntegrityOptions, invalid: (message: string) => Error): void;

package/dist/infrastructure/extensions/extension-integrity.js

@@ -0,0 +1 @@
+import f from"node:crypto";function n(u,e,r){if(e.sha256!==void 0&&e.sha256.trim().toLowerCase().replace(/^sha256[:-]/u,"")!==u)throw r("Extension checksum does not match --sha256.");if(!(e.signature===void 0&&e.publicKeyPem===void 0)){if(e.signature===void 0||e.publicKeyPem===void 0)throw r("Signature verification requires both --signature and --public-key.");if(!f.verify(null,Buffer.from(u,"utf8"),e.publicKeyPem,Buffer.from(e.signature,"base64")))throw r("Extension signature verification failed.")}}export{n as verifyExtensionIntegrity};

package/dist/infrastructure/extensions/extension-source-resolver.d.ts

@@ -0,0 +1,6 @@
+import { type HostPlatformContext } from '../platform/host-platform.js';
+export interface ResolvedExtensionSource {
+    directory: string;
+    cleanup(): Promise<void>;
+}
+export declare function resolveExtensionSource(source: string, platform?: HostPlatformContext, signal?: AbortSignal): Promise<ResolvedExtensionSource>;

package/dist/infrastructure/extensions/extension-source-resolver.js

@@ -0,0 +1 @@
+import n from"node:fs/promises";import p from"node:os";import a from"node:path";import{fileURLToPath as w}from"node:url";import{CliError as l}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as g}from"../../domain/errors/error-codes.js";import{isFileNotFound as f}from"../filesystem/fs-errors.js";import{detectHostPlatform as S}from"../platform/host-platform.js";import{execPlatformCommand as d}from"../platform/host-process.js";import{RESOURCE_LIMITS as m}from"../../domain/runtime/resource-limits.js";async function G(t,r=S(),o){const e=await v(t);if(e!==void 0)return{directory:e,cleanup:async()=>{}};if(j(t))return x(t,r,o);if(z(t))return k(t,r,o);throw c("Source must be a local directory, HTTPS Git repository, or npm package.")}async function v(t){const r=t.startsWith("file://")?w(t):a.resolve(t);try{if(!(await n.stat(r)).isDirectory())throw c("Extension source must be a directory.");return r}catch(o){if(o instanceof l||!f(o))throw o;return}}async function x(t,r,o){const e=await n.mkdtemp(a.join(p.tmpdir(),"lotagate-extension-git-")),i=a.join(e,"source");try{return await d("git",["clone","--depth","1",t,i],r,{maxBufferBytes:m.internalProcessOutputBytes,timeoutMs:m.internalProcessTimeoutMs,...o===void 0?{}:{signal:o}}),await n.rm(a.join(i,".git"),{recursive:!0,force:!0}),{directory:i,cleanup:()=>n.rm(e,{recursive:!0,force:!0})}}catch(s){throw await n.rm(e,{recursive:!0,force:!0}),c(`Unable to clone Git source: ${s instanceof Error?s.message:String(s)}`)}}async function k(t,r,o){const e=await n.mkdtemp(a.join(p.tmpdir(),"lotagate-extension-npm-"));try{await d("npm",["install","--ignore-scripts","--no-package-lock","--no-save","--prefix",e,t],r,{maxBufferBytes:m.internalProcessOutputBytes,timeoutMs:m.internalProcessTimeoutMs,...o===void 0?{}:{signal:o}});const i=await E(a.join(e,"node_modules"));if(i===void 0)throw c("npm package does not contain a LotaGate plugin or skill.");return{directory:i,cleanup:()=>n.rm(e,{recursive:!0,force:!0})}}catch(i){throw await n.rm(e,{recursive:!0,force:!0}),i instanceof l?i:c(`Unable to install npm source: ${i instanceof Error?i.message:String(i)}`)}}async function E(t){let r;try{r=await n.readdir(t,{withFileTypes:!0})}catch(e){if(f(e))return;throw e}const o=[];for(const e of r){if(!e.isDirectory()||e.name.startsWith("."))continue;const i=a.join(t,e.name);if(await h(i)&&o.push(i),e.name.startsWith("@")){let s;try{s=await n.readdir(i,{withFileTypes:!0})}catch{s=[]}for(const y of s.filter(u=>u.isDirectory())){const u=a.join(i,y.name);await h(u)&&o.push(u)}}}if(o.length>1)throw c("npm package contains multiple extension roots.");return o[0]}async function h(t){try{return await n.stat(a.join(t,".lotagate-plugin","plugin.json")),!0}catch(r){if(!f(r))throw r}try{return await n.stat(a.join(t,"SKILL.md")),!0}catch(r){if(!f(r))throw r;return!1}}function j(t){return/^https:\/\//u.test(t)&&(t.endsWith(".git")||/^https:\/\/github\.com\/[^/]+\/[^/]+\/?$/u.test(t))}function z(t){return/^@?[a-z0-9][a-z0-9._/-]*(?:@[a-z0-9][a-z0-9._-]*)?$/iu.test(t)&&!t.includes("/")||/^@[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9._-]*(?:@[a-z0-9][a-z0-9._-]*)?$/iu.test(t)}function c(t){return new l(g.PLUGIN_MANIFEST_INVALID,t,{category:"extension",userMessage:`Unable to resolve extension source: ${t}`})}export{G as resolveExtensionSource};

package/dist/infrastructure/extensions/file-mcp-config-store.d.ts

@@ -0,0 +1,15 @@
+import { type CliMcpConfig, type CliMcpServerConfig } from '../../domain/extensions/mcp-config.js';
+import type { ExtensionScope } from '../../domain/extensions/extension-scope.js';
+export declare class FileMcpConfigStore {
+    private readonly filePath;
+    constructor(location: string, scope?: ExtensionScope);
+    static forScope(cwd: string, globalConfigDir: string, scope: ExtensionScope): FileMcpConfigStore;
+    get path(): string;
+    list(): Promise<CliMcpConfig>;
+    get(name: string): Promise<import("../../domain/extensions/mcp-config.js").CliMcpServerEntry | undefined>;
+    add(name: string, config: CliMcpServerConfig): Promise<void>;
+    remove(name: string): Promise<boolean>;
+    setEnabled(name: string, enabled: boolean): Promise<void>;
+    private readRaw;
+    private write;
+}

package/dist/infrastructure/extensions/file-mcp-config-store.js

@@ -0,0 +1,2 @@
+import a from"node:path";import{validateMcpConfig as c,validateMcpName as n}from"../../domain/extensions/mcp-config.js";import{CliError as h}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as f}from"../../domain/errors/error-codes.js";import{atomicWriteFile as m,withFileLock as s}from"../filesystem/atomic-file-store.js";import{isFileNotFound as u}from"../filesystem/fs-errors.js";import{readJsonFileBounded as d}from"../filesystem/bounded-json-reader.js";import{RESOURCE_LIMITS as w}from"../../domain/runtime/resource-limits.js";class l{filePath;constructor(t,e="project"){this.filePath=e==="user"?a.join(a.resolve(t),"mcp.json"):a.join(a.resolve(t),".lotagate","mcp.json")}static forScope(t,e,r){return new l(r==="user"?e:t,r)}get path(){return this.filePath}async list(){return c(await this.readRaw())}async get(t){return(await this.list())[n(t)]}async add(t,e){const r=n(t);await s(this.filePath,async()=>{const i=await this.list();i[r]={enabled:!0,config:e},await this.write(i)})}async remove(t){const e=n(t);return s(this.filePath,async()=>{const r=await this.list();return r[e]===void 0?!1:(delete r[e],await this.write(r),!0)})}async setEnabled(t,e){const r=n(t);await s(this.filePath,async()=>{const i=await this.list(),o=i[r];if(o===void 0)throw new h(f.MCP_SERVER_NOT_FOUND,`MCP server not found: ${r}`,{category:"mcp",userMessage:`MCP server not found: ${r}.`});i[r]={...o,enabled:e},await this.write(i)})}async readRaw(){try{return await d(this.filePath,w.mcpConfigBytes)}catch(t){if(u(t))return{};throw t}}async write(t){const e=c(t);await m(this.filePath,`${JSON.stringify(e,null,2)}
+`)}}export{l as FileMcpConfigStore};

package/dist/infrastructure/extensions/hook-runtime.d.ts

@@ -0,0 +1,18 @@
+import type { ToolExecutionContext, ToolExecutor, ToolPolicy } from '@lotagate/agent-sdk';
+import { type HookDefinition, type HookEvent } from '../../domain/extensions/hook-manifest.js';
+import { type PluginManifest } from '../../domain/extensions/plugin-manifest.js';
+export interface HookRuntimePolicy {
+    trustedProject: boolean;
+    enabled: boolean;
+    toolPolicy: ToolPolicy;
+}
+export declare class HookRuntime {
+    private readonly executor;
+    private readonly policy;
+    constructor(executor: ToolExecutor, policy: HookRuntimePolicy);
+    load(plugin: PluginManifest): Promise<readonly HookDefinition[]>;
+    loadProject(cwd: string): Promise<readonly HookDefinition[]>;
+    run(hook: HookDefinition, context: ToolExecutionContext): Promise<boolean>;
+    runEvent(hooks: readonly HookDefinition[], event: HookEvent, context: ToolExecutionContext): Promise<number>;
+}
+export declare function discoverHooks(root: string): Promise<readonly HookDefinition[]>;

package/dist/infrastructure/extensions/hook-runtime.js

@@ -0,0 +1 @@
+import l from"node:fs/promises";import i from"node:path";import{ToolExecutionError as m}from"@lotagate/agent-sdk";import{parseHookDefinition as u}from"../../domain/extensions/hook-manifest.js";import{PLUGIN_LAYOUT as f}from"../../domain/extensions/plugin-manifest.js";import{isFileNotFound as d}from"../filesystem/fs-errors.js";import{readJsonFileBounded as p}from"../filesystem/bounded-json-reader.js";import{RESOURCE_LIMITS as h}from"../../domain/runtime/resource-limits.js";class v{executor;policy;constructor(o,t){this.executor=o,this.policy=t}async load(o){const t=i.resolve(o.directory,f.hooksDirectory);return(await c(t)).map(e=>({...e,id:`${o.name}:${e.id}`,scope:"plugin",pluginName:o.name,sourceName:e.id}))}async loadProject(o){return(await c(i.join(i.resolve(o),".lotagate","hooks"))).map(t=>({...t,scope:"project",sourceName:t.id}))}async run(o,t){if(!this.policy.enabled||!this.policy.trustedProject)return!1;const e={command:o.command,args:[...o.args],cwd:".",timeoutMs:o.timeoutMs},r=this.executor.getToolInfo?.("shell.exec");try{await this.policy.toolPolicy.assertAllowed({toolName:"shell.exec",input:e,context:t,...r===void 0?{}:{toolInfo:r}})}catch(a){if(a instanceof m)return!1;throw a}if((await this.executor.execute("shell.exec",e,t)).isError)throw new Error(`Hook failed: ${o.id}`);return!0}async runEvent(o,t,e){let r=0;for(const n of o)n.event===t&&await this.run(n,e)&&(r+=1);return r}}async function c(s){let o;try{o=(await l.readdir(s,{withFileTypes:!0})).filter(e=>e.isFile()&&e.name.endsWith(".json")).map(e=>i.join(s,e.name))}catch(e){if(d(e))return[];throw e}const t=[];for(const e of o.sort())t.push(u(await p(e,h.configFileBytes),s,i.basename(e,".json")));return t}export{v as HookRuntime,c as discoverHooks};

package/dist/infrastructure/extensions/mcp-runtime.d.ts

@@ -0,0 +1,51 @@
+import { McpToolExecutor, type McpConnectionSummary, type McpServerConfigMap } from '@lotagate/agent-sdk';
+import type { CliMcpConfig } from '../../domain/extensions/mcp-config.js';
+import type { McpConfigReader } from './composite-mcp-config-store.js';
+import type { Logger } from '../../ports/logger.js';
+export interface McpRuntimePolicy {
+    readonly connectTimeoutMs: number;
+    readonly disconnectTimeoutMs?: number;
+    readonly idleTtlMs: number;
+    readonly startupConcurrency?: number;
+    readonly probeTimeoutMs?: number;
+    readonly probeMaxRetries?: number;
+    readonly reconnectMaxAttempts?: number;
+    readonly healthCheckIntervalMs?: number;
+    readonly healthCheckTimeoutMs?: number;
+}
+export type McpRuntimeEvent = {
+    type: 'mcp.server.status';
+    summary: McpConnectionSummary & {
+        latencyMs?: number;
+    };
+} | {
+    type: 'mcp.tool.catalog.updated';
+    serverId: string;
+    toolCount: number;
+    error?: Error;
+};
+export type McpRuntimeEventListener = (event: McpRuntimeEvent) => void | Promise<void>;
+export interface McpRuntimeLease {
+    readonly executor: McpToolExecutor;
+    release(): void;
+}
+export declare function resolveMcpRuntimePolicy(env?: Readonly<Record<string, string | undefined>>): McpRuntimePolicy;
+export declare class McpRuntime {
+    private readonly storeFactory;
+    private readonly policy;
+    private readonly logger?;
+    private readonly now;
+    private readonly environment;
+    private readonly runtimes;
+    constructor(storeFactory?: (cwd: string) => McpConfigReader, policy?: McpRuntimePolicy, logger?: Logger | undefined, now?: () => number, environment?: Readonly<Record<string, string | undefined>>);
+    ensure(cwd: string, config: CliMcpConfig, trusted: boolean, options?: {
+        onEvent?: McpRuntimeEventListener;
+        reconnect?: boolean;
+    }): Promise<McpRuntimeLease>;
+    connectConfigured(cwd: string, trusted: boolean): Promise<readonly McpConnectionSummary[]>;
+    invalidate(cwd: string): Promise<void>;
+    close(): Promise<void>;
+    private scheduleIdleInvalidation;
+    private connectAndDiscover;
+}
+export declare function toAgentMcpConfig(config: CliMcpConfig, environment?: Readonly<Record<string, string | undefined>>): McpServerConfigMap;

package/dist/infrastructure/extensions/mcp-runtime.js

@@ -0,0 +1 @@
+import D from"node:crypto";import M from"node:path";import{AgentSdkError as S,AgentSdkErrorCode as j,DEFAULT_MCP_STARTUP_CONCURRENCY as C,mapWithMcpConcurrency as k,McpClientManager as G,McpToolExecutor as F}from"@lotagate/agent-sdk";import{CliError as P}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as v}from"../../domain/errors/error-codes.js";import{FileMcpConfigStore as $}from"./file-mcp-config-store.js";import{readBoundedEnvironmentInteger as f}from"../config/environment-values.js";import{redactLogText as O}from"../logging/log-redactor.js";const H=3e4,g=5e3;function J(t=process.env){return{connectTimeoutMs:f(t.LOTAGATE_MCP_CONNECT_TIMEOUT_MS,H,500,12e4),disconnectTimeoutMs:f(t.LOTAGATE_MCP_DISCONNECT_TIMEOUT_MS,g,500,12e4),idleTtlMs:f(t.LOTAGATE_MCP_RUNTIME_TTL_SECONDS,300,1,86400)*1e3,startupConcurrency:f(t.LOTAGATE_MCP_STARTUP_CONCURRENCY,C,1,32),probeTimeoutMs:f(t.LOTAGATE_MCP_PROBE_TIMEOUT_MS,5e3,500,12e4),probeMaxRetries:f(t.LOTAGATE_MCP_PROBE_MAX_RETRIES,1,0,5),reconnectMaxAttempts:f(t.LOTAGATE_MCP_RECONNECT_MAX_ATTEMPTS,3,0,10),healthCheckIntervalMs:f(t.LOTAGATE_MCP_HEALTH_CHECK_INTERVAL_SECONDS,30,5,3600)*1e3,healthCheckTimeoutMs:f(t.LOTAGATE_MCP_HEALTH_CHECK_TIMEOUT_MS,5e3,500,12e4)}}class ne{storeFactory;policy;logger;now;environment;runtimes=new Map;constructor(e=a=>new $(a),n=J(),i,o=Date.now,s=process.env){this.storeFactory=e,this.policy=n,this.logger=i,this.now=o,this.environment=s}async ensure(e,n,i,o={}){if(!i)throw new P(v.PROJECT_TRUST_REQUIRED,"MCP connections require project trust.",{category:"project",userMessage:"Trust the project before connecting to MCP servers."});const s=M.resolve(e),a=V(n),r=this.runtimes.get(s);if(r?.failed&&r.fingerprint===a&&r.leases>0)return T(r),r.lastUsedAt=this.now(),r.leases+=1,_(r,o.onEvent),await r.ready,E(r,this.now,o.onEvent,()=>this.scheduleIdleInvalidation(s,r));if(r!==void 0&&!r.failed&&r.fingerprint===a&&(r.leases>0||this.now()-r.lastUsedAt<=this.policy.idleTtlMs)){T(r);const h=r.leases===0;r.lastUsedAt=this.now(),r.leases+=1,_(r,o.onEvent),await r.ready;const w=E(r,this.now,o.onEvent,()=>this.scheduleIdleInvalidation(s,r));return h&&!r.failed&&B(r.manager)?(w.release(),await this.invalidate(s),this.ensure(s,n,i,o)):w}r!==void 0&&await this.invalidate(s);const c=new Set;_(c,o.onEvent);const u=b(I(n,this.environment),this.policy,c,o.reconnect??!0),l={cwd:s,fingerprint:a,manager:u.manager,executor:u.executor,ready:this.connectAndDiscover(s,u.manager,u.executor,c),listeners:c,failed:!1,lastUsedAt:this.now(),leases:1,idleTimer:void 0};this.runtimes.set(s,l);const d=await l.ready;return l.failed=d.some(h=>h.status==="failed"),E(l,this.now,o.onEvent,()=>this.scheduleIdleInvalidation(s,l))}async connectConfigured(e,n){if(!n)throw new P(v.PROJECT_TRUST_REQUIRED,"MCP connections require project trust.",{category:"project",userMessage:"Trust the project before connecting to MCP servers."});const i=await this.storeFactory(e).list(),o=b(I(i,this.environment),this.policy,new Set);try{return await this.connectAndDiscover(M.resolve(e),o.manager,o.executor,new Set)}finally{await y(o.manager,this.policy.disconnectTimeoutMs??g,this.logger,M.resolve(e))}}async invalidate(e){const n=M.resolve(e),i=this.runtimes.get(n);i!==void 0&&(this.runtimes.delete(n),T(i),i.listeners.clear(),await y(i.manager,this.policy.disconnectTimeoutMs??g,this.logger,n),this.logger?.info("MCP runtime invalidated.",{cwd:n}))}async close(){const e=[...this.runtimes.values()];this.runtimes.clear();for(const n of e)T(n);await Promise.allSettled(e.map(n=>y(n.manager,this.policy.disconnectTimeoutMs??g,this.logger,n.cwd)))}scheduleIdleInvalidation(e,n){T(n),n.idleTimer=setTimeout(()=>{if(n.idleTimer=void 0,!(this.runtimes.get(e)!==n||n.leases>0)){if(this.now()-n.lastUsedAt<this.policy.idleTtlMs){this.scheduleIdleInvalidation(e,n);return}this.invalidate(e)}},this.policy.idleTtlMs),n.idleTimer.unref?.()}async connectAndDiscover(e,n,i,o){const s=performance.now();this.logger?.debug("MCP runtime startup started.",{cwd:e,serverCount:n.configuredServerIds.length,startupConcurrency:this.policy.startupConcurrency??C});const a=await k(n.configuredServerIds,async r=>{const c=performance.now();try{p(o,{type:"mcp.server.status",summary:{serverId:r,status:"connecting"}});const u=await R(n.connect(r),this.policy.connectTimeoutMs,()=>n.disconnect(r),"connection");if(p(o,{type:"mcp.server.status",summary:{...u,latencyMs:m(c)}}),this.logger?.debug("MCP server connected.",{cwd:e,serverId:r,durationMs:m(c),protocolEra:u.protocolEra,protocolVersion:u.protocolVersion}),u.status!=="connected")return u;try{const l=performance.now(),d=await R(n.listTools(r),this.policy.connectTimeoutMs,()=>n.disconnect(r),"tool discovery");i.replaceServerTools(r,d.tools),p(o,{type:"mcp.tool.catalog.updated",serverId:r,toolCount:d.tools.length}),this.logger?.debug("MCP tools discovered.",{cwd:e,serverId:r,toolCount:d.tools.length,durationMs:m(l),totalDurationMs:m(c)})}catch(l){const d=U(l,r);return p(o,{type:"mcp.server.status",summary:{...u,status:"failed",error:d,latencyMs:m(c)}}),p(o,{type:"mcp.tool.catalog.updated",serverId:r,toolCount:0,error:d}),this.logger?.warn("MCP tool discovery failed.",{cwd:e,serverId:r,durationMs:m(c),reason:d.message,...x(l)}),{...u,status:"failed",error:d}}return u}catch(u){const l=U(u,r);return p(o,{type:"mcp.server.status",summary:{serverId:r,status:"failed",error:l,latencyMs:m(c)}}),this.logger?.warn("MCP server connection failed.",{cwd:e,serverId:r,durationMs:m(c),reason:l.message,...x(u)}),{serverId:r,status:"failed",error:l}}},this.policy.startupConcurrency??C);return this.logger?.info("MCP runtime startup completed.",{cwd:e,serverCount:a.length,connectedCount:a.filter(r=>r.status==="connected").length,failedCount:a.filter(r=>r.status==="failed").length,durationMs:m(s)}),a}}function b(t,e,n,i=!0){let o;const s=new G(t,{protocol:{mode:"auto",...e.probeTimeoutMs===void 0?{}:{probeTimeoutMs:e.probeTimeoutMs},...e.probeMaxRetries===void 0?{}:{probeMaxRetries:e.probeMaxRetries}},reconnect:{enabled:i,...e.reconnectMaxAttempts===void 0?{}:{maxAttempts:e.reconnectMaxAttempts},...e.healthCheckIntervalMs===void 0?{}:{healthCheckIntervalMs:e.healthCheckIntervalMs},...e.healthCheckTimeoutMs===void 0?{}:{healthCheckTimeoutMs:e.healthCheckTimeoutMs}},onToolsChanged:a=>{o!==void 0&&(a.tools===null||a.error!==null?o.removeServerTools(a.serverId):o.replaceServerTools(a.serverId,a.tools),p(n,{type:"mcp.tool.catalog.updated",serverId:a.serverId,toolCount:a.tools?.length??0,...a.error===null?{}:{error:a.error}}))},onServerChanged:a=>{a.type==="removed"&&o?.removeServerTools(a.serverId)}});return o=new F(s),{manager:s,executor:o}}async function y(t,e,n,i){let o,s=!1;const a=t.disconnectAll(),r=new Promise(c=>{o=setTimeout(()=>{s=!0,c()},e)});try{await Promise.race([a,r])}finally{o!==void 0&&clearTimeout(o),a.catch(c=>{s||n?.warn("MCP runtime disconnect failed.",{cwd:i,reason:c instanceof Error?c.message:String(c)})})}s&&n?.warn("MCP runtime disconnect timed out.",{cwd:i,timeoutMs:e})}function E(t,e,n,i){let o=!1;return{executor:t.executor,release:()=>{o||(o=!0,t.leases=Math.max(0,t.leases-1),t.lastUsedAt=e(),z(t,n),t.leases===0&&i?.())}}}function T(t){t.idleTimer!==void 0&&clearTimeout(t.idleTimer),t.idleTimer=void 0}function _(t,e){if(e!==void 0){if(t instanceof Set){t.add(e);return}t.listeners.add(e)}}function z(t,e){e!==void 0&&t.listeners.delete(e)}function p(t,e){for(const n of t)Promise.resolve(n(e)).catch(()=>{})}function B(t){const e=t.connectionSummaries;return e.length>0&&e.some(n=>n.status!=="connected")}function V(t){return D.createHash("sha256").update(A(t)).digest("hex")}function A(t){return Array.isArray(t)?`[${t.map(A).join(",")}]`:typeof t!="object"||t===null?JSON.stringify(t):`{${Object.keys(t).sort().map(e=>`${JSON.stringify(e)}:${A(t[e])}`).join(",")}}`}async function R(t,e,n,i){let o,s=!1;const a=new Promise((r,c)=>{o=setTimeout(()=>{s||(s=!0,c(new Error(`MCP ${i} timed out after ${e}ms.`)),Promise.resolve(n()).catch(()=>{}))},e)});try{return await Promise.race([t.then(c=>(s=!0,c)),a])}finally{o!==void 0&&clearTimeout(o),t.catch(()=>{})}}function m(t){return Math.max(0,Math.round(performance.now()-t))}function U(t,e){return t instanceof S?t:new S(j.McpConnectionFailed,"MCP server connection failed.",{cause:t,details:{serverId:e}})}function x(t){const e=[],n=[],i=[],o=[];let s=t;for(let a=0;a<4&&s!==void 0&&s!==null;a+=1){if(s instanceof Error){e.push(O(s.message)),n.push(s.name),s=s.cause;continue}if(typeof s!="object")break;const r=s,c=r.message;typeof c=="string"&&e.push(O(c));const u=r.name;typeof u=="string"&&n.push(u);const l=r.code;typeof l=="string"&&i.push(l);for(const d of["status","statusCode","httpStatus"]){const h=r[d];typeof h=="number"&&Number.isInteger(h)&&o.push(h)}s=r.cause}return{...e.length===0?{}:{errorMessages:e},...n.length===0?{}:{errorTypes:n},...i.length===0?{}:{errorCodes:i},...o.length===0?{}:{httpStatuses:o}}}function I(t,e=process.env){const n={};for(const[i,o]of Object.entries(t))o.enabled&&(n[i]=q(o.config,e));return n}function q(t,e){if(t.type==="stdio"){const{env:s,...a}=t;return{...a,...t.args===void 0?{}:{args:[...t.args]},...s===void 0?{}:{env:L(s,e)}}}const{headers:n,auth:i,...o}=t;return{...o,...n===void 0?{}:{headers:L(n,e)},...i?.type==="bearer"?{auth:{type:"bearer",token:N(i.token,e,"MCP bearer token")}}:{}}}function L(t,e){return Object.fromEntries(Object.entries(t).map(([n,i])=>[n,N(i,e,`MCP secret ${n}`)]))}function N(t,e,n){if(typeof t=="string")return t;const i=e[t.name];if(i===void 0||i.length===0)throw new Error(`${n} environment variable is not set.`);return i}export{ne as McpRuntime,J as resolveMcpRuntimePolicy,I as toAgentMcpConfig};

package/dist/infrastructure/extensions/plugin-agent-discovery.d.ts

@@ -0,0 +1,4 @@
+import { type PluginAgentDefinition } from '../../domain/extensions/plugin-agent-manifest.js';
+export declare class PluginAgentDiscovery {
+    discover(root: string): Promise<readonly PluginAgentDefinition[]>;
+}

package/dist/infrastructure/extensions/plugin-agent-discovery.js

@@ -0,0 +1 @@
+import c from"node:fs/promises";import u from"node:path";import{parsePluginAgentDocument as f}from"../../domain/extensions/plugin-agent-manifest.js";import{CliError as p}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as g}from"../../domain/errors/error-codes.js";import{isFileNotFound as d}from"../filesystem/fs-errors.js";import{readFileBounded as h}from"../filesystem/bounded-file-reader.js";import{RESOURCE_LIMITS as y}from"../../domain/runtime/resource-limits.js";class C{async discover(r){let a;try{a=await c.readdir(r,{withFileTypes:!0})}catch(t){if(d(t))return[];throw t}const s=[];for(const t of a.filter(e=>e.isFile()&&e.name.endsWith(".yaml")).sort((e,n)=>e.name.localeCompare(n.name))){const e=t.name.slice(0,-5);if(!/^[a-z0-9][a-z0-9-]{0,63}$/u.test(e))throw i(`Invalid plugin agent file name: ${t.name}`);const n=u.join(r,t.name);if((await c.lstat(n)).isSymbolicLink())throw i(`Plugin agent must not be a symbolic link: ${t.name}`);const m=await h(n,y.skillDocumentBytes);if(m.truncated)throw i(`Plugin agent exceeds the supported size: ${t.name}`);const l=f(m.bytes.toString("utf8"),r);if(l.name!==e)throw i(`Plugin agent name must match its file name: ${t.name}`);s.push(l)}return s}}function i(o){return new p(g.PLUGIN_MANIFEST_INVALID,o,{category:"extension",userMessage:`Invalid plugin agent: ${o}`})}export{C as PluginAgentDiscovery};

package/dist/infrastructure/extensions/plugin-discovery.d.ts

@@ -0,0 +1,5 @@
+import { type PluginManifest } from '../../domain/extensions/plugin-manifest.js';
+export declare class PluginDiscovery {
+    discover(roots: readonly string[]): Promise<readonly PluginManifest[]>;
+}
+export declare function validatePluginManifest(manifest: PluginManifest): Promise<void>;

package/dist/infrastructure/extensions/plugin-discovery.js

@@ -0,0 +1 @@
+import s from"node:fs/promises";import a from"node:path";import{parsePluginManifest as y,PLUGIN_LAYOUT as o}from"../../domain/extensions/plugin-manifest.js";import{CliError as c}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as l}from"../../domain/errors/error-codes.js";import{isFileNotFound as p}from"../filesystem/fs-errors.js";import{readJsonFileBounded as h}from"../filesystem/bounded-json-reader.js";import{RESOURCE_LIMITS as w}from"../../domain/runtime/resource-limits.js";import{listExtensionDirectories as d}from"./extension-directory-reader.js";class k{async discover(t){const i=[];for(const e of t)for(const r of await d(e)){const f=a.join(r,o.markerDirectory,o.manifestFile);try{const u=y(await h(f,w.pluginManifestBytes),r);await L(u),i.push(u)}catch(u){if(!p(u))throw u;if(await I(r))throw P()}}return i.sort((e,r)=>e.name.localeCompare(r.name))}}async function I(n){try{return await s.stat(a.join(n,".codex-plugin","plugin.json")),!0}catch(t){if(p(t))return!1;throw t}}function P(){return new c(l.PLUGIN_MANIFEST_INVALID,"Only the .lotagate-plugin/plugin.json plugin format is supported.",{category:"extension",userMessage:"This plugin uses an unsupported format. Reinstall it using the LotaGate plugin structure."})}async function L(n){const t=await s.realpath(n.directory);await D(t,o.skillsDirectory),await m(t,o.readmeFile),await m(t,o.licenseFile);for(const i of[o.markerDirectory,o.skillsDirectory,o.agentsDirectory,o.hooksDirectory,o.mcpDirectory]){const e=a.resolve(t,i);if(e!==t&&!e.startsWith(`${t}${a.sep}`))throw g(i);try{if((await s.lstat(e)).isSymbolicLink())throw g(i);const f=await s.realpath(e);if(f!==t&&!f.startsWith(`${t}${a.sep}`))throw g(i)}catch(r){if(r instanceof c)throw r;if(p(r))continue;throw new c(l.PLUGIN_MANIFEST_INVALID,`Plugin path is not contained in the plugin directory: ${i}`,{category:"extension",userMessage:"Plugin contains an unsafe path.",cause:r})}}}async function D(n,t){try{const i=await s.lstat(a.join(n,t));if(!i.isDirectory()||i.isSymbolicLink())throw new Error("invalid-directory")}catch(i){throw new c(l.PLUGIN_MANIFEST_INVALID,`Plugin directory is missing or invalid: ${t}`,{category:"extension",userMessage:`Plugin must contain the ${t}/ directory.`,cause:i})}}async function m(n,t){try{const i=await s.lstat(a.join(n,t));if(!i.isFile()||i.isSymbolicLink())throw new Error("invalid-file")}catch(i){throw new c(l.PLUGIN_MANIFEST_INVALID,`Plugin file is missing or invalid: ${t}`,{category:"extension",userMessage:`Plugin must contain ${t}.`,cause:i})}}function g(n){return new c(l.PLUGIN_MANIFEST_INVALID,`Plugin path is not contained in the plugin directory: ${n}`,{category:"extension",userMessage:"Plugin contains an unsafe path."})}export{k as PluginDiscovery,L as validatePluginManifest};

package/dist/infrastructure/extensions/plugin-manager.d.ts

@@ -0,0 +1,23 @@
+import { type ExtensionIntegrityOptions } from './extension-integrity.js';
+import { type PluginManifest } from '../../domain/extensions/plugin-manifest.js';
+export interface InstalledPlugin {
+    manifest: PluginManifest;
+    enabled: boolean;
+    integrity?: string;
+}
+export type PluginInstallOptions = ExtensionIntegrityOptions;
+export interface PluginListOptions {
+    verifyIntegrity?: boolean;
+}
+export declare class PluginManager {
+    private readonly root;
+    private readonly statePath;
+    constructor(root: string);
+    list(roots?: readonly string[], options?: PluginListOptions): Promise<readonly InstalledPlugin[]>;
+    install(source: string, options?: PluginInstallOptions): Promise<InstalledPlugin>;
+    uninstall(name: string): Promise<boolean>;
+    setEnabled(name: string, enabled: boolean): Promise<void>;
+    private readState;
+    private writeState;
+}
+export declare function hashDirectory(directory: string): Promise<string>;

package/dist/infrastructure/extensions/plugin-manager.js

@@ -0,0 +1,2 @@
+import g from"node:crypto";import{verifyExtensionIntegrity as M}from"./extension-integrity.js";import c from"node:fs/promises";import o from"node:path";import{parsePluginManifest as b,PLUGIN_LAYOUT as d}from"../../domain/extensions/plugin-manifest.js";import{CliError as P}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as j}from"../../domain/errors/error-codes.js";import{PluginDiscovery as x,validatePluginManifest as I}from"./plugin-discovery.js";import{atomicWriteFile as D,replaceDirectoryWithRollback as N,withFileLock as y}from"../filesystem/atomic-file-store.js";import{isFileNotFound as S}from"../filesystem/fs-errors.js";import{readJsonFileBounded as E}from"../filesystem/bounded-json-reader.js";import{RESOURCE_LIMITS as _}from"../../domain/runtime/resource-limits.js";import{parseExtensionState as U}from"../../domain/extensions/extension-state.js";class K{root;statePath;constructor(t){this.root=t,this.statePath=o.join(t,"state.json")}async list(t=[this.root],a={}){const i=await this.readState(),e=await new x().discover(t),r=[];for(const s of e){const f=a.verifyIntegrity===!1?void 0:await p(s.directory);r.push({manifest:s,enabled:i[s.name]?.enabled!==!1,...f===void 0?{}:{integrity:f}})}return r}async install(t,a={}){const i=o.resolve(t),e=o.join(i,d.markerDirectory,d.manifestFile);let r;try{r=await E(e,_.pluginManifestBytes)}catch(h){if(S(h)){const F=o.join(i,".codex-plugin","plugin.json");try{throw await c.stat(F),l("Only the .lotagate-plugin/plugin.json format is supported.")}catch(w){if(w instanceof P)throw w}}throw l("Plugin source must contain .lotagate-plugin/plugin.json.")}const s=b(r,i);await I(s);const f=await p(i);M(f,a,l),await c.mkdir(this.root,{recursive:!0});const m=o.join(this.root,L(s.name)),u=`${m}.tmp-${g.randomUUID()}`;return y(`${m}.install`,async()=>{try{await c.cp(i,u,{recursive:!0,force:!1,errorOnExist:!0}),await I({...s,directory:u});const h=await p(u);if(h!==f)throw l("Plugin changed while it was being installed.");return await N(u,m),await this.setEnabled(s.name,!0),{manifest:{...s,directory:m},enabled:!0,integrity:h}}finally{await c.rm(u,{recursive:!0,force:!0})}})}async uninstall(t){const a=o.join(this.root,L(t));return y(`${a}.install`,async()=>{const i=(await this.list([this.root],{verifyIntegrity:!1})).find(e=>e.manifest.name===t);return i===void 0?!1:(await c.rm(i.manifest.directory,{recursive:!0,force:!0}),await y(this.statePath,async()=>{const e=await this.readState();delete e[t],await this.writeState(e)}),!0)})}async setEnabled(t,a){await y(this.statePath,async()=>{const i=await this.readState();i[t]={enabled:a},await this.writeState(i)})}async readState(){try{return U(await E(this.statePath,_.workspaceSettingsBytes))}catch(t){if(S(t))return{};throw t}}async writeState(t){await D(this.statePath,`${JSON.stringify(t,null,2)}
+`)}}async function p(n){const t=g.createHash("sha256");let a=0;for(const i of await v(n)){const e=o.relative(n,i).split(o.sep).join("/"),r=await c.stat(i);if(r.size>k)throw l("Plugin file exceeds the integrity scan limit.");if(a+=r.size,a>A)throw l("Plugin exceeds the total integrity scan limit.");t.update(e),t.update("\0"),t.update(await c.readFile(i)),t.update("\0")}return t.digest("hex")}const T=5e3,k=10*1024*1024,A=50*1024*1024,O=32;async function v(n,t=0,a={files:0}){if(t>O)throw l("Plugin directory nesting exceeds the integrity scan limit.");const i=[];for(const e of(await c.readdir(n,{withFileTypes:!0})).sort((r,s)=>r.name.localeCompare(s.name))){const r=o.join(n,e.name);if(e.isSymbolicLink())throw l("Plugin packages must not contain symbolic links.");if(e.isDirectory())i.push(...await v(r,t+1,a));else if(e.isFile()&&(i.push(r),a.files+=1,a.files>T))throw l("Plugin contains too many files for the integrity scan.")}return i}function L(n){return`plugin-${Buffer.from(n,"utf8").toString("base64url")}`}function l(n){return new P(j.PLUGIN_MANIFEST_INVALID,n,{category:"extension",userMessage:`Unable to install plugin: ${n}`})}export{K as PluginManager,p as hashDirectory};

package/dist/infrastructure/extensions/skill-discovery.d.ts

@@ -0,0 +1,4 @@
+import { type SkillManifest } from '../../domain/extensions/skill-manifest.js';
+export declare class SkillDiscovery {
+    discover(roots: readonly string[]): Promise<readonly SkillManifest[]>;
+}

package/dist/infrastructure/extensions/skill-discovery.js

@@ -0,0 +1 @@
+import m from"node:path";import{parseSkillDocument as c}from"../../domain/extensions/skill-manifest.js";import{CliError as a}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as f}from"../../domain/errors/error-codes.js";import{isFileNotFound as p}from"../filesystem/fs-errors.js";import{readFileBounded as u}from"../filesystem/bounded-file-reader.js";import{RESOURCE_LIMITS as d}from"../../domain/runtime/resource-limits.js";import{listExtensionDirectories as S}from"./extension-directory-reader.js";class _{async discover(s){const i=new Map;for(const e of s)for(const t of await S(e)){const l=m.join(t,"SKILL.md");try{const o=await u(l,d.skillDocumentBytes);if(o.truncated)continue;const n=c(o.bytes.toString("utf8"),t);i.has(n.name)||i.set(n.name,n)}catch(o){if(!p(o)&&!I(o))throw o}}return[...i.values()].sort((e,t)=>e.name.localeCompare(t.name))}}function I(r){return r instanceof a&&r.code===f.SKILL_FRONTMATTER_INVALID}export{_ as SkillDiscovery};

package/dist/infrastructure/extensions/skill-installer.d.ts

@@ -0,0 +1,9 @@
+import { type ExtensionIntegrityOptions } from './extension-integrity.js';
+import { type SkillManifest } from '../../domain/extensions/skill-manifest.js';
+export interface InstalledSkill {
+    manifest: SkillManifest;
+    integrity: string;
+}
+export declare class SkillInstaller {
+    install(source: string, root: string, options?: ExtensionIntegrityOptions): Promise<InstalledSkill | undefined>;
+}

package/dist/infrastructure/extensions/skill-installer.js

@@ -0,0 +1 @@
+import n from"node:fs/promises";import{verifyExtensionIntegrity as w}from"./extension-integrity.js";import h from"node:crypto";import o from"node:path";import{parseSkillDocument as S}from"../../domain/extensions/skill-manifest.js";import{CliError as k}from"../../domain/errors/cli-error.js";import{CLI_ERROR_CODES as I}from"../../domain/errors/error-codes.js";import{hashDirectory as p}from"./plugin-manager.js";import{isFileNotFound as c}from"../filesystem/fs-errors.js";import{readFileBounded as g}from"../filesystem/bounded-file-reader.js";import{RESOURCE_LIMITS as L}from"../../domain/runtime/resource-limits.js";import{replaceDirectoryWithRollback as D,withFileLock as F}from"../filesystem/atomic-file-store.js";class N{async install(e,a,r={}){if(await E(e))return;const i=await v(o.resolve(e));if(i===void 0)return;const m=await g(o.join(i,"SKILL.md"),L.skillDocumentBytes);if(m.truncated)throw f("Skill document exceeds the supported size.");const u=S(m.bytes.toString("utf8"),i),d=await p(i);w(d,r,f),await n.mkdir(a,{recursive:!0});const s=o.join(a,u.name),l=`${s}.tmp-${h.randomUUID()}`;return F(`${s}.install`,async()=>{try{await n.cp(i,l,{recursive:!0,force:!1,errorOnExist:!0});const y=await p(l);if(y!==d)throw new Error("Skill changed while it was being installed.");return await D(l,s),{manifest:{...u,directory:s},integrity:y}}finally{await n.rm(l,{recursive:!0,force:!0})}})}}async function E(t){try{return(await n.stat(o.join(t,".lotagate-plugin","plugin.json"))).isFile()}catch(e){if(!c(e))throw e;return!1}}async function v(t){try{if((await n.stat(o.join(t,"SKILL.md"))).isFile())return t}catch(r){if(!c(r))throw r}let e;try{e=await n.readdir(t,{withFileTypes:!0})}catch(r){if(c(r))return;throw r}const a=[];for(const r of e.filter(i=>i.isDirectory()))try{(await n.stat(o.join(t,r.name,"SKILL.md"))).isFile()&&a.push(o.join(t,r.name))}catch(i){if(!c(i))throw i}if(a.length>1)throw f("Source contains multiple skills. Pass the individual skill directory.");return a[0]}function f(t){return new k(I.SKILL_FRONTMATTER_INVALID,t,{category:"extension",userMessage:`Unable to install skill: ${t}`})}export{N as SkillInstaller};

package/dist/infrastructure/extensions/skill-manager.d.ts

@@ -0,0 +1,22 @@
+import type { SkillManifest } from '../../domain/extensions/skill-manifest.js';
+import type { SkillRootScope } from './skill-roots.js';
+export type ScopedSkill = SkillManifest & {
+    skillKey: string;
+    enabled: boolean;
+    scope: SkillRootScope['scope'];
+    root: string;
+    statePath: string;
+    pluginName?: string;
+};
+export interface ScopedSkillListOptions {
+    includeShadowed?: boolean;
+}
+export declare class SkillManager {
+    private readonly statePath;
+    constructor(statePath: string);
+    listScoped(scopes: readonly SkillRootScope[], options?: ScopedSkillListOptions): Promise<readonly ScopedSkill[]>;
+    setEnabled(name: string, enabled: boolean, statePath?: string): Promise<void>;
+    remove(name: string, root: string, statePath?: string): Promise<boolean>;
+    private readState;
+    private writeState;
+}

package/dist/infrastructure/extensions/skill-manager.js

@@ -0,0 +1,2 @@
+import p from"node:fs/promises";import{SkillDiscovery as d}from"./skill-discovery.js";import{atomicWriteFile as f,withFileLock as u}from"../filesystem/atomic-file-store.js";import{isFileNotFound as w}from"../filesystem/fs-errors.js";import{readJsonFileBounded as S}from"../filesystem/bounded-json-reader.js";import{RESOURCE_LIMITS as y}from"../../domain/runtime/resource-limits.js";import{parseExtensionState as g}from"../../domain/extensions/extension-state.js";class M{statePath;constructor(e){this.statePath=e}async listScoped(e,s={}){const a=new Map,i=[],n=new Set,c=new Set;for(const t of e){a.has(t.statePath)||a.set(t.statePath,await this.readState(t.statePath));const m=a.get(t.statePath);for(const o of await new d().discover([t.root])){const r=t.scope==="plugin",h=n.has(o.name)||!r&&t.scope==="builtin"&&c.has(o.name);if(s.includeShadowed!==!0&&h)continue;r?c.add(o.name):t.scope!=="builtin"&&n.add(o.name);const l=r?`${t.pluginName??"plugin"}:${o.name}`:o.name;i.push({...o,skillKey:l,enabled:m[l]?.enabled!==!1,scope:t.scope,root:t.root,statePath:t.statePath,...t.pluginName===void 0?{}:{pluginName:t.pluginName}})}}return i}async setEnabled(e,s,a=this.statePath){await u(a,async()=>{const i=await this.readState(a);i[e]={enabled:s},await this.writeState(i,a)})}async remove(e,s,a=this.statePath){const i=(await new d().discover([s])).find(n=>n.name===e||`${n.name}`===e);return i===void 0?!1:(await p.rm(i.directory,{recursive:!0,force:!0}),await u(a,async()=>{const n=await this.readState(a);delete n[e],await this.writeState(n,a)}),!0)}async readState(e=this.statePath){try{return g(await S(e,y.workspaceSettingsBytes))}catch(s){if(w(s))return{};throw s}}async writeState(e,s=this.statePath){await f(s,`${JSON.stringify(e,null,2)}
+`)}}export{M as SkillManager};

package/dist/infrastructure/extensions/skill-roots.d.ts

@@ -0,0 +1,19 @@
+import type { ExtensionScope } from '../../domain/extensions/extension-scope.js';
+export interface SkillRootScope {
+    scope: ExtensionScope | 'plugin' | 'builtin';
+    root: string;
+    statePath: string;
+    pluginName?: string;
+}
+export interface PluginSkillRoot {
+    root: string;
+    pluginName: string;
+}
+/**
+ * Returns skill roots in precedence order: project, user, enabled plugins,
+ * then immutable package-provided skills. SkillManager keeps project/user
+ * definitions authoritative while qualifying plugin identities so independent
+ * plugins can expose the same raw skill name safely.
+ */
+export declare function resolveSkillRootScopes(cwd: string, globalConfigDir: string, pluginSkillRoots?: readonly PluginSkillRoot[]): readonly SkillRootScope[];
+export declare function builtinSkillsDirectory(executablePath?: string): string;

package/dist/infrastructure/extensions/skill-roots.js

@@ -0,0 +1 @@
+import t from"node:path";import{existsSync as a}from"node:fs";import{fileURLToPath as p}from"node:url";function h(s,o,i=[]){const r=t.join(s,".lotagate","skills"),e=t.join(o,"skills-state.json");return[{scope:"project",root:r,statePath:t.join(s,".lotagate","skills-state.json")},{scope:"user",root:t.join(o,"skills"),statePath:e},...i.map(({root:l,pluginName:n})=>({scope:"plugin",root:l,pluginName:n,statePath:e})),{scope:"builtin",root:c(),statePath:e}]}function c(s=process.execPath){const o=t.resolve(t.dirname(s),"..","skills");return a(o)?o:p(new URL("../../../skills/",import.meta.url))}export{c as builtinSkillsDirectory,h as resolveSkillRootScopes};

package/dist/infrastructure/extensions/skill-tool-executor.d.ts

@@ -0,0 +1,18 @@
+import type { ToolDefinition } from '@lotagate/sdk';
+import type { ToolExecutionContext, ToolExecutor, ToolInfo, ToolResult } from '@lotagate/agent-sdk';
+import type { SkillManifest } from '../../domain/extensions/skill-manifest.js';
+import type { SkillScopeStore } from '../../application/extensions/skill-scope-store.js';
+/** Exposes the same skill capability definitions to runtime and context accounting. */
+export declare function skillToolDefinitions(): readonly ToolDefinition[];
+/** Presents validated, model-invocable skills as lazy agent tools. */
+export declare class SkillToolExecutor implements ToolExecutor {
+    private readonly scopes;
+    private readonly skills;
+    constructor(skills: readonly (SkillManifest & {
+        enabled: boolean;
+        skillKey?: string;
+    })[], scopes: SkillScopeStore);
+    listTools(): readonly ToolDefinition[];
+    getToolInfo(toolName: string): ToolInfo | undefined;
+    execute(toolName: string, input: Record<string, unknown>, context: ToolExecutionContext): Promise<ToolResult>;
+}