@namzu/sdk 14.0.7 → 15.1.0

package/dist/plugin/__tests__/mcp-admission.test.js

@@ -1,227 +0,0 @@
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-/**
- * A plugin's MCP server decided what entered the agent's tool registry.
- *
- * `MCPToolDiscovery` has held the admission boundary — a per-server
- * allow/deny policy, and detection for a server whose tool set changes
- * between discoveries — since it was written, and nothing outside its own
- * tests ever constructed one. `PluginLifecycleManager.attachMCPServer`, the
- * only code in the tree that connects a real MCP server, called
- * `client.listTools()` and registered whatever came back.
- *
- * So least privilege was inverted at the one place it mattered: the remote
- * side chose. Tools land as `deferred` and a run's `allowedTools` filters the
- * model-visible catalogue, so this was not "arbitrary tools reach the model
- * immediately" — but the check written for exactly this was not on the path.
- */
-let advertised = [];
-let advertisedPrompts = [];
-let clientCount = 0;
-vi.mock('../../connector/mcp/client.js', () => ({
-    MCPClient: class {
-        id;
-        serverName;
-        constructor(config) {
-            this.id = `client_${clientCount++}`;
-            this.serverName = config.serverName;
-        }
-        async connect() { }
-        async disconnect() { }
-        isConnected() {
-            return true;
-        }
-        getState() {
-            return { serverName: this.serverName };
-        }
-        async listTools() {
-            return advertised;
-        }
-        async listPrompts() {
-            return advertisedPrompts;
-        }
-    },
-}));
-function tool(name) {
-    return { name, description: name, inputSchema: { type: 'object', properties: {} } };
-}
-const log = {
-    debug: vi.fn(),
-    info: vi.fn(),
-    warn: vi.fn(),
-    error: vi.fn(),
-    child: () => log,
-};
-let root;
-async function harness(config = {}) {
-    const { PluginLifecycleManager } = await import('../lifecycle.js');
-    const { PluginRegistry } = await import('../../registry/plugin/index.js');
-    const registered = [];
-    const toolRegistry = {
-        register: (definition) => registered.push(definition.name),
-        unregister: () => undefined,
-        get: () => undefined,
-    };
-    const manager = new PluginLifecycleManager({
-        pluginRegistry: new PluginRegistry(),
-        toolRegistry,
-        log,
-        ...config,
-    });
-    return {
-        registered,
-        manager,
-        enable: async (name) => {
-            const dir = join(root, name);
-            await mkdir(dir, { recursive: true });
-            await writeFile(join(dir, 'plugin.json'), JSON.stringify({
-                name,
-                version: '1.0.0',
-                description: 'MCP server plugin fixture',
-                mcpServers: [{ name: 'files', command: 'node', args: ['server.js'] }],
-            }), 'utf-8');
-            const plugin = await manager.install(dir, 'project');
-            await manager.enable(plugin.id);
-            return plugin.id;
-        },
-    };
-}
-beforeEach(async () => {
-    root = await mkdtemp(join(tmpdir(), 'namzu-mcp-admit-'));
-    clientCount = 0;
-    advertised = [tool('read_file'), tool('write_file'), tool('delete_everything')];
-    advertisedPrompts = [{ name: 'safe_prompt' }, { name: 'sneaky_prompt' }];
-});
-afterEach(async () => {
-    await rm(root, { recursive: true, force: true });
-    vi.clearAllMocks();
-});
-describe('what a plugin server advertises is not what the registry gets', () => {
-    it('admits only the tools an allowlist names', async () => {
-        const h = await harness({ mcpToolPolicies: { files: { allow: ['read_file', 'write_file'] } } });
-        await h.enable('srv');
-        expect(h.registered.some((n) => n.endsWith('read_file'))).toBe(true);
-        expect(h.registered.some((n) => n.endsWith('write_file'))).toBe(true);
-        // The one the server offered and the host never agreed to.
-        expect(h.registered.some((n) => n.endsWith('delete_everything'))).toBe(false);
-    });
-    it('refuses a denied tool through the wildcard policy', async () => {
-        const h = await harness({ mcpToolPolicies: { '*': { deny: ['delete_everything'] } } });
-        await h.enable('srv');
-        // Counted over TOOLS specifically: prompts register through the same
-        // path and would otherwise make this assertion about both.
-        expect(h.registered.filter((n) => n.includes('mcp__files__'))).toHaveLength(2);
-        expect(h.registered.some((n) => n.endsWith('delete_everything'))).toBe(false);
-    });
-    it('still admits everything when no policy is configured', async () => {
-        // Adding a boundary must not turn every existing host's working plugin
-        // into a broken one.
-        const h = await harness();
-        await h.enable('srv');
-        expect(h.registered.filter((n) => n.includes('mcp__files__'))).toHaveLength(3);
-    });
-    it('namespaces what it admits, exactly as before', async () => {
-        const h = await harness({ mcpToolPolicies: { files: { allow: ['read_file'] } } });
-        await h.enable('srv');
-        expect(h.registered[0]).toContain('mcp__files__read_file');
-    });
-});
-describe('a server that changes its tools between connections is reported', () => {
-    it('says nothing the first time, having nothing to compare against', async () => {
-        const onMCPToolDrift = vi.fn();
-        const h = await harness({ onMCPToolDrift });
-        await h.enable('srv');
-        expect(onMCPToolDrift).not.toHaveBeenCalled();
-    });
-    it('reports a tool the server grew after it was first approved', async () => {
-        const onMCPToolDrift = vi.fn();
-        const h = await harness({ onMCPToolDrift });
-        const first = await h.enable('srv-a');
-        // The rug pull: advertise something benign while a host is deciding,
-        // swap it afterwards. A NEW client connects to the SAME server, which
-        // is why the remembered set is keyed by server name — keyed by client
-        // id, as it was, every connection was its own first and this could
-        // never fire.
-        await h.manager.disable(first);
-        advertised = [...advertised, tool('exfiltrate')];
-        await h.enable('srv-b');
-        expect(onMCPToolDrift).toHaveBeenCalledTimes(1);
-        expect(onMCPToolDrift.mock.calls[0]?.[0]).toMatchObject({
-            serverName: 'files',
-            drift: { added: ['exfiltrate'] },
-        });
-    });
-    it('reports a tool whose shape changed under the same name', async () => {
-        const onMCPToolDrift = vi.fn();
-        const h = await harness({ onMCPToolDrift });
-        const first = await h.enable('srv-a');
-        await h.manager.disable(first);
-        // Same name, different input shape — the version a name-only check
-        // misses entirely.
-        advertised = [
-            {
-                name: 'read_file',
-                description: 'read a file',
-                inputSchema: { type: 'object', properties: { path: { type: 'string' } } },
-            },
-            tool('write_file'),
-            tool('delete_everything'),
-        ];
-        await h.enable('srv-b');
-        expect(onMCPToolDrift).toHaveBeenCalledTimes(1);
-        expect(onMCPToolDrift.mock.calls[0]?.[0]).toMatchObject({ drift: { changed: ['read_file'] } });
-    });
-    it('says nothing when the server offers exactly what it offered before', async () => {
-        const onMCPToolDrift = vi.fn();
-        const h = await harness({ onMCPToolDrift });
-        const first = await h.enable('srv-a');
-        await h.manager.disable(first);
-        await h.enable('srv-b');
-        expect(onMCPToolDrift).not.toHaveBeenCalled();
-    });
-    it('compares what was ADMITTED, not what was advertised', async () => {
-        const onMCPToolDrift = vi.fn();
-        const h = await harness({
-            mcpToolPolicies: { files: { allow: ['read_file'] } },
-            onMCPToolDrift,
-        });
-        const first = await h.enable('srv-a');
-        await h.manager.disable(first);
-        // A tool the policy refuses either way. Reporting drift for it would
-        // train a host to ignore the warning that matters.
-        advertised = [...advertised, tool('another_denied_one')];
-        await h.enable('srv-b');
-        expect(onMCPToolDrift).not.toHaveBeenCalled();
-    });
-});
-describe('a prompt is admitted on the same terms as a tool', () => {
-    it('registers the prompts a server publishes', async () => {
-        const h = await harness();
-        await h.enable('srv');
-        expect(h.registered.some((n) => n.includes('mcp_prompt_files_safe_prompt'))).toBe(true);
-    });
-    it('refuses a prompt the policy does not allow', async () => {
-        const h = await harness({
-            mcpToolPolicies: { files: { allow: ['read_file', 'safe_prompt'] } },
-        });
-        await h.enable('srv');
-        // A server publishing a prompt is the same trust question as one
-        // publishing a tool: the remote side must not decide what enters the
-        // registry. Two copies of an allow/deny check are two chances for one
-        // of them to drift permissive, which is why both go through one.
-        expect(h.registered.some((n) => n.includes('safe_prompt'))).toBe(true);
-        expect(h.registered.some((n) => n.includes('sneaky_prompt'))).toBe(false);
-    });
-    it('names a prompt apart from a tool of the same name', async () => {
-        advertisedPrompts = [{ name: 'read_file' }];
-        const h = await harness();
-        await h.enable('srv');
-        // Both exist. Collapsing them would let whichever registered second
-        // silently replace the first.
-        expect(h.registered.some((n) => n.endsWith('mcp__files__read_file'))).toBe(true);
-        expect(h.registered.some((n) => n.endsWith('mcp_prompt_files_read_file'))).toBe(true);
-    });
-});
-//# sourceMappingURL=mcp-admission.test.js.map

package/dist/plugin/__tests__/mcp-admission.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-admission.test.js","sourceRoot":"","sources":["../../../src/plugin/__tests__/mcp-admission.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAIxE;;;;;;;;;;;;;;GAcG;AAEH,IAAI,UAAU,GAAwB,EAAE,CAAA;AACxC,IAAI,iBAAiB,GAA6C,EAAE,CAAA;AACpE,IAAI,WAAW,GAAG,CAAC,CAAA;AAEnB,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,SAAS,EAAE;QACD,EAAE,CAAQ;QACX,UAAU,CAAQ;QAC1B,YAAY,MAA8B;YACzC,IAAI,CAAC,EAAE,GAAG,UAAU,WAAW,EAAE,EAAE,CAAA;YACnC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,OAAO,KAAmB,CAAC;QACjC,KAAK,CAAC,UAAU,KAAmB,CAAC;QACpC,WAAW;YACV,OAAO,IAAI,CAAA;QACZ,CAAC;QACD,QAAQ;YACP,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;QACvC,CAAC;QACD,KAAK,CAAC,SAAS;YACd,OAAO,UAAU,CAAA;QAClB,CAAC;QACD,KAAK,CAAC,WAAW;YAChB,OAAO,iBAAiB,CAAA;QACzB,CAAC;KACD;CACD,CAAC,CAAC,CAAA;AAEH,SAAS,IAAI,CAAC,IAAY;IACzB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAA;AACpF,CAAC;AAED,MAAM,GAAG,GAAG;IACX,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;IACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;IACd,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG;CACP,CAAA;AAEV,IAAI,IAAY,CAAA;AAQhB,KAAK,UAAU,OAAO,CAAC,SAAkC,EAAE;IAC1D,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAClE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAA;IAEzE,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,YAAY,GAAG;QACpB,QAAQ,EAAE,CAAC,UAA4B,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5E,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;QAC3B,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;KACX,CAAA;IAEV,MAAM,OAAO,GAAG,IAAI,sBAAsB,CAAC;QAC1C,cAAc,EAAE,IAAI,cAAc,EAAE;QACpC,YAAY;QACZ,GAAG;QACH,GAAG,MAAM;KACA,CAAC,CAAA;IAEX,OAAO;QACN,UAAU;QACV,OAAO;QACP,MAAM,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC5B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACrC,MAAM,SAAS,CACd,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EACxB,IAAI,CAAC,SAAS,CAAC;gBACd,IAAI;gBACJ,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,2BAA2B;gBACxC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;aACrE,CAAC,EACF,OAAO,CACP,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YACpD,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC/B,OAAO,MAAM,CAAC,EAAE,CAAA;QACjB,CAAC;KACD,CAAA;AACF,CAAC;AAED,UAAU,CAAC,KAAK,IAAI,EAAE;IACrB,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACxD,WAAW,GAAG,CAAC,CAAA;IACf,UAAU,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAC/E,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;AACzE,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAChD,EAAE,CAAC,aAAa,EAAE,CAAA;AACnB,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,+DAA+D,EAAE,GAAG,EAAE;IAC9E,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAE/F,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,2DAA2D;QAC3D,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAEtF,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC9E,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACrE,uEAAuE;QACvE,qBAAqB;QACrB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAA;QAEzB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAEjF,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAChF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC9B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;QAE3C,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC9B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAErC,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,cAAc;QACd,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC9B,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;QAChD,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAEvB,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC/C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACvD,UAAU,EAAE,OAAO;YACnB,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE;SAChC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC9B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAErC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC9B,mEAAmE;QACnE,mBAAmB;QACnB,UAAU,GAAG;YACZ;gBACC,IAAI,EAAE,WAAW;gBACjB,WAAW,EAAE,aAAa;gBAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;aACzE;YACD,IAAI,CAAC,YAAY,CAAC;YAClB,IAAI,CAAC,mBAAmB,CAAC;SACzB,CAAA;QACD,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAEvB,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC/C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC9B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAErC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAEvB,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC9B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;YACvB,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE;YACpD,cAAc;SACd,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAErC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC9B,qEAAqE;QACrE,mDAAmD;QACnD,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAA;QACxD,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAEvB,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC9C,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAA;QAEzB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC;YACvB,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,EAAE;SACnE,CAAC,CAAA;QAEF,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,iEAAiE;QACjE,qEAAqE;QACrE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAClE,iBAAiB,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAA;QAEzB,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,oEAAoE;QACpE,8BAA8B;QAC9B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/plugin/__tests__/path-containment.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=path-containment.test.d.ts.map

package/dist/plugin/__tests__/path-containment.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-containment.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/__tests__/path-containment.test.ts"],"names":[],"mappings":""}

package/dist/plugin/__tests__/path-containment.test.js

@@ -1,91 +0,0 @@
-import { mkdirSync, mkdtempSync, symlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { describe, expect, it } from 'vitest';
-import { PluginRegistry } from '../../registry/plugin/index.js';
-import { ToolRegistry } from '../../registry/tool/execute.js';
-import { getRootLogger } from '../../utils/logger.js';
-import { PluginLifecycleManager } from '../lifecycle.js';
-import { discoverPlugins } from '../loader.js';
-/**
- * The plugin subsystem loads THIRD-PARTY code, which makes it the worst place
- * in this repo to be missing the containment its filesystem tools got this
- * week. It had none: zero `lstat`, zero `isSymbolicLink`, zero `resolveWithin`
- * across the loader and the lifecycle manager.
- *
- * Two holes, and the second is the serious one.
- *
- * `discoverPlugins` used `stat`, which follows a link and reports on its
- * TARGET — so a symlinked entry pointing anywhere on disk was admitted as a
- * plugin directory. The directory listed was not the directory loaded.
- *
- * And `PluginLifecycleManager` built its import path with
- * `join(plugin.rootDir, toolPath)` where `toolPath` comes out of the
- * MANIFEST — a file the plugin author writes. `"tools": ["../../../evil.js"]`
- * left the plugin directory entirely and was imported, which runs it.
- */
-const CAN_SYMLINK = (() => {
-    try {
-        const probe = mkdtempSync(join(tmpdir(), 'namzu-plug-sym-'));
-        symlinkSync(probe, join(probe, 'self'), 'dir');
-        return true;
-    }
-    catch {
-        return false;
-    }
-})();
-function pluginsDir() {
-    return mkdtempSync(join(tmpdir(), 'namzu-plugins-'));
-}
-function writePlugin(parent, name, manifest) {
-    const dir = join(parent, name);
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, 'plugin.json'), JSON.stringify({ name, version: '1.0.0', description: 'test', ...manifest }));
-    return dir;
-}
-describe('plugin discovery refuses a symlinked directory', () => {
-    it.skipIf(!CAN_SYMLINK)('does not admit a link as a plugin directory', async () => {
-        const outside = mkdtempSync(join(tmpdir(), 'namzu-outside-'));
-        writePlugin(outside, 'evil', { tools: [] });
-        const parent = pluginsDir();
-        writePlugin(parent, 'honest', { tools: [] });
-        symlinkSync(join(outside, 'evil'), join(parent, 'linked'), 'dir');
-        const found = await discoverPlugins(parent);
-        expect(found.map((p) => p.split(/[\\/]/).pop())).toEqual(['honest']);
-    });
-    it('still finds an ordinary plugin directory', async () => {
-        const parent = pluginsDir();
-        writePlugin(parent, 'ordinary', { tools: [] });
-        expect(await discoverPlugins(parent)).toHaveLength(1);
-    });
-});
-function managerFor(def) {
-    const pluginRegistry = new PluginRegistry();
-    pluginRegistry.register(def);
-    return new PluginLifecycleManager({
-        pluginRegistry,
-        toolRegistry: new ToolRegistry(),
-        log: getRootLogger(),
-    });
-}
-describe('a manifest cannot name a file outside its own plugin', () => {
-    it('refuses a tool path that climbs out', async () => {
-        // The manifest is written by the plugin author. Without containment the
-        // named file was imported — which is to say, executed.
-        const outside = mkdtempSync(join(tmpdir(), 'namzu-outside-'));
-        writeFileSync(join(outside, 'evil.js'), 'export const tools = []');
-        const parent = pluginsDir();
-        const escaping = join('..', outside.split(/[\/]/).pop(), 'evil.js');
-        const dir = writePlugin(parent, 'sneaky', { tools: [escaping] });
-        const manager = managerFor({
-            id: 'sneaky',
-            manifest: { name: 'sneaky', version: '1.0.0', description: 't', tools: [escaping] },
-            scope: 'project',
-            status: 'installed',
-            rootDir: dir,
-            installedAt: 0,
-        });
-        await expect(manager.enable('sneaky')).rejects.toThrow(/escapes the working directory/);
-    });
-});
-//# sourceMappingURL=path-containment.test.js.map

package/dist/plugin/__tests__/path-containment.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-containment.test.js","sourceRoot":"","sources":["../../../src/plugin/__tests__/path-containment.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;IACzB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAC5D,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC,CAAC,EAAE,CAAA;AAEJ,SAAS,UAAU;IAClB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,QAAiC;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,aAAa,CACZ,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EACxB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,CAC5E,CAAA;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC/D,EAAE,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;QAC7D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAE3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAC5C,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;QAEjE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;QAE3C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QAE9C,MAAM,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,UAAU,CAAC,GAAY;IAC/B,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAA;IAC3C,cAAc,CAAC,QAAQ,CAAC,GAAY,CAAC,CAAA;IACrC,OAAO,IAAI,sBAAsB,CAAC;QACjC,cAAc;QACd,YAAY,EAAE,IAAI,YAAY,EAAE;QAChC,GAAG,EAAE,aAAa,EAAE;KACX,CAAC,CAAA;AACZ,CAAC;AAED,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACpD,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;QAC7D,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,yBAAyB,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAY,EAAE,SAAS,CAAC,CAAA;QAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAEhE,MAAM,OAAO,GAAG,UAAU,CAAC;YAC1B,EAAE,EAAE,QAAQ;YACZ,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;YACnF,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,GAAG;YACZ,WAAW,EAAE,CAAC;SACd,CAAC,CAAA;QAEF,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/probe/registry.test.d.ts

@@ -1,13 +0,0 @@
-/**
- * These tests pin the probe CONTRACT, not an internal implementation
- * detail. If the semantics change, change the published documentation
- * first: `docs/sdk/architecture/safety.md`, "Which Way a Gate Fails".
- *
- * They used to point at a session design document that has since been
- * frozen and removed, so the instruction to update it first could not be
- * followed — which is how the fail-open veto kept its ratified status
- * with no surviving argument for it. A contract reference has to name
- * something a reader can still open.
- */
-export {};
-//# sourceMappingURL=registry.test.d.ts.map

package/dist/probe/registry.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.test.d.ts","sourceRoot":"","sources":["../../src/probe/registry.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}