@pasko70/pibo 1.9.9 → 1.9.10

package/dist/plugins/dev-auth.js

@@ -0,0 +1,202 @@
+import { randomBytes } from "node:crypto";
+import { definePiboPlugin } from "./registry.js";
+import { SOCKET_PEER_HEADER } from "../web/channel.js";
+const COOKIE_NAME = "pibo_dev_session";
+const COOKIE_MAX_AGE = 60 * 60 * 24 * 7; // 7 days
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function generateToken() {
+    return randomBytes(32).toString("hex");
+}
+function setCookie(value, maxAge = COOKIE_MAX_AGE) {
+    return `${COOKIE_NAME}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}`;
+}
+function clearCookie() {
+    return `${COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function getCookieValue(headers) {
+    const cookie = headers.get("cookie");
+    if (!cookie)
+        return undefined;
+    const match = cookie.match(new RegExp(`${COOKIE_NAME}=([^;]+)`));
+    return match?.[1];
+}
+function firstHeaderValue(value) {
+    return value?.split(",")[0]?.trim() || undefined;
+}
+function isLoopbackHost(value) {
+    if (!value)
+        return false;
+    try {
+        const hostname = new URL(`http://${value}`).hostname;
+        return LOOPBACK_HOSTS.has(hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function isLoopbackSocketAddress(value) {
+    if (!value)
+        return false;
+    const normalized = value.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
+    return normalized === "::1" || normalized === "127.0.0.1" || normalized.startsWith("127.");
+}
+function isPrivateDockerBridgeSocketAddress(value) {
+    if (!value)
+        return false;
+    const normalized = value.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
+    if (normalized.startsWith("10."))
+        return true;
+    if (normalized.startsWith("192.168."))
+        return true;
+    const match = normalized.match(/^172\.(\d{1,2})\./);
+    if (!match)
+        return false;
+    const secondOctet = Number(match[1]);
+    return secondOctet >= 16 && secondOctet <= 31;
+}
+function isComputeWorkerRuntime(env = process.env) {
+    return env.PIBO_COMPUTE_WORKER === "1";
+}
+function isTrustedLocalSocketAddress(value) {
+    return isLoopbackSocketAddress(value) || (isComputeWorkerRuntime() && isPrivateDockerBridgeSocketAddress(value));
+}
+/**
+ * Read the TCP socket peer address attached to the request by the web host
+ * channel via the `x-pibo-socket-peer` header. The header is internal and
+ * stripped from any outgoing response, so it can be trusted.
+ */
+export function getSocketPeerForDevAuth(request) {
+    return firstHeaderValue(request.headers.get(SOCKET_PEER_HEADER));
+}
+/**
+ * Check whether the TCP socket peer attached by the channel is loopback.
+ * Returns `false` (fail-closed) when the header is missing, so a request
+ * that did not flow through the web host channel is never accepted.
+ */
+export function isLoopbackSocketPeerForDevAuth(request) {
+    return isLoopbackSocketAddress(getSocketPeerForDevAuth(request));
+}
+export function isLoopbackDevAuthRequest(request) {
+    const host = firstHeaderValue(request.headers.get("host"));
+    const forwardedHost = firstHeaderValue(request.headers.get("x-forwarded-host"));
+    return isLoopbackHost(host) && (!forwardedHost || isLoopbackHost(forwardedHost));
+}
+/**
+ * Headers-only variants of the loopback predicates so `getSession` can
+ * evaluate the same checks without holding on to the full `Request`
+ * object. `getSession` is part of the auth service contract and only
+ * receives `headers`, but the channel guarantees that the same
+ * `host`, `x-forwarded-host`, and `x-pibo-socket-peer` headers are
+ * present as they would be on a full `Request`.
+ */
+export function isLoopbackDevAuthHeaders(headers) {
+    const host = firstHeaderValue(headers.get("host"));
+    const forwardedHost = firstHeaderValue(headers.get("x-forwarded-host"));
+    return isLoopbackHost(host) && (!forwardedHost || isLoopbackHost(forwardedHost));
+}
+export function isLoopbackSocketPeerForDevAuthHeaders(headers) {
+    return isLoopbackSocketAddress(firstHeaderValue(headers.get(SOCKET_PEER_HEADER)));
+}
+export function isTrustedLocalSocketPeerForDevAuth(request) {
+    return isTrustedLocalSocketAddress(getSocketPeerForDevAuth(request));
+}
+export function isTrustedLocalSocketPeerForDevAuthHeaders(headers) {
+    return isTrustedLocalSocketAddress(firstHeaderValue(headers.get(SOCKET_PEER_HEADER)));
+}
+export function createDevAuthService() {
+    const containerToken = generateToken();
+    const debugSession = {
+        identity: {
+            userId: "dev-user-001",
+            email: "dev@pibo.local",
+            name: "Dev User",
+            image: undefined,
+            provider: "dev",
+        },
+        sessionId: "dev-session-001",
+        expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000),
+    };
+    return {
+        name: "dev-auth",
+        async start() {
+            console.error("[dev-auth] Debug auth service started");
+        },
+        stop() { },
+        async getSession(headers) {
+            // In local auth mode the loopback bind is the real security
+            // boundary. Once the channel has confirmed that the request
+            // reached us from a loopback host and a loopback TCP socket
+            // peer, the caller is on the same host as the gateway and
+            // there is no cookie jar to share. Headless clients (VS Code
+            // extension, CLI scripts) can use the same dev identity as the
+            // browser without needing the HttpOnly session cookie.
+            if (isLoopbackDevAuthHeaders(headers) && isTrustedLocalSocketPeerForDevAuthHeaders(headers)) {
+                return debugSession;
+            }
+            const token = getCookieValue(headers);
+            if (token === containerToken)
+                return debugSession;
+            return undefined;
+        },
+        async requireSession(headers) {
+            const session = await this.getSession(headers);
+            if (!session) {
+                const err = new Error("Unauthenticated");
+                err.statusCode = 401;
+                throw err;
+            }
+            return session;
+        },
+        async handleRequest(request) {
+            if (!isLoopbackDevAuthRequest(request)) {
+                return Response.json({ error: "Dev auth only accepts loopback requests" }, { status: 403 });
+            }
+            if (!isTrustedLocalSocketPeerForDevAuth(request)) {
+                return Response.json({ error: "Dev auth only accepts loopback socket peers" }, { status: 403 });
+            }
+            const url = new URL(request.url);
+            if (url.pathname === "/api/auth/sign-in/social") {
+                // Simulate the Google OAuth redirect — go straight to callback
+                return new Response(null, {
+                    status: 302,
+                    headers: {
+                        location: "/api/auth/callback/google?code=dev",
+                    },
+                });
+            }
+            if (url.pathname === "/api/auth/callback/google") {
+                // Set session cookie and redirect to app
+                return new Response(null, {
+                    status: 302,
+                    headers: {
+                        "Set-Cookie": setCookie(containerToken),
+                        location: "/apps/chat",
+                    },
+                });
+            }
+            if (url.pathname === "/api/auth/sign-out") {
+                return new Response(null, {
+                    status: 302,
+                    headers: {
+                        "Set-Cookie": clearCookie(),
+                        location: "/apps/chat",
+                    },
+                });
+            }
+            if (url.pathname === "/api/auth/session") {
+                const session = await this.getSession(request.headers);
+                return Response.json(session ?? null);
+            }
+            return new Response("Not found", { status: 404 });
+        },
+    };
+}
+export function createPiboDevAuthPlugin() {
+    return definePiboPlugin({
+        id: "pibo.dev-auth",
+        name: "Dev Auth",
+        register(api) {
+            api.registerAuthService(createDevAuthService());
+        },
+    });
+}

package/dist/plugins/native-tooling.js

@@ -0,0 +1,15 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+export const PIBO_NATIVE_TOOLING_CONTEXT_FILE_KEY = "Pibo Native Tooling";
+const PROJECT_ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+export const PIBO_NATIVE_TOOLING_CONTEXT_FILE_PATH = resolve(PROJECT_ROOT, "context/pibo-native-tooling.md");
+export function registerPiboNativeTooling(api) {
+    api.registerContextFile({
+        key: PIBO_NATIVE_TOOLING_CONTEXT_FILE_KEY,
+        label: "Pibo Native Tooling",
+        path: PIBO_NATIVE_TOOLING_CONTEXT_FILE_PATH,
+    });
+}
+export function addPiboNativeToolingContext(builder, context) {
+    return builder.addContextFile(context.getContextFile(PIBO_NATIVE_TOOLING_CONTEXT_FILE_KEY));
+}

package/dist/plugins/registry.js

@@ -0,0 +1,436 @@
+import { randomUUID } from "node:crypto";
+import { listInstalledCliToolAgentContexts } from "../tools/registry.js";
+import { listPiPackages } from "../pi-packages/store.js";
+function getWebAppRoutes(app) {
+    return [
+        { label: "mountPath", prefix: app.mountPath },
+        { label: "apiPrefix", prefix: app.apiPrefix },
+    ];
+}
+function validateWebRoute(appName, label, prefix) {
+    if (!prefix.startsWith("/")) {
+        throw new Error(`Web app "${appName}" ${label} must start with "/"`);
+    }
+    if (prefix.length > 1 && prefix.endsWith("/")) {
+        throw new Error(`Web app "${appName}" ${label} must not end with "/"`);
+    }
+}
+function webRoutesOverlap(left, right) {
+    return left === right || left === "/" || right === "/" || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
+}
+export class PiboPluginRegistry {
+    tools = new Map();
+    subagents = new Map();
+    skills = new Map();
+    contextFiles = new Map();
+    profiles = new Map();
+    profileAliases = new Map();
+    gatewayActions = new Map();
+    gatewaySlashCommands = new Map();
+    channels = new Map();
+    authService;
+    webApps = new Map();
+    capabilityPackages = new Map();
+    eventListeners = new Set();
+    productEventListeners = new Set();
+    ralphStopConditions = new Map();
+    pluginIds = new Set();
+    pluginNames = new Map();
+    eventErrors = [];
+    static create(options = {}) {
+        const registry = new PiboPluginRegistry();
+        for (const plugin of options.plugins ?? []) {
+            registry.registerPlugin(plugin);
+        }
+        return registry;
+    }
+    registerPlugin(plugin) {
+        if (this.pluginIds.has(plugin.id)) {
+            throw new Error(`Plugin "${plugin.id}" is already registered`);
+        }
+        this.pluginIds.add(plugin.id);
+        this.pluginNames.set(plugin.id, plugin.name ?? plugin.id);
+        plugin.register(this.createApi(plugin.id));
+    }
+    registerTool(tool) {
+        this.addUnique(this.tools, tool.name, tool, "tool");
+    }
+    registerTools(tools) {
+        for (const tool of tools) {
+            this.registerTool(tool);
+        }
+    }
+    registerSubagent(subagent) {
+        this.addUnique(this.subagents, subagent.name, subagent, "subagent");
+    }
+    registerSubagents(subagents) {
+        for (const subagent of subagents) {
+            this.registerSubagent(subagent);
+        }
+    }
+    registerSkill(skill) {
+        this.addUnique(this.skills, skill.name, skill, "skill");
+    }
+    unregisterSkill(name) {
+        return this.skills.delete(name);
+    }
+    getRegisteredSkillNames() {
+        return [...this.skills.keys()];
+    }
+    registerContextFile(contextFile) {
+        this.addUnique(this.contextFiles, contextFileKey(contextFile), contextFile, "context file");
+    }
+    upsertContextFile(contextFile) {
+        this.contextFiles.set(contextFileKey(contextFile), contextFile);
+    }
+    removeContextFile(key) {
+        this.contextFiles.delete(key);
+    }
+    registerProfile(profile) {
+        this.addUnique(this.profiles, profile.name, profile, "profile");
+        this.registerProfileAliases(profile);
+    }
+    upsertProfile(profile) {
+        this.profiles.set(profile.name, profile);
+        for (const [alias, profileName] of this.profileAliases.entries()) {
+            if (profileName === profile.name)
+                this.profileAliases.delete(alias);
+        }
+        this.registerProfileAliases(profile);
+    }
+    removeProfile(name) {
+        const resolvedName = this.profileAliases.get(name) ?? name;
+        if (!this.profiles.delete(resolvedName))
+            return;
+        for (const [alias, profileName] of this.profileAliases.entries()) {
+            if (profileName === resolvedName)
+                this.profileAliases.delete(alias);
+        }
+    }
+    registerGatewayAction(action) {
+        const slashCommands = this.getGatewaySlashCommandsToRegister(action);
+        this.addUnique(this.gatewayActions, action.name, action, "gateway action");
+        for (const slashCommand of slashCommands) {
+            this.gatewaySlashCommands.set(slashCommand, action.name);
+        }
+    }
+    registerChannel(channel) {
+        this.addUnique(this.channels, channel.name, channel, "channel");
+    }
+    registerAuthService(service) {
+        if (this.authService) {
+            throw new Error(`Auth service "${this.authService.name}" is already registered`);
+        }
+        this.authService = service;
+    }
+    registerWebApp(app) {
+        if (this.webApps.has(app.name)) {
+            throw new Error(`Duplicate web app "${app.name}"`);
+        }
+        this.validateWebAppRoutes(app);
+        this.webApps.set(app.name, app);
+    }
+    registerCapabilityPackage(pkg) {
+        this.addUnique(this.capabilityPackages, pkg.name, { ...pkg, toolNames: [...pkg.toolNames] }, "capability package");
+    }
+    registerRalphStopCondition(condition, pluginId) {
+        if (!condition.type.trim())
+            throw new Error('Ralph stop condition type is required');
+        if (!condition.name.trim())
+            throw new Error(`Ralph stop condition "${condition.type}" name is required`);
+        if (condition.phases.length === 0)
+            throw new Error(`Ralph stop condition "${condition.type}" must support at least one phase`);
+        this.addUnique(this.ralphStopConditions, condition.type, { definition: { ...condition, phases: [...condition.phases] }, pluginId }, 'Ralph stop condition');
+    }
+    getRalphStopConditionDefinitions() {
+        return [...this.ralphStopConditions.values()].map((entry) => entry.definition);
+    }
+    getRalphStopConditionInfos() {
+        return [...this.ralphStopConditions.values()].map((entry) => ({
+            type: entry.definition.type,
+            name: entry.definition.name,
+            description: entry.definition.description,
+            phases: [...entry.definition.phases],
+            optionsSchema: entry.definition.optionsSchema,
+            defaultOptions: entry.definition.defaultOptions,
+            pluginId: entry.pluginId,
+            pluginName: entry.pluginId ? this.pluginNames.get(entry.pluginId) : undefined,
+        }));
+    }
+    onEvent(listener) {
+        this.eventListeners.add(listener);
+    }
+    onProductEvent(listener) {
+        this.productEventListeners.add(listener);
+        return () => {
+            this.productEventListeners.delete(listener);
+        };
+    }
+    createProfile(name) {
+        const resolvedName = this.resolveProfileName(name);
+        const profile = this.profiles.get(resolvedName);
+        if (!profile)
+            throw new Error(`Unknown profile "${name}"`);
+        return profile.create(this.createProfileBuildContext());
+    }
+    getProfileNames() {
+        return [...this.profiles.keys()];
+    }
+    getProfileInfos() {
+        const context = this.createProfileBuildContext();
+        return [...this.profiles.values()].map((profile) => {
+            const sessionContext = profile.create(context);
+            return {
+                name: profile.name,
+                description: profile.description,
+                aliases: [...(profile.aliases ?? [])],
+                nativeTools: sessionContext.tools.filter((tool) => tool.enabled !== false).map((tool) => tool.name),
+                skills: sessionContext.skills.filter((skill) => skill.enabled !== false).map((skill) => skill.name),
+                contextFiles: sessionContext.contextFiles.filter((contextFile) => contextFile.enabled !== false).map(contextFileKey),
+                subagents: sessionContext.subagents.filter((subagent) => subagent.enabled !== false),
+                mcpServers: [...sessionContext.mcpServers],
+                piPackages: sessionContext.piPackages.filter((pkg) => pkg.enabled !== false).map((pkg) => pkg.id),
+                model: sessionContext.model ? { ...sessionContext.model } : undefined,
+                mainModel: sessionContext.mainModel ? { ...sessionContext.mainModel } : undefined,
+                subagentModel: sessionContext.subagentModel ? { ...sessionContext.subagentModel } : undefined,
+                thinkingLevel: sessionContext.thinkingLevel,
+                mainThinkingLevel: sessionContext.mainThinkingLevel,
+                subagentThinkingLevel: sessionContext.subagentThinkingLevel,
+                fast: sessionContext.fast,
+                mainFast: sessionContext.mainFast,
+                subagentFast: sessionContext.subagentFast,
+                builtinTools: sessionContext.builtinTools,
+                builtinToolNames: [...sessionContext.builtinToolNames],
+                autoContextFiles: sessionContext.autoContextFiles,
+                runControl: sessionContext.toolPackages.runControl === true,
+            };
+        });
+    }
+    getCapabilityCatalog() {
+        return {
+            nativeTools: [...this.tools.values()].map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                yieldable: tool.yieldable !== false,
+                hasDefinition: tool.definition !== undefined || tool.createDefinition !== undefined,
+                pluginId: tool.pluginId,
+                pluginName: tool.pluginId ? this.pluginNames.get(tool.pluginId) : undefined,
+                ...(tool.providerTool ? { providerTool: tool.providerTool } : {}),
+            })),
+            skills: [...this.skills.values()].map((skill) => ({
+                name: skill.name,
+                path: skill.path,
+                kind: skill.kind ?? "plugin",
+                pluginId: skill.pluginId,
+                pluginName: skill.pluginId ? this.pluginNames.get(skill.pluginId) : undefined,
+            })),
+            subagents: [...this.subagents.values()].map((subagent) => ({
+                name: subagent.name,
+                description: subagent.description,
+                targetProfile: subagent.targetProfile,
+                timeoutMs: subagent.timeoutMs,
+                maxDepth: subagent.maxDepth,
+            })),
+            contextFiles: [...this.contextFiles.entries()].map(([key, contextFile]) => ({
+                key,
+                label: contextFile.label,
+                path: contextFile.path,
+                scope: contextFile.scope ?? "global",
+                source: contextFile.source ?? "plugin",
+                pluginId: contextFile.pluginId,
+                pluginName: contextFile.pluginId ? this.pluginNames.get(contextFile.pluginId) : undefined,
+                agentProfileName: contextFile.agentProfileName,
+            })),
+            packages: [
+                {
+                    name: "pibo-run-control",
+                    description: "Expose pibo_run_* tools as one package for yielded native tools and subagents.",
+                    toolNames: [
+                        "pibo_run_start",
+                        "pibo_run_list",
+                        "pibo_run_status",
+                        "pibo_run_wait",
+                        "pibo_run_read",
+                        "pibo_run_cancel",
+                        "pibo_run_ack",
+                    ],
+                },
+                ...[...this.capabilityPackages.values()].map((pkg) => ({
+                    ...pkg,
+                    toolNames: [...pkg.toolNames],
+                    pluginName: pkg.pluginId ? this.pluginNames.get(pkg.pluginId) : pkg.pluginName,
+                })),
+            ],
+            piboTools: listInstalledCliToolAgentContexts(),
+            mcpServers: [],
+            piPackages: listPiPackages(),
+            ralphStopConditions: this.getRalphStopConditionInfos(),
+        };
+    }
+    resolveProfileName(name) {
+        const resolvedName = this.profileAliases.get(name) ?? name;
+        if (!this.profiles.has(resolvedName)) {
+            throw new Error(`Unknown profile "${name}". Available profiles: ${this.getProfileNames().join(", ")}`);
+        }
+        return resolvedName;
+    }
+    getGatewayAction(name) {
+        return this.gatewayActions.get(name);
+    }
+    getGatewayActionInfos() {
+        return [...this.gatewayActions.values()]
+            .filter((action) => action.hidden !== true)
+            .map((action) => ({
+            name: action.name,
+            description: action.description,
+            slashCommands: [...(action.slashCommands ?? [])],
+        }));
+    }
+    getChannels() {
+        return [...this.channels.values()];
+    }
+    getAuthService() {
+        return this.authService;
+    }
+    getWebApps() {
+        return [...this.webApps.values()];
+    }
+    getEventErrors() {
+        return [...this.eventErrors];
+    }
+    notifyEvent(event) {
+        for (const listener of this.eventListeners) {
+            try {
+                listener(event);
+            }
+            catch (error) {
+                this.eventErrors.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+    }
+    emitProductEvent(input) {
+        const event = {
+            ...input,
+            id: input.id ?? randomUUID(),
+            createdAt: input.createdAt ?? new Date().toISOString(),
+        };
+        for (const listener of this.productEventListeners) {
+            try {
+                listener(event);
+            }
+            catch (error) {
+                this.eventErrors.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+        return event;
+    }
+    createApi(pluginId) {
+        const withPluginToolContext = (tool) => ({ ...tool, pluginId: tool.pluginId ?? pluginId });
+        const withPluginSkillContext = (skill) => (skill.kind === "user"
+            ? skill
+            : {
+                ...skill,
+                kind: skill.kind ?? "plugin",
+                pluginId: skill.pluginId ?? pluginId,
+            });
+        const withPluginContext = (contextFile) => (contextFile.source === "managed" ? contextFile : { ...contextFile, pluginId: contextFile.pluginId ?? pluginId });
+        const withPluginPackageContext = (pkg) => ({
+            ...pkg,
+            toolNames: [...pkg.toolNames],
+            pluginId: pkg.pluginId ?? pluginId,
+        });
+        return {
+            registerTool: (tool) => this.registerTool(withPluginToolContext(tool)),
+            registerTools: (tools) => this.registerTools(tools.map(withPluginToolContext)),
+            registerSubagent: (subagent) => this.registerSubagent(subagent),
+            registerSubagents: (subagents) => this.registerSubagents(subagents),
+            registerSkill: (skill) => this.registerSkill(withPluginSkillContext(skill)),
+            registerContextFile: (contextFile) => this.registerContextFile(withPluginContext(contextFile)),
+            upsertContextFile: (contextFile) => this.upsertContextFile(withPluginContext(contextFile)),
+            removeContextFile: (key) => this.removeContextFile(key),
+            registerProfile: (profile) => this.registerProfile(profile),
+            upsertProfile: (profile) => this.upsertProfile(profile),
+            registerGatewayAction: (action) => this.registerGatewayAction(action),
+            registerChannel: (channel) => this.registerChannel(channel),
+            registerAuthService: (service) => this.registerAuthService(service),
+            registerWebApp: (app) => this.registerWebApp(app),
+            registerCapabilityPackage: (pkg) => this.registerCapabilityPackage(withPluginPackageContext(pkg)),
+            registerRalphStopCondition: (condition) => this.registerRalphStopCondition(condition, pluginId),
+            onEvent: (listener) => this.onEvent(listener),
+            emitProductEvent: (event) => this.emitProductEvent(event),
+            onProductEvent: (listener) => this.onProductEvent(listener),
+        };
+    }
+    createProfileBuildContext() {
+        return {
+            getTool: (name) => this.getRequired(this.tools, name, "tool"),
+            getTools: (names) => names.map((name) => this.getRequired(this.tools, name, "tool")),
+            getSkill: (name) => this.getRequired(this.skills, name, "skill"),
+            getContextFile: (key) => this.getRequired(this.contextFiles, key, "context file"),
+            getSubagent: (name) => this.getRequired(this.subagents, name, "subagent"),
+            getSubagents: (names) => names.map((name) => this.getRequired(this.subagents, name, "subagent")),
+        };
+    }
+    getRequired(map, key, label) {
+        const value = map.get(key);
+        if (!value) {
+            throw new Error(`Unknown ${label} "${key}"`);
+        }
+        return value;
+    }
+    registerProfileAliases(profile) {
+        for (const alias of profile.aliases ?? []) {
+            const existingAliasProfile = this.profileAliases.get(alias);
+            if (this.profiles.has(alias) || (existingAliasProfile && existingAliasProfile !== profile.name)) {
+                throw new Error(`Profile alias "${alias}" is already registered`);
+            }
+            this.profileAliases.set(alias, profile.name);
+        }
+    }
+    addUnique(map, key, value, label) {
+        if (map.has(key)) {
+            throw new Error(`Duplicate ${label} "${key}"`);
+        }
+        map.set(key, value);
+    }
+    validateWebAppRoutes(app) {
+        const routes = getWebAppRoutes(app);
+        for (const route of routes) {
+            validateWebRoute(app.name, route.label, route.prefix);
+        }
+        for (const existing of this.webApps.values()) {
+            for (const route of routes) {
+                for (const existingRoute of getWebAppRoutes(existing)) {
+                    if (webRoutesOverlap(route.prefix, existingRoute.prefix)) {
+                        throw new Error(`Web app route "${route.prefix}" for "${app.name}" overlaps ${existingRoute.label} "${existingRoute.prefix}" from web app "${existing.name}"`);
+                    }
+                }
+            }
+        }
+    }
+    getGatewaySlashCommandsToRegister(action) {
+        if (action.hidden === true)
+            return [];
+        const slashCommands = [];
+        for (const slashCommand of action.slashCommands ?? []) {
+            if (!slashCommand || slashCommand.startsWith("/") || /\s/.test(slashCommand)) {
+                throw new Error(`Invalid slash command "${slashCommand}" for gateway action "${action.name}"`);
+            }
+            const existingAction = this.gatewaySlashCommands.get(slashCommand);
+            if (existingAction) {
+                throw new Error(`Duplicate slash command "${slashCommand}" for gateway actions "${existingAction}" and "${action.name}"`);
+            }
+            if (slashCommands.includes(slashCommand)) {
+                throw new Error(`Duplicate slash command "${slashCommand}" for gateway action "${action.name}"`);
+            }
+            slashCommands.push(slashCommand);
+        }
+        return slashCommands;
+    }
+}
+function contextFileKey(contextFile) {
+    return contextFile.key ?? contextFile.label ?? contextFile.path;
+}
+export function definePiboPlugin(plugin) {
+    return plugin;
+}

package/dist/plugins/types.js

@@ -0,0 +1 @@
+export {};

package/dist/plugins/web-annotations.js

@@ -0,0 +1,27 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createWebAnnotationsWebApp } from "../web-annotations/api.js";
+import { WEB_ANNOTATION_TOOL_NAMES, createWebAnnotationToolProfiles } from "../web-annotations/tools.js";
+import { definePiboPlugin } from "./registry.js";
+const PIBO_PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+function webAnnotationsSkillPath() {
+    return resolve(PIBO_PACKAGE_ROOT, "skills", "builtin", "web-annotations", "SKILL.md");
+}
+export const piboWebAnnotationsPlugin = definePiboPlugin({
+    id: "pibo.web-annotations",
+    name: "Pibo Web Annotations",
+    register(api) {
+        api.registerTools(createWebAnnotationToolProfiles());
+        api.registerWebApp(createWebAnnotationsWebApp());
+        api.registerCapabilityPackage({
+            name: "web-annotation-agent-tools",
+            description: "Expose session-scoped Web Annotation tools for listing, reading, watching, and lifecycle updates.",
+            toolNames: [...WEB_ANNOTATION_TOOL_NAMES],
+        });
+        api.registerSkill({
+            name: "web-annotations",
+            path: webAnnotationsSkillPath(),
+            kind: "builtin",
+        });
+    },
+});