@raishin/vanguard-frontier-agentic 1.1.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "type": "commonjs",
@@ -30,6 +30,16 @@
     "validate:links": "python3 tests/validate-links.py --offline",
     "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:links"
   },
+  "devDependencies": {
+    "semantic-release": "25.0.3",
+    "@semantic-release/changelog": "6.0.3",
+    "@semantic-release/git": "10.0.1",
+    "@semantic-release/npm": "13.1.5",
+    "@semantic-release/github": "12.0.6",
+    "@semantic-release/commit-analyzer": "13.0.1",
+    "@semantic-release/release-notes-generator": "14.1.0",
+    "conventional-changelog-conventionalcommits": "8.0.0"
+  },
   "publishConfig": {
     "access": "public"
   },

package/scripts/export-marketplace-agents.mjs

@@ -49,15 +49,24 @@ Export selected marketplace agents into a consumer repository.
 
 Usage:
   vfa-export-agents --platform <platform> --agents <agent-id[,agent-id...]> [--repo <path>] [--force]
+  vfa-export-agents --platform <platform> --role <role-id> [--provider <provider>] [--repo <path>] [--force]
   vfa-export-agents --platform <platform> --all [--repo <path>] [--force]
   vfa-export-agents --list
+  vfa-export-agents --list-roles
 
 Platforms:
   codex, copilot, claude-code, cursor, gemini, kiro, kiro-ide, kiro-cli
 
+Roles:
+  cloud-security-engineer, cloud-platform-engineer, cloud-dba,
+  cloud-finops-analyst, cloud-solutions-architect, cloud-devops-engineer
+
 Examples:
   vfa-export-agents --list
+  vfa-export-agents --list-roles
   vfa-export-agents --platform claude-code --agents azure-cosmosdb-platform-operator-agent
+  vfa-export-agents --platform claude-code --role cloud-security-engineer
+  vfa-export-agents --platform claude-code --role cloud-security-engineer --provider azure
   vfa-export-agents --platform kiro --agents azure-cosmosdb-platform-operator-agent --repo ../consumer-repo
   vfa-export-agents --platform copilot --all --repo /path/to/project --force
 `.trim();
@@ -70,9 +79,12 @@ function parseArgs(argv) {
     repo: process.cwd(),
     force: false,
     list: false,
+    listRoles: false,
     all: false,
     agents: [],
     platform: null,
+    role: null,
+    provider: null,
   };
 
   for (let i = 0; i < argv.length; i += 1) {
@@ -82,6 +94,10 @@ function parseArgs(argv) {
       args.list = true;
       continue;
     }
+    if (arg === "--list-roles") {
+      args.listRoles = true;
+      continue;
+    }
     if (arg === "--force") {
       args.force = true;
       continue;
@@ -105,6 +121,14 @@ function parseArgs(argv) {
         .filter(Boolean);
       continue;
     }
+    if (arg === "--role") {
+      args.role = argv[++i] ?? "";
+      continue;
+    }
+    if (arg === "--provider") {
+      args.provider = argv[++i] ?? "";
+      continue;
+    }
     usage(1);
   }
 
@@ -160,7 +184,24 @@ function ensurePlatform(platform) {
   return normalized;
 }
 
+function assertWithin(parent, child, label) {
+  const resolvedParent = path.resolve(parent);
+  const resolvedChild = path.resolve(child);
+  const sep = path.sep;
+  const parentWithSep = resolvedParent.endsWith(sep) ? resolvedParent : resolvedParent + sep;
+  if (resolvedChild !== resolvedParent && !resolvedChild.startsWith(parentWithSep)) {
+    throw new Error(
+      `Refusing to ${label}: path '${resolvedChild}' escapes '${resolvedParent}'. ` +
+      `This indicates a malformed metadata.json or path traversal attempt.`
+    );
+  }
+}
+
 function copyFile(source, destination, force) {
+  const sourceStat = fs.lstatSync(source);
+  if (sourceStat.isSymbolicLink()) {
+    throw new Error(`Refusing to copy symbolic link as harness source: ${source}`);
+  }
   if (!force && fs.existsSync(destination)) {
     throw new Error(`Refusing to overwrite existing file without --force: ${destination}`);
   }
@@ -168,12 +209,28 @@ function copyFile(source, destination, force) {
   fs.copyFileSync(source, destination);
 }
 
+function loadRoles() {
+  const rolesPath = path.join(repoRoot, "catalog", "install-roles.json");
+  if (!fs.existsSync(rolesPath)) {
+    throw new Error("catalog/install-roles.json not found. Ensure the package is correctly installed.");
+  }
+  return JSON.parse(fs.readFileSync(rolesPath, "utf8"));
+}
+
 function listAgents(agents) {
   for (const agent of agents.sort((a, b) => a.id.localeCompare(b.id))) {
     console.log(`${agent.id}\t${agent.provider}\t${agent.name}`);
   }
 }
 
+function listRoles(rolesData) {
+  for (const [roleId, role] of Object.entries(rolesData.roles)) {
+    const agentCount = role.agents.length;
+    const skillCount = (role.skills ?? []).length;
+    console.log(`${roleId}\t${role.label}\t${agentCount} agents, ${skillCount} skills`);
+  }
+}
+
 function buildDestinations(agent, platform) {
   const config = PLATFORM_CONFIG[platform];
   const destinations = [];
@@ -183,9 +240,23 @@ function buildDestinations(agent, platform) {
     if (!relativeSource) {
       throw new Error(`Agent ${agent.id} does not have a ${variantKey} harness variant.`);
     }
+    if (typeof relativeSource !== "string" || /[\\/]\.\.[\\/]|^\.\.[\\/]|[\\/]\.\.$|^\.\.$/.test(relativeSource) || path.isAbsolute(relativeSource)) {
+      throw new Error(
+        `Agent ${agent.id} ${variantKey} harness path '${relativeSource}' is invalid: ` +
+        `must be a relative path within the repository, no '..' traversal, no absolute paths.`
+      );
+    }
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(agent.id)) {
+      throw new Error(
+        `Agent id '${agent.id}' fails schema pattern ^[a-z0-9][a-z0-9-]*$. ` +
+        `Cannot derive a safe destination filename.`
+      );
+    }
+    const source = path.join(repoRoot, relativeSource);
+    assertWithin(repoRoot, source, "read source");
     destinations.push({
       variantKey,
-      source: path.join(repoRoot, relativeSource),
+      source,
       destRelative: path.join(folder, `${agent.id}${extension}`),
     });
   }
@@ -195,6 +266,16 @@ function buildDestinations(agent, platform) {
 
 function main() {
   const args = parseArgs(process.argv.slice(2));
+
+  const cwd = process.cwd();
+  const cwdWithSep = cwd.endsWith(path.sep) ? cwd : cwd + path.sep;
+  if (args.repo !== cwd && !args.repo.startsWith(cwdWithSep)) {
+    process.stderr.write(
+      `[vfa] Warning: --repo '${args.repo}' is outside the current working directory.\n` +
+      `[vfa] Verify this is the intended target before continuing.\n`
+    );
+  }
+
   const { agents, byId } = loadAgents();
 
   if (args.list) {
@@ -202,19 +283,56 @@ function main() {
     return;
   }
 
+  if (args.listRoles) {
+    const rolesData = loadRoles();
+    listRoles(rolesData);
+    return;
+  }
+
   const platform = ensurePlatform(args.platform);
-  const selectedAgents = args.all
-    ? agents
-    : args.agents.map((agentId) => {
-        const agent = byId.get(agentId);
-        if (!agent) {
-          throw new Error(`Unknown agent id: ${agentId}`);
-        }
-        return agent;
+
+  let selectedAgents;
+  if (args.role) {
+    const rolesData = loadRoles();
+    const role = Object.hasOwn(rolesData.roles, args.role) ? rolesData.roles[args.role] : undefined;
+    if (!role) {
+      const validRoles = Object.keys(rolesData.roles).join(", ");
+      throw new Error(`Unknown role: ${args.role}. Valid roles: ${validRoles}`);
+    }
+    let roleAgentIds = role.agents;
+    if (args.provider) {
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(args.provider)) {
+        throw new Error(`Invalid --provider value. Must match /^[a-z0-9][a-z0-9-]*$/.`);
+      }
+      roleAgentIds = roleAgentIds.filter((id) => {
+        const agent = byId.get(id);
+        return agent && agent.provider === args.provider;
       });
+      if (roleAgentIds.length === 0) {
+        throw new Error(`No agents found for role '${args.role}' with the requested provider.`);
+      }
+    }
+    selectedAgents = roleAgentIds.map((agentId) => {
+      const agent = byId.get(agentId);
+      if (!agent) {
+        throw new Error(`Role '${args.role}' references unknown agent id: ${agentId}. Run npm run validate to check catalog integrity.`);
+      }
+      return agent;
+    });
+  } else if (args.all) {
+    selectedAgents = agents;
+  } else {
+    selectedAgents = args.agents.map((agentId) => {
+      const agent = byId.get(agentId);
+      if (!agent) {
+        throw new Error(`Unknown agent id: ${agentId}`);
+      }
+      return agent;
+    });
+  }
 
   if (selectedAgents.length === 0) {
-    throw new Error("No agents selected. Use --agents or --all.");
+    throw new Error("No agents selected. Use --agents, --role, or --all.");
   }
 
   const operations = [];
@@ -229,6 +347,7 @@ function main() {
   }
 
   for (const operation of operations) {
+    assertWithin(args.repo, operation.dest, "write destination");
     copyFile(operation.source, operation.dest, args.force);
     console.log(
       `installed\t${operation.agentId}\t${operation.variantKey}\t${path.relative(args.repo, operation.dest)}`