@raishin/vanguard-frontier-agentic 2.2.0 → 2.5.0

package/tests/fixtures/salesforce-maestro-routing/taxonomy.json

@@ -0,0 +1,371 @@
+{
+  "provider": "salesforce",
+  "domains": {
+    "platform-admin-review": {
+      "keywords": [
+        "admin",
+        "salesforce-admin",
+        "platform-admin",
+        "org setup",
+        "profiles",
+        "permission sets",
+        "org configuration",
+        "sharing rules",
+        "org-wide defaults"
+      ],
+      "agent": "salesforce-platform-admin-review-agent"
+    },
+    "business-analyst": {
+      "keywords": [
+        "business analyst",
+        "salesforce-ba",
+        "requirements",
+        "business requirements",
+        "user stories",
+        "process mapping",
+        "business process"
+      ],
+      "agent": "salesforce-business-analyst-agent"
+    },
+    "app-builder-automation": {
+      "keywords": [
+        "app builder",
+        "flow",
+        "process builder",
+        "automation",
+        "salesforce-app-builder",
+        "lightning app builder",
+        "validation rules",
+        "workflow rules"
+      ],
+      "agent": "salesforce-app-builder-automation-agent"
+    },
+    "development": {
+      "keywords": [
+        "apex",
+        "lwc",
+        "lightning web component",
+        "salesforce-dev",
+        "development",
+        "developer",
+        "visualforce",
+        "soql",
+        "trigger"
+      ],
+      "agent": "salesforce-development-agent"
+    },
+    "devops-release": {
+      "keywords": [
+        "devops",
+        "release",
+        "deployment",
+        "salesforce-devops",
+        "ci cd",
+        "pipeline",
+        "sandbox",
+        "change set",
+        "metadata deployment"
+      ],
+      "agent": "salesforce-devops-release-agent"
+    },
+    "security-identity-access": {
+      "keywords": [
+        "security",
+        "identity",
+        "access",
+        "salesforce-security",
+        "SSO",
+        "MFA",
+        "SAML",
+        "OAuth",
+        "guest user",
+        "field level security"
+      ],
+      "agent": "salesforce-security-identity-access-agent"
+    },
+    "data-architecture": {
+      "keywords": [
+        "data",
+        "data model",
+        "schema",
+        "salesforce-data",
+        "data architecture",
+        "data migration",
+        "data quality",
+        "master data"
+      ],
+      "agent": "salesforce-data-architecture-agent"
+    },
+    "integration-mulesoft": {
+      "keywords": [
+        "integration",
+        "mulesoft",
+        "api",
+        "salesforce-integration",
+        "REST",
+        "SOAP",
+        "middleware",
+        "connected app",
+        "named credential"
+      ],
+      "agent": "salesforce-integration-mulesoft-agent"
+    },
+    "sales-cloud-revenue": {
+      "keywords": [
+        "sales cloud",
+        "revenue",
+        "cpq",
+        "opportunity",
+        "salesforce-sales",
+        "sales-cloud",
+        "quote",
+        "forecast",
+        "pipeline"
+      ],
+      "agent": "salesforce-sales-cloud-revenue-agent"
+    },
+    "service-field-service": {
+      "keywords": [
+        "service cloud",
+        "case",
+        "field service",
+        "salesforce-service",
+        "omni-channel",
+        "knowledge base",
+        "entitlement",
+        "service level"
+      ],
+      "agent": "salesforce-service-field-service-agent"
+    },
+    "experience-cloud": {
+      "keywords": [
+        "experience cloud",
+        "community",
+        "portal",
+        "salesforce-experience",
+        "experience-cloud",
+        "self-service",
+        "partner portal",
+        "customer portal"
+      ],
+      "agent": "salesforce-experience-cloud-agent"
+    },
+    "marketing-cloud": {
+      "keywords": [
+        "marketing cloud",
+        "email",
+        "journey",
+        "salesforce-marketing",
+        "marketing-cloud",
+        "marketing automation",
+        "campaign",
+        "subscriber",
+        "SFMC"
+      ],
+      "agent": "salesforce-marketing-cloud-agent"
+    },
+    "agentforce-ai": {
+      "keywords": [
+        "agentforce",
+        "einstein",
+        "AI",
+        "salesforce-agentforce",
+        "agentforce-ai",
+        "copilot",
+        "prompt template",
+        "einstein bot",
+        "autonomous agent"
+      ],
+      "agent": "salesforce-agentforce-ai-agent"
+    },
+    "analytics-tableau": {
+      "keywords": [
+        "analytics",
+        "tableau",
+        "crm analytics",
+        "salesforce-analytics",
+        "dashboard",
+        "report",
+        "Einstein Analytics",
+        "Tableau CRM"
+      ],
+      "agent": "salesforce-analytics-tableau-agent"
+    },
+    "slack-collaboration": {
+      "keywords": [
+        "slack",
+        "salesforce-slack",
+        "slack-salesforce",
+        "slack integration",
+        "slack workflow",
+        "collaboration",
+        "slack channel"
+      ],
+      "agent": "salesforce-slack-collaboration-agent"
+    },
+    "industry-cloud": {
+      "keywords": [
+        "industry cloud",
+        "health cloud",
+        "financial services cloud",
+        "salesforce-industry",
+        "industry-cloud",
+        "manufacturing cloud",
+        "consumer goods cloud",
+        "vertical cloud"
+      ],
+      "agent": "salesforce-industry-cloud-agent"
+    },
+    "enterprise-architect": {
+      "keywords": [
+        "enterprise architect",
+        "architecture",
+        "multi-org",
+        "salesforce-enterprise",
+        "solution design",
+        "technical design document",
+        "org strategy",
+        "platform architecture"
+      ],
+      "agent": "salesforce-enterprise-architect-agent"
+    },
+    "compliance-privacy": {
+      "keywords": [
+        "compliance",
+        "privacy",
+        "GDPR",
+        "CCPA",
+        "salesforce-compliance",
+        "data retention",
+        "audit trail",
+        "regulatory",
+        "data subject request"
+      ],
+      "agent": "salesforce-compliance-privacy-agent"
+    },
+    "network-policy-architect": {
+      "keywords": [
+        "network policy",
+        "ip allowlist",
+        "trusted ip",
+        "login ip range",
+        "csp trusted sites",
+        "session timeout",
+        "clickjack",
+        "network security policy"
+      ],
+      "agent": "salesforce-network-policy-architect-agent"
+    },
+    "hyperforce-security": {
+      "keywords": [
+        "hyperforce",
+        "data residency",
+        "infrastructure access",
+        "csp cloud security platform",
+        "edge hardening",
+        "salesforce region selection"
+      ],
+      "agent": "salesforce-hyperforce-security-agent"
+    },
+    "sandbox-isolation": {
+      "keywords": [
+        "sandbox isolation",
+        "sandbox boundary",
+        "sandbox refresh",
+        "production data leak",
+        "developer pro sandbox",
+        "full sandbox",
+        "partial copy"
+      ],
+      "agent": "salesforce-sandbox-isolation-agent"
+    },
+    "session-governance": {
+      "keywords": [
+        "session policy",
+        "high assurance session",
+        "oauth session",
+        "lightning locker",
+        "lightning web security",
+        "session hijacking",
+        "session timeout policy"
+      ],
+      "agent": "salesforce-session-governance-agent"
+    },
+    "continuous-verification": {
+      "keywords": [
+        "continuous verification",
+        "always-on mfa",
+        "adaptive authentication",
+        "behavioral anomaly",
+        "event monitoring anomaly",
+        "risk-based authentication"
+      ],
+      "agent": "salesforce-continuous-verification-agent"
+    },
+    "certificate-lifecycle": {
+      "keywords": [
+        "certificate expiry",
+        "certificate rotation",
+        "mtls",
+        "mutual tls",
+        "jwt signing certificate",
+        "saml signing certificate",
+        "named credential certificate"
+      ],
+      "agent": "salesforce-certificate-lifecycle-agent"
+    },
+    "adaptive-access": {
+      "keywords": [
+        "transaction security policy",
+        "shield event monitoring",
+        "dynamic forms access",
+        "context-aware access",
+        "einstein trust layer",
+        "risk scoring"
+      ],
+      "agent": "salesforce-adaptive-access-agent"
+    },
+    "code-analyzer-orchestrator": {
+      "keywords": [
+        "salesforce code analyzer",
+        "sca findings",
+        "pmd apex",
+        "eslint lwc",
+        "retirejs",
+        "graph engine analysis",
+        "code analysis remediation"
+      ],
+      "agent": "salesforce-code-analyzer-orchestrator-agent"
+    },
+    "sandbox-governance": {
+      "keywords": [
+        "sandbox masking",
+        "pii masking",
+        "anonymization",
+        "pseudonymization",
+        "sandbox data governance",
+        "gdpr sandbox",
+        "ccpa sandbox"
+      ],
+      "agent": "salesforce-sandbox-governance-agent"
+    },
+    "change-impact-analyst": {
+      "keywords": [
+        "change impact",
+        "metadata dependency",
+        "deployment impact",
+        "destructive change risk",
+        "field deletion impact",
+        "api version deprecation",
+        "change freeze"
+      ],
+      "agent": "salesforce-change-impact-analyst-agent"
+    }
+  },
+  "live_guards": [
+    "salesforce-live-guard-agent"
+  ],
+  "gate_mode": "live-guard-gate",
+  "live_guard_intent": "(destroy|delete|terminate|mutate.*org|deploy.*production|push.*prod|execute.*live|run.*prod|apply.*org|drop\\s+(?:object|field)|truncate.*data|mass.*delete|mass.*update.*live|wipe.*org|activate.*in prod|release.*to prod|promote.*to (?:prod|production)|live.*mutation|change.*live.*org)",
+  "parallel_threshold": 0.8
+}

package/tests/test-vfa-export-coverage.test.mjs

@@ -220,13 +220,28 @@ const skillProviderDirs = fs.readdirSync(skillsRoot, { withFileTypes: true })
   .filter((d) => d.isDirectory())
   .map((d) => d.name);
 
-// Map: skillName → providerDir (mirrors loadSkills() internal logic)
+// Map: skillName → provider (reads from metadata.json, falls back to directory name)
+// Mirrors the loadSkills() logic in scripts/export-marketplace-agents.mjs
 const skillProviderByName = new Map();
 for (const prov of skillProviderDirs) {
   const provDir = path.join(skillsRoot, prov);
   for (const skill of fs.readdirSync(provDir, { withFileTypes: true })) {
-    if (skill.isDirectory() && fs.existsSync(path.join(provDir, skill.name, "SKILL.md"))) {
-      skillProviderByName.set(skill.name, prov);
+    if (!skill.isDirectory()) continue;
+    const skillDir = path.join(provDir, skill.name);
+    const metaFile = path.join(skillDir, "metadata.json");
+    if (fs.existsSync(path.join(skillDir, "SKILL.md"))) {
+      let skillProvider = prov; // Default to directory name
+      if (fs.existsSync(metaFile)) {
+        try {
+          const meta = JSON.parse(fs.readFileSync(metaFile, "utf8"));
+          if (meta.provider) {
+            skillProvider = meta.provider; // Use declared provider if available
+          }
+        } catch (err) {
+          // Fall back to directory name if metadata.json is invalid
+        }
+      }
+      skillProviderByName.set(skill.name, skillProvider);
     }
   }
 }
@@ -246,7 +261,9 @@ function findLeakedSkills(skillNames, expectedProvider) {
   return skillNames.filter((s) => {
     const prov = skillProviderByName.get(s);
     if (!prov) return false; // unknown/orphan skill — can't classify
-    return prov !== expectedProvider && prov !== "shared";
+    // Allow export of skills with provider='shared' or provider='generic'.
+    // generic is used by language/stack boards (dotnet, legal, hr, marketing).
+    return prov !== expectedProvider && prov !== "shared" && prov !== "generic";
   });
 }
 
@@ -561,14 +578,18 @@ function findLeakedSkills(skillNames, expectedProvider) {
   }
 }
 
-// F24: --all selects every agent in the catalog.
+// F24: --all selects every catalog agent that supports the requested platform.
+// Agents authored without a claude-code harness variant (e.g., Salesforce
+// Wave 1 entries declaring harnesses: ["other"]) are silently skipped by --all
+// so smoke tests don't fail on partial-portfolio waves.
 {
   const r = run(["--platform", "claude-code", "--all", "--dry-run"]);
   const agentCount = (r.stdout.match(/^export agent:/gm) || []).length;
-  if (r.exitCode === 0 && agentCount === agents.length) {
-    ok(`F24 --all selects all ${agentCount} agents`);
+  const claudeCodeAgents = agents.filter((a) => Array.isArray(a.harnesses) && a.harnesses.includes("claude-code"));
+  if (r.exitCode === 0 && agentCount === claudeCodeAgents.length) {
+    ok(`F24 --all selects all ${agentCount} claude-code-capable agents (of ${agents.length} total)`);
   } else {
-    fail(`F24 --all: expected ${agents.length} agents, got ${agentCount}; exit=${r.exitCode}`);
+    fail(`F24 --all: expected ${claudeCodeAgents.length} claude-code-capable agents, got ${agentCount}; exit=${r.exitCode}`);
   }
 }
 

package/tests/validate-catalog.py

@@ -50,6 +50,10 @@ ALLOWED_PROVIDERS = {
     "nvidia",
     "claude",
     "marketing",
+    "dotnet",
+    "hr",
+    "legal",
+    "salesforce",
 }
 ALLOWED_HARNESSES = {"codex", "copilot", "claude-code", "cursor", "gemini", "kiro", "other"}
 ALLOWED_SOURCE_TYPES = {"original", "adapted", "reference-only"}
@@ -154,7 +158,17 @@ def validate_no_obvious_secrets() -> None:
     # not on changelog prose.
     skip_paths = {"CHANGELOG.md"}
     for path in ROOT.rglob("*"):
-        if ".git" in path.parts or "node_modules" in path.parts or path.is_dir() or path.suffix not in checked_suffixes:
+        # Skip .git internals and .claude/worktrees/** (subagent git-worktree checkouts
+        # that re-expose CHANGELOG.md history, triggering credential-shape false positives).
+        # The consecutive-pair guard prevents accidentally skipping unrelated folders named
+        # "worktrees" (e.g. docs/worktrees/**). .git/worktrees/** is already covered by the
+        # ".git" check.
+        _parts = path.parts
+        _in_claude_worktrees = any(
+            _parts[i] == ".claude" and i + 1 < len(_parts) and _parts[i + 1] == "worktrees"
+            for i in range(len(_parts) - 1)
+        )
+        if ".git" in _parts or "node_modules" in _parts or _in_claude_worktrees or path.is_dir() or path.suffix not in checked_suffixes:
             continue
         if path.relative_to(ROOT).as_posix() in skip_paths:
             continue

package/tests/validate-plugin-manifest.py

@@ -73,12 +73,22 @@ def main() -> int:
                 "marketplace plugin source must be './' so the plugin root is the repo root",
             )
 
-    # Version parity
+    # Version parity (plugin.json — top-level)
     if plugin.get("version") != pkg.get("version"):
         errors.append(
             f"plugin.json version {plugin.get('version')!r} does not match package.json {pkg.get('version')!r}",
         )
 
+    # Version parity (marketplace.json — nested under metadata.version).
+    # package.json is the single source of truth; marketplace metadata.version
+    # is synchronized by scripts/release-prepare.mjs during the release commit.
+    marketplace_version = (marketplace.get("metadata") or {}).get("version")
+    if marketplace_version != pkg.get("version"):
+        errors.append(
+            f"marketplace.json metadata.version {marketplace_version!r} "
+            f"does not match package.json {pkg.get('version')!r}",
+        )
+
     # Every agent path resolves
     manifest_paths = plugin.get("agents") or []
     # Note 4: We check containment before existence. A malicious "../x" could