@raishin/vanguard-frontier-agentic 3.1.0 → 3.2.0

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/schemas/model-policy.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://github.com/Raishin/vanguard-frontier-agentic/schemas/model-policy.schema.json",
+  "title": "VFA Model Policy",
+  "description": "Per-harness model and reasoning-effort policy for agent harness variants. Canonical intent consumed by scripts/model-policy.mjs, which projects it into executable harness files and generates catalog/model-assignments.json. Precedence: agent > role > provider > all; 'auto' omits the managed field so the harness runtime default applies.",
+  "type": "object",
+  "required": ["manifest_version", "rules"],
+  "additionalProperties": false,
+  "properties": {
+    "manifest_version": {
+      "const": 1
+    },
+    "description": {
+      "type": "string"
+    },
+    "defaults": {
+      "type": "object",
+      "description": "Informational: the implicit baseline when no rule matches. Both fields are constitutionally 'auto'.",
+      "required": ["model", "reasoning_effort"],
+      "additionalProperties": false,
+      "properties": {
+        "model": { "const": "auto" },
+        "reasoning_effort": { "const": "auto" }
+      }
+    },
+    "rules": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["scope", "harness"],
+        "additionalProperties": false,
+        "anyOf": [
+          { "required": ["model"] },
+          { "required": ["reasoning_effort"] }
+        ],
+        "properties": {
+          "scope": {
+            "type": "string",
+            "pattern": "^(all|(provider|role|agent):[a-z0-9][a-z0-9-]*)$",
+            "description": "Targeting scope: 'all', 'provider:<id>', 'role:<id>' (install-roles.json), or 'agent:<id>'."
+          },
+          "harness": {
+            "type": "string",
+            "enum": ["codex", "copilot", "claude-code", "cursor", "gemini", "kiro"]
+          },
+          "model": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]*$",
+            "description": "Model name for this harness, or 'auto' to clear the field. This pattern is shape only (union of every harness's charset, including codex's ':' for Ollama name:tag and '/' for OpenRouter author/model); registry membership per harness is enforced by scripts/model-policy.mjs check against catalog/model-registry.json."
+          },
+          "reasoning_effort": {
+            "type": "string",
+            "enum": ["auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"],
+            "description": "Reasoning effort for harnesses that support it (codex, claude-code today). This is the union vocabulary across harnesses; the per-harness subset (codex: none|minimal|low|medium|high|xhigh; claude-code: low|medium|high|xhigh|max; cursor: no reasoning_effort field — unsupported, not even 'none') is enforced by scripts/model-policy.mjs check against catalog/model-registry.json. 'auto' clears the field."
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/model-registry.schema.json

@@ -0,0 +1,127 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://github.com/Raishin/vanguard-frontier-agentic/schemas/model-registry.schema.json",
+  "title": "VFA Model Registry",
+  "description": "Verified model-name and reasoning-effort capability matrix per harness. Consumed by scripts/model-policy.mjs to fail closed on values that would 404 (model_not_found) or be silently dropped at request time. Namespaces are evaluated in array order; the first whose 'match' pattern accepts the value classifies it. 'closed' membership requires the model to be listed in 'models'; 'open' namespaces (catalogs too large to enumerate, e.g. Ollama/OpenRouter) validate shape only. Refresh via .claude/skills/model-registry-refresh/SKILL.md; human-readable companion: docs/model-policy-matrix.md.",
+  "type": "object",
+  "required": ["manifest_version", "last_refreshed", "harnesses"],
+  "additionalProperties": false,
+  "properties": {
+    "manifest_version": { "const": 1 },
+    "description": { "type": "string" },
+    "last_refreshed": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
+      "description": "Date the registry as a whole was last re-verified against official documentation."
+    },
+    "harnesses": {
+      "type": "object",
+      "required": ["codex", "claude-code", "cursor"],
+      "additionalProperties": false,
+      "properties": {
+        "codex": { "$ref": "#/definitions/harness" },
+        "claude-code": { "$ref": "#/definitions/harness" },
+        "cursor": { "$ref": "#/definitions/harness" }
+      }
+    }
+  },
+  "definitions": {
+    "harness": {
+      "type": "object",
+      "required": ["reasoning_key", "reasoning_efforts", "namespaces"],
+      "additionalProperties": false,
+      "properties": {
+        "reasoning_key": {
+          "type": ["string", "null"],
+          "description": "Config key the harness uses for reasoning effort (codex: model_reasoning_effort in codex.toml; claude-code: effort in frontmatter). null = harness has no projectable reasoning field."
+        },
+        "reasoning_efforts": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "^[a-z]+$" },
+          "description": "Complete vocabulary of effort values the harness accepts. Empty = no reasoning field."
+        },
+        "reasoning_note": { "type": "string" },
+        "namespaces": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/namespace" }
+        }
+      }
+    },
+    "namespace": {
+      "type": "object",
+      "required": ["id", "match", "membership"],
+      "additionalProperties": false,
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]*$" },
+        "description": { "type": "string" },
+        "match": {
+          "type": "string",
+          "description": "Anchored (^...$) regular expression classifying a model value into this namespace. Evaluated in array order; first match wins."
+        },
+        "membership": {
+          "enum": ["closed", "open"],
+          "description": "closed: value must appear in 'models' (fail closed on unregistered names). open: shape-validated only; catalog too large/volatile to enumerate."
+        },
+        "model_provider": {
+          "type": ["string", "null"],
+          "description": "codex only: value projected as model_provider in codex.toml when a model in this namespace is assigned. null = default provider (no line projected)."
+        },
+        "requires_provider_table": {
+          "type": "boolean",
+          "description": "codex only: the operator's codex config must define a matching [model_providers.<id>] table for this route to work."
+        },
+        "reasoning_efforts": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "^[a-z]+$" },
+          "description": "Effort values verified to work for models routed through this namespace. Overrides the harness vocabulary; empty = pinning reasoning onto this namespace fails check (fail closed)."
+        },
+        "reasoning_note": { "type": "string" },
+        "sources": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Official documentation URLs / Context7 library IDs backing this namespace's entries."
+        },
+        "examples": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Advisory sample values for open namespaces (not an allowlist)."
+        },
+        "models": {
+          "type": "array",
+          "items": { "$ref": "#/definitions/model" },
+          "description": "Verified allowlist for closed namespaces."
+        }
+      }
+    },
+    "model": {
+      "type": "object",
+      "required": ["id", "last_verified"],
+      "additionalProperties": false,
+      "properties": {
+        "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]*$" },
+        "reasoning_efforts": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "^[a-z]+$" },
+          "description": "Effort values this model supports. Omitted = inherit the namespace (or harness) vocabulary. Empty array = non-reasoning model; pinning any effort fails check."
+        },
+        "last_verified": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$" },
+        "source": { "type": "string" },
+        "note": { "type": "string" },
+        "status": {
+          "enum": ["available", "retiring", "retired"],
+          "description": "Provider lifecycle state. Omitted = available. 'retiring' = provider announced a shutdown; policies pinning it get warnings everywhere (check/apply/report, assignments index, TUI). 'retired' = shutdown effective; projection falls back to the documented successor (chain-followed) with a loud warning until the policy is migrated. Behavior is driven ONLY by this committed field, never by the wall clock — flip it via the model-registry-refresh workflow."
+        },
+        "retirement_date": {
+          "type": "string",
+          "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
+          "description": "Provider-announced shutdown date (informational, surfaced in warnings; does not itself change projection)."
+        },
+        "successor": {
+          "type": "string",
+          "description": "Documented replacement model id within the same namespace. Required when status is 'retired' (it is the fallback target); strongly recommended for 'retiring'. Must reference an existing model entry; chains must terminate at a non-retired model."
+        }
+      }
+    }
+  }
+}

package/scripts/export-marketplace-agents.mjs

@@ -273,16 +273,6 @@ function ensurePlatform(platform) {
 }
 
 function assertWithin(parent, child, label) {
-  // Lexical containment check — path.resolve() is purely string-based and does
-  // NOT follow symlinks. This guards against traversal strings (../../) and
-  // metadata.json with absolute paths outside the repo.
-  //
-  // Residual TOCTOU: if an adversary races to create a symlink at `child`
-  // AFTER this check but BEFORE the actual write, the symlink target would be
-  // written to. copyFile()/copySkillTree() use lstatSync on source AND
-  // destination to detect pre-existing symlinks, which closes the window for
-  // the common case. A fully TOCTOU-proof solution requires O_NOFOLLOW at the
-  // kernel level, which is not exposed by Node.js fs APIs.
   const resolvedParent = path.resolve(parent);
   const resolvedChild = path.resolve(child);
   const sep = path.sep;
@@ -295,6 +285,47 @@ function assertWithin(parent, child, label) {
   }
 }
 
+function assertNoSymlinkAncestor(parent, child, label) {
+  assertWithin(parent, child, label);
+
+  const resolvedParent = path.resolve(parent);
+  const resolvedChild = path.resolve(child);
+  const relativeParent = path.dirname(path.relative(resolvedParent, resolvedChild));
+  if (!relativeParent || relativeParent === ".") return;
+
+  let current = resolvedParent;
+  for (const part of relativeParent.split(path.sep)) {
+    current = path.join(current, part);
+    let stat;
+    try {
+      stat = fs.lstatSync(current);
+    } catch (err) {
+      if (err && err.code === "ENOENT") return;
+      throw err;
+    }
+    if (stat.isSymbolicLink()) {
+      throw new Error(
+        `Refusing to ${label}: symbolic link ancestor '${current}' would redirect writes outside '${resolvedParent}'. ` +
+        `Remove the symlink and retry.`
+      );
+    }
+    if (!stat.isDirectory()) {
+      throw new Error(
+        `Refusing to ${label}: path ancestor '${current}' is not a directory.`
+      );
+    }
+  }
+}
+
+function assertSafeWriteDestination(parent, destination, label) {
+  // Lexical containment blocks traversal strings and absolute-path metadata.
+  // The ancestor walk then rejects pre-existing symlinks such as `.codex -> /x`
+  // before mkdir/copy can follow them. Node does not expose fully race-proof
+  // O_NOFOLLOW directory creation, so this intentionally closes the reachable
+  // planted-symlink case without pretending to solve privileged TOCTOU races.
+  assertNoSymlinkAncestor(parent, destination, label);
+}
+
 function loadSkills() {
   const skillsRoot = path.join(repoRoot, "skills");
   if (!fs.existsSync(skillsRoot)) return new Map();
@@ -325,11 +356,12 @@ function loadSkills() {
   return byName;
 }
 
-function copySkillTree(sourceDir, destDir, force) {
+function copySkillTree(sourceDir, destDir, force, targetRoot) {
   assertWithin(repoRoot, sourceDir, "read skill source");
   for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
     const src = path.join(sourceDir, entry.name);
     const dst = path.join(destDir, entry.name);
+    assertSafeWriteDestination(targetRoot, dst, "write skill tree destination");
     if (entry.isSymbolicLink()) {
       throw new Error(`Refusing to copy symbolic link in skill tree: ${src}`);
     }
@@ -342,7 +374,7 @@ function copySkillTree(sourceDir, destDir, force) {
       );
     }
     if (entry.isDirectory()) {
-      copySkillTree(src, dst, force);
+      copySkillTree(src, dst, force, targetRoot);
       continue;
     }
     if (!entry.isFile()) continue;
@@ -404,7 +436,8 @@ function resolveCompanionSkills(selectedAgents, skillsByName, role, includeAll,
   return { skillNames: [...skillNames].sort(), orphans };
 }
 
-function copyFile(source, destination, force) {
+function copyFile(source, destination, force, targetRoot) {
+  assertSafeWriteDestination(targetRoot, destination, "write file destination");
   const sourceStat = fs.lstatSync(source);
   if (sourceStat.isSymbolicLink()) {
     throw new Error(`Refusing to copy symbolic link as harness source: ${source}`);
@@ -662,7 +695,7 @@ function main() {
 
   for (const operation of operations) {
     assertWithin(args.repo, operation.dest, "write destination");
-    copyFile(operation.source, operation.dest, args.force);
+    copyFile(operation.source, operation.dest, args.force, args.repo);
     if (platform === "codex") {
       rewriteCodexAgentSkillPaths(operation.dest, args.repo);
     }
@@ -705,7 +738,7 @@ function main() {
       if (!sourceDir) continue;
       const destDir = path.join(args.repo, skillsDestRoot, skillName);
       assertWithin(args.repo, destDir, "write skill destination");
-      copySkillTree(sourceDir, destDir, args.force);
+      copySkillTree(sourceDir, destDir, args.force, args.repo);
       console.log(`installed\tskill:${skillName}\t${platform}\t${path.relative(args.repo, destDir)}`);
       bundled += 1;
     }