@raishin/vanguard-frontier-agentic 3.15.0 → 3.17.0

package/mods/secret-redactor/lib/runtime.mjs

@@ -0,0 +1,140 @@
+// Command-hook runtime for the mods under mods/. scripts/generate-mods.mjs copies this file
+// byte-for-byte to mods/<id>/lib/runtime.mjs, so edit it here and run `npm run mods:write`.
+//
+// A mod's bin/hook.mjs hands its handlers to runHook, which reads the harness payload from
+// stdin and renders the handler's decision in that harness's protocol. It writes no files
+// and reads no environment; Claude Code's native runtime never imports it.
+import { readFileSync } from 'node:fs'
+import { isAbsolute, resolve, sep } from 'node:path'
+
+const HARNESSES = new Set(['claude-code', 'kiro', 'codex'])
+const EVENTS = new Set(['PreToolUse', 'PostToolUse', 'SessionStart'])
+const DECISIONS = new Set(['allow', 'deny', 'ask', 'replace', 'context'])
+
+const nodeIo = () => ({
+  argv: process.argv.slice(2),
+  readStdin: () => readFileSync(0, 'utf8'),
+  out: (s) => process.stdout.write(s),
+  err: (s) => process.stderr.write(s),
+})
+
+const message = (err) => (err instanceof Error ? err.message : String(err))
+
+// JSON.parse errors quote the text they failed on, and stdin can carry a tool's input or
+// output: report the failure without echoing any of it.
+function parseStdin(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    throw new Error('stdin is not valid JSON')
+  }
+}
+
+export function parseArgs(argv) {
+  const usage = 'usage: hook.mjs --harness <claude-code|kiro|codex> --event <PreToolUse|PostToolUse|SessionStart>'
+  if (argv.length !== 4) throw new Error(usage)
+  const args = {}
+  for (let i = 0; i < 4; i += 2) {
+    const key = { '--harness': 'harness', '--event': 'event' }[argv[i]]
+    if (!key || key in args) throw new Error(usage)
+    args[key] = argv[i + 1]
+  }
+  if (!HARNESSES.has(args.harness)) throw new Error(`unknown harness ${args.harness}; ${usage}`)
+  if (!EVENTS.has(args.event)) throw new Error(`unknown event ${args.event}; ${usage}`)
+  return args
+}
+
+// Where an observer writes `path`. A relative path resolves against the project root when
+// the hook runs from its install location <root>/.<harness dir>/vanguard-mods/<id>/bin/,
+// otherwise against the working directory. Never CLAUDE_PROJECT_DIR: mods read only their
+// own VANGUARD_<ID>_* variables.
+export function projectPath(path, harness, binDir) {
+  if (isAbsolute(path)) return path
+  const parts = resolve(binDir).split(sep)
+  const n = parts.length
+  const dir = { 'claude-code': '.claude', kiro: '.kiro', codex: '.codex' }[harness]
+  const installed = n >= 5 && parts[n - 1] === 'bin' && parts[n - 3] === 'vanguard-mods' && parts[n - 4] === dir
+  return resolve(installed ? parts.slice(0, n - 4).join(sep) || sep : process.cwd(), path)
+}
+
+// Rejects decisions the harness cannot express, so a handler bug surfaces as an error
+// instead of a silently dropped verdict.
+function normalize(d, { harness, event }) {
+  if (d === undefined) return { decision: 'allow', log: [] }
+  if (d === null || typeof d !== 'object' || !DECISIONS.has(d.decision)) {
+    throw new Error(`handler returned an invalid decision: ${JSON.stringify(d)}`)
+  }
+  const log = d.log ?? []
+  if (!Array.isArray(log) || !log.every((l) => typeof l === 'string')) throw new Error('decision log must be a string array')
+  const needs = { deny: 'reason', ask: 'reason', context: 'text' }[d.decision]
+  if (needs && (typeof d[needs] !== 'string' || d[needs] === '')) throw new Error(`${d.decision} needs a ${needs}`)
+  if ((d.decision === 'deny' || d.decision === 'ask') && event !== 'PreToolUse') {
+    throw new Error(`${d.decision} is only valid for PreToolUse, not ${event}`)
+  }
+  if (d.decision === 'replace' && (harness !== 'claude-code' || event !== 'PostToolUse')) {
+    throw new Error(`replace is only valid for claude-code PostToolUse, not ${harness} ${event}`)
+  }
+  return { ...d, log }
+}
+
+function render(d, { harness, event }, io) {
+  const json = (hookSpecificOutput) => io.out(JSON.stringify({ hookSpecificOutput: { hookEventName: event, ...hookSpecificOutput } }) + '\n')
+  for (const line of d.log) io.err(line + '\n')
+  switch (d.decision) {
+    case 'allow':
+      return 0
+    case 'deny':
+    case 'ask':
+      if (harness === 'claude-code') {
+        json({ permissionDecision: d.decision, permissionDecisionReason: d.reason })
+        return 0
+      }
+      // Kiro and Codex have no confirmation step; exit 2 blocks the call in both.
+      io.err(d.decision === 'ask' ? `${d.reason} (confirmation unsupported on ${harness}; denied)\n` : `${d.reason}\n`)
+      return 2
+    case 'replace':
+      json({ updatedToolOutput: d.output })
+      return 0
+    case 'context':
+      if (harness === 'kiro') io.err(d.text + '\n')
+      else json({ additionalContext: d.text })
+      return 0
+  }
+}
+
+// Runs one hook invocation and returns the exit code; bin/hook.mjs sets process.exitCode
+// with it rather than calling process.exit, so buffered stdout is never cut short.
+//
+// - Bad arguments, or an event this mod has no handler for: exit 2, which blocks a
+//   PreToolUse call in every harness (a broken install must not allow silently).
+// - Invalid stdin or a throwing handler: `onError(err, payload, ctx)` supplies the decision
+//   (guards deny, the redactor withholds). Without onError: stderr and exit 1, which is
+//   loud but does not block.
+// - An onError that throws or returns an invalid decision: exit 2.
+export async function runHook({ name, handlers, onError }, io = nodeIo()) {
+  let ctx
+  try {
+    ctx = parseArgs(io.argv)
+    if (!Object.hasOwn(handlers, ctx.event)) throw new Error(`no handler for ${ctx.event}`)
+  } catch (err) {
+    io.err(`${name}: ${message(err)}\n`)
+    return 2
+  }
+  let payload
+  let decision
+  try {
+    payload = parseStdin(io.readStdin())
+    if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) throw new Error('stdin is not a JSON object')
+    decision = normalize(await handlers[ctx.event](payload, ctx), ctx)
+  } catch (err) {
+    io.err(`${name}: ${message(err)}\n`)
+    if (typeof onError !== 'function') return 1
+    try {
+      decision = normalize(await onError(err, payload, ctx), ctx)
+    } catch (err2) {
+      io.err(`${name}: error handler failed: ${message(err2)}\n`)
+      return 2
+    }
+  }
+  return render(decision, ctx, io)
+}

package/mods/secret-redactor/mod.toml

@@ -0,0 +1,43 @@
+[mod]
+id = "secret-redactor"
+name = "Secret Redactor"
+description = "Asks before tool calls whose input carries a credential and redacts credentials from tool output."
+version = "1.0.0"
+reach_level = 0
+events = ["PreToolUse", "PostToolUse"]
+
+[footprint]
+env_reads = ["VANGUARD_SECRET_REDACTOR_PATTERNS"]
+file_writes = []
+spawns = []
+egress_hosts = []
+
+[harnesses.claude-code]
+supported = true
+surfaces = ["native", "classic"]
+events = ["PreToolUse", "PostToolUse"]
+
+[harnesses.claude-code.degraded]
+classic = "Classic PostToolUse fires only after a tool succeeds, so output from a failed tool is not redacted."
+
+[harnesses.kiro]
+supported = true
+requires = ["node"]
+events = ["PreToolUse"]
+
+[harnesses.kiro.unsupported]
+PostToolUse = "Kiro documents no way for a hook to replace tool output, so output cannot be redacted."
+
+[harnesses.kiro.degraded]
+PreToolUse = "Kiro documents no confirmation protocol or stdin field names; the whole payload is scanned and a hit is denied."
+
+[harnesses.codex]
+supported = true
+requires = ["node"]
+events = ["PreToolUse"]
+
+[harnesses.codex.unsupported]
+PostToolUse = "Codex PostToolUse cannot replace tool output, so output cannot be redacted."
+
+[harnesses.codex.degraded]
+PreToolUse = "Codex rejects ask; a hit is denied with a reason."

package/mods/secret-redactor/patterns.json

@@ -0,0 +1,74 @@
+[
+  {
+    "id": "github-fine-grained-pat",
+    "name": "GitHub fine-grained personal access token",
+    "description": "github_pat_ prefix followed by 22+ [A-Za-z0-9_]. Listed before github-pat so a fine-grained body that happens to contain ghp_ is consumed whole.",
+    "regex": "github_pat_[A-Za-z0-9_]{22,255}",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "github-pat",
+    "name": "GitHub token (ghp/gho/ghu/ghs/ghr)",
+    "description": "GitHub classic PAT / OAuth / user-to-server / server-to-server / refresh token: 3-letter prefix, underscore, 36-255 alphanumerics.",
+    "regex": "(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "aws-secret-key",
+    "name": "AWS secret access key (context-anchored)",
+    "description": "40+ chars of [A-Za-z0-9/+] ONLY when preceded by an AWS secret-key name (aws_secret_access_key, AWS_SECRET_KEY, SecretAccessKey, secretAccessKey, --aws-secret-access-key ...) plus a separator (:, =, =>, or whitespace) with optional quotes/escaped quotes. A bare 40-char base62 run is deliberately NOT matched: it is indistinguishable from a 40-hex git SHA. The match consumes the key name and separator. Listed before aws-access-key so an AKIA-looking prefix inside the value cannot split the secret.",
+    "regex": "(?:aws[_.-]?secret[_.-]?(?:access[_.-]?)?key|secret[_.-]?access[_.-]?key)[\\\\\"']{0,4}(?:[ \\t]*(?::|=>?)[ \\t\\r\\n]*|[ \\t]+)[\\\\\"']{0,4}[A-Za-z0-9/+]{40,}",
+    "flags": "i",
+    "severity": "critical",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "aws-access-key",
+    "name": "AWS access key ID",
+    "description": "AKIA (long-term) or ASIA (STS temporary) followed by 16 uppercase alphanumerics. No boundary anchors (no lookbehind available): fails closed, may over-redact inside long uppercase blobs.",
+    "regex": "(?:AKIA|ASIA)[0-9A-Z]{16}",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "generic-bearer",
+    "name": "HTTP Bearer token",
+    "description": "Bearer (any case) + horizontal whitespace + 16+ token chars [A-Za-z0-9._~+/-] + optional = padding. Spec said '+'; 16+ avoids redacting prose such as 'bearer of'. Token class excludes '[' so it can never extend into a [REDACTED:..] marker.",
+    "regex": "bearer[ \\t]+[A-Za-z0-9._~+/-]{16,}=*",
+    "flags": "i",
+    "severity": "high",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  },
+  {
+    "id": "password-in-url",
+    "name": "Credentials embedded in URL",
+    "description": "scheme://user:password@ . Scheme bounded to 30 chars (avoids quadratic scans on long alnum runs). User/password classes exclude whitespace, quotes, backslash, '/', '@', angle brackets and backtick, so a match cannot cross whitespace, a JSON string quote, or a path. Must stay LAST in the array: its password class accepts '[' and ':' so it can swallow earlier [REDACTED:..] markers (harmless, single pass), and nothing after it can re-form.",
+    "regex": "[A-Za-z][A-Za-z0-9+.-]{0,30}://[^ \\t\\r\\n\"'\\\\/@:?#<>`]*:[^ \\t\\r\\n\"'\\\\/@<>`]+@",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "tool-input",
+      "tool-output"
+    ]
+  }
+]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "3.15.0",
+  "version": "3.17.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -31,6 +31,7 @@
     "agents/",
     "rules/",
     "mcp/",
+    "mods/",
     "templates/",
     "assets/",
     "tests/"
@@ -68,6 +69,7 @@
     "validate:frontend-security-detection": "python3 tests/validate-frontend-security-detection.py",
     "validate:agent-tool-tiers": "python3 tests/validate-agent-tool-tiers.py",
     "validate:istio-review-suite": "python3 -m unittest discover -s tests/istio-review-suite -p \"test_*.py\" -v",
+    "validate:agentic-board": "python3 -m unittest discover -s tests/agentic-board-suite -p \"test_*.py\"",
     "agent-tool-tiers:write": "python3 tests/validate-agent-tool-tiers.py --write",
     "readme-counts:write": "node scripts/generate-readme-counts.mjs",
     "board-counts:write": "node scripts/generate-board-counts.mjs",
@@ -77,15 +79,18 @@
     "cursor-plugin:write": "node scripts/generate-cursor-plugin.mjs",
     "kiro-powers:write": "node scripts/generate-kiro-powers.mjs",
     "asset-integrity:write": "python3 tests/validate-asset-integrity.py --write",
+    "mods:write": "node scripts/generate-mods.mjs",
+    "validate:mods": "python3 tests/validate-mods.py",
+    "test:mods": "node --test tests/mods.test.mjs",
     "model-policy:check": "node scripts/model-policy.mjs check",
     "model-policy:apply": "node scripts/model-policy.mjs apply",
     "model-policy:report": "node scripts/model-policy.mjs report",
-    "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & npm run board-counts:write & npm run workflow-catalog:write & wait",
+    "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & npm run board-counts:write & npm run workflow-catalog:write & npm run mods:write & wait",
     "test:copilot-bundling": "python3 tests/test-copilot-skill-bundling.py",
     "test:gemini-bundling": "python3 tests/test-gemini-skill-bundling.py",
     "test:cursor-kiro-notices": "node tests/export-cursor-kiro-skill-notice.test.mjs",
     "test:fuzz": "node tests/fuzz-properties.test.mjs",
-    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-coherence && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:model-policy && npm run validate:model-params && npm run validate:links && npm run validate:asset-integrity && npm run validate:tracked-secrets && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:board-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection && npm run validate:agent-tool-tiers && npm run validate:istio-review-suite && npm run validate:workflow-catalog && npm run validate:release-notes",
+    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-coherence && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:model-policy && npm run validate:model-params && npm run validate:links && npm run validate:asset-integrity && npm run validate:tracked-secrets && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:board-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection && npm run validate:agent-tool-tiers && npm run validate:istio-review-suite && npm run validate:agentic-board && npm run validate:workflow-catalog && npm run validate:release-notes && npm run validate:mods",
     "release:sbom": "command -v syft >/dev/null 2>&1 && syft scan dir:. -o spdx-json=sbom.spdx.json || echo 'syft not installed; SBOM is generated in CI by anchore/sbom-action'",
     "lint:md": "npx --yes markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#.code-review-graph\" \"#CHANGELOG.md\"",
     "lint:spell": "codespell",
@@ -103,7 +108,7 @@
     "@semantic-release/github": "12.0.10",
     "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "14.1.1",
-    "conventional-changelog-conventionalcommits": "10.4.0",
+    "conventional-changelog-conventionalcommits": "10.4.1",
     "fast-check": "^4.7.0",
     "semantic-release": "25.0.9"
   },

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.15.0",
+  "version": "3.17.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "VincentChuWaiChow",

package/powers/vanguard-generic/POWER.md

@@ -1,13 +1,13 @@
 ---
 name: "vanguard-generic"
 displayName: "Vanguard Frontier — Generic"
-description: "Curated Generic review agents covering ci test pipeline, helm chart quality, kubernetes manifest quality, llm ai pipeline test. Reference agents directly under agents/generic/. Static review only; no live mutations."
-keywords: ["test-quality", "ci-pipeline", "helm-chart", "manifest-review"]
+description: "Curated Generic review agents covering agentic security, agentic system architecture, ci test pipeline, helm chart quality. Reference agents directly under agents/cross-functional/ and agents/qa/. Static review only; no live mutations."
+keywords: ["test-quality", "ci-pipeline", "helm-chart", "manifest-review", "agentic-security", "multi-agent-architecture"]
 author: "VincentChuWaiChow"
 ---
 # Vanguard Frontier — Generic
 
-Curated Generic review agents covering ci test pipeline, helm chart quality, kubernetes manifest quality, llm ai pipeline test. Reference agents directly under agents/generic/. Static review only; no live mutations.
+Curated Generic review agents covering agentic security, agentic system architecture, ci test pipeline, helm chart quality. Reference agents directly under agents/cross-functional/ and agents/qa/. Static review only; no live mutations.
 
 ## When to engage this Power
 
@@ -17,7 +17,7 @@ Activate when the task references Generic services, resources, or operations. Do
 
 - *(no maestro for this provider; reference agents directly under `agents/generic/`)*
 
-Reference agents directly from agents/generic/ without maestro-based routing.
+Reference agents directly from agents/cross-functional/ and agents/qa/ without maestro-based routing.
 
 ## Live-guard agents (gate_mode only)
 
@@ -28,11 +28,11 @@ Live-guard agents enforce approval, target confirmation, evidence capture, and r
 ## Invariants
 
 - Static review only -- agents analyze configuration and provide findings without mutating live systems.
-- Agents are provider-agnostic and focus on CI, Helm, manifest, and test-quality patterns.
+- Agents are provider-agnostic: CI, Helm, manifest, and test-quality review under agents/qa/; cross-tier revenue-journey integrity and vendor-neutral agentic system architecture and security review under agents/cross-functional/. The agentic reviewers hand off through skills/cross-functional/agentic-board-protocol and never approve or execute.
 
 ## Where the agents live
 
-Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/generic/` in that repository. 10 of 11 agents in this provider ship a Kiro adapter; the rest provide steering context only.
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/cross-functional/` and `agents/qa/` in that repository. 12 of 13 agents in this provider ship a Kiro adapter; the rest provide steering context only.
 
 ## Companion install paths
 

package/powers/vanguard-kubernetes/POWER.md

@@ -40,7 +40,7 @@ Live-guard agents enforce approval, target confirmation, evidence capture, and r
 
 ## Where the agents live
 
-Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/kubernetes/` in that repository. All 16 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/finops/` and `agents/kubernetes/` in that repository. All 16 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
 
 ## Companion install paths
 

package/powers/vanguard-multi-cloud/POWER.md

@@ -33,7 +33,7 @@ Live-guard agents enforce approval, target confirmation, evidence capture, and r
 
 ## Where the agents live
 
-Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/multi-cloud/` in that repository. All 3 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/finops/` in that repository. All 3 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
 
 ## Companion install paths