@red-codes/agentguard 1.0.0 → 1.1.2

package/dist/plugins/registry.js

@@ -1,148 +0,0 @@
-// Plugin registry — tracks installed plugins with metadata and persistence.
-//
-// The registry is the lifecycle manager for plugins. It validates manifests
-// at install time, persists the registry to disk (.agentguard/plugins.json),
-// and provides lookup/listing for the CLI and kernel.
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { validatePlugin } from './validator.js';
-const DEFAULT_HOST_VERSION = '1.0.0';
-const REGISTRY_FILENAME = 'plugins.json';
-/**
- * Create a plugin registry backed by a JSON file.
- *
- * The registry validates manifests at install time using the existing
- * plugin validator and persists the installed plugin list to disk.
- */
-export function createPluginRegistry(options) {
-    const storageDir = options?.storageDir ?? '.agentguard';
-    const hostVersion = options?.hostVersion ?? DEFAULT_HOST_VERSION;
-    const registryPath = join(storageDir, REGISTRY_FILENAME);
-    const plugins = new Map();
-    // Load existing registry from disk if present
-    loadFromDisk();
-    function loadFromDisk() {
-        if (!existsSync(registryPath))
-            return;
-        try {
-            const raw = readFileSync(registryPath, 'utf8');
-            const data = JSON.parse(raw);
-            if (data.version === 1 && data.plugins) {
-                plugins.clear();
-                for (const [id, entry] of Object.entries(data.plugins)) {
-                    plugins.set(id, entry);
-                }
-            }
-        }
-        catch {
-            // Corrupt or missing file — start fresh
-        }
-    }
-    function saveToDisk() {
-        const data = {
-            version: 1,
-            plugins: Object.fromEntries(plugins),
-        };
-        mkdirSync(dirname(registryPath), { recursive: true });
-        writeFileSync(registryPath, JSON.stringify(data, null, 2) + '\n', 'utf8');
-    }
-    return {
-        install(manifest, source) {
-            const result = validatePlugin(manifest, hostVersion);
-            if (!result.valid) {
-                return result;
-            }
-            if (plugins.has(manifest.id)) {
-                return {
-                    valid: false,
-                    pluginId: manifest.id,
-                    errors: [
-                        {
-                            field: 'id',
-                            message: `Plugin "${manifest.id}" is already installed. Remove it first to reinstall.`,
-                        },
-                    ],
-                };
-            }
-            // Check dependencies are satisfied
-            if (manifest.dependencies) {
-                for (const dep of manifest.dependencies) {
-                    if (!plugins.has(dep)) {
-                        return {
-                            valid: false,
-                            pluginId: manifest.id,
-                            errors: [
-                                {
-                                    field: 'dependencies',
-                                    message: `Missing dependency: "${dep}" must be installed first`,
-                                },
-                            ],
-                        };
-                    }
-                }
-            }
-            const entry = {
-                manifest,
-                source,
-                installedAt: new Date().toISOString(),
-                enabled: true,
-            };
-            plugins.set(manifest.id, entry);
-            saveToDisk();
-            return result;
-        },
-        remove(pluginId) {
-            // Check if any other plugin depends on this one
-            for (const [id, entry] of plugins) {
-                if (id === pluginId)
-                    continue;
-                if (entry.manifest.dependencies?.includes(pluginId)) {
-                    return false;
-                }
-            }
-            const removed = plugins.delete(pluginId);
-            if (removed) {
-                saveToDisk();
-            }
-            return removed;
-        },
-        get(pluginId) {
-            return plugins.get(pluginId);
-        },
-        has(pluginId) {
-            return plugins.has(pluginId);
-        },
-        enable(pluginId) {
-            const entry = plugins.get(pluginId);
-            if (!entry)
-                return false;
-            plugins.set(pluginId, { ...entry, enabled: true });
-            saveToDisk();
-            return true;
-        },
-        disable(pluginId) {
-            const entry = plugins.get(pluginId);
-            if (!entry)
-                return false;
-            plugins.set(pluginId, { ...entry, enabled: false });
-            saveToDisk();
-            return true;
-        },
-        list() {
-            return [...plugins.values()];
-        },
-        listByType(type) {
-            return [...plugins.values()].filter((p) => p.manifest.type === type);
-        },
-        count() {
-            return plugins.size;
-        },
-        save() {
-            saveToDisk();
-        },
-        reload() {
-            loadFromDisk();
-        },
-    };
-}
-//# sourceMappingURL=registry.js.map

package/dist/plugins/registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/plugins/registry.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,sDAAsD;AAEtD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAgEhD,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,aAAa,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,oBAAoB,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEnD,8CAA8C;IAC9C,YAAY,EAAE,CAAC;IAEf,SAAS,YAAY;QACnB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO;QAEtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;YAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvD,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,MAAM,IAAI,GAAiB;YACzB,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;SACrC,CAAC;QAEF,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,OAAO,CAAC,QAAQ,EAAE,MAAM;YACtB,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACrB,MAAM,EAAE;wBACN;4BACE,KAAK,EAAE,IAAI;4BACX,OAAO,EAAE,WAAW,QAAQ,CAAC,EAAE,uDAAuD;yBACvF;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,mCAAmC;YACnC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAC1B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;oBACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACtB,OAAO;4BACL,KAAK,EAAE,KAAK;4BACZ,QAAQ,EAAE,QAAQ,CAAC,EAAE;4BACrB,MAAM,EAAE;gCACN;oCACE,KAAK,EAAE,cAAc;oCACrB,OAAO,EAAE,wBAAwB,GAAG,2BAA2B;iCAChE;6BACF;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAoB;gBAC7B,QAAQ;gBACR,MAAM;gBACN,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,OAAO,EAAE,IAAI;aACd,CAAC;YAEF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAChC,UAAU,EAAE,CAAC;YAEb,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,QAAQ;YACb,gDAAgD;YAChD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,EAAE,KAAK,QAAQ;oBAAE,SAAS;gBAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC;YACf,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,GAAG,CAAC,QAAQ;YACV,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,GAAG,CAAC,QAAQ;YACV,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,QAAQ;YACb,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,QAAQ;YACd,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI;YACF,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,CAAC;QAED,UAAU,CAAC,IAAI;YACb,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvE,CAAC;QAED,KAAK;YACH,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QAED,IAAI;YACF,UAAU,EAAE,CAAC;QACf,CAAC;QAED,MAAM;YACJ,YAAY,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/plugins/sandbox.d.ts

@@ -1,87 +0,0 @@
-import type { PluginManifest, PluginCapability, SandboxViolation, SandboxConfig } from './types.js';
-/**
- * PluginSandbox — enforces capability boundaries for a single plugin.
- *
- * Created per-plugin at registration time. Tracks granted capabilities
- * and records any violations when a plugin attempts undeclared access.
- *
- * Usage:
- * ```ts
- * const sandbox = createPluginSandbox(manifest);
- * if (sandbox.hasCapability('filesystem:read')) {
- *   // safe to proceed
- * }
- * const result = sandbox.execute(() => plugin.onEvent(event));
- * ```
- */
-export interface PluginSandbox {
-    /** The plugin this sandbox wraps */
-    readonly pluginId: string;
-    /** Check if the plugin has declared a specific capability */
-    hasCapability(capability: PluginCapability): boolean;
-    /** Get all granted capabilities */
-    getCapabilities(): readonly PluginCapability[];
-    /**
-     * Assert that the plugin has a capability. Records a violation if not.
-     * Returns true if the capability is granted, false if denied.
-     */
-    assertCapability(capability: PluginCapability): boolean;
-    /**
-     * Execute a plugin callback with error isolation.
-     * Catches any thrown errors and returns a structured result.
-     * In strict mode, capability violations throw instead of returning.
-     */
-    execute<T>(fn: () => T): SandboxExecutionResult<T>;
-    /**
-     * Execute an async plugin callback with error isolation.
-     */
-    executeAsync<T>(fn: () => Promise<T>): Promise<SandboxExecutionResult<T>>;
-    /** Get all recorded violations for this plugin */
-    getViolations(): readonly SandboxViolation[];
-    /** Number of violations recorded */
-    violationCount(): number;
-}
-/** Result of a sandboxed execution */
-export interface SandboxExecutionResult<T> {
-    readonly success: boolean;
-    readonly value?: T;
-    readonly error?: string;
-    readonly durationMs: number;
-}
-/**
- * Create a sandbox for a plugin based on its manifest.
- *
- * The sandbox:
- * - Grants only capabilities declared in the manifest
- * - Records violations when undeclared capabilities are asserted
- * - Wraps execution with error isolation (try/catch)
- * - Tracks timing for each execution
- */
-export declare function createPluginSandbox(manifest: PluginManifest, config?: SandboxConfig): PluginSandbox;
-/**
- * SandboxRegistry — manages sandboxes for all loaded plugins.
- *
- * Provides centralized access to per-plugin sandboxes and aggregated
- * violation reporting for audit trails.
- */
-export interface SandboxRegistry {
-    /** Create and register a sandbox for a plugin */
-    register(manifest: PluginManifest): PluginSandbox;
-    /** Get the sandbox for a registered plugin */
-    get(pluginId: string): PluginSandbox | undefined;
-    /** Check if a plugin has a sandbox */
-    has(pluginId: string): boolean;
-    /** Remove a plugin's sandbox */
-    unregister(pluginId: string): boolean;
-    /** Get all violations across all plugins */
-    getAllViolations(): readonly SandboxViolation[];
-    /** Number of registered sandboxes */
-    count(): number;
-    /** List all registered plugin IDs */
-    list(): string[];
-}
-/**
- * Create a sandbox registry for managing per-plugin sandboxes.
- */
-export declare function createSandboxRegistry(config?: SandboxConfig): SandboxRegistry;
-//# sourceMappingURL=sandbox.d.ts.map

package/dist/plugins/sandbox.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/plugins/sandbox.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAQpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,6DAA6D;IAC7D,aAAa,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAErD,mCAAmC;IACnC,eAAe,IAAI,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;OAGG;IACH,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAExD;;;;OAIG;IACH,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACH,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1E,kDAAkD;IAClD,aAAa,IAAI,SAAS,gBAAgB,EAAE,CAAC;IAE7C,oCAAoC;IACpC,cAAc,IAAI,MAAM,CAAC;CAC1B;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,MAAM,CAAC,EAAE,aAAa,GACrB,aAAa,CAwEf;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,aAAa,CAAC;IAElD,8CAA8C;IAC9C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IAEjD,sCAAsC;IACtC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/B,gCAAgC;IAChC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAEtC,4CAA4C;IAC5C,gBAAgB,IAAI,SAAS,gBAAgB,EAAE,CAAC;IAEhD,qCAAqC;IACrC,KAAK,IAAI,MAAM,CAAC;IAEhB,qCAAqC;IACrC,IAAI,IAAI,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,eAAe,CAyC7E"}

package/dist/plugins/sandbox.js

@@ -1,122 +0,0 @@
-// Plugin sandbox — runtime capability enforcement for third-party plugins.
-//
-// Wraps plugin execution with capability checks and error isolation.
-// Plugins can only access capabilities they declared in their manifest.
-// Undeclared capability usage is denied and recorded as a violation.
-/** Default sandbox configuration */
-const DEFAULT_CONFIG = {
-    timeoutMs: 5000,
-    strict: false,
-};
-/**
- * Create a sandbox for a plugin based on its manifest.
- *
- * The sandbox:
- * - Grants only capabilities declared in the manifest
- * - Records violations when undeclared capabilities are asserted
- * - Wraps execution with error isolation (try/catch)
- * - Tracks timing for each execution
- */
-export function createPluginSandbox(manifest, config) {
-    const resolvedConfig = { ...DEFAULT_CONFIG, ...config };
-    const grantedCapabilities = new Set(manifest.capabilities ?? []);
-    const violations = [];
-    return {
-        pluginId: manifest.id,
-        hasCapability(capability) {
-            return grantedCapabilities.has(capability);
-        },
-        getCapabilities() {
-            return [...grantedCapabilities];
-        },
-        assertCapability(capability) {
-            if (grantedCapabilities.has(capability)) {
-                return true;
-            }
-            const violation = {
-                pluginId: manifest.id,
-                capability,
-                message: `Plugin "${manifest.id}" attempted to use undeclared capability "${capability}"`,
-                timestamp: Date.now(),
-            };
-            violations.push(violation);
-            if (resolvedConfig.strict) {
-                throw new Error(violation.message);
-            }
-            return false;
-        },
-        execute(fn) {
-            const start = Date.now();
-            try {
-                const value = fn();
-                return { success: true, value, durationMs: Date.now() - start };
-            }
-            catch (err) {
-                return {
-                    success: false,
-                    error: err instanceof Error ? err.message : String(err),
-                    durationMs: Date.now() - start,
-                };
-            }
-        },
-        async executeAsync(fn) {
-            const start = Date.now();
-            try {
-                const value = await fn();
-                return { success: true, value, durationMs: Date.now() - start };
-            }
-            catch (err) {
-                return {
-                    success: false,
-                    error: err instanceof Error ? err.message : String(err),
-                    durationMs: Date.now() - start,
-                };
-            }
-        },
-        getViolations() {
-            return [...violations];
-        },
-        violationCount() {
-            return violations.length;
-        },
-    };
-}
-/**
- * Create a sandbox registry for managing per-plugin sandboxes.
- */
-export function createSandboxRegistry(config) {
-    const sandboxes = new Map();
-    return {
-        register(manifest) {
-            if (sandboxes.has(manifest.id)) {
-                throw new Error(`Sandbox already registered for plugin: "${manifest.id}"`);
-            }
-            const sandbox = createPluginSandbox(manifest, config);
-            sandboxes.set(manifest.id, sandbox);
-            return sandbox;
-        },
-        get(pluginId) {
-            return sandboxes.get(pluginId);
-        },
-        has(pluginId) {
-            return sandboxes.has(pluginId);
-        },
-        unregister(pluginId) {
-            return sandboxes.delete(pluginId);
-        },
-        getAllViolations() {
-            const allViolations = [];
-            for (const sandbox of sandboxes.values()) {
-                allViolations.push(...sandbox.getViolations());
-            }
-            return allViolations.sort((a, b) => a.timestamp - b.timestamp);
-        },
-        count() {
-            return sandboxes.size;
-        },
-        list() {
-            return [...sandboxes.keys()];
-        },
-    };
-}
-//# sourceMappingURL=sandbox.js.map

package/dist/plugins/sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/plugins/sandbox.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AAIrE,oCAAoC;AACpC,MAAM,cAAc,GAA4B;IAC9C,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,KAAK;CACd,CAAC;AA4DF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,MAAsB;IAEtB,MAAM,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACxD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAmB,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QAErB,aAAa,CAAC,UAA4B;YACxC,OAAO,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC;QAED,eAAe;YACb,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;QAClC,CAAC;QAED,gBAAgB,CAAC,UAA4B;YAC3C,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,SAAS,GAAqB;gBAClC,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,UAAU;gBACV,OAAO,EAAE,WAAW,QAAQ,CAAC,EAAE,6CAA6C,UAAU,GAAG;gBACzF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE3B,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAI,EAAW;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,EAAE,EAAE,CAAC;gBACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,YAAY,CAAI,EAAoB;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACvD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,aAAa;YACX,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;QACzB,CAAC;QAED,cAAc;YACZ,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AA+BD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,OAAO;QACL,QAAQ,CAAC,QAAwB;YAC/B,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,GAAG,CAAC,QAAgB;YAClB,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAED,GAAG,CAAC,QAAgB;YAClB,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAED,UAAU,CAAC,QAAgB;YACzB,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,gBAAgB;YACd,MAAM,aAAa,GAAuB,EAAE,CAAC;YAC7C,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzC,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QAED,KAAK;YACH,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;QAED,IAAI;YACF,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/plugins/types.d.ts

@@ -1,61 +0,0 @@
-/** Supported plugin types in the AgentGuard ecosystem */
-export type PluginType = 'renderer' | 'replay-processor' | 'policy-pack';
-/**
- * Capabilities a plugin may request.
- *
- * Plugins declare required capabilities in their manifest. The sandbox
- * grants only declared capabilities — any undeclared access is denied.
- */
-export type PluginCapability = 'filesystem:read' | 'filesystem:write' | 'network' | 'process:spawn' | 'events:emit' | 'events:subscribe';
-/** All known capabilities for validation */
-export declare const VALID_CAPABILITIES: readonly PluginCapability[];
-/**
- * Plugin manifest — the metadata every plugin must provide.
- *
- * This is validated at load time before the plugin is registered.
- * Think of it as the plugin's "package.json" for AgentGuard.
- */
-export interface PluginManifest {
-    /** Unique identifier (e.g., "agentguard-renderer-json") */
-    readonly id: string;
-    /** Human-readable display name */
-    readonly name: string;
-    /** Plugin version (semver, e.g., "1.2.0") */
-    readonly version: string;
-    /** Brief description of what the plugin does */
-    readonly description?: string;
-    /** The type of plugin */
-    readonly type: PluginType;
-    /** Required AgentGuard API version (semver range, e.g., "^1.0.0" or ">=1.0.0") */
-    readonly apiVersion: string;
-    /** Capabilities this plugin requires at runtime */
-    readonly capabilities?: readonly PluginCapability[];
-    /** Other plugin IDs this plugin depends on */
-    readonly dependencies?: readonly string[];
-}
-/** Individual validation error with a field path and message */
-export interface PluginValidationError {
-    readonly field: string;
-    readonly message: string;
-}
-/** Result of validating a plugin manifest */
-export interface PluginValidationResult {
-    readonly valid: boolean;
-    readonly pluginId: string | undefined;
-    readonly errors: readonly PluginValidationError[];
-}
-/** Result of a sandbox capability check */
-export interface SandboxViolation {
-    readonly pluginId: string;
-    readonly capability: string;
-    readonly message: string;
-    readonly timestamp: number;
-}
-/** Configuration for the plugin sandbox */
-export interface SandboxConfig {
-    /** Maximum execution time per callback in milliseconds (default: 5000) */
-    readonly timeoutMs?: number;
-    /** Whether to throw on violation or silently deny (default: false = silent) */
-    readonly strict?: boolean;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/plugins/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":"AAOA,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,kBAAkB,GAClB,SAAS,GACT,eAAe,GACf,aAAa,GACb,kBAAkB,CAAC;AAEvB,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EAOzD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpD,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6CAA6C;AAC7C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,2CAA2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B"}

package/dist/plugins/types.js

@@ -1,16 +0,0 @@
-// Plugin system type definitions — manifest schema, capabilities, and validation results.
-//
-// All third-party plugins (renderers, replay processors, policy packs) must provide
-// a PluginManifest describing their metadata, required capabilities, and API version
-// compatibility. The validation and sandboxing layer uses these declarations to
-// enforce security boundaries at load time and runtime.
-/** All known capabilities for validation */
-export const VALID_CAPABILITIES = [
-    'filesystem:read',
-    'filesystem:write',
-    'network',
-    'process:spawn',
-    'events:emit',
-    'events:subscribe',
-];
-//# sourceMappingURL=types.js.map

package/dist/plugins/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,oFAAoF;AACpF,qFAAqF;AACrF,gFAAgF;AAChF,wDAAwD;AAmBxD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAgC;IAC7D,iBAAiB;IACjB,kBAAkB;IAClB,SAAS;IACT,eAAe;IACf,aAAa;IACb,kBAAkB;CACnB,CAAC"}

package/dist/plugins/validator.d.ts

@@ -1,36 +0,0 @@
-import type { PluginValidationResult } from './types.js';
-/**
- * Validate a plugin manifest for structural correctness.
- *
- * Checks:
- * - Required fields: id, name, version, type, apiVersion
- * - String format: non-empty strings, valid semver
- * - Plugin type: must be a known PluginType
- * - Capabilities: all entries must be known PluginCapability values
- * - Dependencies: must be non-empty strings if provided
- */
-export declare function validateManifest(manifest: unknown): PluginValidationResult;
-/**
- * Check if a plugin's declared apiVersion is compatible with the host API version.
- *
- * Supports simple semver range operators:
- * - `^1.0.0` — compatible with 1.x.x (major must match, minor/patch >= specified)
- * - `~1.2.0` — compatible with 1.2.x (major+minor must match, patch >= specified)
- * - `>=1.0.0` — any version >= 1.0.0
- * - `1.0.0` — exact match (treated as ^1.0.0 for convenience)
- */
-export declare function checkApiVersionCompatibility(pluginApiVersion: string, hostVersion: string): {
-    compatible: boolean;
-    reason?: string;
-};
-/**
- * Fully validate a plugin manifest including API version compatibility.
- *
- * This is the main entry point for plugin validation. It runs:
- * 1. Structural validation (validateManifest)
- * 2. API version compatibility check (checkApiVersionCompatibility)
- *
- * Returns a combined result with all errors.
- */
-export declare function validatePlugin(manifest: unknown, hostVersion: string): PluginValidationResult;
-//# sourceMappingURL=validator.d.ts.map

package/dist/plugins/validator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/plugins/validator.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAIV,sBAAsB,EAEvB,MAAM,YAAY,CAAC;AAYpB;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,sBAAsB,CA4G1E;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,GAClB;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA2G1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,sBAAsB,CAyB7F"}