@rynx-ai/daemon 0.1.10 → 0.1.11-beta.2

package/dist/plugin-marketplace.js

@@ -0,0 +1,299 @@
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, } from "node:fs";
+import { isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+import { MARKETPLACE_ID_PATTERN, parsePluginMarketplace, } from "@rynx-ai/plugin-sdk";
+import { rynxHome } from "@rynx-ai/core";
+import { db } from "./db.js";
+import { detectPluginSource, materializePluginPackage, parsePluginSourceSpec, pluginSourceFingerprint, } from "./plugin-package.js";
+export function listPluginMarketplaces() {
+    return db().prepare("SELECT * FROM plugin_marketplaces ORDER BY marketplace_id").all().map(toRecord);
+}
+export function getPluginMarketplace(id) {
+    const row = db().prepare("SELECT * FROM plugin_marketplaces WHERE marketplace_id = ?").get(id);
+    return row ? toRecord(row) : undefined;
+}
+export async function addPluginMarketplace(spec, options = {}) {
+    const staged = await stageMarketplace(spec, options);
+    try {
+        const repositoryId = githubRepositoryMarketplaceId(staged.requestedSource);
+        if (repositoryId && options.alias && options.alias !== repositoryId) {
+            throw new Error(`GitHub marketplace id is fixed to "${repositoryId}" and cannot be aliased`);
+        }
+        const marketplaceId = repositoryId ?? options.alias ?? staged.catalog.id;
+        if (!MARKETPLACE_ID_PATTERN.test(marketplaceId)) {
+            throw new Error(`invalid marketplace id "${marketplaceId}"`);
+        }
+        const existing = getPluginMarketplace(marketplaceId);
+        if (existing?.builtIn && !options.builtIn) {
+            throw new Error(`built-in marketplace "${marketplaceId}" is managed by Rynx`);
+        }
+        const now = new Date().toISOString();
+        db().transaction(() => {
+            const binding = db().prepare(`SELECT source_fingerprint AS sourceFingerprint
+         FROM plugin_marketplace_bindings
+         WHERE marketplace_id = ?`).get(marketplaceId);
+            if (binding &&
+                binding.sourceFingerprint !== staged.sourceFingerprint &&
+                !options.allowSourceRebind) {
+                throw new Error(`marketplace id "${marketplaceId}" is already bound to another source; use a different alias`);
+            }
+            db().prepare(`INSERT INTO plugin_marketplace_bindings (
+           marketplace_id, source_fingerprint, created_at
+         ) VALUES (?, ?, ?)
+         ON CONFLICT(marketplace_id) DO UPDATE SET
+           source_fingerprint = excluded.source_fingerprint`).run(marketplaceId, staged.sourceFingerprint, now);
+            db().prepare(`INSERT INTO plugin_marketplaces (
+           marketplace_id, source_type, requested_source, resolved_revision,
+           source_fingerprint, built_in, catalog, created_at, refreshed_at
+         ) VALUES (
+           @marketplaceId, @sourceType, @requestedSource, @resolvedRevision,
+           @sourceFingerprint, @builtIn, @catalog, @now, @now
+         )
+         ON CONFLICT(marketplace_id) DO UPDATE SET
+           source_type = excluded.source_type,
+           requested_source = excluded.requested_source,
+           resolved_revision = excluded.resolved_revision,
+           source_fingerprint = excluded.source_fingerprint,
+           built_in = excluded.built_in,
+           catalog = excluded.catalog,
+           refreshed_at = excluded.refreshed_at`).run({
+                marketplaceId,
+                sourceType: staged.requestedSource.type,
+                requestedSource: JSON.stringify(staged.requestedSource),
+                resolvedRevision: staged.resolvedRevision,
+                sourceFingerprint: staged.sourceFingerprint,
+                builtIn: options.builtIn ? 1 : 0,
+                catalog: JSON.stringify(staged.catalog),
+                now,
+            });
+        }).immediate();
+        return getPluginMarketplace(marketplaceId);
+    }
+    finally {
+        staged.discard();
+    }
+}
+export async function refreshPluginMarketplace(marketplaceId, options = {}) {
+    const existing = getPluginMarketplace(marketplaceId);
+    if (!existing)
+        throw new Error(`marketplace "${marketplaceId}" not found`);
+    if (existing.builtIn) {
+        throw new Error(`built-in marketplace "${marketplaceId}" updates with Rynx and cannot be refreshed`);
+    }
+    return await addPluginMarketplace(serializeSource(existing.requestedSource), {
+        ...options,
+        alias: marketplaceId,
+    });
+}
+export function removePluginMarketplace(marketplaceId) {
+    if (!MARKETPLACE_ID_PATTERN.test(marketplaceId))
+        return false;
+    const existing = getPluginMarketplace(marketplaceId);
+    if (existing?.builtIn) {
+        throw new Error(`built-in marketplace "${marketplaceId}" is part of Rynx and cannot be removed`);
+    }
+    const installed = db().prepare("SELECT COUNT(*) AS count FROM plugin_installations WHERE marketplace_id = ?").get(marketplaceId);
+    if (installed.count > 0) {
+        throw new Error(`marketplace "${marketplaceId}" still owns installed plugins; uninstall them first`);
+    }
+    return db().prepare("DELETE FROM plugin_marketplaces WHERE marketplace_id = ?").run(marketplaceId).changes > 0;
+}
+export function isBuiltInPluginMarketplace(marketplaceId) {
+    return getPluginMarketplace(marketplaceId)?.builtIn === true;
+}
+export function resolveMarketplacePlugin(identity) {
+    const separator = identity.lastIndexOf("@");
+    if (separator <= 0 || separator === identity.length - 1) {
+        throw new Error("marketplace plugin identity must be <plugin-id>@<marketplace-id>");
+    }
+    const pluginId = identity.slice(0, separator);
+    const marketplaceId = identity.slice(separator + 1);
+    const marketplace = getPluginMarketplace(marketplaceId);
+    if (!marketplace)
+        throw new Error(`marketplace "${marketplaceId}" not found`);
+    const entry = marketplace.catalog.plugins.find((plugin) => plugin.id === pluginId);
+    if (!entry)
+        throw new Error(`plugin "${pluginId}" not found in marketplace "${marketplaceId}"`);
+    return {
+        marketplace,
+        pluginId,
+        spec: serializeSource(resolveCatalogSource(marketplace, entry.source)),
+    };
+}
+async function stageMarketplace(spec, options) {
+    options.signal?.throwIfAborted();
+    const sourceType = detectPluginSource(spec);
+    const normalized = parsePluginSourceSpec(spec, sourceType);
+    if (normalized.type === "local" && !options.materializer) {
+        return {
+            catalog: readMarketplaceCatalog(selectLocalMarketplaceRoot(normalized)),
+            requestedSource: structuredClone(normalized.requested),
+            resolvedRevision: "local",
+            sourceFingerprint: pluginSourceFingerprint(normalized),
+            discard: () => { },
+        };
+    }
+    const stagingRoot = join(rynxHome(), "plugins", "staging");
+    mkdirSync(stagingRoot, { recursive: true, mode: 0o700 });
+    const transaction = mkdtempSync(join(stagingRoot, "market-"));
+    const source = join(transaction, "source");
+    try {
+        const materializeSpec = !options.materializer && normalized.type === "git"
+            ? serializeSource({
+                ...normalized.requested,
+                subdir: combineSubdirectories(normalized.subdir, ".rynx-plugin"),
+            })
+            : spec;
+        const destination = !options.materializer && normalized.type === "git"
+            ? join(source, ".rynx-plugin")
+            : source;
+        const materialized = await (options.materializer ?? materializePluginPackage)({
+            spec: materializeSpec,
+            source: sourceType,
+            destination,
+            onProgress: options.onProgress ?? (() => { }),
+            signal: options.signal,
+        });
+        return {
+            catalog: readMarketplaceCatalog(source),
+            requestedSource: structuredClone(normalized.requested),
+            resolvedRevision: materialized.resolvedRevision,
+            sourceFingerprint: pluginSourceFingerprint(normalized),
+            discard: () => rmSync(transaction, { recursive: true, force: true }),
+        };
+    }
+    catch (error) {
+        rmSync(transaction, { recursive: true, force: true });
+        throw error;
+    }
+}
+function selectLocalMarketplaceRoot(source) {
+    const candidate = source.subdir === "."
+        ? source.normalizedLocation
+        : resolve(source.normalizedLocation, ...source.subdir.split("/"));
+    const info = lstatSync(candidate);
+    if (!info.isDirectory() || info.isSymbolicLink()) {
+        throw new Error("marketplace source must be a regular directory");
+    }
+    const selected = realpathSync(candidate);
+    const rel = relative(source.normalizedLocation, selected);
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new Error("marketplace source subdirectory resolves outside its source");
+    }
+    return selected;
+}
+function readMarketplaceCatalog(root) {
+    const metadataDir = join(root, ".rynx-plugin");
+    const metadataInfo = lstatSync(metadataDir);
+    if (!metadataInfo.isDirectory() || metadataInfo.isSymbolicLink()) {
+        throw new Error(".rynx-plugin must be a regular directory");
+    }
+    const catalogPath = join(metadataDir, "marketplace.json");
+    const info = lstatSync(catalogPath);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024) {
+        throw new Error(".rynx-plugin/marketplace.json must be a regular file under 1 MiB");
+    }
+    return parsePluginMarketplace(JSON.parse(readFileSync(catalogPath, "utf8")));
+}
+function resolveCatalogSource(marketplace, source) {
+    const relativePath = normalizeRelativeCatalogPath(source);
+    const parent = marketplace.requestedSource;
+    if (parent.type === "git") {
+        const subdir = combineSubdirectories(parent.subdir, relativePath);
+        return {
+            type: "git",
+            url: parent.url,
+            ...(subdir ? { subdir } : {}),
+            commit: marketplace.resolvedRevision,
+        };
+    }
+    const catalogRoot = parent.subdir
+        ? resolve(parent.path, ...parent.subdir.split("/"))
+        : parent.path;
+    return {
+        type: "local",
+        path: resolve(catalogRoot, ...relativePath.split("/")),
+    };
+}
+function normalizeRelativeCatalogPath(value) {
+    if (value === "." || value === "./")
+        return ".";
+    const normalized = value.startsWith("./") ? value.slice(2) : value;
+    if (!normalized ||
+        normalized.includes("\\") ||
+        normalized.split("/").some((part) => !part || part === "." || part === "..")) {
+        throw new Error("relative marketplace plugin path must be a normalized POSIX path");
+    }
+    return normalized;
+}
+function combineSubdirectories(...parts) {
+    const combined = parts.filter((part) => part && part !== ".").join("/");
+    if (!combined)
+        return undefined;
+    const normalized = posix.normalize(combined);
+    if (!normalized ||
+        normalized.startsWith("../") ||
+        normalized.includes("/../") ||
+        normalized.startsWith("/")) {
+        throw new Error("marketplace plugin path escapes the marketplace source");
+    }
+    return normalized;
+}
+function serializeSource(source) {
+    const params = new URLSearchParams();
+    if (source.subdir)
+        params.set("path", source.subdir);
+    if (source.type === "git") {
+        if (source.ref)
+            params.set("ref", source.ref);
+        if (source.commit)
+            params.set("ref", source.commit);
+        const fragment = params.toString();
+        return `${source.url}${fragment ? `#${fragment}` : ""}`;
+    }
+    const fragment = params.toString();
+    return `${realpathSync(source.path)}${fragment ? `#${fragment}` : ""}`;
+}
+function toRecord(row) {
+    return {
+        marketplaceId: row.marketplace_id,
+        sourceType: row.source_type === "local" ? "local" : "git",
+        builtIn: row.built_in !== 0,
+        requestedSource: JSON.parse(row.requested_source),
+        resolvedRevision: row.resolved_revision,
+        sourceFingerprint: row.source_fingerprint,
+        catalog: parseStoredMarketplace(JSON.parse(row.catalog)),
+        createdAt: row.created_at,
+        refreshedAt: row.refreshed_at,
+    };
+}
+function githubRepositoryMarketplaceId(source) {
+    if (source.type !== "git")
+        return undefined;
+    let repositoryPath;
+    const scp = /^git@github\.com:([^?#]+)$/i.exec(source.url);
+    if (scp) {
+        repositoryPath = scp[1];
+    }
+    else {
+        try {
+            const parsed = new URL(source.url);
+            if (parsed.hostname.toLowerCase() !== "github.com")
+                return undefined;
+            repositoryPath = parsed.pathname.replace(/^\/+|\/+$/g, "");
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const segments = repositoryPath.replace(/\.git$/i, "").split("/");
+    if (segments.length !== 2 || segments.some((segment) => !segment))
+        return undefined;
+    const id = segments.join("/").toLowerCase();
+    return MARKETPLACE_ID_PATTERN.test(id) ? id : undefined;
+}
+function parseStoredMarketplace(value) {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        delete value.displayName;
+    }
+    return parsePluginMarketplace(value);
+}

package/dist/plugin-package.d.ts

@@ -1,4 +1,4 @@
-import { type PluginManifestV1 } from "@rynx-ai/plugin-sdk";
+import { type PluginManifestV1, type PluginPackageSourceV1 } from "@rynx-ai/plugin-sdk";
 import type { PluginSource } from "./plugin-store.js";
 export interface PluginPackageInspectionLimits {
     maxFileBytes: number;
@@ -8,11 +8,15 @@ export interface PluginPackageInspectionLimits {
 }
 export declare const DEFAULT_PLUGIN_PACKAGE_INSPECTION_LIMITS: Readonly<PluginPackageInspectionLimits>;
 export interface InspectPluginPackageOptions {
-    requireEntries?: boolean;
     signal?: AbortSignal;
-    /** Test/internal override; daemon installation always uses the safe defaults. */
     limits?: Partial<PluginPackageInspectionLimits>;
 }
+export interface NormalizedPluginSource {
+    type: PluginSource;
+    requested: PluginPackageSourceV1;
+    normalizedLocation: string;
+    subdir: string;
+}
 export interface MaterializePluginPackageRequest {
     spec: string;
     source: PluginSource;
@@ -20,42 +24,36 @@ export interface MaterializePluginPackageRequest {
     onProgress: (line: string) => void;
     signal?: AbortSignal;
 }
-export type PluginPackageMaterializer = (request: MaterializePluginPackageRequest) => Promise<void>;
+export interface MaterializedPluginPackage {
+    requestedSource: PluginPackageSourceV1;
+    resolvedRevision: string;
+    sourceFingerprint: string;
+}
+export type PluginPackageMaterializer = (request: MaterializePluginPackageRequest) => Promise<MaterializedPluginPackage>;
 export interface InspectedPluginPackage {
     manifest: PluginManifestV1;
-    version?: string;
+    version: string;
     integrity: string;
 }
-/** Classify provenance without fetching or executing anything. */
 export declare function detectPluginSource(spec: string): PluginSource;
-/** Stable provenance for local sources; remote specs are retained verbatim. */
 export declare function normalizePluginSpec(spec: string, source: PluginSource): string;
-/**
- * Materialize a package without running package lifecycle scripts.
- *
- * Local workspace packages are archived with their internal dependency closure
- * and then installed into a disposable npm prefix. Other local, npm, git, and
- * URL specs use the same prefix flow. Every path therefore reaches inspection
- * with runtime dependencies present, while lifecycle scripts remain disabled.
- */
+/** CLI source syntax: local paths, Git URLs, github:owner/repo, or owner/repo. */
+export declare function parsePluginSourceSpec(spec: string, forced?: PluginSource): NormalizedPluginSource;
+export declare function pluginSourceFingerprint(source: NormalizedPluginSource): string;
 export declare const materializePluginPackage: PluginPackageMaterializer;
 export declare function parseGitSpec(spec: string): {
     url: string;
     ref?: string;
+    subdir: string;
 };
-/** Parse and validate static metadata, validate all executable entry paths, and hash the tree. */
+export declare function normalizeGitUrl(value: string): string;
 export declare function inspectPluginPackage(packageDir: string, options?: InspectPluginPackageOptions): Promise<InspectedPluginPackage>;
-/** Run package/dependency build scripts only after explicit user approval. */
-export declare function rebuildPluginPackage(packageDir: string, onProgress: (line: string) => void, signal?: AbortSignal): Promise<void>;
+/** Validate and hash a closed package/catalog snapshot without executing it. */
+export declare function validatePluginPackageSnapshot(packageDir: string, options?: InspectPluginPackageOptions): Promise<string>;
+export declare function resolvePackagePath(packageRoot: string, entry: string, label: string, kind: "file" | "directory"): string;
 export interface RunPluginPackageCommandOptions {
     signal?: AbortSignal;
     cwd?: string;
-    /** Internal/test override; production uses a bounded two-second grace. */
     abortGraceMs?: number;
 }
-/**
- * Run one package tool without a shell and tear down its full POSIX process
- * group on cancellation. Windows cannot signal process groups through Node,
- * so it safely degrades to TERM→KILL on the direct child.
- */
 export declare function runPluginPackageCommand(command: string, args: string[], onProgress: (line: string) => void, options?: RunPluginPackageCommandOptions): Promise<void>;