@stratusagent/cli 0.11.2 → 0.11.4

package/dist/commands/logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../src/commands/logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,OAAO,GAER,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAC1B,OAA0B,EAC1B,OAAmB,EACnB,MAAsB,EAAE,EACP,EAAE;IACnB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAiB,EAAQ,EAAE;QACvC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,CAAC,CAAC;IAEF,wEAAwE;IACxE,wEAAwE;IACxE,qDAAqD;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,sEAAsE;IACtE,qEAAqE;IACrE,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/E,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,CAAC;IACf,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,4CAA4C,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;QAChC,IAAI,EAAE,CAAC;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC;YACZ,GAAG;YACH,MAAM;YACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC"}

package/dist/commands/memory.d.ts

@@ -0,0 +1,20 @@
+import type { CliStreams, CliEnvironment } from '../environment.ts';
+import type { ParsedMemoryCommand } from '../parse.ts';
+/**
+ * `stratus memory list|reassert` — the operator's half of provenance.
+ *
+ * `list` shows what an agent's store holds with the label each entry
+ * carries, because an operator cannot re-assert what they cannot see.
+ * `reassert` is the one way a label ever rises: it appends a re-assertion
+ * record to the JSONL (never rewrites a line), so a running daemon — which
+ * re-reads the file on every read — sees it at once. Operator only, on
+ * purpose: no tool exposes this, because an agent re-labelling its own
+ * memory as trusted is the attack writing its own permission slip.
+ *
+ * `--all-unknown` exists for the upgrade: every entry written before labels
+ * existed reads `unknown`, and the injected slice of such a store makes
+ * every session `unknown` on its first turn. Re-asserting the entries the
+ * agent actually surfaces, once, is the bounded work that drains it.
+ */
+export declare const runMemory: (command: ParsedMemoryCommand, streams: CliStreams, env?: CliEnvironment) => Promise<number>;
+//# sourceMappingURL=memory.d.ts.map

package/dist/commands/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/commands/memory.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,GACpB,SAAS,mBAAmB,EAC5B,SAAS,UAAU,EACnB,MAAK,cAAmB,KACvB,OAAO,CAAC,MAAM,CAkGhB,CAAC"}

package/dist/commands/memory.js

@@ -0,0 +1,110 @@
+import { escapeControlCharacters, memoryEntryTrust } from '@stratusagent/core';
+import { createFileMemoryStore, memoryFilePath, migrateLegacyMemory, withLegacyDefaultMemories, } from '@stratusagent/state';
+import { writeLine } from "../io.js";
+/**
+ * `stratus memory list|reassert` — the operator's half of provenance.
+ *
+ * `list` shows what an agent's store holds with the label each entry
+ * carries, because an operator cannot re-assert what they cannot see.
+ * `reassert` is the one way a label ever rises: it appends a re-assertion
+ * record to the JSONL (never rewrites a line), so a running daemon — which
+ * re-reads the file on every read — sees it at once. Operator only, on
+ * purpose: no tool exposes this, because an agent re-labelling its own
+ * memory as trusted is the attack writing its own permission slip.
+ *
+ * `--all-unknown` exists for the upgrade: every entry written before labels
+ * existed reads `unknown`, and the injected slice of such a store makes
+ * every session `unknown` on its first turn. Re-asserting the entries the
+ * agent actually surfaces, once, is the bounded work that drains it.
+ */
+export const runMemory = async (command, streams, env = {}) => {
+    // Only the writer folds a legacy per-directory store in: `list` is the
+    // read-only command a downgraded build is allowed to run against newer
+    // state, and a migration is a write.
+    if (command.action === 'reassert') {
+        await migrateLegacyMemory(env);
+    }
+    const store = withLegacyDefaultMemories(createFileMemoryStore(memoryFilePath(env)));
+    // Two ways an entry reads `unknown`, and only one is the upgrade case:
+    // no label at all (written before labels existed, or added by hand), or a
+    // recorded `unknown` — a session that heard from a sender nobody vouched
+    // for, or ran a shell command. The bulk re-assertion is for the first;
+    // the second may hold a stranger's text and is named by id, once read.
+    const unlabelled = (entry) => entry.trust === undefined;
+    const describeEntry = (entry) => ({
+        id: entry.id,
+        trust: memoryEntryTrust(entry),
+        content: entry.content,
+        createdAt: entry.createdAt,
+        ...(entry.origin ? { origin: entry.origin } : {}),
+    });
+    if (command.action === 'list') {
+        const live = (await store.list(command.agentId)).entries
+            .filter((entry) => command.trust === undefined || memoryEntryTrust(entry) === command.trust);
+        if (command.format === 'json') {
+            writeLine(streams.stdout, JSON.stringify({ agentId: command.agentId, entries: live.map(describeEntry) }, null, 2));
+            return 0;
+        }
+        if (live.length === 0) {
+            writeLine(streams.stdout, command.trust === undefined
+                ? `${command.agentId} has no live memory entries in ${memoryFilePath(env)}.`
+                : `${command.agentId} has no live memory entries at ${command.trust}.`);
+            return 0;
+        }
+        for (const entry of live) {
+            const taintedBy = entry.origin?.taintedBy ? `  (tainted by ${entry.origin.taintedBy})` : '';
+            const unrecorded = unlabelled(entry) ? '  (no recorded origin)' : '';
+            writeLine(streams.stdout, `${entry.id}  [${memoryEntryTrust(entry)}]${taintedBy}${unrecorded}`);
+            writeLine(streams.stdout, `  ${escapeControlCharacters(entry.content)}`);
+        }
+        if (command.trust === undefined) {
+            const unlabelledCount = live.filter(unlabelled).length;
+            const recordedUnknown = live.filter((entry) => !unlabelled(entry) && memoryEntryTrust(entry) === 'unknown').length;
+            if (unlabelledCount > 0) {
+                writeLine(streams.stdout, '');
+                writeLine(streams.stdout, `${unlabelledCount} entr${unlabelledCount === 1 ? 'y has' : 'ies have'} no recorded origin, so any session that reads one writes unknown. `
+                    + `Review them, then: stratus memory reassert ${command.agentId} --trust user --all-unknown (or name ids).`);
+            }
+            if (recordedUnknown > 0) {
+                writeLine(streams.stdout, '');
+                writeLine(streams.stdout, `${recordedUnknown} entr${recordedUnknown === 1 ? 'y was' : 'ies were'} recorded unknown — written after a message from someone not configured as a principal, or after a shell command — `
+                    + 'and may repeat what a stranger said. --all-unknown leaves these alone; re-assert one by id once you have read it.');
+            }
+        }
+        return 0;
+    }
+    if (!store.reassertTrust) {
+        writeLine(streams.stderr, 'Error: this memory store cannot re-assert trust.');
+        return 1;
+    }
+    const trust = command.trust ?? 'user';
+    const live = (await store.list(command.agentId)).entries;
+    const targets = command.allUnknown
+        ? [...new Set([...live.filter(unlabelled).map((entry) => entry.id), ...command.ids])]
+        : command.ids;
+    if (targets.length === 0) {
+        writeLine(streams.stdout, `${command.agentId} has no live entries with no recorded origin; nothing to re-assert. An entry recorded unknown is named by id.`);
+        return 0;
+    }
+    const missing = [];
+    let changed = 0;
+    for (const id of targets) {
+        if (await store.reassertTrust(command.agentId, id, trust)) {
+            changed += 1;
+        }
+        else {
+            missing.push(id);
+        }
+    }
+    if (command.format === 'json') {
+        writeLine(streams.stdout, JSON.stringify({ agentId: command.agentId, trust, reasserted: changed, missing }, null, 2));
+    }
+    else {
+        writeLine(streams.stdout, `Re-asserted ${changed} entr${changed === 1 ? 'y' : 'ies'} of ${command.agentId} as ${trust}. A running daemon reads the change on its next turn.`);
+    }
+    for (const id of missing) {
+        writeLine(streams.stderr, `No live memory entry with id ${id} belongs to ${command.agentId}; nothing was re-asserted for it.`);
+    }
+    return missing.length === 0 ? 0 : 1;
+};
+//# sourceMappingURL=memory.js.map

package/dist/commands/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/commands/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAoB,MAAM,oBAAoB,CAAC;AACjG,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAA4B,EAC5B,OAAmB,EACnB,MAAsB,EAAE,EACP,EAAE;IACnB,uEAAuE;IACvE,uEAAuE;IACvE,qCAAqC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,qBAAqB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpF,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAW,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;IAC9E,MAAM,aAAa,GAAG,CAAC,KAAkB,EAA2B,EAAE,CAAC,CAAC;QACtE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;aACrD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,SAAS,CACP,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,KAAK,KAAK,SAAS;gBACzB,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,kCAAkC,cAAc,CAAC,GAAG,CAAC,GAAG;gBAC5E,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,kCAAkC,OAAO,CAAC,KAAK,GAAG,CACzE,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC,CAAC;YAChG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YACvD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;YACnH,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,SAAS,CACP,OAAO,CAAC,MAAM,EACd,GAAG,eAAe,QAAQ,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,qEAAqE;sBACzI,8CAA8C,OAAO,CAAC,OAAO,4CAA4C,CAC5G,CAAC;YACJ,CAAC;YACD,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,SAAS,CACP,OAAO,CAAC,MAAM,EACd,GAAG,eAAe,QAAQ,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,qHAAqH;sBACzL,mHAAmH,CACtH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,kDAAkD,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU;QAChC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAChB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,+GAA+G,CAAC,CAAC;QAC7J,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,OAAO,CAAC,OAAO,OAAO,KAAK,uDAAuD,CAAC,CAAC;IAChL,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,eAAe,OAAO,CAAC,OAAO,mCAAmC,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,CAAC"}

package/dist/commands/plugins.d.ts

@@ -0,0 +1,103 @@
+import { type ToolRisk } from '@stratusagent/core';
+import type { CliStreams, CliEnvironment } from '../environment.ts';
+import type { ParsedPluginsCommand } from '../parse.ts';
+/** One tool a plugin's manifest declares, as this machine would have it. */
+export interface PluginToolReport {
+    name: string;
+    /**
+     * Declared as a namespace rather than named, so the tools under it arrive
+     * when the server connects. `mcp.*` is the case: a name that does not
+     * exist yet is not a name that does not exist.
+     */
+    discovered: boolean;
+    /**
+     * What `ManifestBoundToolRegistry` would settle on, minus the claim only a
+     * running daemon has. An operator's `toolRisks` override *replaces* the
+     * manifest's declaration and is bounded only by the package's floor —
+     * lowering one is the whole point of the key — and without an override it
+     * is the riskier of the declaration and that floor. A registered object
+     * may then raise itself further, so this is a floor on what a call will
+     * face rather than the last word on it.
+     */
+    risk: ToolRisk;
+    /**
+     * Agent ids whose `tools:` allowlist selects this name. Empty is the
+     * finding, not the absence of one: installing a plugin grants nothing.
+     */
+    grantedTo: string[];
+}
+export interface PluginReport {
+    package: string;
+    /** Resolvable from this process. */
+    installed: boolean;
+    /** Named in the trusted config's plugins block, whatever its `enabled`. */
+    configured: boolean;
+    /** Configured and not switched off. */
+    enabled: boolean;
+    tools: PluginToolReport[];
+    /**
+     * What the manifest declares besides tools and skills: the provider,
+     * channel, memory-store, and executor names its `setup()` may register.
+     * Declarations, read without loading — whether `setup()` registers each
+     * is the daemon's to report (`GET /catalog/tools`), not a manifest's.
+     */
+    contributes?: {
+        providers: string[];
+        channels: string[];
+        memory: string[];
+        executors: string[];
+    };
+    /**
+     * Why a daemon would register nothing for this plugin, when it would —
+     * an unreadable manifest, or settings its own schema rejects. Enabled and
+     * loadable are different questions, and a report that ran them together
+     * would call `plugin-mcp` with no `servers` ready to use.
+     */
+    problem?: string;
+    /**
+     * What might go wrong that a manifest cannot settle. A name two packages
+     * both declare collides only if both *register* it, and registration is
+     * `setup()`'s business — so this says "if it does" rather than reporting
+     * a failure that may never happen.
+     */
+    warnings?: string[];
+}
+export interface PluginsReport {
+    approvals: 'headless' | 'remote';
+    /**
+     * What this machine would really do with a gated call — the mode alone
+     * does not say. `headless` still runs one a standing grant, an approved
+     * command scope, or an approved site already covers (the engine checks
+     * all three before it refuses), and `remote` with no reachable approver
+     * denies on arrival rather than asking anybody.
+     */
+    approvalsSummary: string;
+    /**
+     * Set when the roster did not load, in which case every `grantedTo` is
+     * withheld rather than reported empty — the same rule `stratus skills`
+     * follows, and for the same reason: unreadable enablement must not print
+     * as "granted to nobody".
+     */
+    rosterUnreadable: boolean;
+    plugins: PluginReport[];
+}
+/**
+ * What this machine's plugins are, and where the chain from installed to
+ * callable breaks.
+ *
+ * Four things have to be true before an agent can call a plugin's tool —
+ * the package is installed, a trusted config enables it, the agent's
+ * `tools:` names it, and the approval policy lets the call through — and
+ * every one of them fails silently on its own. A listing of installed
+ * packages answers the first and reads as an answer to all four, which is
+ * how an agent ends up with a persona describing tools it never had.
+ *
+ * Manifests rather than a load: `readPluginManifest` imports nothing, so
+ * this never runs a plugin's `setup` — which for the MCP bridge would spawn
+ * every configured server's subprocess to answer a question about a
+ * daemon that is not running.
+ */
+export declare const collectPluginsReport: (command: ParsedPluginsCommand, env: CliEnvironment, warn: (line: string) => void) => Promise<PluginsReport>;
+/** `stratus plugins` — the chain from installed to callable, per plugin. */
+export declare const runPlugins: (command: ParsedPluginsCommand, streams: CliStreams, env?: CliEnvironment) => Promise<number>;
+//# sourceMappingURL=plugins.d.ts.map

package/dist/commands/plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.d.ts","sourceRoot":"","sources":["../../src/commands/plugins.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAW5B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAUxD,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,IAAI,EAAE,QAAQ,CAAC;IACf;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QACZ,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,UAAU,GAAG,QAAQ,CAAC;IACjC;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,oBAAoB,EAC7B,KAAK,cAAc,EACnB,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAC3B,OAAO,CAAC,aAAa,CAgSvB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,UAAU,GACrB,SAAS,oBAAoB,EAC7B,SAAS,UAAU,EACnB,MAAK,cAAmB,KACvB,OAAO,CAAC,MAAM,CAmFhB,CAAC"}

package/dist/commands/plugins.js

@@ -0,0 +1,386 @@
+import { matchesToolAllowlist, raiseRiskTo, toolScopesOverlap, } from '@stratusagent/core';
+import { declaredRiskFor, isFirstPartyPackage, parseToolRiskOverrides, preflightPlugin, readPluginManifest, riskFloorFor, } from '@stratusagent/plugins';
+import { workspacesDirPath } from '@stratusagent/state';
+import { describeUnattendedReach } from "../approvals.js";
+import { writeLine } from "../io.js";
+import { packageInstalled } from "../loaders.js";
+import { PLUGIN_MARKETPLACE_URL, FIRST_PARTY_CAPABILITY_PACKAGES, FIRST_PARTY_CONTRIBUTION_PACKAGES, KERNEL_TOOL_NAMES, } from "../plugin-catalog.js";
+import { soulGrantsTool, rosterSoulsWithConfigured } from "../roster.js";
+import { loadServeApprovals, loadServeApi, loadServePlugins } from "../trusted-config.js";
+/**
+ * What this machine's plugins are, and where the chain from installed to
+ * callable breaks.
+ *
+ * Four things have to be true before an agent can call a plugin's tool —
+ * the package is installed, a trusted config enables it, the agent's
+ * `tools:` names it, and the approval policy lets the call through — and
+ * every one of them fails silently on its own. A listing of installed
+ * packages answers the first and reads as an answer to all four, which is
+ * how an agent ends up with a persona describing tools it never had.
+ *
+ * Manifests rather than a load: `readPluginManifest` imports nothing, so
+ * this never runs a plugin's `setup` — which for the MCP bridge would spawn
+ * every configured server's subprocess to answer a question about a
+ * daemon that is not running.
+ */
+export const collectPluginsReport = async (command, env, warn) => {
+    const pluginsConfig = await loadServePlugins(env, command.configPath, warn);
+    const approvals = await loadServeApprovals(env, command.configPath, warn);
+    // What the loader would fold in, so the validation below is against the
+    // object a daemon on this machine would build.
+    const workspaceRoot = workspacesDirPath(env);
+    // Read the same way the daemon reads it: installed, and not switched off
+    // by the trusted config's `api` block.
+    const api = await loadServeApi(env, command.configPath, warn);
+    const apiReachable = packageInstalled('@stratusagent/control-api', env) && api.enabled !== false;
+    // Who grants what, from the roster a dispatch actually serves — the same
+    // resolution `stratus skills` uses, so the two commands cannot disagree
+    // about which souls are live.
+    let roster = [];
+    let rosterUnreadable = false;
+    try {
+        const resolved = await rosterSoulsWithConfigured(env, warn, {
+            ...(command.configPath !== undefined ? { configPath: command.configPath } : {}),
+            includeBuiltIn: true,
+        });
+        roster = resolved.entries;
+        rosterUnreadable = !resolved.complete;
+    }
+    catch (error) {
+        rosterUnreadable = true;
+        warn(`cannot say who is granted what — the roster did not load: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    /**
+     * Which agents a declared name reaches. A soul with no `tools:` key
+     * grants every registered tool, which is the opposite of an empty list —
+     * so an absent allowlist matches everything here too, or this would
+     * report the most permissive agents as the least.
+     */
+    const grantedTo = (name, discovered) => roster
+        .filter((entry) => soulGrantsTool(entry.soul.agent.tools, name, discovered))
+        .map((entry) => entry.soul.agent.id);
+    // Configured first, in the operator's own order, then the first-party
+    // packages they have not configured — the second group is why an install
+    // that granted nothing is visible at all.
+    const configured = Object.keys(pluginsConfig);
+    const packages = [
+        ...configured,
+        ...[...FIRST_PARTY_CAPABILITY_PACKAGES, ...FIRST_PARTY_CONTRIBUTION_PACKAGES].filter((name) => !configured.includes(name)),
+    ];
+    const plugins = [];
+    // Which package claimed each literal tool name, across the whole loop.
+    // `loadPlugins` keeps the same map and rejects the *later* plugin whole
+    // when a registration collides, so a per-plugin check would report two
+    // packages ready to serve one name that only one of them will get.
+    //
+    // Literal declarations only: the registry claims names as they register,
+    // and a namespace has none until its server connects.
+    // Qualified skill ids, tracked the same way and for the same reason.
+    const claimedSkills = new Map();
+    /**
+     * Every name or namespace some plugin may register, in config order.
+     *
+     * One list rather than a map of literals, because a collision is an
+     * *overlap* and overlap has no preferred direction: a later literal falls
+     * under an earlier namespace exactly as a later namespace covers an
+     * earlier literal. Two one-way passes is what this was, and it missed
+     * whichever direction was written second.
+     *
+     * The daemon's own tools are *registered*, unconditionally, before any
+     * plugin loads; a plugin's entry is only a declaration, which is why the
+     * two produce different warnings.
+     */
+    const claims = KERNEL_TOOL_NAMES
+        .map((name) => ({ pattern: name, owner: 'the daemon itself', registered: true }));
+    for (const specifier of packages) {
+        const block = pluginsConfig[specifier] ?? {};
+        const isConfigured = configured.includes(specifier);
+        const base = {
+            package: specifier,
+            installed: packageInstalled(specifier, env),
+            configured: isConfigured,
+            enabled: isConfigured && block.enabled !== false,
+            tools: [],
+        };
+        // Nothing below runs for a plugin the loader would skip. It skips an
+        // absent or switched-off block before it reads a manifest, parses an
+        // override, or validates anything — so doing any of that here invents a
+        // failure for a plugin that has none, and the renderer shows no tools
+        // for one either way. Gating the whole block rather than each call is
+        // deliberate: gating them one at a time is what left the override parse
+        // unconditional after the preflight moved.
+        if (!base.installed || !base.enabled) {
+            plugins.push(base);
+            continue;
+        }
+        try {
+            const { manifest, directory } = await readPluginManifest(specifier, {
+                resolve: (target) => import.meta.resolve(target),
+            });
+            const floor = riskFloorFor(isFirstPartyPackage(manifest.packageName));
+            const overrides = parseToolRiskOverrides(manifest, block);
+            // Everything the loader checks before importing, through the loader's
+            // own function — a plugin whose settings or skill files it rejects
+            // registers nothing, and reading here as enabled is the false clean
+            // bill this command exists to stop giving.
+            //
+            // Only for a plugin the loader would actually reach, though: it skips
+            // an absent or switched-off block before validating anything, so
+            // preflighting one would report `plugin-mcp` that nobody configured as
+            // broken settings instead of as the install to enable.
+            if (base.enabled) {
+                await preflightPlugin(manifest, directory, block, workspaceRoot);
+            }
+            // One row per tool the report will name, tracked as they are emitted.
+            // A concrete name can be reached more than one way — declared outright
+            // *and* covered by a namespace, or covered by two nested namespaces
+            // like `mcp.*` and `mcp.linear.*` — and every one of those is a single
+            // runtime tool. Filtering each source against the others is what
+            // produced two rounds of duplicate rows; one set, checked as rows are
+            // added, cannot miss a path.
+            const seen = new Set();
+            const declared = [];
+            const emit = (row) => {
+                if (seen.has(row.name)) {
+                    return;
+                }
+                seen.add(row.name);
+                declared.push(row);
+            };
+            // Literal declarations first: a name the manifest states outright is
+            // described best by its own entry, not by a namespace that covers it.
+            // Risk through `declaredRiskFor`, never the declaration in hand: with
+            // overlapping namespaces (`mcp.*` and `mcp.linear.*`) it is the *first*
+            // match that registration uses, so reading each entry's own risk would
+            // show a narrower namespace at a risk none of its tools will have.
+            const riskOf = (name, fallback) => declaredRiskFor(manifest, name) ?? fallback;
+            for (const tool of manifest.contributes.tools) {
+                emit({ name: tool.name, discovered: false, namespace: false, declared: riskOf(tool.name, tool.risk) });
+            }
+            for (const entry of manifest.contributes.toolsDiscovered) {
+                emit({
+                    name: entry.namespace,
+                    discovered: true,
+                    namespace: true,
+                    declared: riskOf(entry.namespace, entry.risk),
+                });
+                // An override under a declared namespace names a concrete tool
+                // (`mcp.linear.get_issue`), which is the whole point of the key for
+                // a bridge — and it can never equal the namespace, so the namespace
+                // row alone would report the default risk for a tool the operator
+                // has deliberately re-rated. Listed beside it rather than folded in:
+                // they are different risks, and which tools carry the override is
+                // the thing worth seeing.
+                for (const name of overrides.keys()) {
+                    // Any wildcard key, not merely the declared namespace itself: the
+                    // registry applies an override by each concrete *registered*
+                    // name, so a nested `mcp.linear.*` is exactly as inert as
+                    // `mcp.*`. Excluding only the equal case left the nested one
+                    // advertising a re-rating no call gets.
+                    if (name.endsWith('.*')) {
+                        continue;
+                    }
+                    if (matchesToolAllowlist(name, [entry.namespace])) {
+                        emit({ name, discovered: true, namespace: false, declared: riskOf(name, entry.risk) });
+                    }
+                }
+            }
+            // A warning, not a failure. Ownership is claimed at registration —
+            // `view.commit(owners)` records what `setup()` actually registered —
+            // so a name two manifests both declare collides only if both plugins
+            // go on to register it, which nothing here can know. Reporting it as
+            // a load failure would condemn a plugin that loads perfectly well
+            // because its tool is optional.
+            // Keyed by config entry, never by package name: the same package
+            // configured through two specifiers is two entries the loader treats
+            // as two plugins, and exempting them for sharing a `packageName`
+            // would hide the collision an operator is likeliest to create by
+            // accident.
+            //
+            // A plugin never collides with itself: everything it declares is
+            // gathered first, checked against what came before, and only then
+            // added. That ordering is what makes a manifest declaring both
+            // `mcp.ping` and `mcp.*` silent — it registers that name once — and
+            // it is load-bearing, so adding claims inside the loop below would
+            // reintroduce a warning telling operators to fix a working config.
+            const declaredHere = [
+                ...manifest.contributes.tools.map((tool) => tool.name),
+                ...manifest.contributes.toolsDiscovered.map((entry) => entry.namespace),
+            ];
+            for (const pattern of declaredHere) {
+                for (const claim of claims) {
+                    if (!toolScopesOverlap(pattern, claim.pattern)) {
+                        continue;
+                    }
+                    const subject = pattern === claim.pattern
+                        ? `${pattern} is`
+                        : `${pattern} overlaps ${claim.pattern}, which is`;
+                    // One sentence for every collision, because a manifest cannot
+                    // tell when a name registers and the cost turns entirely on
+                    // that. `ManifestBoundToolRegistry` stages while `owners` is
+                    // unset and registers live once `commit` sets it, so a clash
+                    // before the plugin commits rolls it back whole and a clash
+                    // after refuses that one registration. Neither side of the
+                    // declaration says which: a bridge's first connect happens
+                    // inside `setup()` when its server is up and on a reconnect
+                    // when it is not, and a plugin may hold `context.tools` and
+                    // register a plainly-named tool from a timer long after.
+                    //
+                    // Three rounds of review went into splitting this by
+                    // declaration kind, then by which side of the pair held the
+                    // namespace. Both splits claimed knowledge the manifest does
+                    // not have. Do not reintroduce one.
+                    base.warnings = [
+                        ...(base.warnings ?? []),
+                        `${subject} ${claim.registered ? 'already registered by' : 'also declared by'} ${claim.owner}; `
+                            + 'if both register that name, a daemon keeps the first and refuses the second registration — '
+                            + 'the whole plugin, tools and skills together, if it happens before that plugin finishes loading, '
+                            + 'or just that one tool if it happens after',
+                    ];
+                }
+            }
+            for (const pattern of declaredHere) {
+                claims.push({ pattern, owner: specifier, registered: false });
+            }
+            // Skills collide on the qualified `packageName:id`, so a clash means
+            // one package configured twice — the two-specifier case again. Firmer
+            // than the tool warning and worded that way: the loader stages skills
+            // from the manifest and refuses the second entry outright rather than
+            // waiting to see what `setup()` does. Still "if it loads", since a
+            // plugin that fails to import never reaches the check.
+            for (const skill of manifest.contributes.skills) {
+                const qualified = `${manifest.packageName}:${skill.id}`;
+                const owner = claimedSkills.get(qualified);
+                if (owner !== undefined) {
+                    base.warnings = [
+                        ...(base.warnings ?? []),
+                        `skill ${qualified} is already declared by ${owner}; if both load, a daemon keeps the first `
+                            + 'and refuses this one whole, tools and skills together',
+                    ];
+                }
+                else {
+                    claimedSkills.set(qualified, specifier);
+                }
+            }
+            const named = {
+                providers: manifest.contributes.providers.map((entry) => entry.name),
+                channels: manifest.contributes.channels.map((entry) => entry.name),
+                memory: manifest.contributes.memory.map((entry) => entry.name),
+                executors: manifest.contributes.executors.map((entry) => entry.name),
+            };
+            if (Object.values(named).some((names) => names.length > 0)) {
+                base.contributes = named;
+            }
+            base.tools = declared.map((tool) => {
+                // Never on the namespace row. `parseToolRiskOverrides` accepts a
+                // namespace-shaped key, but the registry looks an override up by
+                // each concrete *registered* name — so `toolRisks: { "mcp.*": … }`
+                // changes no call, and showing the row at that risk would advertise
+                // a re-rating the daemon will not honour.
+                const override = tool.namespace ? undefined : overrides.get(tool.name);
+                return {
+                    name: tool.name,
+                    discovered: tool.discovered,
+                    risk: override !== undefined
+                        ? raiseRiskTo(override, floor)
+                        : raiseRiskTo(tool.declared, floor),
+                    grantedTo: grantedTo(tool.name, tool.discovered),
+                };
+            });
+        }
+        catch (error) {
+            // Reported per plugin rather than thrown: one package with a broken
+            // manifest must not take down the listing that would have shown it.
+            base.problem = error instanceof Error ? error.message : String(error);
+        }
+        plugins.push(base);
+    }
+    const mode = approvals.mode ?? 'headless';
+    return {
+        approvals: mode,
+        approvalsSummary: await describeUnattendedReach(mode, approvals, env, rosterUnreadable ? undefined : roster.map((entry) => entry.soul.agent.id), apiReachable),
+        rosterUnreadable,
+        plugins,
+    };
+};
+/** `stratus plugins` — the chain from installed to callable, per plugin. */
+export const runPlugins = async (command, streams, env = {}) => {
+    const report = await collectPluginsReport(command, env, (line) => {
+        writeLine(streams.stderr, `Warning: ${line}`);
+    });
+    if (command.format === 'json') {
+        writeLine(streams.stdout, JSON.stringify(report, null, 2));
+        return 0;
+    }
+    writeLine(streams.stdout, `approvals: ${report.approvalsSummary}`);
+    writeLine(streams.stdout);
+    for (const plugin of report.plugins) {
+        const state = !plugin.installed
+            ? 'not installed'
+            : !plugin.configured
+                ? 'installed, not enabled'
+                : !plugin.enabled
+                    ? 'installed, switched off'
+                    // Enabled and loadable are separate: a plugin whose settings its
+                    // own schema rejects is enabled and registers nothing, and saying
+                    // only "enabled" here is the false clean bill this command exists
+                    // to stop giving.
+                    : plugin.problem !== undefined ? 'installed, enabled, will not load' : 'installed, enabled';
+        // Padded to a column, but never run together: a package name longer
+        // than the column would otherwise touch its own status.
+        writeLine(streams.stdout, `${plugin.package.padEnd(29)} ${state}`);
+        if (plugin.problem !== undefined) {
+            writeLine(streams.stdout, `  a daemon would register nothing for it: ${plugin.problem}`);
+            continue;
+        }
+        if (!plugin.installed) {
+            writeLine(streams.stdout, `  install it: npm install -g ${plugin.package}`);
+            continue;
+        }
+        // Nothing is registered for a plugin that will not load, so its tools
+        // are not listed: a grant column beside a name no agent can call reads
+        // as capability this machine has.
+        if (!plugin.configured) {
+            writeLine(streams.stdout, `  installing granted nothing — add "${plugin.package}" to the plugins block of a trusted config to load it`);
+            continue;
+        }
+        if (!plugin.enabled) {
+            writeLine(streams.stdout, '  switched off — remove "enabled": false to load it');
+            continue;
+        }
+        for (const warning of plugin.warnings ?? []) {
+            writeLine(streams.stdout, `  warning: ${warning}`);
+        }
+        for (const [kind, names] of Object.entries(plugin.contributes ?? {})) {
+            if (names.length === 0) {
+                continue;
+            }
+            const label = kind === 'providers'
+                ? 'provider'
+                : kind === 'channels'
+                    ? 'channel'
+                    : kind === 'memory'
+                        ? 'memory store'
+                        : 'executor';
+            const how = kind === 'providers'
+                ? 'a soul selects it with provider:'
+                : kind === 'channels'
+                    ? 'starts for the agents with tokens under channels.<kind> in credentials.json'
+                    : `a trusted config selects it with ${kind === 'memory' ? 'memoryStore' : 'executor'}:`;
+            writeLine(streams.stdout, `  ${`${label} ${names.join(', ')}`.padEnd(28)}${how}`);
+        }
+        for (const tool of plugin.tools) {
+            const granted = report.rosterUnreadable
+                ? ''
+                : tool.grantedTo.length > 0
+                    ? ` → ${tool.grantedTo.join(', ')}`
+                    : ' → nobody, until a soul’s tools: list names it';
+            const shape = tool.discovered ? ' (names arrive at connect)' : '';
+            writeLine(streams.stdout, `  ${tool.name.padEnd(28)}${tool.risk}${shape}${granted}`);
+        }
+    }
+    writeLine(streams.stdout);
+    writeLine(streams.stdout, `More plugins — ${PLUGIN_MARKETPLACE_URL}`);
+    return 0;
+};
+//# sourceMappingURL=plugins.js.map