@stratusagent/plugins 0.11.1 → 0.11.3

package/dist/index.d.ts

@@ -11,5 +11,6 @@
 export { declaredRiskFor, parsePluginManifest, parseToolRiskOverrides, resolvePluginAgentConfig, validateAgainstSchema, validatePluginConfig, HOST_CONFIG_KEYS, PLUGIN_MANIFEST_VERSION, PluginConfigError, PluginManifestError, type PluginContributions, type PluginManifest, type PluginNamespaceDeclaration, type PluginSkillDeclaration, type PluginToolDeclaration, } from './manifest.ts';
 export { createManifestBoundCredentialResolver } from './credentials.ts';
 export { ManifestBoundToolRegistry, riskFloorFor, type PluginToolRecord, } from './registry.ts';
-export { isFirstPartyPackage, loadOptionalModule, loadPlugins, type CreatePlugin, type LoadedPlugin, type LoadPluginsOptions, type LoadPluginsResult, type OptionalModuleHost, type PluginLoadFailure, type PluginSkillRecord, } from './loader.ts';
+export { isFirstPartyPackage, loadOptionalModule, loadPlugins, pluginConfigWithHostDefaults, preflightPlugin, installedPackageVersion, readPluginManifest, type CreatePlugin, type LoadedPlugin, type LoadPluginsOptions, type LoadPluginsResult, type OptionalModuleHost, type PluginLoadFailure, type PluginSkillRecord, } from './loader.ts';
+export { createFileLedger, createProcessLocalLedger, isLedgerPath, LEDGER_FILENAME, ledgerContentTrust, ledgerGuard, ledgerTrustOfContent, nameIdentifiesHandle, type FileIdentity, type LedgerGuard, type TaintedWriteLedger, } from './provenance.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -11,5 +11,6 @@
 export { declaredRiskFor, parsePluginManifest, parseToolRiskOverrides, resolvePluginAgentConfig, validateAgainstSchema, validatePluginConfig, HOST_CONFIG_KEYS, PLUGIN_MANIFEST_VERSION, PluginConfigError, PluginManifestError, } from "./manifest.js";
 export { createManifestBoundCredentialResolver } from "./credentials.js";
 export { ManifestBoundToolRegistry, riskFloorFor, } from "./registry.js";
-export { isFirstPartyPackage, loadOptionalModule, loadPlugins, } from "./loader.js";
+export { isFirstPartyPackage, loadOptionalModule, loadPlugins, pluginConfigWithHostDefaults, preflightPlugin, installedPackageVersion, readPluginManifest, } from "./loader.js";
+export { createFileLedger, createProcessLocalLedger, isLedgerPath, LEDGER_FILENAME, ledgerContentTrust, ledgerGuard, ledgerTrustOfContent, nameIdentifiesHandle, } from "./provenance.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,GAMpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,yBAAyB,EACzB,YAAY,GAEb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,GAQZ,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,GAMpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,yBAAyB,EACzB,YAAY,GAEb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,4BAA4B,EAC5B,eAAe,EACf,uBAAuB,EACvB,kBAAkB,GAQnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,GAIrB,MAAM,iBAAiB,CAAC"}

package/dist/loader.d.ts

@@ -33,6 +33,37 @@ export interface OptionalModuleHost {
 export declare const loadOptionalModule: <T = unknown>(specifier: string, host: OptionalModuleHost) => Promise<T | undefined>;
 /** The ABI every loadable plugin exports. See `plugins.md`. */
 export type CreatePlugin = (config: JsonObject) => Plugin | Promise<Plugin>;
+/**
+ * The version an installed package declares, or undefined when it is not
+ * installed or names no version.
+ *
+ * Through `packageJsonFor`, so there is one answer to where a package's
+ * package.json is rather than a second walk that drifts from it — and one
+ * that is bounded the same way, so a package without its own manifest
+ * reports nothing instead of some parent directory's version.
+ *
+ * Nothing is imported: `stratus update` asks this of every companion
+ * package before it decides what to upgrade, and importing a channel
+ * adapter to read its version would open the sockets it exists to open.
+ */
+export declare const installedPackageVersion: (specifier: string, host: Pick<OptionalModuleHost, "resolve">) => Promise<string | undefined>;
+/**
+ * A package's manifest, and the directory it was found in.
+ *
+ * Nothing here imports the package — the property `parsePluginManifest`
+ * exists for, and the reason this is worth having on its own. `stratus
+ * plugins` has to answer "what would this contribute, and at what risk"
+ * for a daemon that is not running, and running somebody's `setup` to find
+ * out would spawn the MCP subprocesses and open the sockets that a listing
+ * command has no business starting.
+ *
+ * `loadPlugins` goes through here too, so there is one answer to where a
+ * package's manifest is rather than a second walk that drifts from it.
+ */
+export declare const readPluginManifest: (specifier: string, host: Pick<OptionalModuleHost, "resolve">) => Promise<{
+    manifest: PluginManifest;
+    directory: string;
+}>;
 /**
  * Whether a package's code is trusted — which is to say whether its
  * manifest may declare a tool `safe`.
@@ -132,6 +163,44 @@ export interface LoadPluginsResult {
     loaded: LoadedPlugin[];
     failures: PluginLoadFailure[];
 }
+/**
+ * The configuration a plugin will actually be handed: its own block, minus
+ * the keys the host owns, plus the host defaults its manifest declares.
+ *
+ * Exported because validating a block against a manifest is only right on
+ * *this* object — `validatePluginConfig` on the raw block would refuse a
+ * manifest that declares `workspaceRoot` required for missing the very
+ * setting the host supplies. `stratus plugins` has to answer whether a
+ * daemon would accept a plugin's settings, and answering it from a
+ * different object than the loader uses is how a diagnostic ends up
+ * disagreeing with the thing it diagnoses.
+ */
+export declare const pluginConfigWithHostDefaults: (block: JsonObject, manifest: PluginManifest, workspaceRoot: string | undefined) => JsonObject;
+/**
+ * Everything `loadPlugins` checks before it imports a package: that the
+ * settings match the manifest's own schema, that any `toolRisks` overrides
+ * name tools the manifest declares and risks it permits, and that every
+ * skill file the manifest names is present, inside the package, and
+ * readable.
+ *
+ * One function because any of them failing rejects the *whole* plugin — it
+ * registers no tools and no skills — so a caller that ran a subset would
+ * report a plugin ready that the daemon refuses. `stratus plugins` is that
+ * caller, and it got exactly half of this right the first time; the
+ * `toolRisks` parse was the third check, missing here while the doc below
+ * said it should not be, until setup started asking this question too.
+ *
+ * Nothing here imports the package, which is what lets a diagnostic ask the
+ * question without starting anything.
+ *
+ * `loadPlugins` calls the same three checks rather than this composition of
+ * them, because it needs what the staging and the parse *return* and stages
+ * only when it has a registry to put skills in. The checks themselves are
+ * shared, so there is no second reading of a schema, an override or a skill
+ * path here — only a second caller of each. Anything added to the loader's
+ * preflight belongs in both.
+ */
+export declare const preflightPlugin: (manifest: PluginManifest, directory: string, block: JsonObject, workspaceRoot: string | undefined) => Promise<void>;
 /**
  * Turn a `plugins` config block into running capability.
  *

package/dist/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,MAAM,EAEN,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAAU,CAAC,GAAG,OAAO,EAClD,WAAW,MAAM,EACjB,MAAM,kBAAkB,KACvB,OAAO,CAAC,CAAC,GAAG,SAAS,CASvB,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AA8B5E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,MAAM,KAAG,OACmB,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;IAC/C,IAAI,EAAE,kBAAkB,CAAC;IACzB,4EAA4E;IAC5E,KAAK,EAAE,YAAY,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,GAAG,EAAE,QAAQ,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,yEAAyE;IACzE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AA2FD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,iBAAiB,CAsHxF,CAAC"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,kBAAkB,EAClB,QAAQ,EACR,UAAU,EACV,MAAM,EAEN,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAAU,CAAC,GAAG,OAAO,EAClD,WAAW,MAAM,EACjB,MAAM,kBAAkB,KACvB,OAAO,CAAC,CAAC,GAAG,SAAS,CASvB,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AA8B5E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,GAClC,WAAW,MAAM,EACjB,MAAM,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,KACxC,OAAO,CAAC,MAAM,GAAG,SAAS,CAc5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,EACjB,MAAM,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,KACxC,OAAO,CAAC;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,MAAM,KAAG,OACmB,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;IAC/C,IAAI,EAAE,kBAAkB,CAAC;IACzB,4EAA4E;IAC5E,KAAK,EAAE,YAAY,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,GAAG,EAAE,QAAQ,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,yEAAyE;IACzE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAqBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACvC,OAAO,UAAU,EACjB,UAAU,cAAc,EACxB,eAAe,MAAM,GAAG,SAAS,KAChC,UAaF,CAAC;AAmEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAU,cAAc,EACxB,WAAW,MAAM,EACjB,OAAO,UAAU,EACjB,eAAe,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,iBAAiB,CAoHxF,CAAC"}

package/dist/loader.js

@@ -55,6 +55,53 @@ const packageJsonFor = async (resolvedUrl, specifier) => {
     }
     throw new PluginManifestError(`Could not find a package.json for ${specifier}.`);
 };
+/**
+ * The version an installed package declares, or undefined when it is not
+ * installed or names no version.
+ *
+ * Through `packageJsonFor`, so there is one answer to where a package's
+ * package.json is rather than a second walk that drifts from it — and one
+ * that is bounded the same way, so a package without its own manifest
+ * reports nothing instead of some parent directory's version.
+ *
+ * Nothing is imported: `stratus update` asks this of every companion
+ * package before it decides what to upgrade, and importing a channel
+ * adapter to read its version would open the sockets it exists to open.
+ */
+export const installedPackageVersion = async (specifier, host) => {
+    let resolved;
+    try {
+        resolved = host.resolve(specifier);
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const { packageJson } = await packageJsonFor(resolved, specifier);
+        const version = packageJson.version;
+        return typeof version === 'string' && version.length > 0 ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * A package's manifest, and the directory it was found in.
+ *
+ * Nothing here imports the package — the property `parsePluginManifest`
+ * exists for, and the reason this is worth having on its own. `stratus
+ * plugins` has to answer "what would this contribute, and at what risk"
+ * for a daemon that is not running, and running somebody's `setup` to find
+ * out would spawn the MCP subprocesses and open the sockets that a listing
+ * command has no business starting.
+ *
+ * `loadPlugins` goes through here too, so there is one answer to where a
+ * package's manifest is rather than a second walk that drifts from it.
+ */
+export const readPluginManifest = async (specifier, host) => {
+    const { packageJson, directory } = await packageJsonFor(host.resolve(specifier), specifier);
+    return { manifest: parsePluginManifest(packageJson, specifier), directory };
+};
 /**
  * Whether a package's code is trusted — which is to say whether its
  * manifest may declare a tool `safe`.
@@ -66,20 +113,45 @@ const packageJsonFor = async (resolvedUrl, specifier) => {
  */
 export const isFirstPartyPackage = (packageName) => packageName === '@stratusagent' || packageName.startsWith('@stratusagent/');
 const WORKSPACE_ROOT_KEY = 'workspaceRoot';
-const configFor = (block, manifest, workspaceRoot) => {
+/**
+ * Where the filesystem provenance ledger lives — always the host's
+ * workspace root, whatever a plugin's own `workspaceRoot` says. Two plugins
+ * write into the ledger (`tool-fs`, `plugin-mcp`), and an operator who
+ * points one of them at a different workspace must not thereby give it a
+ * different ledger: `fs.read` consults one, so a file recorded in another
+ * reads back unlabelled. Overwritten rather than defaulted, for that reason.
+ */
+const LEDGER_ROOT_KEY = 'ledgerRoot';
+const declares = (manifest, key) => Boolean(manifest.config
+    && typeof manifest.config.properties === 'object'
+    && manifest.config.properties !== null
+    && !Array.isArray(manifest.config.properties)
+    && key in manifest.config.properties);
+/**
+ * The configuration a plugin will actually be handed: its own block, minus
+ * the keys the host owns, plus the host defaults its manifest declares.
+ *
+ * Exported because validating a block against a manifest is only right on
+ * *this* object — `validatePluginConfig` on the raw block would refuse a
+ * manifest that declares `workspaceRoot` required for missing the very
+ * setting the host supplies. `stratus plugins` has to answer whether a
+ * daemon would accept a plugin's settings, and answering it from a
+ * different object than the loader uses is how a diagnostic ends up
+ * disagreeing with the thing it diagnoses.
+ */
+export const pluginConfigWithHostDefaults = (block, manifest, workspaceRoot) => {
     // `toolRisks` is the host's key, applied by the view at registration —
     // stripped here so the plugin's code never sees, and so can never
     // second-guess, the operator's risk word.
     const { enabled: _enabled, toolRisks: _toolRisks, ...rest } = block;
-    const declaresWorkspace = Boolean(manifest.config
-        && typeof manifest.config.properties === 'object'
-        && manifest.config.properties !== null
-        && !Array.isArray(manifest.config.properties)
-        && WORKSPACE_ROOT_KEY in manifest.config.properties);
-    if (declaresWorkspace && workspaceRoot !== undefined && rest[WORKSPACE_ROOT_KEY] === undefined) {
-        return { ...rest, [WORKSPACE_ROOT_KEY]: workspaceRoot };
+    let config = rest;
+    if (declares(manifest, WORKSPACE_ROOT_KEY) && workspaceRoot !== undefined && config[WORKSPACE_ROOT_KEY] === undefined) {
+        config = { ...config, [WORKSPACE_ROOT_KEY]: workspaceRoot };
+    }
+    if (declares(manifest, LEDGER_ROOT_KEY) && workspaceRoot !== undefined) {
+        config = { ...config, [LEDGER_ROOT_KEY]: workspaceRoot };
     }
-    return rest;
+    return config;
 };
 /**
  * Read and validate every skill a manifest declares — staged, not
@@ -131,6 +203,38 @@ const stageManifestSkills = async (manifest, packageDirectory) => {
     }
     return staged;
 };
+/**
+ * Everything `loadPlugins` checks before it imports a package: that the
+ * settings match the manifest's own schema, that any `toolRisks` overrides
+ * name tools the manifest declares and risks it permits, and that every
+ * skill file the manifest names is present, inside the package, and
+ * readable.
+ *
+ * One function because any of them failing rejects the *whole* plugin — it
+ * registers no tools and no skills — so a caller that ran a subset would
+ * report a plugin ready that the daemon refuses. `stratus plugins` is that
+ * caller, and it got exactly half of this right the first time; the
+ * `toolRisks` parse was the third check, missing here while the doc below
+ * said it should not be, until setup started asking this question too.
+ *
+ * Nothing here imports the package, which is what lets a diagnostic ask the
+ * question without starting anything.
+ *
+ * `loadPlugins` calls the same three checks rather than this composition of
+ * them, because it needs what the staging and the parse *return* and stages
+ * only when it has a registry to put skills in. The checks themselves are
+ * shared, so there is no second reading of a schema, an override or a skill
+ * path here — only a second caller of each. Anything added to the loader's
+ * preflight belongs in both.
+ */
+export const preflightPlugin = async (manifest, directory, block, workspaceRoot) => {
+    // The loader's order, kept: a block whose settings are wrong should say
+    // so before its overrides are read, since the overrides are the narrower
+    // mistake and the schema error is the one more likely to explain it.
+    validatePluginConfig(manifest, pluginConfigWithHostDefaults(block, manifest, workspaceRoot));
+    parseToolRiskOverrides(manifest, block);
+    await stageManifestSkills(manifest, directory);
+};
 /**
  * Turn a `plugins` config block into running capability.
  *
@@ -166,15 +270,13 @@ export const loadPlugins = async (options) => {
         // held for the life of a daemon that goes on running without it.
         let instance;
         try {
-            const resolved = options.host.resolve(specifier);
-            const { packageJson, directory } = await packageJsonFor(resolved, specifier);
-            const manifest = parsePluginManifest(packageJson, specifier);
+            const { manifest, directory } = await readPluginManifest(specifier, options.host);
             const isTrusted = trusted(manifest.packageName);
             // Validated *after* the host's defaults are folded in, because that
             // is the configuration the plugin will actually be handed: a manifest
             // that declares `workspaceRoot` required would otherwise be refused
             // for missing the very setting the host supplies.
-            const config = configFor(block, manifest, options.workspaceRoot);
+            const config = pluginConfigWithHostDefaults(block, manifest, options.workspaceRoot);
             validatePluginConfig(manifest, config);
             const riskOverrides = parseToolRiskOverrides(manifest, block);
             // Skills are read and validated before the module is imported —

package/dist/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAWzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAyB,MAAM,eAAe,CAAC;AAkBjF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,IAAwB,EACA,EAAE;IAC1B,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,yEAAyE;IACzE,yBAAyB;IACzB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;AAC7C,CAAC,CAAC;AAKF;;;;GAIG;AACH,MAAM,cAAc,GAAG,KAAK,EAC1B,WAAmB,EACnB,SAAiB,EACqC,EAAE;IACxD,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,uEAAuE;IACvE,qEAAqE;IACrE,qCAAqC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;YACzE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,SAAS,EAAE,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,SAAS,GAAG,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAClE,WAAW,KAAK,eAAe,IAAI,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAgG9E,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,SAAS,GAAG,CAChB,KAAiB,EACjB,QAAwB,EACxB,aAAiC,EACrB,EAAE;IACd,uEAAuE;IACvE,kEAAkE;IAClE,0CAA0C;IAC1C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpE,MAAM,iBAAiB,GAAG,OAAO,CAC/B,QAAQ,CAAC,MAAM;WACZ,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ;WAC9C,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI;WACnC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;WAC1C,kBAAkB,IAAK,QAAQ,CAAC,MAAM,CAAC,UAAyB,CACpE,CAAC;IACF,IAAI,iBAAiB,IAAI,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/F,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AASF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,KAAK,EAC/B,QAAwB,EACxB,gBAAwB,EACM,EAAE;IAChC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,gBAAgB;QAChB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,yCAAyC,WAAW,CAAC,IAAI,EAAE,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,yBAAyB,WAAW,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9J,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,MAAM,EAAE;gBACN,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,WAAW,CAAC,EAAE;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE;gBACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,QAAQ;aACf;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAA2B,EAA8B,EAAE;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IACvD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChD,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,kDAAkD;YAClD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACjE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,aAAa,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAE9D,gEAAgE;YAChE,+DAA+D;YAC/D,0CAA0C;YAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1F,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAoC,CAAC;YACzF,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBAC9C,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,0EAA0E,CACzG,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAClD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,+DAA+D,CAC9F,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC;YAElB,MAAM,IAAI,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;YACnH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAI;gBACX,kEAAkE;gBAClE,gEAAgE;gBAChE,8DAA8D;gBAC9D,kBAAkB;gBAClB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE,WAAW,EAAE,qCAAqC,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE;oBACvF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,mEAAmE;YACnE,8DAA8D;YAC9D,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,KAAK,CAAC,EAAE,2DAA2D,CAC3F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,MAAM,GAAwB,EAAE,CAAC;YACvC,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;gBACrD,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChC,gEAAgE;gBAChE,gEAAgE;gBAChE,gEAAgE;gBAChE,6DAA6D;gBAC7D,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;gBACpG,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,KAAK;gBACL,MAAM;gBACN,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAWzC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAyB,MAAM,eAAe,CAAC;AAkBjF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,IAAwB,EACA,EAAE;IAC1B,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,yEAAyE;IACzE,yBAAyB;IACzB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;AAC7C,CAAC,CAAC;AAKF;;;;GAIG;AACH,MAAM,cAAc,GAAG,KAAK,EAC1B,WAAmB,EACnB,SAAiB,EACqC,EAAE;IACxD,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,uEAAuE;IACvE,qEAAqE;IACrE,qCAAqC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;YACzE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,SAAS,EAAE,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,SAAS,GAAG,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,SAAiB,EACjB,IAAyC,EACZ,EAAE;IAC/B,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAI,WAAqC,CAAC,OAAO,CAAC;QAC/D,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,IAAyC,EACiB,EAAE;IAC5D,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AAC9E,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAClE,WAAW,KAAK,eAAe,IAAI,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAgG9E,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,MAAM,QAAQ,GAAG,CAAC,QAAwB,EAAE,GAAW,EAAW,EAAE,CAAC,OAAO,CAC1E,QAAQ,CAAC,MAAM;OACZ,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ;OAC9C,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI;OACnC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;OAC1C,GAAG,IAAK,QAAQ,CAAC,MAAM,CAAC,UAAyB,CACrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,KAAiB,EACjB,QAAwB,EACxB,aAAiC,EACrB,EAAE;IACd,uEAAuE;IACvE,kEAAkE;IAClE,0CAA0C;IAC1C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,IAAI,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QACtH,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AASF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,KAAK,EAC/B,QAAwB,EACxB,gBAAwB,EACM,EAAE;IAChC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,gBAAgB;QAChB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,yCAAyC,WAAW,CAAC,IAAI,EAAE,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,yBAAyB,WAAW,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9J,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,WAAW,WAAW,CAAC,EAAE,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,SAAS,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,MAAM,EAAE;gBACN,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,WAAW,CAAC,EAAE;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE;gBACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,QAAQ;aACf;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,QAAwB,EACxB,SAAiB,EACjB,KAAiB,EACjB,aAAiC,EAClB,EAAE;IACjB,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,oBAAoB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7F,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAA2B,EAA8B,EAAE;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IACvD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAClF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChD,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,kDAAkD;YAClD,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACpF,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,aAAa,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAE9D,gEAAgE;YAChE,+DAA+D;YAC/D,0CAA0C;YAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1F,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAoC,CAAC;YACzF,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBAC9C,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,0EAA0E,CACzG,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAClD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,+DAA+D,CAC9F,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC;YAElB,MAAM,IAAI,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;YACnH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAI;gBACX,kEAAkE;gBAClE,gEAAgE;gBAChE,8DAA8D;gBAC9D,kBAAkB;gBAClB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE,WAAW,EAAE,qCAAqC,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE;oBACvF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,mEAAmE;YACnE,8DAA8D;YAC9D,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,KAAK,CAAC,EAAE,2DAA2D,CAC3F,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,MAAM,GAAwB,EAAE,CAAC;YACvC,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;gBACrD,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChC,gEAAgE;gBAChE,gEAAgE;gBAChE,gEAAgE;gBAChE,6DAA6D;gBAC7D,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;gBACpG,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,KAAK;gBACL,MAAM;gBACN,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC,CAAC"}

package/dist/provenance.d.ts

@@ -0,0 +1,144 @@
+import type { FileHandle } from 'node:fs/promises';
+import { type TrustLevel } from '@stratusagent/core';
+/**
+ * The tainted-write ledger: which paths an agent wrote while its session
+ * was at `external` or `unknown`, and at which label.
+ *
+ * The filesystem is a laundering channel by construction — a durable store
+ * the agent controls. An agent that `fs.write`s fetched text into its
+ * workspace and `fs.read`s it back next week gets a file with no
+ * provenance, arriving as its own notes. This closes the sequence an agent
+ * can perform by itself: a write from a tainted session records the path,
+ * and a later read of that path taints the reading session at the recorded
+ * label.
+ *
+ * What it does not cover, said plainly: a copy under another name, a file a
+ * different process wrote, content pasted through some path the ledger
+ * never saw. Full filesystem provenance means carrying labels on bytes
+ * across a surface the agent does not exclusively own, which is a different
+ * project.
+ *
+ * One file per agent, under the agent's own workspace — next to the roots
+ * `tool-fs` already resolves per call, and keyed the same way, because two
+ * agents with different roots is the whole point of the per-agent block.
+ * It lives in the plugin host rather than in `tool-fs` because `tool-fs`
+ * is not the only plugin that puts a server's bytes on disk: `plugin-mcp`
+ * writes a bridged tool's image and audio blocks into the same workspace,
+ * and a file that bypassed `fs.write` would otherwise read back unlabelled.
+ * Without a workspace root (a host that loaded the plugin outside the
+ * loader) the ledger is process-local and says so in its name: the
+ * read-back-next-week case then survives only as long as the daemon does.
+ */
+export interface TaintedWriteLedger {
+    /** The label a read of this path carries, or undefined for a path the ledger never saw. */
+    lookup(agentId: string, absolutePath: string): Promise<TrustLevel | undefined>;
+    /**
+     * Every recorded path and its label, for a result that names many files
+     * at once — a listing, a search's matches and skips — read once rather
+     * than once per file.
+     */
+    snapshot(agentId: string): Promise<Record<string, TrustLevel>>;
+    /**
+     * Record a write at the writing session's label. A record only ever goes
+     * down and never clears — not even when a clean session later rewrites
+     * the file whole — because the path was the tainted session's choice as
+     * much as the bytes were, and because a clearing is the one record that
+     * could race a tainted write from another process into leaving tainted
+     * bytes unlabelled. Over-marking is the safe direction; an operator who
+     * wants a path back removes its lines from the ledger by hand. A clean
+     * session's write records nothing.
+     */
+    recordWrite(agentId: string, absolutePath: string, trust: TrustLevel): Promise<void>;
+}
+/** The ledger's filename inside an agent's workspace. Exported so `fs.write` can refuse to write it. */
+export declare const LEDGER_FILENAME = "fs-provenance.jsonl";
+/** In-process only. See `TaintedWriteLedger` for when this is what a host gets. */
+export declare const createProcessLocalLedger: () => TaintedWriteLedger;
+/**
+ * The label the ledger's own contents carry: the lowest label recorded in
+ * it. Every path in it was chosen by a session at `unknown` or `external`,
+ * and the ledger's own path has no record, so an agent whose roots cover
+ * its workspace could otherwise `fs.read` the ledger and get a list of
+ * attacker-chosen filenames back at `agent`. Undefined for no file or an
+ * empty one; `unknown` for a file that holds lines nothing here can read
+ * — nobody vouches for those.
+ */
+export declare const ledgerContentTrust: (ledgerFilePath: string, 
+/**
+ * The inode the caller read the ledger at. Given, the bytes judged are
+ * read from that inode or not at all: a name swapped for an empty file
+ * after the caller's read would otherwise be read here as "no label",
+ * while the result still shows the ledger's contents. A swap reads
+ * `unknown` — nobody can vouch for bytes they can no longer see.
+ */
+identity?: FileIdentity) => Promise<TrustLevel | undefined>;
+/**
+ * The label a ledger's bytes carry: the lowest recorded label, `unknown`
+ * for lines nothing here can read, nothing for an empty file. Pure over the
+ * bytes, so a caller that already holds what it showed the model — an
+ * `fs.read` result, a search's file contents — judges exactly that, and a
+ * peer rewriting the ledger in place after the read (same inode, new
+ * bytes) cannot make the shown lines read as unlabelled.
+ */
+export declare const ledgerTrustOfContent: (raw: string) => TrustLevel | undefined;
+/**
+ * The durable ledger, one append-only JSONL file per agent at
+ * `<workspaceRoot>/<agentId>/fs-provenance.jsonl`, owner-only. Each record
+ * is one `O_APPEND` write, so processes that share an agent — the daemon and
+ * a `stratus run` — interleave records rather than overwrite each other.
+ */
+export declare const createFileLedger: (workspaceRoot: string) => TaintedWriteLedger;
+/**
+ * Whether `absolutePath` is an agent's ledger — exactly
+ * `<workspaceRoot>/<agentId>/fs-provenance.json`, any agent's — which is the
+ * one path `fs.write` refuses. Exactly that depth, not any descendant with
+ * the name: a project an agent keeps under its workspace may legitimately
+ * have a file called `fs-provenance.json` of its own.
+ *
+ * `workspaceRoots` are every spelling of the workspace root worth checking
+ * — the configured path and its canonical form — because the path being
+ * judged arrives canonical from the root resolver, and a workspace an
+ * operator moved behind a symlink would otherwise compare as outside.
+ */
+export declare const isLedgerPath: (workspaceRoots: readonly string[], absolutePath: string) => boolean;
+/**
+ * The predicate `fs.write` refuses on and `fs.read` labels by, built once
+ * per tool call from what the workspace holds right now. A path is an
+ * agent's ledger two ways: lexically —
+ * `<workspaceRoot>/<agent>/fs-provenance.jsonl` under the configured or the
+ * canonical root — or through a link at the agent directory. An operator
+ * who relocated one agent's workspace with `<workspaceRoot>/ava -> /data/ava`
+ * has the ledger at `/data/ava/fs-provenance.jsonl`, which is how the root
+ * resolver spells every path under it and which no spelling of the root
+ * reaches, so every entry of the workspace is canonicalized and its ledger
+ * path listed — the ledger file's own canonical path too, for a link at
+ * the file rather than the directory, and its device and inode, for a hard
+ * link to it from inside a root. Built per call and never cached: a
+ * link repointed under a running daemon is judged where it points now, and
+ * one `readdir` plus two `realpath`s per agent is nothing next to the write.
+ */
+export interface FileIdentity {
+    dev: number;
+    ino: number;
+}
+/**
+ * Whether a path is an agent's ledger. `identity` is the inode the caller
+ * already holds for it — captured by the root resolver and verified by the
+ * open, so it is the file whose bytes were read or are about to be
+ * written. Given, it is what is judged; without it the path is stat'd,
+ * which names whatever is there *now*, and a peer can swap the name
+ * between a read and this check.
+ */
+export type LedgerGuard = (absolutePath: string, identity?: FileIdentity) => Promise<boolean>;
+export declare const ledgerGuard: (workspaceRoot: string | undefined) => Promise<LedgerGuard>;
+/**
+ * Whether `absolutePath`, spelled exactly so and through no link, names the
+ * file `handle` holds open — right now. Both halves matter: the canonical
+ * spelling must be the name itself, or a directory on the way is a link and
+ * the file lives somewhere else; and the inode at that name must be the
+ * handle's, or the name has since been given to a decoy while the handle
+ * still refers to wherever the link sent the create. A pathname comparison
+ * alone passes the second case.
+ */
+export declare const nameIdentifiesHandle: (absolutePath: string, handle: FileHandle) => Promise<boolean>;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC/E;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/D;;;;;;;;;OASG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,wGAAwG;AACxG,eAAO,MAAM,eAAe,wBAAwB,CAAC;AAiCrD,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,QAAO,kBAa3C,CAAC;AAiCF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC7B,gBAAgB,MAAM;AACtB;;;;;;GAMG;AACH,WAAW,YAAY,KACtB,OAAO,CAAC,UAAU,GAAG,SAAS,CA0BhC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,SAW/D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,eAAe,MAAM,KAAG,kBAmExD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,GAAI,gBAAgB,SAAS,MAAM,EAAE,EAAE,cAAc,MAAM,KAAG,OAQnF,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAI9F,eAAO,MAAM,WAAW,GAAU,eAAe,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,WAAW,CAgExF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAC/B,cAAc,MAAM,EACpB,QAAQ,UAAU,KACjB,OAAO,CAAC,OAAO,CAUjB,CAAC"}

package/dist/provenance.js

@@ -0,0 +1,316 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, readFile, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { isTrustLevel, leastTrusted } from '@stratusagent/core';
+/** The ledger's filename inside an agent's workspace. Exported so `fs.write` can refuse to write it. */
+export const LEDGER_FILENAME = 'fs-provenance.jsonl';
+const tainted = (trust) => trust === 'external' || trust === 'unknown';
+/** The ledger after a write at `trust`: the same object when nothing changed. */
+const nextPaths = (paths, absolutePath, trust) => {
+    if (!tainted(trust)) {
+        return paths;
+    }
+    const recorded = paths[absolutePath];
+    const combined = recorded !== undefined ? leastTrusted(recorded, trust) : trust;
+    return combined === recorded ? paths : { ...paths, [absolutePath]: combined };
+};
+/** In-process only. See `TaintedWriteLedger` for when this is what a host gets. */
+export const createProcessLocalLedger = () => {
+    const byAgent = new Map();
+    return {
+        async lookup(agentId, absolutePath) {
+            return byAgent.get(agentId)?.[absolutePath];
+        },
+        async snapshot(agentId) {
+            return { ...(byAgent.get(agentId) ?? {}) };
+        },
+        async recordWrite(agentId, absolutePath, trust) {
+            byAgent.set(agentId, nextPaths(byAgent.get(agentId) ?? {}, absolutePath, trust));
+        },
+    };
+};
+const parseLedger = (raw, filePath) => {
+    const paths = {};
+    for (const line of raw.split('\n')) {
+        if (line.trim().length === 0) {
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            throw new Error(`The filesystem provenance ledger has an invalid line: ${filePath}. Delete it to start over; the cost is that files written by earlier tainted sessions read as the agent's own.`);
+        }
+        if (typeof parsed !== 'object' || parsed === null || typeof parsed.path !== 'string') {
+            continue;
+        }
+        const record = parsed;
+        // Order-independent on purpose: labels only ever go down, so the lowest
+        // record for a path stands whichever process appended first. A path is
+        // in the ledger because a tainted write put it there, so a record whose
+        // label is missing or one nobody recognises — a hand edit, a label from
+        // a newer build — still marks the path: at `unknown`, never dropped,
+        // which would read the file back as the agent's own.
+        const label = isTrustLevel(record.trust) ? record.trust : 'unknown';
+        if (tainted(label)) {
+            const recorded = paths[record.path];
+            paths[record.path] = recorded !== undefined ? leastTrusted(recorded, label) : label;
+        }
+    }
+    return paths;
+};
+/**
+ * The label the ledger's own contents carry: the lowest label recorded in
+ * it. Every path in it was chosen by a session at `unknown` or `external`,
+ * and the ledger's own path has no record, so an agent whose roots cover
+ * its workspace could otherwise `fs.read` the ledger and get a list of
+ * attacker-chosen filenames back at `agent`. Undefined for no file or an
+ * empty one; `unknown` for a file that holds lines nothing here can read
+ * — nobody vouches for those.
+ */
+export const ledgerContentTrust = async (ledgerFilePath, 
+/**
+ * The inode the caller read the ledger at. Given, the bytes judged are
+ * read from that inode or not at all: a name swapped for an empty file
+ * after the caller's read would otherwise be read here as "no label",
+ * while the result still shows the ledger's contents. A swap reads
+ * `unknown` — nobody can vouch for bytes they can no longer see.
+ */
+identity) => {
+    let raw;
+    try {
+        if (identity !== undefined) {
+            const handle = await open(ledgerFilePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            try {
+                const info = await handle.stat();
+                if (info.dev !== identity.dev || info.ino !== identity.ino) {
+                    return 'unknown';
+                }
+                raw = (await handle.readFile()).toString('utf8');
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        else {
+            raw = await readFile(ledgerFilePath, 'utf8');
+        }
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EISDIR' || code === 'ELOOP') {
+            // With an inode in hand, a name that no longer opens is a swap too.
+            return identity !== undefined ? 'unknown' : undefined;
+        }
+        throw error;
+    }
+    return ledgerTrustOfContent(raw);
+};
+/**
+ * The label a ledger's bytes carry: the lowest recorded label, `unknown`
+ * for lines nothing here can read, nothing for an empty file. Pure over the
+ * bytes, so a caller that already holds what it showed the model — an
+ * `fs.read` result, a search's file contents — judges exactly that, and a
+ * peer rewriting the ledger in place after the read (same inode, new
+ * bytes) cannot make the shown lines read as unlabelled.
+ */
+export const ledgerTrustOfContent = (raw) => {
+    if (raw.trim().length === 0) {
+        return undefined;
+    }
+    let labels;
+    try {
+        labels = Object.values(parseLedger(raw, 'the ledger as read'));
+    }
+    catch {
+        return 'unknown';
+    }
+    return labels.length > 0 ? leastTrusted(...labels) : 'unknown';
+};
+/**
+ * The durable ledger, one append-only JSONL file per agent at
+ * `<workspaceRoot>/<agentId>/fs-provenance.jsonl`, owner-only. Each record
+ * is one `O_APPEND` write, so processes that share an agent — the daemon and
+ * a `stratus run` — interleave records rather than overwrite each other.
+ */
+export const createFileLedger = (workspaceRoot) => {
+    const ledgerPath = (agentId) => path.join(workspaceRoot, agentId, LEDGER_FILENAME);
+    const read = async (agentId) => {
+        const filePath = ledgerPath(agentId);
+        try {
+            return parseLedger(await readFile(filePath, 'utf8'), filePath);
+        }
+        catch (error) {
+            // No ledger yet, or a workspace root that is not a directory: either
+            // way nothing has been recorded. A tainted write still fails when it
+            // tries to record, which is the failure direction that leaves no
+            // unlabelled file behind.
+            const code = error.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR') {
+                return {};
+            }
+            throw error;
+        }
+    };
+    // Serialized per process: two writes in one turn are rare, but a
+    // read-modify-write with no lock would let the second drop the first.
+    let chain = Promise.resolve();
+    return {
+        lookup: (agentId, absolutePath) => read(agentId).then((paths) => paths[absolutePath]),
+        snapshot: (agentId) => read(agentId),
+        recordWrite(agentId, absolutePath, trust) {
+            const work = chain.then(async () => {
+                if (!tainted(trust)) {
+                    // A clean write records nothing — see `TaintedWriteLedger`.
+                    return;
+                }
+                const filePath = ledgerPath(agentId);
+                await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+                // Read and appended through ONE descriptor. A ledger reached through
+                // a link (a relocated workspace, a relocated file — both supported)
+                // is resolved once, at this open; a second open for the append
+                // would resolve the name afresh, and a link repointed in between
+                // would put the record in some other file while the bytes it
+                // describes land where the resolver already decided. O_APPEND keeps
+                // the write itself atomic against a peer's.
+                const handle = await open(filePath, constants.O_RDWR | constants.O_CREAT | constants.O_APPEND, 0o600);
+                try {
+                    // Tightened before the append, like the memory file: the mode on
+                    // open applies only when it creates the file.
+                    await handle.chmod(0o600);
+                    const before = parseLedger((await handle.readFile()).toString('utf8'), filePath);
+                    const paths = nextPaths(before, absolutePath, trust);
+                    // A path already at this label or lower needs no second line.
+                    if (paths === before) {
+                        return;
+                    }
+                    const record = {
+                        path: absolutePath,
+                        trust: paths[absolutePath],
+                        at: new Date().toISOString(),
+                    };
+                    await handle.appendFile(`${JSON.stringify(record)}\n`);
+                }
+                finally {
+                    await handle.close();
+                }
+            });
+            chain = work.then(() => undefined, () => undefined);
+            return work;
+        },
+    };
+};
+/**
+ * Whether `absolutePath` is an agent's ledger — exactly
+ * `<workspaceRoot>/<agentId>/fs-provenance.json`, any agent's — which is the
+ * one path `fs.write` refuses. Exactly that depth, not any descendant with
+ * the name: a project an agent keeps under its workspace may legitimately
+ * have a file called `fs-provenance.json` of its own.
+ *
+ * `workspaceRoots` are every spelling of the workspace root worth checking
+ * — the configured path and its canonical form — because the path being
+ * judged arrives canonical from the root resolver, and a workspace an
+ * operator moved behind a symlink would otherwise compare as outside.
+ */
+export const isLedgerPath = (workspaceRoots, absolutePath) => workspaceRoots.some((workspaceRoot) => {
+    const relative = path.relative(workspaceRoot, absolutePath);
+    if (relative.length === 0 || relative.startsWith('..') || path.isAbsolute(relative)) {
+        return false;
+    }
+    const segments = relative.split(path.sep);
+    return segments.length === 2 && segments[1] === LEDGER_FILENAME;
+});
+const identityKey = (identity) => `${identity.dev}:${identity.ino}`;
+export const ledgerGuard = async (workspaceRoot) => {
+    if (workspaceRoot === undefined) {
+        return async () => false;
+    }
+    const roots = [workspaceRoot];
+    try {
+        const canonical = await realpath(workspaceRoot);
+        if (canonical !== workspaceRoot) {
+            roots.push(canonical);
+        }
+    }
+    catch {
+        // Not there yet: only the configured spelling, and no agents to list.
+    }
+    const ledgers = new Set();
+    // And the files themselves, by identity: a hard link to a ledger from
+    // inside a root has a path no spelling reaches and `realpath` leaves
+    // alone, and is the same bytes. Plain numbers, like the resolver's
+    // `identity`, so the two sides of a comparison round the same way.
+    const identities = new Set();
+    let entries = [];
+    try {
+        entries = await readdir(workspaceRoot, { withFileTypes: true });
+    }
+    catch {
+        entries = [];
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() && !entry.isSymbolicLink()) {
+            continue;
+        }
+        const lexical = path.join(workspaceRoot, entry.name, LEDGER_FILENAME);
+        // Two canonical spellings, because either component can be a link: the
+        // agent directory (`ava -> /data/ava`, judged even before the ledger
+        // exists there) and the ledger file itself (`fs-provenance.jsonl ->
+        // /data/ava-ledger.jsonl`, whose target is what the resolver returns
+        // and what a truncating write would empty).
+        try {
+            ledgers.add(path.join(await realpath(path.dirname(lexical)), LEDGER_FILENAME));
+        }
+        catch {
+            // A dangling link holds no ledger.
+        }
+        try {
+            ledgers.add(await realpath(lexical));
+            identities.add(identityKey(await stat(lexical)));
+        }
+        catch {
+            // No ledger there yet, or a dangling link: nothing to protect.
+        }
+    }
+    return async (absolutePath, identity) => {
+        if (isLedgerPath(roots, absolutePath) || ledgers.has(absolutePath)) {
+            return true;
+        }
+        if (identities.size === 0) {
+            return false;
+        }
+        if (identity !== undefined) {
+            return identities.has(identityKey(identity));
+        }
+        try {
+            return identities.has(identityKey(await stat(absolutePath)));
+        }
+        catch {
+            // Nothing there: a write about to create a file is not the ledger.
+            return false;
+        }
+    };
+};
+/**
+ * Whether `absolutePath`, spelled exactly so and through no link, names the
+ * file `handle` holds open — right now. Both halves matter: the canonical
+ * spelling must be the name itself, or a directory on the way is a link and
+ * the file lives somewhere else; and the inode at that name must be the
+ * handle's, or the name has since been given to a decoy while the handle
+ * still refers to wherever the link sent the create. A pathname comparison
+ * alone passes the second case.
+ */
+export const nameIdentifiesHandle = async (absolutePath, handle) => {
+    try {
+        if ((await realpath(absolutePath)) !== absolutePath) {
+            return false;
+        }
+        const [atName, held] = await Promise.all([lstat(absolutePath), handle.stat()]);
+        return atName.dev === held.dev && atName.ino === held.ino;
+    }
+    catch {
+        return false;
+    }
+};
+//# sourceMappingURL=provenance.js.map

package/dist/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AAqDjF,wGAAwG;AACxG,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAiBrD,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAW,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS,CAAC;AAE5F,iFAAiF;AACjF,MAAM,SAAS,GAAG,CAChB,KAAiC,EACjC,YAAoB,EACpB,KAAiB,EACW,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC;AAChF,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAuB,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC9D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY;YAChC,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK;YAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,QAAgB,EAA8B,EAAE;IAChF,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yDAAyD,QAAQ,gHAAgH,CAAC,CAAC;QACrM,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAQ,MAAuB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvG,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAA+B,CAAC;QAC/C,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,qDAAqD;QACrD,MAAM,KAAK,GAAe,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;YACrC,KAAK,CAAC,MAAM,CAAC,IAAK,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,cAAsB;AACtB;;;;;;GAMG;AACH,QAAuB,EACU,EAAE;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAC3D,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrF,oEAAoE;YACpE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAA0B,EAAE;IAC1E,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,aAAqB,EAAsB,EAAE;IAC5E,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IAEnG,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAuC,EAAE;QAC1E,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,0BAA0B;YAC1B,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,iEAAiE;IACjE,sEAAsE;IACtE,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACrF,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpB,4DAA4D;oBAC5D,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtE,qEAAqE;gBACrE,oEAAoE;gBACpE,+DAA+D;gBAC/D,iEAAiE;gBACjE,6DAA6D;gBAC7D,oEAAoE;gBACpE,4CAA4C;gBAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtG,IAAI,CAAC;oBACH,iEAAiE;oBACjE,8CAA8C;oBAC9C,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACjF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;oBACrD,8DAA8D;oBAC9D,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;wBACrB,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAiB;wBAC3B,IAAI,EAAE,YAAY;wBAClB,KAAK,EAAE,KAAK,CAAC,YAAY,CAAE;wBAC3B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBAC7B,CAAC;oBACF,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzD,CAAC;wBAAS,CAAC;oBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,cAAiC,EAAE,YAAoB,EAAW,EAAE,CAC/F,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC;AAClE,CAAC,CAAC,CAAC;AAiCL,MAAM,WAAW,GAAG,CAAC,QAAsB,EAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;AAE1F,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,aAAiC,EAAwB,EAAE;IAC3F,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,4CAA4C;QAC5C,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;QACtC,IAAI,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,YAAoB,EACpB,MAAkB,EACA,EAAE;IACpB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratusagent/plugins",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -18,8 +18,8 @@
     "node": ">=22.13 <23 || >=23.4"
   },
   "dependencies": {
-    "@stratusagent/agents": "0.11.1",
-    "@stratusagent/core": "0.11.1"
+    "@stratusagent/agents": "0.11.3",
+    "@stratusagent/core": "0.11.3"
   },
   "devDependencies": {
     "@types/node": "^24.6.0",