@stratusagent/plugins 0.6.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stratus Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,103 @@
+# @stratusagent/plugins
+
+The plugin host: what a plugin claims, what it is allowed to register, and how
+a config block becomes running capability.
+
+The contract lives in
+[`docs/architecture/plugins.md`](../../docs/architecture/plugins.md) and is not
+re-derived here. This package is what makes it enforceable.
+
+You do not install this directly — it comes with `@stratusagent/cli`. You do
+read it if you are writing a plugin.
+
+## What a plugin author needs
+
+A `stratus` field in `package.json`, and one named export:
+
+```jsonc
+{
+  "name": "stratus-plugin-notes",
+  "keywords": ["stratus-plugin"],
+  "stratus": {
+    "pluginVersion": 1,
+    "contributes": {
+      "tools": [
+        { "name": "notes.read", "risk": "safe" },
+        { "name": "notes.write", "risk": "gated" }
+      ]
+    },
+    "config": {
+      "type": "object",
+      "properties": { "vault": { "type": "string" } },
+      "required": ["vault"]
+    }
+  }
+}
+```
+
+```ts
+export const createPlugin = (config) => ({
+  name: 'stratus-plugin-notes',
+  setup(context) {
+    context.tools.register(readTool(config));
+  },
+  // Optional. Only if setup acquired something a daemon shutdown must release.
+  async dispose() {},
+});
+```
+
+## What the host does with it
+
+- **Reads the manifest without importing the package.** A misconfigured or
+  over-reaching plugin fails at load, with its own name in the message, rather
+  than at the first tool call in the middle of somebody's turn.
+- **Validates your config against your schema** — including each per-agent
+  entry under `agents`, with `required` relaxed there, because an override says
+  what differs for one agent rather than restating the defaults.
+- **Hands `setup()` a manifest-bound registry, not the real one.** A name your
+  manifest does not declare is refused. The risk a tool registers at is the
+  riskiest of three claims — your manifest's, the floor your package is held
+  to, and whatever the object says about itself — so a tool can raise itself
+  and can never talk its way below what it declared.
+- **Stages and commits.** Nothing reaches the shared registry until your whole
+  `setup()` has succeeded, so a plugin that over-reaches on its fourth tool
+  leaves none of the first three behind.
+- **Refuses collisions.** Two packages contributing one tool name is a
+  load-time error naming both, never whichever loaded last.
+
+## Resolving settings per call
+
+```ts
+import { resolvePluginAgentConfig } from '@stratusagent/plugins';
+
+async execute(input, session) {
+  const settings = resolvePluginAgentConfig(config, session.agent.id);
+  …
+}
+```
+
+Per call, from the session — not once at setup. For a plugin whose settings
+are an access boundary (`tool-fs` roots are the example), resolving once hands
+every agent whichever value was resolved first, which is one agent reading
+another's files from code that looks correct.
+
+## `loadOptionalModule`
+
+The resolve-then-import split, in one place:
+
+```ts
+const slack = await loadOptionalModule('@stratusagent/channel-slack', {
+  resolve: (id) => import.meta.resolve(id),
+  import: (id) => import(id),
+});
+```
+
+Only a package failing to **resolve** means "not installed". One that is
+installed but missing a dependency of its own throws `ERR_MODULE_NOT_FOUND`
+too, naming that dependency — so reading the import's error would turn a broken
+install into a silently disabled feature.
+
+The two capabilities come from the caller because `import.meta.resolve` answers
+relative to the module that calls it: resolvable *from the daemon* and
+resolvable *from this package* are different questions, and only the first is
+the one being asked.

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The plugin host: what a plugin claims, what it is allowed to register,
+ * and how a config block becomes running capability.
+ *
+ * The contract lives in `docs/architecture/plugins.md` and is not
+ * re-derived here. What this package adds is enforcement — a manifest read
+ * without importing the package it describes, a registration view that
+ * holds `setup()` to that manifest, and a loader that refuses rather than
+ * degrades when a plugin over-reaches.
+ */
+export { declaredRiskFor, parsePluginManifest, resolvePluginAgentConfig, validateAgainstSchema, validatePluginConfig, HOST_CONFIG_KEYS, PLUGIN_MANIFEST_VERSION, PluginConfigError, PluginManifestError, type PluginContributions, type PluginManifest, type PluginNamespaceDeclaration, type PluginSkillDeclaration, type PluginToolDeclaration, } from './manifest.ts';
+export { ManifestBoundToolRegistry, riskFloorFor, type PluginToolRecord, } from './registry.ts';
+export { isFirstPartyPackage, loadOptionalModule, loadPlugins, type CreatePlugin, type LoadedPlugin, type LoadPluginsOptions, type LoadPluginsResult, type OptionalModuleHost, type PluginLoadFailure, } from './loader.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+/**
+ * The plugin host: what a plugin claims, what it is allowed to register,
+ * and how a config block becomes running capability.
+ *
+ * The contract lives in `docs/architecture/plugins.md` and is not
+ * re-derived here. What this package adds is enforcement — a manifest read
+ * without importing the package it describes, a registration view that
+ * holds `setup()` to that manifest, and a loader that refuses rather than
+ * degrades when a plugin over-reaches.
+ */
+export { declaredRiskFor, parsePluginManifest, resolvePluginAgentConfig, validateAgainstSchema, validatePluginConfig, HOST_CONFIG_KEYS, PLUGIN_MANIFEST_VERSION, PluginConfigError, PluginManifestError, } from "./manifest.js";
+export { ManifestBoundToolRegistry, riskFloorFor, } from "./registry.js";
+export { isFirstPartyPackage, loadOptionalModule, loadPlugins, } from "./loader.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,GAMpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,yBAAyB,EACzB,YAAY,GAEb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,GAOZ,MAAM,aAAa,CAAC"}

package/dist/loader.d.ts

@@ -0,0 +1,105 @@
+import type { EventBus, JsonObject, Plugin, ToolRegistry } from '@stratusagent/core';
+import { type PluginManifest } from './manifest.ts';
+import { type PluginToolRecord } from './registry.ts';
+/**
+ * The two capabilities loading an optional package needs, taken from the
+ * caller rather than used here.
+ *
+ * `import.meta.resolve` answers relative to the module that calls it, so a
+ * helper that called its own would answer for this package's node_modules
+ * rather than the host's — resolvable from the daemon and resolvable from
+ * here are different questions, and only the first one is the one being
+ * asked. Callers pass `{ resolve: (id) => import.meta.resolve(id), import:
+ * (id) => import(id) }` and get the rule without a copy of it.
+ */
+export interface OptionalModuleHost {
+    resolve(specifier: string): string;
+    import(specifier: string): Promise<unknown>;
+}
+/**
+ * Load a package that may not be installed, or report that it is not.
+ *
+ * Resolution and loading are separate questions, and only the first one
+ * means "not installed". Inspecting the import's error cannot tell them
+ * apart: a package that IS installed but is missing one of its own
+ * dependencies throws `ERR_MODULE_NOT_FOUND` too, naming that dependency —
+ * so a broken install would read as an absent one, silently disabling
+ * something whose configuration says it should be running.
+ *
+ * Extracted because there were three copies of it — the Slack adapter, the
+ * control API, and the dashboard resolved from inside the control API —
+ * and a plugin loader would have been the fourth.
+ */
+export declare const loadOptionalModule: <T = unknown>(specifier: string, host: OptionalModuleHost) => Promise<T | undefined>;
+/** The ABI every loadable plugin exports. See `plugins.md`. */
+export type CreatePlugin = (config: JsonObject) => Plugin | Promise<Plugin>;
+/**
+ * Whether a package's code is trusted — which is to say whether its
+ * manifest may declare a tool `safe`.
+ *
+ * First-party packages ship from this repository and pass its CI; anything
+ * else floors at `gated`. An operator can widen the set deliberately, and
+ * doing so is the same act as enabling the plugin at all: enablement is the
+ * security boundary, and this is a statement about how far it extends.
+ */
+export declare const isFirstPartyPackage: (packageName: string) => boolean;
+export interface LoadedPlugin {
+    /** The package name — a plugin's identity is its package. */
+    package: string;
+    /** What the plugin called itself in its `Plugin.name`. */
+    name: string;
+    manifest: PluginManifest;
+    trusted: boolean;
+    tools: PluginToolRecord[];
+    /**
+     * The plugin itself, so the host can shut it down. A browser plugin holds
+     * a Chromium and a listening socket; a daemon that stopped without
+     * telling it would leak both.
+     */
+    instance: Plugin;
+}
+/** A plugin an operator asked for that did not load, and why. */
+export interface PluginLoadFailure {
+    package: string;
+    reason: string;
+}
+export interface LoadPluginsOptions {
+    /** The `plugins` block: package name to that package's settings. */
+    config: Record<string, JsonObject> | undefined;
+    host: OptionalModuleHost;
+    /** The registry a plugin's tools are committed into once it loads whole. */
+    tools: ToolRegistry;
+    bus: EventBus;
+    /**
+     * Where tool output belongs on this machine. Supplied to any plugin whose
+     * schema declares `workspaceRoot` and whose operator did not set one —
+     * the host knows the platform's answer (`~/.stratus/workspaces`) and a
+     * plugin that had to derive it would be re-deriving a path this
+     * repository owns.
+     */
+    workspaceRoot?: string;
+    /** Overrides the trusted set. See `isFirstPartyPackage`. */
+    trusted?: (packageName: string) => boolean;
+}
+export interface LoadPluginsResult {
+    loaded: LoadedPlugin[];
+    failures: PluginLoadFailure[];
+}
+/**
+ * Turn a `plugins` config block into running capability.
+ *
+ * Ordered the way the trust model requires: **nothing auto-loads** (only
+ * what is listed and enabled, and callers pass this only what a trusted
+ * config named), the **manifest is validated before the module is
+ * imported**, and `setup()` registers through the manifest-bound view
+ * rather than the raw registry.
+ *
+ * One plugin failing does not take the others — or the daemon — down: a
+ * failure is collected, named, and reported to the operator, because a
+ * daemon that refuses to start over a mistyped package name is a worse
+ * outcome than one running the plugins that do load and saying which did
+ * not. What is *never* degraded is the security half: an undeclared name, a
+ * collision, or a manifest that will not parse refuses that plugin whole.
+ */
+export declare const loadPlugins: (options: LoadPluginsOptions) => Promise<LoadPluginsResult>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErF,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,GAAU,CAAC,GAAG,OAAO,EAClD,WAAW,MAAM,EACjB,MAAM,kBAAkB,KACvB,OAAO,CAAC,CAAC,GAAG,SAAS,CASvB,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAuB5E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,MAAM,KAAG,OACmB,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;IAC/C,IAAI,EAAE,kBAAkB,CAAC;IACzB,4EAA4E;IAC5E,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,QAAQ,CAAC;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,kBAAkB,KAAG,OAAO,CAAC,iBAAiB,CA0ExF,CAAC"}

package/dist/loader.js

@@ -0,0 +1,158 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parsePluginManifest, validatePluginConfig, PluginManifestError, } from "./manifest.js";
+import { ManifestBoundToolRegistry } from "./registry.js";
+/**
+ * Load a package that may not be installed, or report that it is not.
+ *
+ * Resolution and loading are separate questions, and only the first one
+ * means "not installed". Inspecting the import's error cannot tell them
+ * apart: a package that IS installed but is missing one of its own
+ * dependencies throws `ERR_MODULE_NOT_FOUND` too, naming that dependency —
+ * so a broken install would read as an absent one, silently disabling
+ * something whose configuration says it should be running.
+ *
+ * Extracted because there were three copies of it — the Slack adapter, the
+ * control API, and the dashboard resolved from inside the control API —
+ * and a plugin loader would have been the fourth.
+ */
+export const loadOptionalModule = async (specifier, host) => {
+    try {
+        host.resolve(specifier);
+    }
+    catch {
+        return undefined;
+    }
+    // Resolvable: any failure from here is a real problem with the installed
+    // package, and surfaces.
+    return (await host.import(specifier));
+};
+/** Where a package's own package.json is, given something it resolved to. */
+const packageJsonFor = async (resolvedUrl, specifier) => {
+    let directory = path.dirname(fileURLToPath(resolvedUrl));
+    // Bounded rather than "until the filesystem root": a walk that reaches
+    // `/` would read some unrelated package.json and validate a manifest
+    // that never described this package.
+    for (let depth = 0; depth < 8; depth += 1) {
+        try {
+            const raw = await readFile(path.join(directory, 'package.json'), 'utf8');
+            return JSON.parse(raw);
+        }
+        catch {
+            const parent = path.dirname(directory);
+            if (parent === directory) {
+                break;
+            }
+            directory = parent;
+        }
+    }
+    throw new PluginManifestError(`Could not find a package.json for ${specifier}.`);
+};
+/**
+ * Whether a package's code is trusted — which is to say whether its
+ * manifest may declare a tool `safe`.
+ *
+ * First-party packages ship from this repository and pass its CI; anything
+ * else floors at `gated`. An operator can widen the set deliberately, and
+ * doing so is the same act as enabling the plugin at all: enablement is the
+ * security boundary, and this is a statement about how far it extends.
+ */
+export const isFirstPartyPackage = (packageName) => packageName === '@stratusagent' || packageName.startsWith('@stratusagent/');
+const WORKSPACE_ROOT_KEY = 'workspaceRoot';
+const configFor = (block, manifest, workspaceRoot) => {
+    const { enabled: _enabled, ...rest } = block;
+    const declaresWorkspace = Boolean(manifest.config
+        && typeof manifest.config.properties === 'object'
+        && manifest.config.properties !== null
+        && !Array.isArray(manifest.config.properties)
+        && WORKSPACE_ROOT_KEY in manifest.config.properties);
+    if (declaresWorkspace && workspaceRoot !== undefined && rest[WORKSPACE_ROOT_KEY] === undefined) {
+        return { ...rest, [WORKSPACE_ROOT_KEY]: workspaceRoot };
+    }
+    return rest;
+};
+/**
+ * Turn a `plugins` config block into running capability.
+ *
+ * Ordered the way the trust model requires: **nothing auto-loads** (only
+ * what is listed and enabled, and callers pass this only what a trusted
+ * config named), the **manifest is validated before the module is
+ * imported**, and `setup()` registers through the manifest-bound view
+ * rather than the raw registry.
+ *
+ * One plugin failing does not take the others — or the daemon — down: a
+ * failure is collected, named, and reported to the operator, because a
+ * daemon that refuses to start over a mistyped package name is a worse
+ * outcome than one running the plugins that do load and saying which did
+ * not. What is *never* degraded is the security half: an undeclared name, a
+ * collision, or a manifest that will not parse refuses that plugin whole.
+ */
+export const loadPlugins = async (options) => {
+    const entries = Object.entries(options.config ?? {});
+    const trusted = options.trusted ?? isFirstPartyPackage;
+    const loaded = [];
+    const failures = [];
+    // Which package owns each name so far, so a collision can name both.
+    const owners = new Map();
+    for (const [specifier, rawBlock] of entries) {
+        const block = rawBlock ?? {};
+        if (block.enabled === false) {
+            continue;
+        }
+        // Held outside the try so a plugin that was *constructed* and then
+        // failed can still be told to let go. A plugin acquires its resources
+        // in `createPlugin` and `setup` — a subscription on the bus, a socket,
+        // a child process — and a load that fails after that point leaves them
+        // held for the life of a daemon that goes on running without it.
+        let instance;
+        try {
+            const resolved = options.host.resolve(specifier);
+            const manifest = parsePluginManifest(await packageJsonFor(resolved, specifier), specifier);
+            const isTrusted = trusted(manifest.packageName);
+            // Validated *after* the host's defaults are folded in, because that
+            // is the configuration the plugin will actually be handed: a manifest
+            // that declares `workspaceRoot` required would otherwise be refused
+            // for missing the very setting the host supplies.
+            const config = configFor(block, manifest, options.workspaceRoot);
+            validatePluginConfig(manifest, config);
+            const module = (await options.host.import(specifier));
+            if (typeof module.createPlugin !== 'function') {
+                throw new PluginManifestError(`Plugin ${manifest.packageName} does not export createPlugin(config). See docs/architecture/plugins.md.`);
+            }
+            const plugin = await module.createPlugin(config);
+            if (!plugin || typeof plugin.setup !== 'function') {
+                throw new PluginManifestError(`Plugin ${manifest.packageName}: createPlugin did not return a plugin with a setup(context).`);
+            }
+            instance = plugin;
+            const view = new ManifestBoundToolRegistry({ manifest, target: options.tools, trusted: isTrusted });
+            await plugin.setup({ bus: options.bus, tools: view });
+            const tools = view.commit(owners);
+            loaded.push({
+                package: manifest.packageName,
+                name: typeof plugin.name === 'string' && plugin.name.length > 0 ? plugin.name : manifest.packageName,
+                manifest,
+                trusted: isTrusted,
+                tools,
+                instance: plugin,
+            });
+        }
+        catch (error) {
+            // Refused, and then released. A plugin whose `dispose` also throws is
+            // ignored: it is already being reported as failed, and the second
+            // failure would replace the reason that says why.
+            try {
+                await instance?.dispose?.();
+            }
+            catch {
+                // Nothing more to do for a plugin that cannot even let go.
+            }
+            failures.push({
+                package: specifier,
+                reason: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return { loaded, failures };
+};
+//# sourceMappingURL=loader.js.map

package/dist/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAyB,MAAM,eAAe,CAAC;AAkBjF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,SAAiB,EACjB,IAAwB,EACA,EAAE;IAC1B,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,yEAAyE;IACzE,yBAAyB;IACzB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;AAC7C,CAAC,CAAC;AAKF,6EAA6E;AAC7E,MAAM,cAAc,GAAG,KAAK,EAAE,WAAmB,EAAE,SAAiB,EAAoB,EAAE;IACxF,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,uEAAuE;IACvE,qEAAqE;IACrE,qCAAqC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,SAAS,GAAG,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAClE,WAAW,KAAK,eAAe,IAAI,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAgD9E,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,SAAS,GAAG,CAChB,KAAiB,EACjB,QAAwB,EACxB,aAAiC,EACrB,EAAE;IACd,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,iBAAiB,GAAG,OAAO,CAC/B,QAAQ,CAAC,MAAM;WACZ,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ;WAC9C,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI;WACnC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;WAC1C,kBAAkB,IAAK,QAAQ,CAAC,MAAM,CAAC,UAAyB,CACpE,CAAC;IACF,IAAI,iBAAiB,IAAI,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/F,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAA2B,EAA8B,EAAE;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IACvD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;YAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChD,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,kDAAkD;YAClD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACjE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAEvC,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAoC,CAAC;YACzF,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;gBAC9C,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,0EAA0E,CACzG,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAClD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,QAAQ,CAAC,WAAW,+DAA+D,CAC9F,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC;YAElB,MAAM,IAAI,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACpG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAElC,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW;gBACpG,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,KAAK;gBACL,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,110 @@
+import { type JsonObject, type JsonValue, type ToolRisk } from '@stratusagent/core';
+/**
+ * The manifest version this host understands. A plugin declaring anything
+ * else is refused rather than read optimistically: the whole point of the
+ * manifest is that the daemon can trust what it says about a package it has
+ * not imported, and reading an unknown dialect on a guess gives that up.
+ */
+export declare const PLUGIN_MANIFEST_VERSION = 1;
+/** A tool the manifest names outright. */
+export interface PluginToolDeclaration {
+    name: string;
+    risk: ToolRisk;
+}
+/**
+ * A namespace the manifest claims instead of naming what is inside it —
+ * the form a bridge whose tool names exist only at connect time can be
+ * declared under. The risk is a ceiling on trust, never a floor the plugin
+ * picks: everything discovered under it registers at this risk or higher.
+ */
+export interface PluginNamespaceDeclaration {
+    namespace: string;
+    risk: ToolRisk;
+}
+export interface PluginSkillDeclaration {
+    id: string;
+    path: string;
+}
+export interface PluginContributions {
+    tools: PluginToolDeclaration[];
+    toolsDiscovered: PluginNamespaceDeclaration[];
+    /** Parsed and reported, but not yet registrable — skills are step 09. */
+    skills: PluginSkillDeclaration[];
+}
+export interface PluginManifest {
+    /** The package name, which is the plugin's identity. */
+    packageName: string;
+    pluginVersion: number;
+    contributes: PluginContributions;
+    credentials: string[];
+    /** JSON Schema for the plugin's own config block, if it declared one. */
+    config?: JsonObject;
+}
+/** A manifest that cannot be trusted to describe the package it came from. */
+export declare class PluginManifestError extends Error {
+    constructor(message: string);
+}
+/** A config block that does not match what the manifest said it would be. */
+export declare class PluginConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Read the `stratus` field of a package.json into a manifest, or refuse it.
+ *
+ * Nothing here imports the package — that is the property the manifest
+ * exists for. A misconfigured or over-reaching plugin fails at load, with
+ * its own name in the message, rather than at the first tool call in the
+ * middle of somebody's turn.
+ */
+export declare const parsePluginManifest: (packageJson: unknown, specifier: string) => PluginManifest;
+/**
+ * The risk a manifest says a tool registers at, or undefined when the
+ * manifest does not authorize the name at all.
+ *
+ * A literal declaration wins over a namespace: a plugin that both owns
+ * `mcp.*` at `gated` and names `mcp.ping` at `safe` gets what it wrote for
+ * the name it wrote. Namespace matching is `matchesToolAllowlist` — the
+ * same reading of `mcp.*` a soul's allowlist gets, because two readings of
+ * one glob is two answers to what a package may register.
+ */
+export declare const declaredRiskFor: (manifest: PluginManifest, toolName: string) => ToolRisk | undefined;
+/**
+ * Keys the host owns inside a plugin's config block. They are stripped
+ * before the plugin's own schema sees the block — a plugin author writes a
+ * schema for their settings, not for the machinery that selects them.
+ */
+export declare const HOST_CONFIG_KEYS: readonly ["enabled", "agents"];
+/**
+ * Check a config block against the manifest's schema.
+ *
+ * A deliberately small subset of JSON Schema — `type`, `properties`,
+ * `required`, `items`, `enum`, and `additionalProperties: false` — chosen
+ * so that the daemon can answer "is this configuration well-formed" without
+ * carrying a validator library into every install. Keywords outside the
+ * subset are ignored rather than refused, so a schema written against the
+ * full standard still loads; what it buys is fewer checks, never a false
+ * pass on a keyword we pretended to understand.
+ */
+export declare const validateAgainstSchema: (value: JsonValue, schema: JsonObject, where: string, options?: {
+    requireRequired?: boolean;
+}) => void;
+/**
+ * Validate one plugin's whole config block — the defaults and every
+ * per-agent override — against the manifest's schema.
+ *
+ * The per-agent entries are checked with `required` relaxed, and that is
+ * the point of them: an agent block says what differs for that agent, so
+ * holding a two-key override to a schema's required list would make the
+ * defaults above it unusable.
+ */
+export declare const validatePluginConfig: (manifest: PluginManifest, block: JsonObject) => void;
+/**
+ * One agent's settings for a plugin: its own entry over the defaults, key
+ * by key — the shape `approvals` already uses, and the reason a plugin
+ * whose settings are an access boundary must call this **per execution**
+ * rather than closing over a value at setup. `session.agent.id` is what
+ * makes the answer different for two agents; resolving once at setup gives
+ * every agent whichever one happened to be asked about first.
+ */
+export declare const resolvePluginAgentConfig: (block: JsonObject | undefined, agentId: string) => JsonObject;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,eAAe,EAAE,0BAA0B,EAAE,CAAC;IAC9C,yEAAyE;IACzE,MAAM,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,mBAAmB,CAAC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,8EAA8E;AAC9E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,6EAA6E;AAC7E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AA6BD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,OAAO,EAAE,WAAW,MAAM,KAAG,cAyG7E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAI,UAAU,cAAc,EAAE,UAAU,MAAM,KAAG,QAAQ,GAAG,SASvF,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,gCAAiC,CAAC;AAY/D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,SAAS,EAChB,QAAQ,UAAU,EAClB,OAAO,MAAM,EACb,UAAS;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,KAC1C,IA6CF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,cAAc,EAAE,OAAO,UAAU,KAAG,IA6BlF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,UAAU,GAAG,SAAS,EAAE,SAAS,MAAM,KAAG,UAOzF,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,264 @@
+import { DEFAULT_TOOL_RISK, matchesToolAllowlist, } from '@stratusagent/core';
+/**
+ * The manifest version this host understands. A plugin declaring anything
+ * else is refused rather than read optimistically: the whole point of the
+ * manifest is that the daemon can trust what it says about a package it has
+ * not imported, and reading an unknown dialect on a guess gives that up.
+ */
+export const PLUGIN_MANIFEST_VERSION = 1;
+/** A manifest that cannot be trusted to describe the package it came from. */
+export class PluginManifestError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PluginManifestError';
+    }
+}
+/** A config block that does not match what the manifest said it would be. */
+export class PluginConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PluginConfigError';
+    }
+}
+// `namespace.verb`, with the nesting a bridged server's names need
+// (`mcp.linear.create_issue`). Underscores are allowed inside a segment
+// because somebody else's API chose those names; the leading character is
+// not, so nothing can be typed to look like a flag or a hidden file.
+const TOOL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*(\.[a-z0-9][a-z0-9_-]*)+$/;
+const NAMESPACE_PATTERN = /^[a-z0-9][a-z0-9-]*(\.[a-z0-9][a-z0-9_-]*)*\.\*$/;
+const SKILL_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+const RISKS = ['safe', 'gated', 'dangerous'];
+const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const parseRisk = (raw, where) => {
+    // Undeclared is `gated`, exactly as it is on a Tool: a manifest entry
+    // that forgot to think about risk is held back rather than waved through.
+    if (raw === undefined) {
+        return DEFAULT_TOOL_RISK;
+    }
+    if (typeof raw !== 'string' || !RISKS.includes(raw)) {
+        throw new PluginManifestError(`Invalid risk in ${where}: ${JSON.stringify(raw)}. Use safe, gated, or dangerous.`);
+    }
+    return raw;
+};
+/**
+ * Read the `stratus` field of a package.json into a manifest, or refuse it.
+ *
+ * Nothing here imports the package — that is the property the manifest
+ * exists for. A misconfigured or over-reaching plugin fails at load, with
+ * its own name in the message, rather than at the first tool call in the
+ * middle of somebody's turn.
+ */
+export const parsePluginManifest = (packageJson, specifier) => {
+    if (!isObject(packageJson)) {
+        throw new PluginManifestError(`Package ${specifier} has no readable package.json.`);
+    }
+    const packageName = typeof packageJson.name === 'string' && packageJson.name.length > 0
+        ? packageJson.name
+        : specifier;
+    const stratus = packageJson.stratus;
+    if (!isObject(stratus)) {
+        throw new PluginManifestError(`Package ${packageName} is not a Stratus plugin: its package.json has no "stratus" manifest.`);
+    }
+    const version = stratus.pluginVersion;
+    if (version !== PLUGIN_MANIFEST_VERSION) {
+        throw new PluginManifestError(`Plugin ${packageName} declares pluginVersion ${JSON.stringify(version)}; this host understands ${PLUGIN_MANIFEST_VERSION}.`);
+    }
+    const contributes = isObject(stratus.contributes) ? stratus.contributes : {};
+    const tools = [];
+    const toolsDiscovered = [];
+    const skills = [];
+    if (contributes.tools !== undefined) {
+        if (!Array.isArray(contributes.tools)) {
+            throw new PluginManifestError(`Plugin ${packageName}: contributes.tools must be an array.`);
+        }
+        for (const entry of contributes.tools) {
+            if (!isObject(entry) || typeof entry.name !== 'string') {
+                throw new PluginManifestError(`Plugin ${packageName}: every contributes.tools entry needs a "name".`);
+            }
+            if (!TOOL_NAME_PATTERN.test(entry.name)) {
+                throw new PluginManifestError(`Plugin ${packageName}: ${JSON.stringify(entry.name)} is not a tool name. Tools are namespace.verb, lowercase (fs.read).`);
+            }
+            tools.push({ name: entry.name, risk: parseRisk(entry.risk, `${packageName} tool ${entry.name}`) });
+        }
+    }
+    if (contributes.toolsDiscovered !== undefined) {
+        if (!Array.isArray(contributes.toolsDiscovered)) {
+            throw new PluginManifestError(`Plugin ${packageName}: contributes.toolsDiscovered must be an array.`);
+        }
+        for (const entry of contributes.toolsDiscovered) {
+            if (!isObject(entry) || typeof entry.namespace !== 'string') {
+                throw new PluginManifestError(`Plugin ${packageName}: every contributes.toolsDiscovered entry needs a "namespace".`);
+            }
+            if (!NAMESPACE_PATTERN.test(entry.namespace)) {
+                throw new PluginManifestError(`Plugin ${packageName}: ${JSON.stringify(entry.namespace)} is not a namespace. Declare one as a prefix and a star (mcp.*).`);
+            }
+            toolsDiscovered.push({
+                namespace: entry.namespace,
+                risk: parseRisk(entry.risk, `${packageName} namespace ${entry.namespace}`),
+            });
+        }
+    }
+    if (contributes.skills !== undefined) {
+        if (!Array.isArray(contributes.skills)) {
+            throw new PluginManifestError(`Plugin ${packageName}: contributes.skills must be an array.`);
+        }
+        for (const entry of contributes.skills) {
+            if (!isObject(entry) || typeof entry.id !== 'string' || typeof entry.path !== 'string') {
+                throw new PluginManifestError(`Plugin ${packageName}: every contributes.skills entry needs an "id" and a "path".`);
+            }
+            if (!SKILL_ID_PATTERN.test(entry.id)) {
+                throw new PluginManifestError(`Plugin ${packageName}: ${JSON.stringify(entry.id)} is not a skill id. Skill ids are kebab-case (web-research).`);
+            }
+            skills.push({ id: entry.id, path: entry.path });
+        }
+    }
+    const credentials = [];
+    if (stratus.credentials !== undefined) {
+        if (!Array.isArray(stratus.credentials) || stratus.credentials.some((name) => typeof name !== 'string')) {
+            throw new PluginManifestError(`Plugin ${packageName}: credentials must be an array of names.`);
+        }
+        credentials.push(...stratus.credentials);
+    }
+    if (stratus.config !== undefined && !isObject(stratus.config)) {
+        throw new PluginManifestError(`Plugin ${packageName}: config must be a JSON Schema object.`);
+    }
+    return {
+        packageName,
+        pluginVersion: PLUGIN_MANIFEST_VERSION,
+        contributes: { tools, toolsDiscovered, skills },
+        credentials,
+        ...(isObject(stratus.config) ? { config: stratus.config } : {}),
+    };
+};
+/**
+ * The risk a manifest says a tool registers at, or undefined when the
+ * manifest does not authorize the name at all.
+ *
+ * A literal declaration wins over a namespace: a plugin that both owns
+ * `mcp.*` at `gated` and names `mcp.ping` at `safe` gets what it wrote for
+ * the name it wrote. Namespace matching is `matchesToolAllowlist` — the
+ * same reading of `mcp.*` a soul's allowlist gets, because two readings of
+ * one glob is two answers to what a package may register.
+ */
+export const declaredRiskFor = (manifest, toolName) => {
+    const literal = manifest.contributes.tools.find((entry) => entry.name === toolName);
+    if (literal) {
+        return literal.risk;
+    }
+    const namespace = manifest.contributes.toolsDiscovered.find((entry) => matchesToolAllowlist(toolName, [entry.namespace]));
+    return namespace?.risk;
+};
+// ---- config validation -----------------------------------------------------
+/**
+ * Keys the host owns inside a plugin's config block. They are stripped
+ * before the plugin's own schema sees the block — a plugin author writes a
+ * schema for their settings, not for the machinery that selects them.
+ */
+export const HOST_CONFIG_KEYS = ['enabled', 'agents'];
+const typeOf = (value) => {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    if (Number.isInteger(value))
+        return 'integer';
+    return typeof value;
+};
+const typeMatches = (expected, actual) => expected === actual || (expected === 'number' && actual === 'integer');
+/**
+ * Check a config block against the manifest's schema.
+ *
+ * A deliberately small subset of JSON Schema — `type`, `properties`,
+ * `required`, `items`, `enum`, and `additionalProperties: false` — chosen
+ * so that the daemon can answer "is this configuration well-formed" without
+ * carrying a validator library into every install. Keywords outside the
+ * subset are ignored rather than refused, so a schema written against the
+ * full standard still loads; what it buys is fewer checks, never a false
+ * pass on a keyword we pretended to understand.
+ */
+export const validateAgainstSchema = (value, schema, where, options = {}) => {
+    const requireRequired = options.requireRequired ?? true;
+    const allowedValues = Array.isArray(schema.enum) ? schema.enum : undefined;
+    if (allowedValues && !allowedValues.some((allowed) => JSON.stringify(allowed) === JSON.stringify(value))) {
+        throw new PluginConfigError(`${where} must be one of ${allowedValues.map((entry) => JSON.stringify(entry)).join(', ')}; got ${JSON.stringify(value)}.`);
+    }
+    if (typeof schema.type === 'string' && !typeMatches(schema.type, typeOf(value))) {
+        throw new PluginConfigError(`${where} must be a ${schema.type}; got ${typeOf(value)}.`);
+    }
+    if (Array.isArray(value) && schema.items !== undefined && isObject(schema.items)) {
+        value.forEach((entry, index) => {
+            validateAgainstSchema(entry, schema.items, `${where}[${index}]`, options);
+        });
+        return;
+    }
+    if (isObject(value) && !Array.isArray(value)) {
+        const properties = isObject(schema.properties) ? schema.properties : undefined;
+        if (requireRequired && Array.isArray(schema.required)) {
+            for (const key of schema.required) {
+                if (typeof key === 'string' && !(key in value)) {
+                    throw new PluginConfigError(`${where} is missing required setting ${JSON.stringify(key)}.`);
+                }
+            }
+        }
+        if (properties) {
+            for (const [key, entry] of Object.entries(value)) {
+                const propertySchema = properties[key];
+                if (propertySchema === undefined) {
+                    if (schema.additionalProperties === false) {
+                        throw new PluginConfigError(`${where} has no setting named ${JSON.stringify(key)}.`);
+                    }
+                    continue;
+                }
+                if (isObject(propertySchema)) {
+                    validateAgainstSchema(entry, propertySchema, `${where}.${key}`, options);
+                }
+            }
+        }
+    }
+};
+/**
+ * Validate one plugin's whole config block — the defaults and every
+ * per-agent override — against the manifest's schema.
+ *
+ * The per-agent entries are checked with `required` relaxed, and that is
+ * the point of them: an agent block says what differs for that agent, so
+ * holding a two-key override to a schema's required list would make the
+ * defaults above it unusable.
+ */
+export const validatePluginConfig = (manifest, block) => {
+    const schema = manifest.config;
+    if (!schema) {
+        return;
+    }
+    const { enabled: _enabled, agents, ...defaults } = block;
+    validateAgainstSchema(defaults, schema, `plugins["${manifest.packageName}"]`);
+    if (agents === undefined) {
+        return;
+    }
+    if (!isObject(agents)) {
+        throw new PluginConfigError(`plugins["${manifest.packageName}"].agents must be an object keyed by agent id.`);
+    }
+    for (const [agentId, entry] of Object.entries(agents)) {
+        if (!isObject(entry)) {
+            throw new PluginConfigError(`plugins["${manifest.packageName}"].agents.${agentId} must be an object of settings.`);
+        }
+        validateAgainstSchema(entry, schema, `plugins["${manifest.packageName}"].agents.${agentId}`, { requireRequired: false });
+    }
+};
+/**
+ * One agent's settings for a plugin: its own entry over the defaults, key
+ * by key — the shape `approvals` already uses, and the reason a plugin
+ * whose settings are an access boundary must call this **per execution**
+ * rather than closing over a value at setup. `session.agent.id` is what
+ * makes the answer different for two agents; resolving once at setup gives
+ * every agent whichever one happened to be asked about first.
+ */
+export const resolvePluginAgentConfig = (block, agentId) => {
+    if (!block) {
+        return {};
+    }
+    const { enabled: _enabled, agents, ...defaults } = block;
+    const overrides = isObject(agents) ? agents[agentId] : undefined;
+    return isObject(overrides) ? { ...defaults, ...overrides } : { ...defaults };
+};
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GAIrB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAyCzC,8EAA8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mEAAmE;AACnE,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,MAAM,iBAAiB,GAAG,kDAAkD,CAAC;AAC7E,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD,MAAM,KAAK,GAAe,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAEzD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,KAAa,EAAY,EAAE;IAC1D,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAe,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,mBAAmB,CAC3B,mBAAmB,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,kCAAkC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,GAAe,CAAC;AACzB,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAAoB,EAAE,SAAiB,EAAkB,EAAE;IAC7F,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAAC,WAAW,SAAS,gCAAgC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACrF,CAAC,CAAC,WAAW,CAAC,IAAI;QAClB,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,mBAAmB,CAC3B,WAAW,WAAW,uEAAuE,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IACtC,IAAI,OAAO,KAAK,uBAAuB,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAC3B,UAAU,WAAW,2BAA2B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,2BAA2B,uBAAuB,GAAG,CAC7H,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAiC,EAAE,CAAC;IACzD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAE5C,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,UAAU,WAAW,uCAAuC,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,mBAAmB,CAC3B,UAAU,WAAW,iDAAiD,CACvE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,mBAAmB,CAC3B,UAAU,WAAW,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAC1H,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,WAAW,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,mBAAmB,CAAC,UAAU,WAAW,iDAAiD,CAAC,CAAC;QACxG,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,IAAI,mBAAmB,CAC3B,UAAU,WAAW,gEAAgE,CACtF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,mBAAmB,CAC3B,UAAU,WAAW,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,kEAAkE,CAC5H,CAAC;YACJ,CAAC;YACD,eAAe,CAAC,IAAI,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,WAAW,cAAc,KAAK,CAAC,SAAS,EAAE,CAAC;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,UAAU,WAAW,wCAAwC,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvF,MAAM,IAAI,mBAAmB,CAC3B,UAAU,WAAW,8DAA8D,CACpF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,mBAAmB,CAC3B,UAAU,WAAW,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,8DAA8D,CACjH,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,mBAAmB,CAAC,UAAU,WAAW,0CAA0C,CAAC,CAAC;QACjG,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAI,OAAO,CAAC,WAAwB,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,UAAU,WAAW,wCAAwC,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO;QACL,WAAW;QACX,aAAa,EAAE,uBAAuB;QACtC,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE;QAC/C,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAwB,EAAE,QAAgB,EAAwB,EAAE;IAClG,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACpF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CACzD,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC7D,CAAC;IACF,OAAO,SAAS,EAAE,IAAI,CAAC;AACzB,CAAC,CAAC;AAEF,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAU,CAAC;AAE/D,MAAM,MAAM,GAAG,CAAC,KAAgB,EAAU,EAAE;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAW,EAAE,CAChE,QAAQ,KAAK,MAAM,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAgB,EAChB,MAAkB,EAClB,KAAa,EACb,UAAyC,EAAE,EACrC,EAAE;IACR,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IAExD,MAAM,aAAa,GAA4B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,mBAAmB,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAC3H,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,cAAc,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAmB,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,UAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,eAAe,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,gCAAgC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9F,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;wBAC1C,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvF,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC7B,qBAAqB,CAAC,KAAK,EAAE,cAA4B,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAwB,EAAE,KAAiB,EAAQ,EAAE;IACxF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,KAA4C,CAAC;IAChG,qBAAqB,CAAC,QAAsB,EAAE,MAAM,EAAE,YAAY,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC;IAE5F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,iBAAiB,CACzB,YAAY,QAAQ,CAAC,WAAW,gDAAgD,CACjF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAoB,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CACzB,YAAY,QAAQ,CAAC,WAAW,aAAa,OAAO,iCAAiC,CACtF,CAAC;QACJ,CAAC;QACD,qBAAqB,CACnB,KAAmB,EACnB,MAAM,EACN,YAAY,QAAQ,CAAC,WAAW,aAAa,OAAO,EAAE,EACtD,EAAE,eAAe,EAAE,KAAK,EAAE,CAC3B,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAA6B,EAAE,OAAe,EAAc,EAAE;IACrG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,KAA4C,CAAC;IAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAI,SAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;AAC/F,CAAC,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,64 @@
+import { ToolRegistry, type Tool, type ToolDescriptor, type ToolRisk } from '@stratusagent/core';
+import { type PluginManifest } from './manifest.ts';
+/** What the daemon knows about one registered tool once a plugin is loaded. */
+export interface PluginToolRecord {
+    name: string;
+    description?: string;
+    risk: ToolRisk;
+    /** The package whose code this tool is — provenance, kept for risk questions. */
+    package: string;
+    /** Whether that package is inside the trusted set (see the risk floor). */
+    trusted: boolean;
+}
+/**
+ * The risk floor a package's tools cannot register below.
+ *
+ * `safe` means "run this unattended, with nobody watching", and it is not a
+ * claim the code being judged gets to make about itself. First-party
+ * packages ship in this repository and are gated by its CI, so their
+ * manifests are read as written; everything else floors at `gated`.
+ */
+export declare const riskFloorFor: (trusted: boolean) => ToolRisk;
+/**
+ * The manifest-bound view a plugin's `setup()` registers through.
+ *
+ * Validating package.json before importing says what a plugin *claims*; it
+ * says nothing about what `setup()` then does, and `ToolRegistry.register`
+ * is a bare `Map.set` that records neither the originating package nor
+ * anything to check a claim against. Handed the raw registry, a plugin
+ * could register a tool it never declared, mark it `safe`, and run
+ * unattended — which would make the floor decoration. So this view rejects
+ * a name the manifest does not declare, applies the declared risk and the
+ * floor rather than trusting the object it is handed, and keeps the package
+ * as provenance.
+ *
+ * Registrations are **staged, not committed**. A plugin that registers
+ * three tools and then throws — or whose fourth name collides with another
+ * package's — must not leave the first three live in a shared registry, so
+ * nothing reaches the target until `commit()` says the whole plugin loaded.
+ */
+export declare class ManifestBoundToolRegistry extends ToolRegistry {
+    private readonly manifest;
+    private readonly target;
+    private readonly trusted;
+    private readonly staged;
+    private readonly records;
+    constructor(options: {
+        manifest: PluginManifest;
+        target: ToolRegistry;
+        trusted: boolean;
+    });
+    register(tool: Tool): void;
+    /** Reads see the whole registry: a plugin composing on another's tool is not the boundary here. */
+    get(name: string): Tool | undefined;
+    list(): Tool[];
+    describe(): ToolDescriptor[];
+    /**
+     * Move this plugin's tools into the shared registry, or refuse the whole
+     * plugin. A name already registered is a load-time error naming both
+     * packages, never a silent overwrite — the same reason a duplicate agent
+     * id refuses the roster rather than picking whichever loaded last.
+     */
+    commit(owners: Map<string, string>): PluginToolRecord[];
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EACZ,KAAK,IAAI,EACT,KAAK,cAAc,EACnB,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAwC,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAE1F,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,QAAwC,CAAC;AAEzF;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,yBAA0B,SAAQ,YAAY;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAE1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAElD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;gBAEtC,OAAO,EAAE;QAAE,QAAQ,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAOhF,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAuCnC,mGAAmG;IAC1F,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAInC,IAAI,IAAI,IAAI,EAAE;IAId,QAAQ,IAAI,cAAc,EAAE;IASrC;;;;;OAKG;IACH,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,EAAE;CAsBxD"}

package/dist/registry.js

@@ -0,0 +1,111 @@
+import { raiseRiskTo, resolveToolRisk, ToolRegistry, } from '@stratusagent/core';
+import { declaredRiskFor, PluginManifestError } from "./manifest.js";
+/**
+ * The risk floor a package's tools cannot register below.
+ *
+ * `safe` means "run this unattended, with nobody watching", and it is not a
+ * claim the code being judged gets to make about itself. First-party
+ * packages ship in this repository and are gated by its CI, so their
+ * manifests are read as written; everything else floors at `gated`.
+ */
+export const riskFloorFor = (trusted) => (trusted ? 'safe' : 'gated');
+/**
+ * The manifest-bound view a plugin's `setup()` registers through.
+ *
+ * Validating package.json before importing says what a plugin *claims*; it
+ * says nothing about what `setup()` then does, and `ToolRegistry.register`
+ * is a bare `Map.set` that records neither the originating package nor
+ * anything to check a claim against. Handed the raw registry, a plugin
+ * could register a tool it never declared, mark it `safe`, and run
+ * unattended — which would make the floor decoration. So this view rejects
+ * a name the manifest does not declare, applies the declared risk and the
+ * floor rather than trusting the object it is handed, and keeps the package
+ * as provenance.
+ *
+ * Registrations are **staged, not committed**. A plugin that registers
+ * three tools and then throws — or whose fourth name collides with another
+ * package's — must not leave the first three live in a shared registry, so
+ * nothing reaches the target until `commit()` says the whole plugin loaded.
+ */
+export class ManifestBoundToolRegistry extends ToolRegistry {
+    manifest;
+    target;
+    trusted;
+    staged = new Map();
+    records = [];
+    constructor(options) {
+        super();
+        this.manifest = options.manifest;
+        this.target = options.target;
+        this.trusted = options.trusted;
+    }
+    register(tool) {
+        const declared = declaredRiskFor(this.manifest, tool.name);
+        if (declared === undefined) {
+            throw new PluginManifestError(`Plugin ${this.manifest.packageName} tried to register ${tool.name}, which its manifest does not declare. `
+                + 'Add it to contributes.tools, or declare the namespace it belongs to in contributes.toolsDiscovered.');
+        }
+        if (this.staged.has(tool.name)) {
+            throw new PluginManifestError(`Plugin ${this.manifest.packageName} registered ${tool.name} twice.`);
+        }
+        // Three claims, and the effective risk is the riskiest of them: the
+        // manifest's declaration, the floor its package is held to, and
+        // whatever the object says about itself. The object can raise itself
+        // and can never talk its way below what its own package declared.
+        const claimed = tool.risk;
+        const risk = raiseRiskTo(raiseRiskTo(declared, riskFloorFor(this.trusted)), claimed ?? 'safe');
+        // Prototype preserved: a tool may be a class instance or carry the
+        // `runtime`/`createCommand` shape the local-command executor detects,
+        // and a plain spread would quietly turn either into an object the
+        // executor no longer recognises.
+        const bound = Object.assign(Object.create(Object.getPrototypeOf(tool)), tool, { risk });
+        this.staged.set(tool.name, bound);
+        this.records.push({
+            name: tool.name,
+            ...(tool.description ? { description: tool.description } : {}),
+            risk,
+            package: this.manifest.packageName,
+            trusted: this.trusted,
+        });
+    }
+    /** Reads see the whole registry: a plugin composing on another's tool is not the boundary here. */
+    get(name) {
+        return this.staged.get(name) ?? this.target.get(name);
+    }
+    list() {
+        return [...this.target.list(), ...this.staged.values()];
+    }
+    describe() {
+        return this.list().map((tool) => ({
+            name: tool.name,
+            ...(tool.description ? { description: tool.description } : {}),
+            ...(tool.parameters ? { parameters: tool.parameters } : {}),
+            risk: resolveToolRisk(tool),
+        }));
+    }
+    /**
+     * Move this plugin's tools into the shared registry, or refuse the whole
+     * plugin. A name already registered is a load-time error naming both
+     * packages, never a silent overwrite — the same reason a duplicate agent
+     * id refuses the roster rather than picking whichever loaded last.
+     */
+    commit(owners) {
+        for (const name of this.staged.keys()) {
+            const existing = owners.get(name);
+            if (existing !== undefined) {
+                throw new PluginManifestError(`Tool name collision: ${name} is contributed by both ${existing} and ${this.manifest.packageName}. `
+                    + 'Disable one of them; a tool name is unique per install.');
+            }
+            if (this.target.get(name)) {
+                throw new PluginManifestError(`Tool name collision: ${name} is already registered by the kernel. `
+                    + `Plugin ${this.manifest.packageName} cannot replace it.`);
+            }
+        }
+        for (const [name, tool] of this.staged) {
+            this.target.register(tool);
+            owners.set(name, this.manifest.packageName);
+        }
+        return [...this.records];
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,eAAe,EACf,YAAY,GAIb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAuB,MAAM,eAAe,CAAC;AAa1F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAY,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAEzF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,yBAA0B,SAAQ,YAAY;IACxC,QAAQ,CAAiB;IAEzB,MAAM,CAAe;IAErB,OAAO,CAAU;IAEjB,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEjC,OAAO,GAAuB,EAAE,CAAC;IAElD,YAAY,OAA6E;QACvF,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAEQ,QAAQ,CAAC,IAAU;QAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,mBAAmB,CAC3B,UAAU,IAAI,CAAC,QAAQ,CAAC,WAAW,sBAAsB,IAAI,CAAC,IAAI,yCAAyC;kBACzG,qGAAqG,CACxG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAC3B,UAAU,IAAI,CAAC,QAAQ,CAAC,WAAW,eAAe,IAAI,CAAC,IAAI,SAAS,CACrE,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,gEAAgE;QAChE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,WAAW,CACtB,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACjD,OAAO,IAAI,MAAM,CAClB,CAAC;QAEF,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,iCAAiC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAW,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAS,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAED,mGAAmG;IAC1F,GAAG,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAEQ,IAAI;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IAEQ,QAAQ;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;SAC5B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAA2B;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,IAAI,2BAA2B,QAAQ,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI;sBAClG,yDAAyD,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,IAAI,wCAAwC;sBAClE,UAAU,IAAI,CAAC,QAAQ,CAAC,WAAW,qBAAqB,CAC3D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@stratusagent/plugins",
+  "version": "0.6.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.13 <23 || >=23.4"
+  },
+  "dependencies": {
+    "@stratusagent/core": "0.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.6.0",
+    "typescript": "^5.9.3"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stratuslabs/agent.git",
+    "directory": "packages/plugins"
+  },
+  "description": "The Stratus Agent plugin host: manifest validation, the manifest-bound registration view, and the loader that turns a config block into running capability",
+  "keywords": [
+    "stratus",
+    "agent",
+    "ai",
+    "llm",
+    "plugins"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc --noEmit --project tsconfig.test.json",
+    "test": "node --test --experimental-strip-types"
+  }
+}