@vibecontrols/vibe-plugin-security-release-gate 2026.528.1 → 2026.1108.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +23 -3
- package/README.md +28 -1
- package/dist/index.js +1 -1
- package/dist/provider.d.ts +1 -2
- package/package.json +38 -26
package/LICENSE
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
|
-
|
|
1
|
+
MIT License
|
|
2
2
|
|
|
3
|
-
Copyright (c) 2026 Burdenoff Consultancy Services
|
|
3
|
+
Copyright (c) 2026 Burdenoff Consultancy Services Private Limited,
|
|
4
|
+
Algoshred Technologies Private Limited,
|
|
5
|
+
and all its sister companies.
|
|
4
6
|
|
|
5
|
-
|
|
7
|
+
Maintainer: Vignesh T.V <https://github.com/tvvignesh>
|
|
8
|
+
|
|
9
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
10
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
11
|
+
in the Software without restriction, including without limitation the rights
|
|
12
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
13
|
+
copies of the Software, and to permit persons to whom the Software is furnished
|
|
14
|
+
to do so, subject to the following conditions:
|
|
15
|
+
|
|
16
|
+
The above copyright notice and this permission notice shall be included in all
|
|
17
|
+
copies or substantial portions of the Software.
|
|
18
|
+
|
|
19
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
20
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
21
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
22
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
23
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
24
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
25
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -20,6 +20,33 @@ It POSTs the document to `POST {OPA_URL}/v1/data/vibecontrols/security/release/a
|
|
|
20
20
|
- `NormalizedFinding[]` — one row per `deny[]` entry with `category: "policy"` and severity derived from the policy expression
|
|
21
21
|
- Evidence: a single `opa-decision` JSON document containing the input + decision (uploaded to S3 for the audit trail)
|
|
22
22
|
|
|
23
|
+
<!-- VIBECONTROLS_OSS_FOOTER_START -->
|
|
24
|
+
|
|
25
|
+
---
|
|
26
|
+
|
|
27
|
+
## About VibeControls
|
|
28
|
+
|
|
29
|
+
**VibeControls** is the agentic engineering mission control for AI-native teams. Vibe-plugins extend the VibeControls agent with new providers, tools, sessions, tunnels, storage backends, and security stages.
|
|
30
|
+
|
|
31
|
+
- Website: <https://vibecontrols.com>
|
|
32
|
+
- Documentation: <https://docs.vibecontrols.com>
|
|
33
|
+
- Plugin SDK: <https://github.com/algoshred/vibecontrols-plugin-sdk>
|
|
34
|
+
- All plugins: <https://github.com/algoshred?q=vibe-plugin-&type=all>
|
|
35
|
+
|
|
36
|
+
## Credits
|
|
37
|
+
|
|
38
|
+
This plugin builds on the following upstream open-source projects. All trademarks and copyrights remain with their respective owners.
|
|
39
|
+
|
|
40
|
+
- **Open Policy Agent (Rego inspiration)** — <https://www.openpolicyagent.org/>
|
|
41
|
+
|
|
23
42
|
## License
|
|
24
43
|
|
|
25
|
-
|
|
44
|
+
Released under the [MIT License](./LICENSE).
|
|
45
|
+
|
|
46
|
+
Copyright (c) 2026 Burdenoff Consultancy Services Private Limited, Algoshred Technologies Private Limited, and all its sister companies.
|
|
47
|
+
|
|
48
|
+
Maintainer: **Vignesh T.V** — <https://github.com/tvvignesh>
|
|
49
|
+
|
|
50
|
+
**Note**: this plugin is open source under MIT. The `@vibecontrols/agent` runtime that loads and orchestrates plugins is **closed source** and proprietary to Burdenoff Consultancy Services Pvt. Ltd. If you want a fully self-hostable agent, please open an issue or contact the maintainer.
|
|
51
|
+
|
|
52
|
+
<!-- VIBECONTROLS_OSS_FOOTER_END -->
|
package/dist/index.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
// @bun
|
|
2
|
-
import{ProviderRegistry,TelemetryEmitter,createLifecycleHooks}from"@vibecontrols/plugin-sdk";import{createHash}from"crypto";import{promises as fs}from"fs";import*as path from"path";import{normalizeOpaDecision}from"@vibecontrols/vibe-plugin-security/normalizer";var POLICY_VERSION=2,POLICY_ID="vibecontrols.security.release";class ReleaseGateProvider{name="opa-release-gate";stage="promote.prod";toolVersion=`agent-local-policy@${POLICY_ID}/v${POLICY_VERSION}`;
|
|
2
|
+
import{ProviderRegistry,TelemetryEmitter,createLifecycleHooks}from"@vibecontrols/plugin-sdk";import{createHash}from"crypto";import{promises as fs}from"fs";import*as path from"path";import{normalizeOpaDecision}from"@vibecontrols/vibe-plugin-security/normalizer";var POLICY_VERSION=2,POLICY_ID="vibecontrols.security.release";class ReleaseGateProvider{name="opa-release-gate";stage="promote.prod";toolVersion=`agent-local-policy@${POLICY_ID}/v${POLICY_VERSION}`;async init(_host){}async ensureToolInstalled(){}async run(input){let startedAt=Date.now(),cfg=input.config??{};input.onProgress?.({pct:10,message:"Loading upstream scan data"});let upstreamFindings=cfg.upstreamFindings??[],upstreamSummary=cfg.upstreamSummary??{critical:0,high:0,medium:0,low:0,info:0};input.onProgress?.({pct:40,message:"Evaluating release gate policy"});let decision=evaluatePolicy(upstreamFindings,upstreamSummary,cfg);input.onProgress?.({pct:70,message:"Building deny[] -> findings"});let opaResultDoc=JSON.stringify({result:{allow:decision.allow,deny:decision.denyReasons}}),findings=normalizeOpaDecision(opaResultDoc,this.name),evidencePath=path.join(input.workdir,"opa-decision.json"),evidenceJson=JSON.stringify(decision,null,2);await fs.writeFile(evidencePath,evidenceJson,"utf-8");let stat=await fs.stat(evidencePath),sha256=createHash("sha256").update(evidenceJson).digest("hex"),evidence=[{type:"opa-decision",localPath:evidencePath,sha256,sizeBytes:stat.size}];return input.onProgress?.({pct:100,message:"Release gate evaluated"}),{runId:input.runId,status:"succeeded",findings,evidence,durationMs:Date.now()-startedAt,summary:summarize(findings)}}async cancel(_runId){}metadata(){return{stage:this.stage,supportedProfiles:["backend","frontend","cli","sdk","mcp","mobile","container","iac"],toolVersion:this.toolVersion,description:"Agent-local release-gate policy for the promote.prod stage. No backend."}}}function evaluatePolicy(upstreamFindings,summary,cfg){let denyReasons=[],openCriticals=upstreamFindings.filter((f)=>f.severity==="critical"&&f.status==="open"),openHighs=upstreamFindings.filter((f)=>f.severity==="high"&&f.status==="open");if(openCriticals.length>0)denyReasons.push(`${openCriticals.length} critical finding(s) open: ${openCriticals.slice(0,3).map((f)=>f.ruleId).join(", ")}${openCriticals.length>3?"...":""}`);if(!cfg.upstreamScanRunId&&summary.critical===0&&summary.high===0&&summary.medium===0&&summary.low===0&&summary.info===0)denyReasons.push("No upstream scan recorded \u2014 build stage must run before promote.prod");if(cfg.requireSignedArtifact&&!cfg.signature?.verified)denyReasons.push("Required signature is missing or not verified");if(typeof cfg.maxHighOpen==="number"&&openHighs.length>cfg.maxHighOpen)denyReasons.push(`${openHighs.length} open high-severity finding(s) exceeds maxHighOpen=${cfg.maxHighOpen}`);return{allow:denyReasons.length===0,denyReasons,evaluatedAt:new Date().toISOString(),policyVersion:POLICY_VERSION,policyId:POLICY_ID,input:{summary,openCriticalCount:openCriticals.length,openHighCount:openHighs.length,upstreamScanRunId:cfg.upstreamScanRunId}}}function summarize(findings){let s={critical:0,high:0,medium:0,low:0,info:0};for(let f of findings)s[f.severity]++;return s}var PLUGIN_NAME="security-release-gate",PLUGIN_VERSION="2026.527.1",createPlugin=(_ctx)=>{let provider=new ReleaseGateProvider,telemetry=new TelemetryEmitter(PLUGIN_NAME,PLUGIN_VERSION),lifecycle=createLifecycleHooks({name:PLUGIN_NAME,telemetryEventName:"security.release-gate.ready",onInit:async(host)=>{await provider.init(host),new ProviderRegistry(host).registerProvider("security.release","opa-release-gate",provider),telemetry.emit("security.release-gate.registered",{provider:"opa-release-gate",toolVersion:provider.toolVersion})}});return{name:PLUGIN_NAME,version:PLUGIN_VERSION,description:"OPA Rego release-gate provider for the promote.prod stage.",tags:["backend","provider","integration"],capabilities:{storage:"rw",audit:!0,telemetry:!0,gateway:!0},onServerStart:lifecycle.onServerStart,onServerStop:lifecycle.onServerStop}},src_default=createPlugin;export{ReleaseGateProvider,createPlugin,src_default as default};
|
package/dist/provider.d.ts
CHANGED
|
@@ -4,8 +4,7 @@ export declare class ReleaseGateProvider implements SecurityProvider {
|
|
|
4
4
|
readonly name = "opa-release-gate";
|
|
5
5
|
readonly stage: SecurityStage;
|
|
6
6
|
readonly toolVersion = "agent-local-policy@vibecontrols.security.release/v2";
|
|
7
|
-
|
|
8
|
-
init(host: HostServices): Promise<void>;
|
|
7
|
+
init(_host: HostServices): Promise<void>;
|
|
9
8
|
ensureToolInstalled(): Promise<void>;
|
|
10
9
|
run(input: SecurityScanInput): Promise<SecurityScanResult>;
|
|
11
10
|
cancel(_runId: string): Promise<void>;
|
package/package.json
CHANGED
|
@@ -1,46 +1,44 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vibecontrols/vibe-plugin-security-release-gate",
|
|
3
|
-
"version": "2026.
|
|
3
|
+
"version": "2026.1108.1",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"types": "./dist/index.d.ts",
|
|
7
7
|
"description": "OPA-backed release-gate provider for the promote.prod lifecycle stage. Calls the backend policy decision resolver and maps deny[] to NormalizedFinding[]. Registers as a security.release provider with @vibecontrols/vibe-plugin-security.",
|
|
8
8
|
"engines": {
|
|
9
|
-
"bun": ">=1.
|
|
9
|
+
"bun": ">=1.4.4"
|
|
10
10
|
},
|
|
11
11
|
"author": {
|
|
12
12
|
"name": "Vignesh T.V",
|
|
13
|
-
"email": "vignesh@burdenoff.com",
|
|
14
13
|
"url": "https://github.com/tvvignesh"
|
|
15
14
|
},
|
|
16
|
-
"license": "
|
|
15
|
+
"license": "MIT",
|
|
17
16
|
"scripts": {
|
|
18
|
-
"build": "bun build ./src/index.ts --outdir ./dist --target bun --minify-syntax --minify-whitespace --external elysia --external @vibecontrols/vibe-plugin-security --external @vibecontrols/plugin-sdk && tsc
|
|
19
|
-
"dev": "tsc --watch",
|
|
20
|
-
"lint": "eslint
|
|
21
|
-
"format": "
|
|
22
|
-
"format:check": "
|
|
23
|
-
"type:check": "
|
|
24
|
-
"test": "bun test
|
|
17
|
+
"build": "bun build ./src/index.ts --outdir ./dist --target bun --minify-syntax --minify-whitespace --external elysia --external @vibecontrols/vibe-plugin-security --external @vibecontrols/plugin-sdk && tsc -p tsconfig.build.json",
|
|
18
|
+
"dev": "tsc -p tsconfig.build.json --watch",
|
|
19
|
+
"lint": "eslint .",
|
|
20
|
+
"format": "bun fmt",
|
|
21
|
+
"format:check": "bun fmt --check",
|
|
22
|
+
"type:check": "boff gate -- bun check --no-pretty",
|
|
23
|
+
"test": "bun test",
|
|
25
24
|
"clean": "rimraf dist",
|
|
26
25
|
"prebuild": "bun run clean",
|
|
27
26
|
"prepublishOnly": "bun run build",
|
|
28
|
-
"sanity": "
|
|
27
|
+
"sanity": "boff sanity",
|
|
28
|
+
"sanity:force": "boff sanity --force",
|
|
29
|
+
"audit": "bun audit --audit-level=high"
|
|
29
30
|
},
|
|
30
31
|
"dependencies": {
|
|
31
|
-
"@vibecontrols/plugin-sdk": "2026.
|
|
32
|
-
"@vibecontrols/vibe-plugin-security": "2026.
|
|
32
|
+
"@vibecontrols/plugin-sdk": "2026.1107.1",
|
|
33
|
+
"@vibecontrols/vibe-plugin-security": "2026.731.1"
|
|
33
34
|
},
|
|
34
35
|
"devDependencies": {
|
|
35
|
-
"@
|
|
36
|
-
"@types/
|
|
37
|
-
"
|
|
38
|
-
"
|
|
39
|
-
"
|
|
40
|
-
"
|
|
41
|
-
"rimraf": "^6.0.1",
|
|
42
|
-
"typescript": "^5.9.3",
|
|
43
|
-
"typescript-eslint": "^8.56.0"
|
|
36
|
+
"@burdenoff/toolchain": "2026.1107.14",
|
|
37
|
+
"@types/bun": "^1.4.4",
|
|
38
|
+
"eslint": "^9.39.5",
|
|
39
|
+
"knip": "^6.44.1",
|
|
40
|
+
"rimraf": "^6.1.4",
|
|
41
|
+
"typescript": "6.0.3"
|
|
44
42
|
},
|
|
45
43
|
"peerDependencies": {
|
|
46
44
|
"@vibecontrols/agent": ">=2026.428.0"
|
|
@@ -64,10 +62,10 @@
|
|
|
64
62
|
],
|
|
65
63
|
"repository": {
|
|
66
64
|
"type": "git",
|
|
67
|
-
"url": "git+https://github.com/
|
|
65
|
+
"url": "git+https://github.com/Algoshred/vibe-plugin-security-release-gate.git"
|
|
68
66
|
},
|
|
69
67
|
"bugs": {
|
|
70
|
-
"url": "https://github.com/
|
|
68
|
+
"url": "https://github.com/Algoshred/vibe-plugin-security-release-gate/issues"
|
|
71
69
|
},
|
|
72
70
|
"homepage": "https://vibecontrols.com",
|
|
73
71
|
"publishConfig": {
|
|
@@ -79,5 +77,19 @@
|
|
|
79
77
|
"!dist/**/*.map",
|
|
80
78
|
"README.md",
|
|
81
79
|
"LICENSE"
|
|
82
|
-
]
|
|
80
|
+
],
|
|
81
|
+
"packageManager": "bun@1.4.4",
|
|
82
|
+
"boff": {
|
|
83
|
+
"type": "plugin",
|
|
84
|
+
"sanity": {
|
|
85
|
+
"steps": [
|
|
86
|
+
"format",
|
|
87
|
+
"lint",
|
|
88
|
+
"typecheck",
|
|
89
|
+
"build",
|
|
90
|
+
"test",
|
|
91
|
+
"knip"
|
|
92
|
+
]
|
|
93
|
+
}
|
|
94
|
+
}
|
|
83
95
|
}
|