@vinhnt-sdk/core 0.1.0

package/dist/permission/checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../../src/permission/checker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAa,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAIjG,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,GACrB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,gBAAgB,GAAG,SAAS,GAAG,YAAY,CAgBlF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,GAAG,YAAY,CA6BrF;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,WAAW,EAClB,SAAS,CAAC,EAAE,WAAW,EAAE,GACxB,YAAY,CAYd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,gBAAgB,CAqBlB;AAID,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,IAAI,EAAE,MAAM,GACX,OAAO,CAGT"}

package/dist/permission/checker.js

@@ -0,0 +1,102 @@
+import { wildcardMatch } from "@vinhnt-sdk/schema";
+import { matchPermission } from "./evaluator.js";
+export function normalizePermissions(p) {
+    if (!p)
+        return {};
+    if (p.ruleset)
+        return { ...p.ruleset };
+    const result = { inheritFromParent: true };
+    const rules = [];
+    if (p.allowedTools) {
+        for (const t of p.allowedTools)
+            rules.push({ effect: "allow", target: `tool.${t}` });
+    }
+    if (p.deniedTools) {
+        for (const t of p.deniedTools)
+            rules.push({ effect: "deny", target: `tool.${t}` });
+    }
+    if (rules.length > 0)
+        result.rules = rules;
+    if (p.allowedRisks)
+        result.allowedRisks = [...p.allowedRisks];
+    if (p.maxSteps !== undefined)
+        result.maxSteps = p.maxSteps;
+    if (p.maxTokens !== undefined)
+        result.maxTokens = p.maxTokens;
+    return result;
+}
+export function mergeRulesets(child, parent) {
+    const parentRules = parent.rules ?? [];
+    const childRules = child.rules ?? [];
+    // Child deny rules override parent allow rules
+    const childDenyTargets = new Set(childRules.filter((r) => r.effect === "deny").map((r) => r.target));
+    const filteredParent = parentRules.filter((r) => !(r.effect === "allow" && childDenyTargets.has(r.target)));
+    const result = { inheritFromParent: child.inheritFromParent ?? true };
+    result.rules = [...filteredParent, ...childRules];
+    const mergedRisks = [...new Set([...(parent.allowedRisks ?? []), ...(child.allowedRisks ?? [])])];
+    if (mergedRisks.length > 0)
+        result.allowedRisks = mergedRisks;
+    const ms = child.maxSteps !== undefined
+        ? Math.min(child.maxSteps, parent.maxSteps ?? Infinity)
+        : parent.maxSteps;
+    if (ms !== undefined)
+        result.maxSteps = ms;
+    const mt = child.maxTokens !== undefined
+        ? Math.min(child.maxTokens, parent.maxTokens ?? Infinity)
+        : parent.maxTokens;
+    if (mt !== undefined)
+        result.maxTokens = mt;
+    return result;
+}
+export function resolveEffectivePermissions(agent, ancestors) {
+    const own = normalizePermissions(agent.permissions);
+    if (!own.inheritFromParent)
+        return own;
+    if (ancestors && ancestors.length > 0) {
+        let effective = own;
+        for (const parent of ancestors) {
+            const pRules = normalizePermissions(parent.permissions);
+            effective = mergeRulesets(effective, pRules);
+        }
+        return effective;
+    }
+    return own;
+}
+/**
+ * Evaluate a resource against a ruleset.
+ *
+ * Semantics (matching OpenCode's findLast):
+ * - Rules are evaluated in order; last matching rule wins.
+ * - "deny" blocks access.
+ * - "ask" triggers human-in-the-loop.
+ * - "allow" permits access.
+ * - If no rule matches, the default is "ask" (safe default).
+ *
+ * When `paramPattern` is set on a rule, the rule only matches if
+ * the JSON-stringified tool args also match the paramPattern glob.
+ */
+export function evaluatePermission(ruleset, resource, args) {
+    if (!ruleset?.rules || ruleset.rules.length === 0) {
+        return { decision: "ask", reason: "No permission rules configured" };
+    }
+    const context = args ? JSON.stringify(args) : undefined;
+    const { effect, matchedRule } = matchPermission(ruleset.rules, resource, context);
+    if (!matchedRule) {
+        return { decision: "ask", reason: `No matching rule for "${resource}"` };
+    }
+    const rule = matchedRule;
+    switch (effect) {
+        case "deny":
+            return { decision: "deny", reason: rule.reason ?? `Denied by rule: ${resource}` };
+        case "ask":
+            return { decision: "ask", reason: rule.reason ?? `Approval needed for "${resource}"` };
+        case "allow":
+            return { decision: "allow" };
+    }
+}
+export function checkRiskAllowed(ruleset, risk) {
+    if (!ruleset?.allowedRisks)
+        return false;
+    return ruleset.allowedRisks.some((r) => wildcardMatch(r, risk));
+}
+//# sourceMappingURL=checker.js.map

package/dist/permission/checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checker.js","sourceRoot":"","sources":["../../src/permission/checker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAOjD,MAAM,UAAU,oBAAoB,CAAC,CAA+B;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAA4B,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACpE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAC3C,IAAI,CAAC,CAAC,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3D,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC9D,OAAO,MAAsB,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,MAAoB;IACrE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAErC,+CAA+C;IAC/C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CACnE,CAAC;IACF,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACjE,CAAC;IAEF,MAAM,MAAM,GAA4B,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;IAC/F,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,CAAC;IAElD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,YAAY,GAAG,WAAW,CAAC;IAE9D,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS;QACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;QACvD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACpB,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IAE3C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACrB,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;IAE5C,OAAO,MAAsB,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAkB,EAClB,SAAyB;IAEzB,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,GAAG,CAAC;IACvC,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,SAAS,GAAG,GAAG,CAAC;QACpB,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxD,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAiC,EACjC,QAAgB,EAChB,IAA8B;IAE9B,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,QAAQ,GAAG,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,WAAwB,CAAC;IACtC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,mBAAmB,QAAQ,EAAE,EAAE,CAAC;QACpF,KAAK,KAAK;YACR,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,wBAAwB,QAAQ,GAAG,EAAE,CAAC;QACzF,KAAK,OAAO;YACV,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAID,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EACjC,IAAY;IAEZ,IAAI,CAAC,OAAO,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/permission/evaluator.d.ts

@@ -0,0 +1,24 @@
+import type { PermissionRule } from "./permission.js";
+type AnyRule = {
+    effect: "allow" | "deny" | "ask";
+    action?: string;
+    target?: string;
+    paramPattern?: string;
+};
+/**
+ * Evaluate a list of permission rules against a tool action and context.
+ * Uses last-match-wins semantics: later rules override earlier ones.
+ *
+ * If no rule matches, returns "ask" by default (safe default).
+ */
+export declare function matchPermission(rules: readonly AnyRule[], action: string, context?: string): {
+    effect: "allow" | "deny" | "ask";
+    matchedRule?: AnyRule;
+};
+/**
+ * Build a lookup-friendly permission set from raw config rules.
+ * Handles flat syntax (`edit: deny`) and nested syntax (`bash: { "*": "ask", "git diff": "allow" }`).
+ */
+export declare function buildPermissionRules(config: Record<string, string | Record<string, string>>): PermissionRule[];
+export {};
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/permission/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/permission/evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,KAAK,OAAO,GAAG;IAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAqB7G;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf;IAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,CAc7D;AAsCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACtD,cAAc,EAAE,CAelB"}

package/dist/permission/evaluator.js

@@ -0,0 +1,89 @@
+import { wildcardMatch } from "@vinhnt-sdk/schema";
+import { normalize } from "node:path";
+/**
+ * Normalize a path-like string for consistent glob matching.
+ * Resolves `.`/`..` segments and normalizes backslashes to forward slashes.
+ * Non-path strings are returned as-is.
+ */
+function normalizeMatchValue(value) {
+    if (!value || value.includes("\\")) {
+        return value.replace(/\\/g, "/");
+    }
+    if (value.startsWith("/") || value.startsWith("./") || value.includes("../")) {
+        try {
+            return normalize(value).replace(/\\/g, "/");
+        }
+        catch {
+            return value;
+        }
+    }
+    return value;
+}
+/**
+ * Evaluate a list of permission rules against a tool action and context.
+ * Uses last-match-wins semantics: later rules override earlier ones.
+ *
+ * If no rule matches, returns "ask" by default (safe default).
+ */
+export function matchPermission(rules, action, context) {
+    let matched;
+    let effect = "ask";
+    const normContext = context !== undefined ? normalizeMatchValue(context) : undefined;
+    for (const rule of rules) {
+        if (matchesRule(rule, action, normContext)) {
+            matched = rule;
+            effect = rule.effect;
+        }
+    }
+    return { effect, ...(matched ? { matchedRule: matched } : {}) };
+}
+/**
+ * Check if a rule matches the given action and context.
+ * Supports dot-separated action patterns like "bash.read", "edit.*", etc.
+ */
+function normalizePattern(pattern) {
+    return pattern.includes("\\") ? pattern.replace(/\\/g, "/") : pattern;
+}
+function matchesRule(rule, action, context) {
+    const target = normalizePattern(rule.action ?? rule.target ?? "");
+    const paramPattern = rule.paramPattern !== undefined ? normalizePattern(rule.paramPattern) : undefined;
+    if (wildcardMatch(target, action)) {
+        if (paramPattern !== undefined && context !== undefined) {
+            return wildcardMatch(paramPattern, context);
+        }
+        return true;
+    }
+    // Nested context match: action.context (e.g., "bash.git *")
+    if (context && target.includes(".")) {
+        const dotIdx = target.indexOf(".");
+        const ruleAction = normalizePattern(target.slice(0, dotIdx));
+        const ruleContext = normalizePattern(target.slice(dotIdx + 1));
+        if (wildcardMatch(ruleAction, action) && wildcardMatch(ruleContext, context)) {
+            if (paramPattern !== undefined) {
+                return wildcardMatch(paramPattern, context);
+            }
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Build a lookup-friendly permission set from raw config rules.
+ * Handles flat syntax (`edit: deny`) and nested syntax (`bash: { "*": "ask", "git diff": "allow" }`).
+ */
+export function buildPermissionRules(config) {
+    const rules = [];
+    for (const [key, value] of Object.entries(config)) {
+        if (typeof value === "string") {
+            rules.push({ action: key, resource: "*", effect: value });
+        }
+        else if (typeof value === "object" && value !== null) {
+            for (const [pattern, effect] of Object.entries(value)) {
+                const action = pattern === "*" ? key : `${key}.${pattern}`;
+                rules.push({ action, resource: "*", effect: effect });
+            }
+        }
+    }
+    return rules;
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/permission/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/permission/evaluator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAyB,EACzB,MAAc,EACd,OAAgB;IAEhB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAM,GAA6B,KAAK,CAAC;IAE7C,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,MAAc,EAAE,OAAgB;IAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvG,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAClC,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAE/D,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAuD;IAEvD,MAAM,KAAK,GAAqB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAiC,EAAE,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAkC,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/permission/permission.d.ts

@@ -0,0 +1,29 @@
+import type { RunId, SessionId } from "@vinhnt-sdk/schema";
+import { VntError } from "@vinhnt-sdk/schema";
+export type PermissionEffect = "allow" | "deny" | "ask";
+export interface PermissionRule {
+    readonly action: string;
+    readonly resource: string;
+    readonly effect: PermissionEffect;
+}
+export type PermissionRuleset = readonly PermissionRule[];
+export interface PermissionRequest {
+    readonly id: string;
+    readonly runId: RunId;
+    readonly sessionId: SessionId;
+    readonly action: string;
+    readonly resource: string;
+    readonly description: string;
+    readonly createdAt: number;
+    readonly savePatterns?: readonly string[];
+}
+export type PermissionReply = "once" | "always" | "reject";
+export declare class PermissionDeniedError extends VntError {
+    readonly rules: PermissionRuleset;
+    constructor(rules: PermissionRuleset);
+}
+export declare class PermissionRejectedError extends VntError {
+    readonly feedback: string | undefined;
+    constructor(feedback?: string);
+}
+//# sourceMappingURL=permission.d.ts.map

package/dist/permission/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/permission/permission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,cAAc,EAAE,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,qBAAa,qBAAsB,SAAQ,QAAQ;IACjD,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;gBACtB,KAAK,EAAE,iBAAiB;CAKrC;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;gBAC1B,QAAQ,CAAC,EAAE,MAAM;CAK9B"}

package/dist/permission/permission.js

@@ -0,0 +1,18 @@
+import { VntError } from "@vinhnt-sdk/schema";
+export class PermissionDeniedError extends VntError {
+    rules;
+    constructor(rules) {
+        super(`Permission denied by configured rules`);
+        this.name = "PermissionDeniedError";
+        this.rules = rules;
+    }
+}
+export class PermissionRejectedError extends VntError {
+    feedback;
+    constructor(feedback) {
+        super(feedback ?? "Permission rejected by user");
+        this.name = "PermissionRejectedError";
+        this.feedback = feedback;
+    }
+}
+//# sourceMappingURL=permission.js.map

package/dist/permission/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../src/permission/permission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAyB9C,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACxC,KAAK,CAAoB;IAClC,YAAY,KAAwB;QAClC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IAC1C,QAAQ,CAAqB;IACtC,YAAY,QAAiB;QAC3B,KAAK,CAAC,QAAQ,IAAI,6BAA6B,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF"}

package/dist/permission/saved.d.ts

@@ -0,0 +1,34 @@
+import type { PermissionRequest, PermissionReply, SavedApproval } from "@vinhnt-sdk/schema";
+import type { PermissionRule } from "./permission.js";
+export interface PermissionStore {
+    addSavedRule(runId: string, action: string, resource: string): Promise<void>;
+    removeSavedRule(runId: string, action: string, resource: string): Promise<void>;
+    listSavedRules(runId: string): Promise<readonly PermissionRule[]>;
+}
+export interface ApprovalStore {
+    awaitReply(request: PermissionRequest): Promise<PermissionReply>;
+    resolveRequest(requestId: string, reply: PermissionReply): void;
+    getRequest(requestId: string): PermissionRequest | undefined;
+    pendingRequests(runId?: string): readonly PermissionRequest[];
+    cancelRequest(requestId: string): void;
+    saveApproval(approval: SavedApproval): void;
+    checkApproval(resource: string, action: string, agentId?: string): boolean;
+    saveRejection(resource: string, action: string, agentId?: string): void;
+    checkRejection(resource: string, action: string, agentId?: string): boolean;
+}
+export declare class InMemoryApprovalStore implements ApprovalStore {
+    private pending;
+    readonly requests: PermissionRequest[];
+    readonly savedApprovals: SavedApproval[];
+    readonly savedRejections: SavedApproval[];
+    awaitReply(request: PermissionRequest): Promise<PermissionReply>;
+    resolveRequest(requestId: string, reply: PermissionReply): void;
+    getRequest(requestId: string): PermissionRequest | undefined;
+    cancelRequest(requestId: string): void;
+    pendingRequests(runId?: string): readonly PermissionRequest[];
+    saveApproval(approval: SavedApproval): void;
+    checkApproval(resource: string, action: string, agentId?: string): boolean;
+    saveRejection(resource: string, action: string, agentId?: string): void;
+    checkRejection(resource: string, action: string, agentId?: string): boolean;
+}
+//# sourceMappingURL=saved.d.ts.map

package/dist/permission/saved.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saved.d.ts","sourceRoot":"","sources":["../../src/permission/saved.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAChE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC7D,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,iBAAiB,EAAE,CAAC;IAC9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3E,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7E;AAED,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,OAAO,CAAuD;IACtE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAM;IAC5C,QAAQ,CAAC,cAAc,EAAE,aAAa,EAAE,CAAM;IAC9C,QAAQ,CAAC,eAAe,EAAE,aAAa,EAAE,CAAM;IAE/C,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAOhE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IAQ/D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAI5D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAItC,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,iBAAiB,EAAE;IAK7D,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAI3C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAM1E,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAIvE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;CAK5E"}

package/dist/permission/saved.js

@@ -0,0 +1,43 @@
+export class InMemoryApprovalStore {
+    pending = new Map();
+    requests = [];
+    savedApprovals = [];
+    savedRejections = [];
+    awaitReply(request) {
+        this.requests.push(request);
+        return new Promise((resolve) => {
+            this.pending.set(request.id, resolve);
+        });
+    }
+    resolveRequest(requestId, reply) {
+        const resolve = this.pending.get(requestId);
+        if (resolve) {
+            this.pending.delete(requestId);
+            resolve(reply);
+        }
+    }
+    getRequest(requestId) {
+        return this.requests.find((r) => r.id === requestId);
+    }
+    cancelRequest(requestId) {
+        this.pending.delete(requestId);
+    }
+    pendingRequests(runId) {
+        if (runId)
+            return this.requests.filter((r) => r.runId === runId);
+        return [...this.requests];
+    }
+    saveApproval(approval) {
+        this.savedApprovals.push(approval);
+    }
+    checkApproval(resource, action, agentId) {
+        return this.savedApprovals.some((a) => a.resource === resource && a.action === action && (!a.agentId || a.agentId === agentId));
+    }
+    saveRejection(resource, action, agentId) {
+        this.savedRejections.push({ resource, action, agentId });
+    }
+    checkRejection(resource, action, agentId) {
+        return this.savedRejections.some((r) => r.resource === resource && r.action === action && (!r.agentId || r.agentId === agentId));
+    }
+}
+//# sourceMappingURL=saved.js.map

package/dist/permission/saved.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saved.js","sourceRoot":"","sources":["../../src/permission/saved.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,qBAAqB;IACxB,OAAO,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC7D,QAAQ,GAAwB,EAAE,CAAC;IACnC,cAAc,GAAoB,EAAE,CAAC;IACrC,eAAe,GAAoB,EAAE,CAAC;IAE/C,UAAU,CAAC,OAA0B;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,KAAsB;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,eAAe,CAAC,KAAc;QAC5B,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,YAAY,CAAC,QAAuB;QAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,aAAa,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAgB;QAC9D,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAC/F,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAgB;QAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAgB;QAC/D,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAC/F,CAAC;IACJ,CAAC;CACF"}

package/dist/plugin/manager.d.ts

@@ -0,0 +1,33 @@
+import type { ToolDefinition } from "../tool/definitions.js";
+import type { ContextSourceValue } from "../system-context/types.js";
+import type { AgentRegistry } from "../agent/agent-registry.js";
+import type { ToolProviderRegistry } from "../tool/provider.js";
+import type { EventBus } from "../event-bus/types.js";
+import type { Plugin, PluginManager, HookName, HookPayload, HookReturn } from "../plugin.js";
+export interface PluginManagerConfig {
+    agentRegistry: AgentRegistry;
+    toolProviderRegistry: ToolProviderRegistry;
+    eventBus: EventBus;
+}
+export declare class DefaultPluginManager implements PluginManager {
+    private readonly plugins;
+    private readonly activePluginIds;
+    private readonly toolRegistrations;
+    private readonly ctxSources;
+    private readonly agentRegistry;
+    private readonly toolProviderRegistry;
+    private readonly eventBus;
+    constructor(config: PluginManagerConfig);
+    /** @deprecated Use config-based constructor: `new DefaultPluginManager({ agentRegistry, toolProviderRegistry, eventBus })` */
+    constructor(agentRegistry: AgentRegistry);
+    get tools(): readonly ToolDefinition[];
+    get contextSources(): readonly ContextSourceValue[];
+    register(plugin: Plugin): Promise<void>;
+    activate(id: string): Promise<void>;
+    deactivate(id: string): Promise<void>;
+    list(): readonly Plugin[];
+    get(id: string): Plugin | undefined;
+    getActivePlugins(): readonly Plugin[];
+    fireHook<N extends HookName>(name: N, data: HookPayload<N>): Promise<HookReturn<N>>;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/plugin/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/plugin/manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EACK,MAAM,EAAE,aAAa,EACvB,QAAQ,EAAE,WAAW,EAAE,UAAU,EAC/C,MAAM,cAAc,CAAC;AAGtB,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,qBAAa,oBAAqB,YAAW,aAAa;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAwB;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;gBAExB,MAAM,EAAE,mBAAmB;IACvC,8HAA8H;gBAClH,aAAa,EAAE,aAAa;IAsBxC,IAAI,KAAK,IAAI,SAAS,cAAc,EAAE,CAErC;IAED,IAAI,cAAc,IAAI,SAAS,kBAAkB,EAAE,CAElD;IAEK,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBnC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3C,IAAI,IAAI,SAAS,MAAM,EAAE;IAIzB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAInC,gBAAgB,IAAI,SAAS,MAAM,EAAE;IAM/B,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAC/B,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;CA6C1B"}

package/dist/plugin/manager.js

@@ -0,0 +1,114 @@
+import { getLogger } from "../logger.js";
+export class DefaultPluginManager {
+    plugins = new Map();
+    activePluginIds = new Set();
+    toolRegistrations = [];
+    ctxSources = [];
+    agentRegistry;
+    toolProviderRegistry;
+    eventBus;
+    constructor(configOrRegistry) {
+        if ("toolProviderRegistry" in configOrRegistry) {
+            this.agentRegistry = configOrRegistry.agentRegistry;
+            this.toolProviderRegistry = configOrRegistry.toolProviderRegistry;
+            this.eventBus = configOrRegistry.eventBus;
+        }
+        else {
+            // Backward compatibility: old single-arg constructor
+            this.agentRegistry = configOrRegistry;
+            // Lazy-init — these will be replaced by real instances at runtime
+            this.toolProviderRegistry = {
+                registerProvider() { }, unregisterProvider() { }, getProvider() { return undefined; },
+                listProviders() { return []; }, getAllTools() { return []; }, getTool() { return undefined; },
+                hasTool() { return false; }, async refreshProvider() { }, count() { return 0; },
+            };
+            this.eventBus = {
+                publish() { }, subscribe() { return () => { }; }, subscribeAll() { return () => { }; },
+                async durable() { return (async function* () { })(); },
+            };
+        }
+    }
+    get tools() {
+        return this.toolRegistrations;
+    }
+    get contextSources() {
+        return this.ctxSources;
+    }
+    async register(plugin) {
+        if (this.plugins.has(plugin.manifest.id)) {
+            throw new Error(`Plugin '${plugin.manifest.id}' already registered`);
+        }
+        this.plugins.set(plugin.manifest.id, plugin);
+    }
+    async activate(id) {
+        const plugin = this.plugins.get(id);
+        if (!plugin)
+            throw new Error(`Plugin '${id}' not found`);
+        const ctx = {
+            registerTool: (tool) => { this.toolRegistrations.push(tool); },
+            registerContextSource: (source) => { this.ctxSources.push(source); },
+            registerAgent: async (config) => { await this.agentRegistry.register(config); },
+            getAgentRegistry: () => this.agentRegistry,
+            getToolProviderRegistry: () => this.toolProviderRegistry,
+            getEventBus: () => this.eventBus,
+        };
+        await plugin.activate(ctx);
+        this.activePluginIds.add(id);
+    }
+    async deactivate(id) {
+        const plugin = this.plugins.get(id);
+        if (!plugin)
+            throw new Error(`Plugin '${id}' not found`);
+        await plugin.deactivate?.();
+        this.activePluginIds.delete(id);
+    }
+    list() {
+        return [...this.plugins.values()];
+    }
+    get(id) {
+        return this.plugins.get(id);
+    }
+    getActivePlugins() {
+        return [...this.activePluginIds]
+            .map((id) => this.plugins.get(id))
+            .filter((p) => p !== undefined);
+    }
+    async fireHook(name, data) {
+        let currentData = data;
+        let mutationResult = null;
+        for (const plugin of this.getActivePlugins()) {
+            const hookFn = plugin.hooks?.[name];
+            if (!hookFn)
+                continue;
+            try {
+                const result = await hookFn(currentData);
+                if (result !== null &&
+                    result !== undefined &&
+                    typeof result === "object" &&
+                    "modified" in result) {
+                    mutationResult = result;
+                    // Chain mutations: pass modified data to next plugin
+                    const isMutationHook = [
+                        "onToolInvoked", "onToolCompleted", "onPermissionAsk",
+                        "onChatParams", "onShellEnv", "onBeforeModelCall",
+                        "onAfterModelCall", "onBeforeToolExecution", "onAfterToolExecution",
+                    ].includes(name);
+                    if (isMutationHook) {
+                        const mod = result.modified;
+                        currentData = { ...currentData, ...mod };
+                    }
+                }
+            }
+            catch (err) {
+                getLogger().warn(`[Plugin ${plugin.manifest.id}] ${name} failed:`, err);
+            }
+        }
+        const isMutationHook = [
+            "onToolInvoked", "onToolCompleted", "onPermissionAsk",
+            "onChatParams", "onShellEnv", "onBeforeModelCall",
+            "onAfterModelCall", "onBeforeToolExecution", "onAfterToolExecution",
+        ].includes(name);
+        return (isMutationHook ? mutationResult : undefined);
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/plugin/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/plugin/manager.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzC,MAAM,OAAO,oBAAoB;IACd,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,iBAAiB,GAAqB,EAAE,CAAC;IACzC,UAAU,GAAyB,EAAE,CAAC;IACtC,aAAa,CAAgB;IAC7B,oBAAoB,CAAuB;IAC3C,QAAQ,CAAW;IAKpC,YAAY,gBAAqD;QAC/D,IAAI,sBAAsB,IAAI,gBAAgB,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,aAAa,CAAC;YACpD,IAAI,CAAC,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC;YAClE,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC;YACtC,kEAAkE;YAClE,IAAI,CAAC,oBAAoB,GAAG;gBAC1B,gBAAgB,KAAI,CAAC,EAAE,kBAAkB,KAAI,CAAC,EAAE,WAAW,KAAK,OAAO,SAAS,CAAC,CAAC,CAAC;gBACnF,aAAa,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,CAAC;gBAC7F,OAAO,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,KAAI,CAAC,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;aAC5C,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG;gBACd,OAAO,KAAI,CAAC,EAAE,SAAS,KAAK,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;gBACnF,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,SAAS,CAAC,MAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aAC/B,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEzD,MAAM,GAAG,GAAkB;YACzB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9D,qBAAqB,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,aAAa,EAAE,KAAK,EAAE,MAAmB,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5F,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa;YAC1C,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB;YACxD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ;SACjC,CAAC;QAEF,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;aAC7B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAAO,EACP,IAAoB;QAEpB,IAAI,WAAW,GAAG,IAAI,CAAC;QACvB,IAAI,cAAc,GAAiC,IAAI,CAAC;QAExD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAI,MAAM,CAAC,KAAiC,EAAE,CACxD,IAAyB,CAC2B,CAAC;YACvD,IAAI,CAAC,MAAM;gBAAE,SAAS;YAEtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;gBAEzC,IACE,MAAM,KAAK,IAAI;oBACf,MAAM,KAAK,SAAS;oBACpB,OAAO,MAAM,KAAK,QAAQ;oBAC1B,UAAU,IAAK,MAAkC,EACjD,CAAC;oBACD,cAAc,GAAG,MAA+B,CAAC;oBACjD,qDAAqD;oBACrD,MAAM,cAAc,GAAG;wBACrB,eAAe,EAAE,iBAAiB,EAAE,iBAAiB;wBACrD,cAAc,EAAE,YAAY,EAAE,mBAAmB;wBACjD,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB;qBACpE,CAAC,QAAQ,CAAC,IAAc,CAAC,CAAC;oBAE3B,IAAI,cAAc,EAAE,CAAC;wBACnB,MAAM,GAAG,GAAI,MAAgD,CAAC,QAAQ,CAAC;wBACvE,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,GAAG,EAAoB,CAAC;oBAC7D,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,EAAE,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,eAAe,EAAE,iBAAiB,EAAE,iBAAiB;YACrD,cAAc,EAAE,YAAY,EAAE,mBAAmB;YACjD,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB;SACpE,CAAC,QAAQ,CAAC,IAAc,CAAC,CAAC;QAE3B,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAkB,CAAC;IACxE,CAAC;CACF"}

package/dist/plugin/plugin-file-loader.d.ts

@@ -0,0 +1,43 @@
+import type { Plugin } from "../plugin.js";
+export interface PluginSourceDir {
+    type: "global" | "project";
+    dir: string;
+    priority: number;
+}
+export interface PluginFileLoaderConfig {
+    parser?: (content: string, filePath: string) => Plugin | null;
+}
+/**
+ * PluginFileLoader — Discovers and loads plugins from file system.
+ *
+ * Convention:
+ *   .vnt/plugins/<plugin-id>/plugin.ts   (project)
+ *   .vnt/plugins/<plugin-id>/plugin.js
+ *   ~/.vnt/plugins/<plugin-id>/plugin.ts (global)
+ *   ~/.vnt/plugins/<plugin-id>/plugin.js
+ *   .claude/plugins/<plugin-id>/plugin.ts (Claude-compatible)
+ *   .agents/plugins/<plugin-id>/plugin.ts (Agents-compatible)
+ */
+export declare class PluginFileLoader {
+    private readonly parser;
+    constructor(config?: PluginFileLoaderConfig);
+    /**
+     * Load plugins from a directory.
+     * Each subdirectory with a `plugin.ts` or `plugin.js` file is a plugin.
+     */
+    loadFromDirectory(dir: string, _source: PluginSourceDir): Promise<Plugin[]>;
+    /**
+     * Load plugins from multiple directories (global first, then project).
+     */
+    loadFromDirectories(dirs: PluginSourceDir[]): Promise<Plugin[]>;
+}
+/**
+ * PluginFileProvider — Implements ToolProvider interface for plugin files.
+ * Actually, this is a PluginProvider (not ToolProvider), but follows same pattern.
+ */
+export interface PluginProvider {
+    readonly id: string;
+    readonly name: string;
+    readonly plugins: Plugin[];
+}
+//# sourceMappingURL=plugin-file-loader.d.ts.map

package/dist/plugin/plugin-file-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-file-loader.d.ts","sourceRoot":"","sources":["../../src/plugin/plugin-file-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAkB,MAAM,cAAc,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuD;gBAElE,MAAM,CAAC,EAAE,sBAAsB;IAI3C;;;OAGG;IACG,iBAAiB,CACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC;IAgCpB;;OAEG;IACG,mBAAmB,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAyBtE;AA+CD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;CAC5B"}