graphlin 0.1.2 → 0.2.0

package/scripts/graphlin.mjs

@@ -4,11 +4,12 @@ import { parseArguments } from './arguments.mjs';
 import { initOnboarding, uninstallOnboarding, needsOnboarding, openViewer, agentInstructions } from './onboarding.mjs';
 import { readSettings } from '../runtime/daemon/settings.mjs';
 import { projectPaths } from '../runtime/daemon/paths.mjs';
+import { runExtensions } from './extensions.mjs';
 
 const HELP = `Graphlin — local architecture and activity viewer (Node.js 22.14+, macOS/Linux).
   graphlin                           Guided setup if needed, then foreground start
-  init [--host claude|codex|both] [--allow-source|--no-source] [--replace-key]
-  start --project PATH [--allow-source|--no-source] [--persist-evidence] [--no-display-evidence] [--background] [--no-open]
+  init [--host claude|codex|both] [--allow-source|--local-source|--no-source] [--replace-key]
+  start --project PATH [--allow-source|--local-source|--no-source] [--persist-evidence] [--no-display-evidence] [--background] [--no-open]
   open --project PATH                Open/reopen the viewer; start detached if needed
   uninstall [--host claude|codex|both]
   stop --project PATH
@@ -17,10 +18,16 @@ const HELP = `Graphlin — local architecture and activity viewer (Node.js 22.14
   demo [--data-dir PATH] [--background]
   export --project PATH
   logs --project PATH [--file PATH]
+  extensions list                    List installed visualizers and approvals
+  extensions add PACKAGE@VERSION     Install without running package scripts
+  extensions dev ./DIRECTORY         Install a local development snapshot
+  extensions update PACKAGE@VERSION  Replace an installed visualizer
+  extensions remove ID
+  extensions doctor
 All commands accept --project PATH and --data-dir PATH (or GRAPHLIN_DATA_DIR).
 init installs for your user account using the host CLIs; it saves project consent
 and offers a masked key prompt only in a terminal. Non-interactive init requires
---host and --allow-source or --no-source; source also needs a saved/environment key.
+--host and one source mode; remote source also needs a saved/environment key.
 init --replace-key replaces a saved key at the masked prompt; it requires a terminal.
 uninstall removes only Graphlin host plugins for all projects, retaining keys,
 history, packages and marketplace registrations; it resets current project consent.
@@ -31,6 +38,10 @@ Omitted policy flags reuse current/saved consent. Without consent: metadata only
 --no-source explicitly opts out; --allow-source permits sanitized source/public
 intent to TypeSafe using TYPESAFE_API_KEY or the privately saved key. Approved evidence
 is displayed by default; excerpts are persisted only with --persist-evidence.
+--local-source parses supported source on this machine, without remote decisions.
+Metadata mode inventories paths without opening source files. Visualizers require
+project approval in the viewer before receiving data; custom renderers run in a
+sandboxed frame. Install or mount does not run decision profiles.
 Credentials, environment files, excluded paths, binary and oversized files are
 filtered locally. Replay history is bounded to 7 days; an expired stopped-daemon
 snapshot is deleted on the next startup. Current snapshots are private and bounded.
@@ -47,6 +58,15 @@ artifact identity, including files since deleted.
 try {
   const args = process.argv.slice(2);
   if (args.includes('--help') || args[0] === 'help') process.stdout.write(HELP);
+  else if (args[0] === 'extensions') {
+    const globalArgs = [], extensionArgs = [];
+    for (let index = 1; index < args.length; index++) {
+      if (['--project', '--data-dir'].includes(args[index])) globalArgs.push(args[index], args[++index]);
+      else extensionArgs.push(args[index]);
+    }
+    const { projectRoot, dataDir } = parseArguments(['status', ...globalArgs]);
+    await runExtensions(extensionArgs, { projectRoot, dataDir });
+  }
   else {
     const options = parseArguments(args);
     const print = result => process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);

package/scripts/onboarding.mjs

@@ -313,13 +313,19 @@ export async function initOnboarding(options, dependencies = {}) {
   write(`Project: ${JSON.stringify(paths.projectRoot)}\n`);
   if (upgrading) write('Updating every recorded Graphlin host to keep the installed version consistent.\n');
   let allowSource = options.allowSource ?? (resuming ? saved.policy?.allowSource : undefined);
+  let localSource = options.localSource === true ||
+    (resuming && options.allowSource === undefined && saved.policy?.localSource === true);
   if (allowSource === undefined) {
-    write('Source mode sends locally filtered source excerpts, user prompts, and public agent messages to TypeSafe. Metadata mode sends none of these and needs no key.\n');
-    allowSource = await choose('For this project, choose source or metadata: ', ['source', 'metadata'], prompt) === 'source';
+    write('Source mode sends locally filtered source excerpts and public messages to the decision provider (Jev by default). Local mode parses code on this machine without sending it. Metadata mode reads no source content. Local and metadata need no key.\n');
+    const mode = await choose('For this project, choose source, local, or metadata: ', ['source', 'local', 'metadata'], prompt);
+    allowSource = mode === 'source';
+    localSource = mode === 'local';
   }
   const policy = { ...defaults, ...saved.policy, allowSource,
     persistEvidence: options.persistEvidence ?? saved.policy?.persistEvidence ?? false,
     displayEvidence: options.displayEvidence ?? saved.policy?.displayEvidence ?? true };
+  if (localSource && !allowSource) policy.localSource = true;
+  else delete policy.localSource;
   // Explicit setup plus source consent authorizes saving the supplied key so
   // later launches do not depend on this terminal's environment.
   let apiKey = allowSource && env.TYPESAFE_API_KEY ? env.TYPESAFE_API_KEY : undefined;
@@ -399,7 +405,8 @@ export async function uninstallOnboarding(options, dependencies = {}) {
     await record();
     write(`Graphlin removed from ${host}.\n`);
   }
-  await saveSettings(paths, { policy: { ...defaults, ...saved.policy, allowSource: false, persistEvidence: false } });
+  await saveSettings(paths, { policy: { ...defaults, ...saved.policy, allowSource: false,
+    ...(saved.policy?.localSource ? { localSource: false } : {}), persistEvidence: false } });
   write('Source and evidence-persistence consent reset for this project. A running viewer keeps its current policy until stopped; use graphlin stop.\n');
   return { removed, ...(cancelledPending.length ? { cancelledPending } : {}), retainedData: true };
 }

package/scripts/validate-packages.mjs

@@ -4,6 +4,51 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import assert from 'node:assert/strict';
 
+const PARSER_NAME = '@vscode/tree-sitter-wasm';
+const PARSER_VERSION = '0.3.1';
+// The complete published 0.3.1 package, not a pruned grammar subset. Keep this
+// explicit: arbitrary new files under node_modules must never enter a release.
+const PARSER_FILES = [
+  'LICENSE', 'README.md', 'SECURITY.md', 'cgmanifest.json', 'package.json',
+  'wasm/tree-sitter.js', 'wasm/tree-sitter.wasm', 'wasm/web-tree-sitter.d.ts',
+  ...['bash', 'c-sharp', 'cpp', 'css', 'go', 'ini', 'java', 'javascript', 'php',
+    'powershell', 'python', 'regex', 'ruby', 'rust', 'tsx', 'typescript']
+    .map(language => `wasm/tree-sitter-${language}.wasm`),
+];
+const SDK_EXPORTS = {
+  './extensions/sdk': {
+    types: './runtime/extensions/sdk.d.ts',
+    import: './runtime/extensions/sdk.mjs',
+    default: './runtime/extensions/sdk.mjs',
+  },
+  './extensions/scene': './runtime/extensions/scene.mjs',
+};
+
+async function assertRegularFile(root, file) {
+  let current = root;
+  for (const component of file.split('/')) {
+    current = path.join(current, component);
+    assert.equal((await lstat(current)).isSymbolicLink(), false, 'package_symlink_rejected');
+  }
+  assert.ok((await lstat(current)).isFile(), 'package_file_must_be_regular');
+}
+
+export async function bundledPackageFiles(root, metadata) {
+  metadata ??= JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+  assert.deepEqual(metadata.bundledDependencies, [PARSER_NAME], 'parser_bundle_required');
+  assert.equal(metadata.dependencies?.[PARSER_NAME], PARSER_VERSION, 'parser_dependency_must_be_pinned');
+  const base = `node_modules/${PARSER_NAME}`;
+  await assertRegularFile(root, `${base}/package.json`);
+  const parser = JSON.parse(await readFile(path.join(root, base, 'package.json'), 'utf8'));
+  assert.equal(parser.name, PARSER_NAME, 'unexpected_parser_package');
+  assert.equal(parser.version, PARSER_VERSION, 'unexpected_parser_version');
+  assert.equal(parser.license, 'MIT', 'unexpected_parser_license');
+  assert.deepEqual(Object.keys(parser.dependencies ?? {}), [], 'unexpected_parser_dependencies');
+  const files = PARSER_FILES.map(file => `${base}/${file}`);
+  for (const file of files) await assertRegularFile(root, file);
+  return files;
+}
+
 // Dependency-free checks for this package's deliberately small manifest profile.
 // This is not a replacement for a host's schema validation or activation/trust.
 export async function publicPackageFiles(root) {
@@ -22,21 +67,22 @@ export async function publicPackageFiles(root) {
     assert.ok(typeof file === 'string' && file.length > 0 && !file.includes('\\') &&
       !path.posix.isAbsolute(file) && !/[*?[\]{}!\u0000-\u001f]/.test(file) &&
       file.split('/').every(part => part && part !== '.' && part !== '..'), 'invalid_package_file');
-    assert.ok(/^(?:package\.json|LICENSE|README\.md|plugin\.json|mcp\.json|\.mcp\.json|\.claude-plugin\/plugin\.json|\.codex-plugin\/plugin\.json|adapters\/(?:README\.md|(?:claude|codex|kiro)\/(?:hooks|profile)\.json)|skills\/graphlin\/SKILL\.md|runtime\/(?:[a-z0-9-]+\/)*[a-z0-9-]+\.(?:mjs|js|css|html)|schemas\/[a-z0-9-]+\.schema\.json|scripts\/(?:arguments|build-packages|collector|control|daemon|graphlin|onboarding|validate-packages)\.mjs|scripts\/collect\.sh)$/.test(file),
+    assert.ok(/^(?:package\.json|LICENSE|README\.md|plugin\.json|mcp\.json|\.mcp\.json|\.claude-plugin\/plugin\.json|\.codex-plugin\/plugin\.json|adapters\/(?:README\.md|(?:claude|codex|kiro)\/(?:hooks|profile)\.json)|skills\/graphlin\/SKILL\.md|runtime\/(?:[a-z0-9-]+\/)*[a-z0-9-]+\.(?:mjs|js|css|html|d\.ts)|docs\/(?:decision-service|extension-authoring|model-api|visualizer-views|usage)\.md|schemas\/[a-z0-9-]+\.schema\.json|scripts\/(?:arguments|build-packages|collector|control|daemon|extensions|graphlin|onboarding|validate-packages)\.mjs|scripts\/collect\.sh)$/.test(file),
     'unexpected_public_package_file');
-    let current = root;
-    for (const component of file.split('/')) {
-      current = path.join(current, component);
-      assert.equal((await lstat(current)).isSymbolicLink(), false, 'package_symlink_rejected');
-    }
-    assert.ok((await lstat(current)).isFile(), 'package_file_must_be_regular');
+    await assertRegularFile(root, file);
   }
-  return files;
+  return [...files, ...await bundledPackageFiles(root, metadata)];
 }
 
 export async function validatePackage(root) {
   const json = async name => JSON.parse(await readFile(path.join(root, name), 'utf8'));
   const metadata = await json('package.json');
+  await bundledPackageFiles(root, metadata);
+  assert.deepEqual(metadata.exports, SDK_EXPORTS, 'invalid_sdk_exports');
+  for (const file of ['runtime/extensions/sdk.mjs', 'runtime/extensions/sdk.d.ts', 'runtime/extensions/scene.mjs']) {
+    assert.ok(metadata.files.includes(`./${file}`), 'sdk_export_must_be_packaged');
+    await assertRegularFile(root, file);
+  }
   const manifest = await json('plugin.json'), portable = await json('mcp.json');
   assert.equal(manifest.$schema, 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json');
   assert.equal(manifest.name, 'graphlin');