neuralos 2.8.0

package/plugins/patch-manager/index.mjs

@@ -0,0 +1,288 @@
+/**
+ * patch-manager plugin — autonomous patch management for RTerm.
+ *
+ * Discovers patch status across hosts (yum/apt/Windows Update), plans patch
+ * deployments, executes via playbooks with MOP approval gates, and alerts on
+ * completion/failure. Combines RTerm's fleet orchestration, MOP change
+ * management, triggers, and audit trail into an autonomous patch pipeline.
+ */
+
+// --- Pure: build the command to query patch status on a host ---
+export function buildPatchStatusCommand(os) {
+  const o = String(os).toLowerCase()
+  if (o === 'windows' || o === 'win32') {
+    return 'powershell -Command "Get-WindowsUpdate -Verbose 2>&1 | Select-Object -First 50"'
+  }
+  if (o === 'linux' || o === 'darwin') {
+    // Try yum first, then apt
+    return '(yum check-update --quiet 2>/dev/null || apt list --upgradable 2>/dev/null) | head -50'
+  }
+  return 'echo "unsupported os: ' + o + '"'
+}
+
+// --- Pure: build the command to apply patches on a host ---
+export function buildPatchApplyCommand(os, opts = {}) {
+  const o = String(os).toLowerCase()
+  const severity = opts.severity ?? 'all' // all, critical, security, recommended
+  const dryRun = opts.dryRun ?? false
+
+  if (o === 'windows' || o === 'win32') {
+    const kbFilter = severity === 'critical' ? '-KBArticleID "KB*"' : ''
+    const dryRunFlag = dryRun ? '-WhatIf' : ''
+    return `powershell -Command "Install-WindowsUpdate ${kbFilter} ${dryRunFlag} -AcceptAll -AutoReboot:$false 2>&1"`
+  }
+  if (o === 'linux') {
+    if (severity === 'security') {
+      return dryRun
+        ? '(yum update --security --assumeno 2>/dev/null || apt-get -s upgrade --with-new-pkgs 2>/dev/null | grep -i security | head -20)'
+        : '(yum update --security -y 2>/dev/null || apt-get upgrade -y --with-new-pkgs 2>/dev/null) | tail -20'
+    }
+    return dryRun
+      ? '(yum update --assumeno 2>/dev/null || apt-get -s upgrade 2>/dev/null) | tail -20'
+      : '(yum update -y 2>/dev/null || apt-get upgrade -y 2>/dev/null) | tail -20'
+  }
+  return 'echo "unsupported os: ' + o + '"'
+}
+
+// --- Pure: build the pre-patch verification command ---
+export function buildPrePatchCheckCommand(os) {
+  const o = String(os).toLowerCase()
+  if (o === 'windows' || o === 'win32') {
+    return 'powershell -Command "Get-PSDrive -Name C | Select-Object Used,Free; Get-Service -Name wuauserv | Select-Object Status"'
+  }
+  if (o === 'linux') {
+    return 'df -h / | tail -1; systemctl is-system-running 2>/dev/null || true; uptime'
+  }
+  return 'echo "unsupported os: ' + o + '"'
+}
+
+// --- Pure: build the post-patch verification command ---
+export function buildPostPatchCheckCommand(os) {
+  const o = String(os).toLowerCase()
+  if (o === 'windows' || o === 'win32') {
+    return 'powershell -Command "Get-WindowsUpdate -Verbose 2>&1 | Select-Object -First 10; Get-Service -Name wuauserv | Select-Object Status"'
+  }
+  if (o === 'linux') {
+    return 'echo "post-patch check: system running"; uptime; df -h / | tail -1'
+  }
+  return 'echo "unsupported os: ' + o + '"'
+}
+
+// --- Pure: parse patch status output into structured results ---
+export function parsePatchStatus(output, os) {
+  const o = String(os ?? '').toLowerCase()
+  const lines = String(output ?? '').split(/\r?\n/).filter((l) => l.trim().length > 0)
+  const patches = []
+  let summary = { total: 0, critical: 0, security: 0, recommended: 0 }
+
+  for (const line of lines) {
+    const l = line.trim()
+    // Windows: KB article lines
+    const kbMatch = l.match(/(KB\d{7})/i)
+    if (kbMatch) {
+      patches.push({
+        id: kbMatch[1],
+        title: l.replace(/KB\d{7}/i, '').trim().slice(0, 80),
+        severity: l.match(/critical/i) ? 'critical' : l.match(/security/i) ? 'security' : 'recommended',
+        os: 'windows',
+      })
+      summary.total++
+      if (l.match(/critical/i)) summary.critical++
+      if (l.match(/security/i)) summary.security++
+      continue
+    }
+    // Linux yum: package.arch version repo
+    const yumMatch = l.match(/^(\S+)\.(\S+)\s+(\S+)\s+(\S+)/)
+    if (yumMatch && !l.startsWith('Loaded') && !l.startsWith('Last') && !l.startsWith('No')) {
+      patches.push({
+        id: yumMatch[1],
+        title: `${yumMatch[1]}.${yumMatch[2]} ${yumMatch[3]} (${yumMatch[4]})`,
+        severity: l.match(/security/i) ? 'security' : l.match(/critical/i) ? 'critical' : 'recommended',
+        os: 'linux',
+      })
+      summary.total++
+      if (l.match(/security/i)) summary.security++
+      if (l.match(/critical/i)) summary.critical++
+      continue
+    }
+    // Linux apt: package/version
+    const aptMatch = l.match(/^(\S+)\/(\S+)\s+(\S+)\s+(\S+)/)
+    if (aptMatch && !l.startsWith('Listing')) {
+      patches.push({
+        id: aptMatch[1],
+        title: `${aptMatch[1]}/${aptMatch[2]} ${aptMatch[3]} (${aptMatch[4]})`,
+        severity: l.match(/security/i) ? 'security' : l.match(/critical/i) ? 'critical' : 'recommended',
+        os: 'linux',
+      })
+      summary.total++
+      if (l.match(/security/i)) summary.security++
+      if (l.match(/critical/i)) summary.critical++
+    }
+  }
+
+  summary.recommended = summary.total - summary.critical - summary.security
+  return { patches, summary }
+}
+
+// --- Pure: build a patch plan from patch status ---
+export function buildPatchPlan(host, os, patchStatus, opts = {}) {
+  const severity = opts.severity ?? 'all'
+  const toApply = severity === 'all'
+    ? patchStatus.patches
+    : patchStatus.patches.filter((p) => p.severity === severity)
+
+  return {
+    host,
+    os,
+    patchesToApply: toApply.length,
+    patchIds: toApply.map((p) => p.id),
+    severity,
+    estimatedDowntimeMin: toApply.length * 2, // rough estimate
+    requiresReboot: os === 'windows' || toApply.some((p) => p.severity === 'critical'),
+    plan: [
+      { step: 1, name: 'pre-check', command: buildPrePatchCheckCommand(os), description: 'Verify system health before patching' },
+      { step: 2, name: 'backup', command: 'echo "snapshot/checkpoint before patch"', description: 'Create restore point' },
+      { step: 3, name: 'apply', command: buildPatchApplyCommand(os, { severity }), description: `Apply ${toApply.length} patches (${severity})` },
+      { step: 4, name: 'post-check', command: buildPostPatchCheckCommand(os), description: 'Verify patches applied successfully' },
+      { step: 5, name: 'rollback', command: 'echo "rollback if post-check fails"', description: 'Rollback on failure', onError: 'continue' },
+    ],
+  }
+}
+
+// --- Pure: build a compliance report for a fleet ---
+export function buildComplianceReport(hostStatuses) {
+  const hosts = Object.entries(hostStatuses ?? {}).map(([host, status]) => ({
+    host,
+    os: status.os ?? 'unknown',
+    totalPatches: status.summary?.total ?? 0,
+    criticalPatches: status.summary?.critical ?? 0,
+    securityPatches: status.summary?.security ?? 0,
+    compliant: (status.summary?.critical ?? 0) === 0 && (status.summary?.security ?? 0) === 0,
+  }))
+
+  const totalHosts = hosts.length
+  const compliantHosts = hosts.filter((h) => h.compliant).length
+  const nonCompliantHosts = totalHosts - compliantHosts
+  const totalCritical = hosts.reduce((s, h) => s + h.criticalPatches, 0)
+  const totalSecurity = hosts.reduce((s, h) => s + h.securityPatches, 0)
+
+  return {
+    hosts,
+    summary: {
+      totalHosts,
+      compliantHosts,
+      nonCompliantHosts,
+      complianceRate: totalHosts > 0 ? Math.round((compliantHosts / totalHosts) * 100) : 100,
+      totalCriticalPatches: totalCritical,
+      totalSecurityPatches: totalSecurity,
+    },
+  }
+}
+
+// --- Plugin entry ---
+export function register(ctx) {
+  const { registerTool, registerTrigger, registerPanel, exec, readLedger, log } = ctx
+
+  // Tool: patch_status — query patch status of a host
+  registerTool({
+    name: 'patch_status',
+    description: 'Query the current patch status of a host (available updates). Returns patch list with severity classification.',
+    params: {
+      host: { type: 'string', description: 'Host to query' },
+      os: { type: 'string', description: 'OS type: linux, windows, darwin' },
+    },
+    handler: async (params) => {
+      const { host, os } = params ?? {}
+      if (!host || !os) return { error: 'host and os are required' }
+      const cmd = buildPatchStatusCommand(os)
+      log(`[patch-manager] querying patch status on ${host} (${os})`)
+      const output = await exec(cmd, { host })
+      const result = parsePatchStatus(output, os)
+      return { host, os, ...result }
+    },
+  })
+
+  // Tool: patch_plan — build a patch deployment plan for a host
+  registerTool({
+    name: 'patch_plan',
+    description: 'Build a patch deployment plan for a host (pre-check → backup → apply → post-check → rollback). Returns the plan for MOP approval.',
+    params: {
+      host: { type: 'string', description: 'Host to plan for' },
+      os: { type: 'string', description: 'OS type' },
+      severity: { type: 'string', description: 'Patch severity filter: all, critical, security, recommended' },
+    },
+    handler: async (params) => {
+      const { host, os, severity = 'all' } = params ?? {}
+      if (!host || !os) return { error: 'host and os are required' }
+      // First get current status
+      const statusCmd = buildPatchStatusCommand(os)
+      const statusOutput = await exec(statusCmd, { host })
+      const patchStatus = parsePatchStatus(statusOutput, os)
+      const plan = buildPatchPlan(host, os, patchStatus, { severity })
+      log(`[patch-manager] built patch plan for ${host}: ${plan.patchesToApply} patches`)
+      return plan
+    },
+  })
+
+  // Tool: patch_apply — execute a patch plan on a host (runs as MOP change)
+  registerTool({
+    name: 'patch_apply',
+    description: 'Execute a patch deployment on a host. This is a destructive operation — requires MOP approval. Returns the execution result.',
+    params: {
+      host: { type: 'string', description: 'Host to patch' },
+      os: { type: 'string', description: 'OS type' },
+      severity: { type: 'string', description: 'Patch severity filter' },
+      dryRun: { type: 'boolean', description: 'If true, simulate only (no changes)' },
+    },
+    handler: async (params) => {
+      const { host, os, severity = 'all', dryRun = false } = params ?? {}
+      if (!host || !os) return { error: 'host and os are required' }
+      const applyCmd = buildPatchApplyCommand(os, { severity, dryRun })
+      log(`[patch-manager] ${dryRun ? 'simulating' : 'applying'} patches on ${host} (${severity})`)
+      const output = await exec(applyCmd, { host })
+      const postCheck = await exec(buildPostPatchCheckCommand(os), { host })
+      return { host, os, severity, dryRun, output: output.slice(0, 2000), postCheck: postCheck.slice(0, 500) }
+    },
+  })
+
+  // Trigger: patch_failure — fires when a patch execution fails
+  registerTrigger({
+    name: 'patch_failure',
+    description: 'Fires when a patch execution output contains error/failure indicators. Use for auto-remediation or investigation.',
+    match: (event) => {
+      if (event?.source !== 'playbook') return false
+      const detail = String(event?.detail ?? '').toLowerCase()
+      return detail.includes('error') || detail.includes('failed') || detail.includes('rollback')
+    },
+    action: 'propose-change',
+  })
+
+  // Trigger: patch_completion — fires when a patch execution completes successfully
+  registerTrigger({
+    name: 'patch_completion',
+    description: 'Fires when a patch execution completes without errors. Use for compliance reporting.',
+    match: (event) => {
+      if (event?.source !== 'playbook') return false
+      const detail = String(event?.detail ?? '').toLowerCase()
+      return detail.includes('success') || detail.includes('completed') || detail.includes('no packages marked for update')
+    },
+    action: 'run-playbook',
+  })
+
+  // Panel: patch-compliance — patch compliance dashboard
+  registerPanel({
+    name: 'patch-compliance',
+    title: 'Patch Compliance',
+    render: (data) => {
+      const report = buildComplianceReport(data ?? {})
+      const rows = report.hosts.map((h) =>
+        `<tr><td>${h.host}</td><td>${h.os}</td><td>${h.totalPatches}</td><td>${h.criticalPatches}</td><td>${h.securityPatches}</td><td>${h.compliant ? '✅' : '❌'}</td></tr>`
+      ).join('')
+      return `<div class="patch-compliance"><h3>Patch Compliance</h3><p>Compliance rate: ${report.summary.complianceRate}% (${report.summary.compliantHosts}/${report.summary.totalHosts} hosts)</p><p>Critical: ${report.summary.totalCriticalPatches} | Security: ${report.summary.totalSecurityPatches}</p><table><thead><tr><th>Host</th><th>OS</th><th>Total</th><th>Critical</th><th>Security</th><th>Compliant</th></tr></thead><tbody>${rows}</tbody></table></div>`
+    },
+  })
+
+  log('[patch-manager] registered: 3 tools, 2 triggers, 1 panel')
+}
+
+export default { register, buildPatchStatusCommand, buildPatchApplyCommand, buildPrePatchCheckCommand, buildPostPatchCheckCommand, parsePatchStatus, buildPatchPlan, buildComplianceReport }

package/plugins/patch-manager/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "patch-manager",
+  "version": "1.0.0",
+  "description": "Autonomous patch management for RTerm — discover patch status across hosts, plan patch deployments, execute via playbooks with MOP approval gates, and alert on completion/failure. Supports Linux (yum/apt) and Windows (Get-WindowsUpdate).",
+  "entry": "index.mjs",
+  "tools": ["patch_status", "patch_plan", "patch_apply"],
+  "triggers": ["patch_failure", "patch_completion"],
+  "panels": ["patch-compliance"],
+  "permissions": ["exec", "readLedger:metrics", "readLedger:incidents"]
+}

package/plugins/request-router/index.d.mts

@@ -0,0 +1,9 @@
+// request-router plugin type declarations
+export function register(ctx: any): void
+export function classifyRequest(request: any): string
+export function routeRequest(request: any): { route: string; risk: string; reason: string }
+export function buildRequestId(): string
+export function buildApprovalRecord(requestId: string, approvedBy: string, rationale: string, decision: string): any
+export function buildQueueEntry(request: any, requestId: string): any
+export function filterQueue(queue: any[] | null | undefined, filter?: any): any[]
+export default any

package/plugins/request-router/index.mjs

@@ -0,0 +1,239 @@
+/**
+ * request-router plugin — automated request handling and approval workflow.
+ *
+ * Receives operational requests (access, restart, deploy, patch, custom),
+ * classifies risk, routes for approval (auto-approve/queue/MOP), executes
+ * end-to-end, and audits every step. Formalizes RTerm's existing command
+ * policy + MOP approval into a structured request pipeline.
+ */
+
+// --- Pure: classify a request by risk ---
+export function classifyRequest(request) {
+  const req = request ?? {}
+  const type = String(req.type ?? '').toLowerCase()
+  const urgency = String(req.urgency ?? 'low').toLowerCase()
+  const target = String(req.target ?? '').toLowerCase()
+
+  // Destructive operations = high risk
+  if (['delete', 'drop', 'purge', 'format', 'destroy'].some((w) => type.includes(w))) return 'high'
+  // Production targets = elevated risk
+  if (target.includes('prod') || target.includes('production')) {
+    if (['restart', 'stop', 'kill', 'deploy', 'patch', 'update'].some((w) => type.includes(w))) return 'high'
+    return 'medium'
+  }
+  // Restart/stop operations = medium risk
+  if (['restart', 'stop', 'kill', 'deploy', 'patch', 'update', 'reboot', 'shutdown'].some((w) => type.includes(w))) return 'medium'
+  // Access requests = medium risk
+  if (['access', 'grant', 'permission', 'role', 'sudo', 'admin'].some((w) => type.includes(w))) return 'medium'
+  // Read-only = low risk
+  if (['status', 'check', 'list', 'show', 'get', 'describe', 'read'].some((w) => type.includes(w))) return 'low'
+  // Default: medium
+  return 'medium'
+}
+
+// --- Pure: route a request based on risk ---
+export function routeRequest(request) {
+  const req = request ?? {}
+  const risk = classifyRequest(req)
+  const urgency = String(req.urgency ?? 'low').toLowerCase()
+
+  if (risk === 'low') return { route: 'auto_approve', risk, reason: 'low-risk read-only operation' }
+  if (risk === 'medium') {
+    if (urgency === 'critical' || urgency === 'high') {
+      return { route: 'queue', risk, reason: 'medium-risk with high urgency — expedited approval' }
+    }
+    return { route: 'queue', risk, reason: 'medium-risk operation — requires operator approval' }
+  }
+  return { route: 'mop', risk, reason: 'high-risk operation — requires MOP change (plan → approve → run)' }
+}
+
+// --- Pure: build a request ID ---
+export function buildRequestId() {
+  return `req-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`
+}
+
+// --- Pure: build an approval record ---
+export function buildApprovalRecord(requestId, approvedBy, rationale, decision) {
+  return {
+    requestId,
+    approvedBy,
+    rationale,
+    decision, // approved | denied
+    at: Date.now(),
+  }
+}
+
+// --- Pure: build a request queue entry ---
+export function buildQueueEntry(request, requestId) {
+  const req = request ?? {}
+  const { route, risk, reason } = routeRequest(req)
+  return {
+    id: requestId,
+    type: req.type,
+    target: req.target,
+    justification: req.justification ?? '',
+    urgency: req.urgency ?? 'low',
+    risk,
+    route,
+    routeReason: reason,
+    status: route === 'auto_approve' ? 'auto_approved' : 'pending',
+    submittedBy: req.submittedBy ?? 'unknown',
+    submittedAt: Date.now(),
+    ...(route === 'auto_approve' ? { approvedAt: Date.now(), approvedBy: 'system' } : {}),
+  }
+}
+
+// --- Pure: filter the request queue ---
+export function filterQueue(queue, filter = {}) {
+  let out = Array.isArray(queue) ? [...queue] : []
+  const f = filter ?? {}
+  if (f.status) out = out.filter((r) => r.status === f.status)
+  if (f.risk) out = out.filter((r) => r.risk === f.risk)
+  if (f.urgency) out = out.filter((r) => r.urgency === f.urgency)
+  if (f.target) out = out.filter((r) => String(r.target ?? '').includes(f.target))
+  return out
+}
+
+// --- Plugin entry ---
+export function register(ctx) {
+  const { registerTool, registerTrigger, registerPanel, exec, readLedger, log } = ctx
+  const requestQueue = []
+
+  // Tool: submit_request — submit an operational request
+  registerTool({
+    name: 'submit_request',
+    description: 'Submit an operational request for approval and execution. The request is classified by risk and routed: low-risk → auto-approve, medium-risk → queue for operator approval, high-risk → MOP change.',
+    params: {
+      type: { type: 'string', description: 'Request type: access, restart, deploy, patch, status, custom' },
+      target: { type: 'string', description: 'Target host or service' },
+      justification: { type: 'string', description: 'Business justification' },
+      urgency: { type: 'string', description: 'low, medium, high, critical' },
+      submittedBy: { type: 'string', description: 'Who is submitting the request' },
+    },
+    handler: async (params) => {
+      const requestId = buildRequestId()
+      const entry = buildQueueEntry(params, requestId)
+      requestQueue.push(entry)
+      log(`[request-router] ${entry.id}: ${entry.type} on ${entry.target} → ${entry.route} (${entry.risk} risk)`)
+      return { requestId, ...entry }
+    },
+  })
+
+  // Tool: approve_request — approve or deny a pending request
+  registerTool({
+    name: 'approve_request',
+    description: 'Approve or deny a pending request. Executes the request if approved. Records the approval in the audit trail.',
+    params: {
+      requestId: { type: 'string', description: 'Request ID to approve/deny' },
+      approvedBy: { type: 'string', description: 'Who is approving' },
+      rationale: { type: 'string', description: 'Reason for the decision' },
+      decision: { type: 'string', description: 'approved or denied' },
+    },
+    handler: async (params) => {
+      const { requestId, approvedBy, rationale, decision } = params ?? {}
+      if (!requestId || !approvedBy) return { error: 'requestId and approvedBy are required' }
+      const entry = requestQueue.find((r) => r.id === requestId)
+      if (!entry) return { error: `request ${requestId} not found` }
+      if (entry.status !== 'pending') return { error: `request ${requestId} is already ${entry.status}` }
+
+      const approval = buildApprovalRecord(requestId, approvedBy, rationale ?? '', decision ?? 'approved')
+      entry.status = approval.decision === 'approved' ? 'approved' : 'denied'
+      entry.approvedBy = approvedBy
+      entry.approvedAt = approval.at
+      entry.rationale = rationale
+
+      log(`[request-router] ${requestId} ${approval.decision} by ${approvedBy}`)
+
+      // If approved, execute the request
+      if (approval.decision === 'approved') {
+        const cmd = buildRequestCommand(entry)
+        if (cmd) {
+          const output = await exec(cmd, { host: entry.target })
+          entry.executionOutput = output.slice(0, 1000)
+          entry.executedAt = Date.now()
+        }
+      }
+
+      return { requestId, ...entry, approval }
+    },
+  })
+
+  // Tool: list_requests — list requests in the queue
+  registerTool({
+    name: 'list_requests',
+    description: 'List requests in the queue with optional filters (status, risk, urgency, target).',
+    params: {
+      status: { type: 'string', description: 'Filter by status: pending, approved, denied, auto_approved' },
+      risk: { type: 'string', description: 'Filter by risk: low, medium, high' },
+      urgency: { type: 'string', description: 'Filter by urgency' },
+      target: { type: 'string', description: 'Filter by target (substring match)' },
+    },
+    handler: async (params) => {
+      const filtered = filterQueue(requestQueue, params ?? {})
+      return { total: filtered.length, requests: filtered }
+    },
+  })
+
+  // Tool: request_status — get the status of a specific request
+  registerTool({
+    name: 'request_status',
+    description: 'Get the status of a specific request by ID.',
+    params: { requestId: { type: 'string', description: 'Request ID' } },
+    handler: async (params) => {
+      const entry = requestQueue.find((r) => r.id === params?.requestId)
+      if (!entry) return { error: `request ${params?.requestId} not found` }
+      return entry
+    },
+  })
+
+  // Trigger: request_urgent — fires when a high-urgency request is submitted
+  registerTrigger({
+    name: 'request_urgent',
+    description: 'Fires when a request with critical/high urgency is submitted. Use for immediate notification.',
+    match: (event) => {
+      if (event?.source !== 'request-router') return false
+      return event.labels?.urgency === 'critical' || event.labels?.urgency === 'high'
+    },
+    action: 'run-playbook',
+  })
+
+  // Trigger: request_approved — fires when a request is approved
+  registerTrigger({
+    name: 'request_approved',
+    description: 'Fires when a request is approved. Use for post-approval automation.',
+    match: (event) => {
+      if (event?.source !== 'request-router') return false
+      return event.labels?.status === 'approved'
+    },
+    action: 'run-playbook',
+  })
+
+  // Panel: request-queue — request queue dashboard
+  registerPanel({
+    name: 'request-queue',
+    title: 'Request Queue',
+    render: (data) => {
+      const queue = Array.isArray(data) ? data : requestQueue
+      const rows = queue.map((r) =>
+        `<tr><td>${r.id}</td><td>${r.type}</td><td>${r.target}</td><td>${r.risk}</td><td>${r.urgency}</td><td>${r.status}</td><td>${r.submittedBy ?? ''}</td></tr>`
+      ).join('')
+      return `<div class="request-queue"><h3>Request Queue</h3><p>Total: ${queue.length} | Pending: ${queue.filter((r) => r.status === 'pending').length} | Approved: ${queue.filter((r) => r.status === 'approved').length}</p><table><thead><tr><th>ID</th><th>Type</th><th>Target</th><th>Risk</th><th>Urgency</th><th>Status</th><th>By</th></tr></thead><tbody>${rows}</tbody></table></div>`
+    },
+  })
+
+  log('[request-router] registered: 4 tools, 2 triggers, 1 panel')
+}
+
+// --- Pure: build the command to execute for an approved request ---
+function buildRequestCommand(entry) {
+  const type = String(entry.type ?? '').toLowerCase()
+  const target = entry.target
+  if (type.includes('restart')) return `systemctl restart ${target} 2>/dev/null || Restart-Service ${target} -Force 2>/dev/null`
+  if (type.includes('stop')) return `systemctl stop ${target} 2>/dev/null || Stop-Service ${target} -Force 2>/dev/null`
+  if (type.includes('status')) return `systemctl status ${target} 2>/dev/null || Get-Service ${target} 2>/dev/null`
+  if (type.includes('deploy')) return `echo "deploying to ${target}"`
+  if (type.includes('patch')) return `echo "patching ${target}"`
+  return null // custom requests don't have a built-in command
+}
+
+export default { register, classifyRequest, routeRequest, buildRequestId, buildApprovalRecord, buildQueueEntry, filterQueue }

package/plugins/request-router/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "request-router",
+  "version": "1.0.0",
+  "description": "Automated request handling and approval workflow for RTerm — receive operational requests, classify risk, route for approval (auto-approve/queue/MOP), execute end-to-end, and audit every step.",
+  "entry": "index.mjs",
+  "tools": ["submit_request", "approve_request", "list_requests", "request_status"],
+  "triggers": ["request_urgent", "request_approved"],
+  "panels": ["request-queue"],
+  "permissions": ["exec", "readLedger:incidents"]
+}

package/plugins/sop-assistant/index.d.mts

@@ -0,0 +1,9 @@
+// sop-assistant plugin type declarations
+export function register(ctx: any): void
+export function searchSops(query: string, sops?: any[]): Array<{ id: string; title: string; category: string; relevance: number; steps: number }>
+export function getSop(id: string, sops?: any[]): any
+export function searchIamPolicies(query: string, policies?: any[]): Array<{ id: string; title: string; category: string; relevance: number; rules: string[] }>
+export function buildStepCommand(step: any, vars?: Record<string, any>): string
+export const BUILTIN_SOPS: any[]
+export const IAM_POLICIES: any[]
+export default any