qlogicagent 2.13.4 → 2.13.5

package/dist/runtime/community/community-desensitization.test.js

@@ -0,0 +1,43 @@
+import { describe, expect, it } from "vitest";
+import { buildCommunityDesensitizationRedTeamCases, detectCommunityPublishSensitiveContent, runCommunityDesensitizationRedTeam, } from "./community-desensitization.js";
+describe("community desensitization", () => {
+    it("detects every hard-block sensitive category used before community publishing", () => {
+        expect(detectCommunityPublishSensitiveContent("contact alice@example.com")).toMatchObject({
+            reason: "sensitive email",
+            ruleId: "sensitive-email",
+        });
+        expect(detectCommunityPublishSensitiveContent("export OPENAI_API_KEY=sk-abcdefghijklmnop")).toMatchObject({
+            reason: "sensitive secret",
+            ruleId: "sensitive-secret",
+        });
+        expect(detectCommunityPublishSensitiveContent("read C:\\Users\\alice\\.ssh\\id_rsa")).toMatchObject({
+            reason: "sensitive path",
+            ruleId: "sensitive-path",
+        });
+        expect(detectCommunityPublishSensitiveContent("call +1 555 200 3000 now")).toMatchObject({
+            reason: "sensitive phone",
+            ruleId: "sensitive-phone",
+        });
+        expect(detectCommunityPublishSensitiveContent("Reusable generic workflow with no user data.")).toBeNull();
+    });
+    it("runs a 500+ case red-team report without leaking raw sample content", () => {
+        const cases = buildCommunityDesensitizationRedTeamCases();
+        const report = runCommunityDesensitizationRedTeam(cases);
+        expect(cases.length).toBeGreaterThanOrEqual(500);
+        expect(report).toMatchObject({
+            suite: "desensitization",
+            cases: cases.length,
+            passed: true,
+            failures: 0,
+        });
+        expect(report.breakdown["sensitive-email"]).toMatchObject({ cases: 125, failures: 0 });
+        expect(report.breakdown["sensitive-secret"]).toMatchObject({ cases: 125, failures: 0 });
+        expect(report.breakdown["sensitive-path"]).toMatchObject({ cases: 125, failures: 0 });
+        expect(report.breakdown["sensitive-phone"]).toMatchObject({ cases: 125, failures: 0 });
+        const serialized = JSON.stringify(report);
+        expect(serialized).not.toContain("@example.com");
+        expect(serialized).not.toContain("sk-");
+        expect(serialized).not.toContain("id_rsa");
+        expect(serialized).not.toContain("+1 555");
+    });
+});

package/dist/runtime/community/community-discovery-cache.d.ts

@@ -0,0 +1,24 @@
+import type { CommunityRegistryMatchResult } from "./community-consent-client.js";
+export interface CommunityDiscoveryCacheEntry {
+    intentKey: string;
+    resourceId: string;
+    type: string;
+    title: string;
+    summary: string;
+    sourceTier: string;
+    trustStage: string;
+    effectiveRiskTier: string;
+    latestVersion: string | null;
+    cachedAt: string;
+}
+export interface CommunityDiscoveryCacheOptions {
+    ownerUserId?: string;
+    filePath?: string;
+}
+export declare class CommunityDiscoveryCache {
+    private readonly filePath;
+    constructor(options?: CommunityDiscoveryCacheOptions);
+    readAll(): CommunityDiscoveryCacheEntry[];
+    find(intentKey: string): CommunityDiscoveryCacheEntry | undefined;
+    writeMatch(intentKey: string, match: CommunityRegistryMatchResult, now?: Date): CommunityDiscoveryCacheEntry;
+}

package/dist/runtime/community/community-discovery-cache.js

@@ -0,0 +1,52 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getOwnerProfileDir } from "../infra/agent-paths.js";
+export class CommunityDiscoveryCache {
+    filePath;
+    constructor(options = {}) {
+        this.filePath = options.filePath ?? path.join(getOwnerProfileDir(options.ownerUserId), "community", "discovery-cache.json");
+    }
+    readAll() {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.filePath, "utf8"));
+            if (!Array.isArray(parsed))
+                return [];
+            return parsed.filter(isCacheEntry);
+        }
+        catch {
+            return [];
+        }
+    }
+    find(intentKey) {
+        return this.readAll().find((entry) => entry.intentKey === intentKey);
+    }
+    writeMatch(intentKey, match, now = new Date()) {
+        const entry = {
+            intentKey,
+            resourceId: match.id,
+            type: match.type,
+            title: match.title,
+            summary: match.summary,
+            sourceTier: match.sourceTier,
+            trustStage: match.trustStage,
+            effectiveRiskTier: match.effectiveRiskTier,
+            latestVersion: match.latestVersion,
+            cachedAt: now.toISOString(),
+        };
+        const next = [
+            entry,
+            ...this.readAll().filter((item) => item.intentKey !== intentKey),
+        ].slice(0, 200);
+        fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+        fs.writeFileSync(this.filePath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+        return entry;
+    }
+}
+function isCacheEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return typeof record.intentKey === "string"
+        && typeof record.resourceId === "string"
+        && typeof record.title === "string";
+}

package/dist/runtime/community/community-discovery-coordinator.d.ts

@@ -0,0 +1,33 @@
+import type { CommunityConsentClient, CommunityRegistryMatchResult } from "./community-consent-client.js";
+import { CommunityDiscoveryCache, type CommunityDiscoveryCacheEntry } from "./community-discovery-cache.js";
+export interface LocalCommunityResourceIndex {
+    findInstalled(intentKey: string): CommunityRegistryMatchResult | undefined;
+}
+export type CommunityDiscoveryStatus = "matched" | "local" | "cached" | "miss" | "disabled" | "unavailable";
+export interface CommunityDiscoveryResult {
+    status: CommunityDiscoveryStatus;
+    intentKey: string;
+    match?: CommunityRegistryMatchResult;
+    cacheEntry?: CommunityDiscoveryCacheEntry;
+    error?: string;
+}
+export interface CommunityDiscoveryCoordinatorOptions {
+    client: Pick<CommunityConsentClient, "getConsent" | "matchRegistry"> | null;
+    cache?: CommunityDiscoveryCache;
+    localIndex?: LocalCommunityResourceIndex;
+    topK?: number;
+    now?: () => Date;
+}
+export declare class CommunityDiscoveryCoordinator {
+    private readonly client;
+    private readonly cache;
+    private readonly localIndex?;
+    private readonly topK;
+    private readonly now;
+    private readonly inMemory;
+    constructor(options: CommunityDiscoveryCoordinatorOptions);
+    matchForTurn(intent: string): Promise<CommunityDiscoveryResult>;
+    prefetchIdle(intents: string[]): Promise<CommunityDiscoveryResult[]>;
+    private memo;
+}
+export declare function normalizeDiscoveryIntent(intent: string): string;

package/dist/runtime/community/community-discovery-coordinator.js

@@ -0,0 +1,84 @@
+import { CommunityDiscoveryCache } from "./community-discovery-cache.js";
+export class CommunityDiscoveryCoordinator {
+    client;
+    cache;
+    localIndex;
+    topK;
+    now;
+    inMemory = new Map();
+    constructor(options) {
+        this.client = options.client;
+        this.cache = options.cache ?? new CommunityDiscoveryCache();
+        this.localIndex = options.localIndex;
+        this.topK = options.topK ?? 1;
+        this.now = options.now ?? (() => new Date());
+    }
+    async matchForTurn(intent) {
+        const intentKey = normalizeDiscoveryIntent(intent);
+        if (!intentKey)
+            return { status: "miss", intentKey };
+        const local = this.localIndex?.findInstalled(intentKey);
+        if (local)
+            return { status: "local", intentKey, match: local };
+        const cached = this.inMemory.get(intentKey);
+        if (cached)
+            return cached;
+        if (!this.client) {
+            return this.memo(intentKey, { status: "disabled", intentKey });
+        }
+        let consent;
+        try {
+            consent = await this.client.getConsent();
+        }
+        catch (error) {
+            return this.memo(intentKey, unavailable(intentKey, error));
+        }
+        if (!consent.enabled || !consent.methodSharingEnabled) {
+            return this.memo(intentKey, { status: "disabled", intentKey });
+        }
+        const diskCached = this.cache.find(intentKey);
+        if (diskCached) {
+            return this.memo(intentKey, { status: "cached", intentKey, cacheEntry: diskCached });
+        }
+        try {
+            const [match] = await this.client.matchRegistry({
+                intent: intentKey,
+                topK: this.topK,
+                preferOfficial: true,
+            });
+            if (!match)
+                return this.memo(intentKey, { status: "miss", intentKey });
+            const cacheEntry = this.cache.writeMatch(intentKey, match, this.now());
+            return this.memo(intentKey, { status: "matched", intentKey, match, cacheEntry });
+        }
+        catch (error) {
+            return this.memo(intentKey, unavailable(intentKey, error));
+        }
+    }
+    async prefetchIdle(intents) {
+        const results = [];
+        const seen = new Set();
+        for (const intent of intents) {
+            const intentKey = normalizeDiscoveryIntent(intent);
+            if (!intentKey || seen.has(intentKey))
+                continue;
+            seen.add(intentKey);
+            results.push(await this.matchForTurn(intentKey));
+        }
+        return results;
+    }
+    memo(intentKey, result) {
+        this.inMemory.set(intentKey, result);
+        return result;
+    }
+}
+export function normalizeDiscoveryIntent(intent) {
+    return intent.trim().toLowerCase().replace(/\s+/g, " ");
+}
+function unavailable(intentKey, error) {
+    return {
+        status: "unavailable",
+        intentKey,
+        error: error instanceof Error ? error.message : String(error),
+    };
+}

package/dist/runtime/community/community-discovery-coordinator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/community/community-discovery-coordinator.test.js

@@ -0,0 +1,97 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { describe, expect, it } from "vitest";
+import { CommunityDiscoveryCache } from "./community-discovery-cache.js";
+import { CommunityDiscoveryCoordinator } from "./community-discovery-coordinator.js";
+describe("community discovery coordinator", () => {
+    it("performs at most one O(1) registry match per normalized intent", async () => {
+        const client = fakeCommunityClient({ matches: [match("skill-email")] });
+        const coordinator = createTestCoordinator({ client });
+        await coordinator.matchForTurn("  Triage Email  ");
+        await coordinator.matchForTurn("triage   email");
+        expect(client.matchCalls).toEqual(["triage email"]);
+    });
+    it("returns unavailable without queuing fake installs when hub is offline", async () => {
+        const client = fakeCommunityClient({ rejectMatch: new Error("offline") });
+        const coordinator = createTestCoordinator({ client });
+        await expect(coordinator.matchForTurn("summarize docket")).resolves.toMatchObject({
+            status: "unavailable",
+            error: "offline",
+        });
+        expect(client.matchCalls).toEqual(["summarize docket"]);
+        expect("resolveInstall" in client).toBe(false);
+    });
+    it("writes idle prefetch matches to owner-profile compact cache without injecting bodies", async () => {
+        const home = tempDir();
+        const client = fakeCommunityClient({ matches: [match("skill-calendar")] });
+        const coordinator = createTestCoordinator({ client, home });
+        await coordinator.prefetchIdle(["calendar cleanup"]);
+        const cachePath = path.join(home, "discovery-cache.json");
+        const cached = JSON.parse(fs.readFileSync(cachePath, "utf8"));
+        expect(cached).toEqual([
+            expect.objectContaining({ resourceId: "skill-calendar", intentKey: "calendar cleanup" }),
+        ]);
+        expect(cached[0]).not.toHaveProperty("manifest");
+        expect(cached[0]).not.toHaveProperty("body");
+    });
+    it("skips network when local installed resource already matches", async () => {
+        const client = fakeCommunityClient({ matches: [match("skill-email")] });
+        const coordinator = createTestCoordinator({
+            client,
+            localMatch: match("local-email"),
+        });
+        await expect(coordinator.matchForTurn("triage email")).resolves.toMatchObject({
+            status: "local",
+            match: expect.objectContaining({ id: "local-email" }),
+        });
+        expect(client.matchCalls).toEqual([]);
+    });
+});
+function createTestCoordinator(options) {
+    return new CommunityDiscoveryCoordinator({
+        client: options.client,
+        cache: new CommunityDiscoveryCache({ filePath: path.join(options.home ?? tempDir(), "discovery-cache.json") }),
+        localIndex: options.localMatch ? { findInstalled: () => options.localMatch } : undefined,
+        now: () => new Date("2026-06-02T00:00:00.000Z"),
+    });
+}
+function fakeCommunityClient(options) {
+    return {
+        matchCalls: [],
+        async getConsent() {
+            return {
+                enabled: true,
+                methodSharingEnabled: true,
+                signalsEnabled: true,
+                encounterEnabled: true,
+                remoteSynced: true,
+                ...options.consent,
+            };
+        },
+        async matchRegistry(input) {
+            this.matchCalls.push(input.intent);
+            if (options.rejectMatch)
+                throw options.rejectMatch;
+            return options.matches ?? [];
+        },
+    };
+}
+function match(id) {
+    return {
+        id,
+        type: "skill",
+        title: id,
+        summary: "Useful community skill",
+        capabilityTags: ["email"],
+        sourceTier: "community",
+        trustStage: "trusted",
+        resourceRiskTier: "R0",
+        effectiveRiskTier: "R0",
+        latestVersion: "1.0.0",
+        canonical: true,
+    };
+}
+function tempDir() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), "qlogic-community-discovery-"));
+}

package/dist/runtime/community/community-pet-publisher.d.ts

@@ -0,0 +1,30 @@
+import type { CommunityConsentClient, CommunityPublishSkillResult } from "./community-consent-client.js";
+export interface CommunityPetPublishInput {
+    id: string;
+    name: string;
+    summary: string;
+    persona: string;
+    traits?: string[];
+    assets?: Array<{
+        kind: string;
+        path: string;
+    }>;
+    visibility?: "public" | "private";
+    tags?: string[];
+}
+export declare function packageCommunityPetAsset(input: CommunityPetPublishInput): {
+    manifest: {
+        schema_version: number;
+        kind: string;
+        name: string;
+        summary: string;
+        persona: string;
+        traits: string[];
+        assets: {
+            kind: string;
+            path: string;
+        }[];
+        tags: string[];
+    };
+};
+export declare function publishCommunityPetAsset(client: Pick<CommunityConsentClient, "getConsent" | "publishPet">, input: CommunityPetPublishInput): Promise<CommunityPublishSkillResult>;

package/dist/runtime/community/community-pet-publisher.js

@@ -0,0 +1,53 @@
+const PRIVATE_TEXT_RE = /(?:[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}|[A-Za-z]:\\|\/Users\/|\/home\/|secret|token|password|\+?\d[\d\s().-]{7,}\d)/i;
+const EXECUTION_ACTOR_RE = /\b(?:agent|tool|shell|execute|permission|memory|system prompt|developer message)\b/i;
+export function packageCommunityPetAsset(input) {
+    assertSafePetPublish(input);
+    return {
+        manifest: {
+            schema_version: 15,
+            kind: "asset",
+            name: input.name,
+            summary: input.summary,
+            persona: input.persona,
+            traits: input.traits ?? [],
+            assets: input.assets ?? [],
+            tags: input.tags ?? [],
+        },
+    };
+}
+export async function publishCommunityPetAsset(client, input) {
+    const consent = await client.getConsent();
+    if (!consent.enabled || !consent.methodSharingEnabled) {
+        throw new Error("Community method-sharing consent is required before publishing pet assets.");
+    }
+    const pkg = packageCommunityPetAsset(input);
+    return client.publishPet({
+        id: input.id,
+        title: input.name,
+        summary: input.summary,
+        visibility: input.visibility ?? "public",
+        tags: input.tags ?? [],
+        manifest: pkg.manifest,
+    });
+}
+function assertSafePetPublish(input) {
+    const text = [
+        input.id,
+        input.name,
+        input.summary,
+        input.persona,
+        ...(input.traits ?? []),
+        ...(input.tags ?? []),
+    ].join("\n");
+    if (PRIVATE_TEXT_RE.test(text)) {
+        throw new Error("Pet asset publish blocked: private email, path, secret, token, or phone-like text detected.");
+    }
+    if (EXECUTION_ACTOR_RE.test(text)) {
+        throw new Error("Pet asset publish blocked: pets are display-only and cannot claim agent execution powers.");
+    }
+    for (const asset of input.assets ?? []) {
+        if (asset.path.includes("..") || asset.path.startsWith("/") || /^[A-Za-z]:\\/.test(asset.path)) {
+            throw new Error("Pet asset publish blocked: unsafe asset path.");
+        }
+    }
+}

package/dist/runtime/community/community-pet-publisher.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/community/community-pet-publisher.test.js

@@ -0,0 +1,53 @@
+import { describe, expect, it, vi } from "vitest";
+import { packageCommunityPetAsset, publishCommunityPetAsset } from "./community-pet-publisher.js";
+describe("community pet publisher", () => {
+    it("packages a pet asset manifest with schema_version 15 kind asset", () => {
+        expect(packageCommunityPetAsset(validPetProfile())).toMatchObject({
+            manifest: {
+                schema_version: 15,
+                kind: "asset",
+                name: "Neko",
+                persona: "Quiet display companion.",
+            },
+        });
+    });
+    it("blocks publish when persona contains private email/path/secret/phone", () => {
+        expect(() => packageCommunityPetAsset({
+            ...validPetProfile(),
+            persona: "Reach me at alice@example.com",
+        })).toThrow(/private/i);
+    });
+    it("blocks publish when persona claims to be an execution actor", () => {
+        expect(() => packageCommunityPetAsset({
+            ...validPetProfile(),
+            persona: "I am an agent and can execute shell tools.",
+        })).toThrow(/display-only/i);
+    });
+    it("requires method-sharing consent before network publish", async () => {
+        const publishPet = vi.fn();
+        await expect(publishCommunityPetAsset({
+            async getConsent() {
+                return {
+                    enabled: true,
+                    methodSharingEnabled: false,
+                    signalsEnabled: true,
+                    encounterEnabled: true,
+                    remoteSynced: true,
+                };
+            },
+            publishPet,
+        }, validPetProfile())).rejects.toThrow(/consent/i);
+        expect(publishPet).not.toHaveBeenCalled();
+    });
+});
+function validPetProfile() {
+    return {
+        id: "neko-pet",
+        name: "Neko",
+        summary: "A calm companion",
+        persona: "Quiet display companion.",
+        traits: ["gentle"],
+        assets: [{ kind: "sprite", path: "neko.png" }],
+        tags: ["pet"],
+    };
+}

package/dist/runtime/community/community-signal-reporter.d.ts

@@ -0,0 +1,33 @@
+import type { CommunityConsentClient, CommunityRecordSignalInput, CommunitySignalEvent } from "./community-consent-client.js";
+export interface CommunitySkillLifecycleRecord {
+    name: string;
+    createdAt: string;
+    lastUsedAt?: string;
+    source?: string;
+    registryResourceId?: string;
+    registryVersion?: string;
+    registrySourceTier?: string;
+    registryRiskTier?: string;
+    registryEffectiveRiskTier?: string;
+    registryKeptSignalAt?: string;
+}
+export interface CommunitySkillLifecycleStore {
+    version?: number;
+    records: Record<string, CommunitySkillLifecycleRecord>;
+}
+export interface CommunitySignalReporter {
+    record(input: CommunityRecordSignalInput): Promise<"recorded" | "disabled" | "skipped" | "failed">;
+    recordSkillUsage(record: CommunitySkillLifecycleRecord | undefined, outcome: CommunitySkillUsageOutcome): Promise<"recorded" | "disabled" | "skipped" | "failed">;
+    recordSkillLifecycle(record: CommunitySkillLifecycleRecord | undefined, event: Extract<CommunitySignalEvent, "kept" | "uninstalled" | "endorse">): Promise<"recorded" | "disabled" | "skipped" | "failed">;
+    recordKeptSignals(store: CommunitySkillLifecycleStore, options?: RecordKeptSignalsOptions): Promise<Array<{
+        skillName: string;
+        status: "recorded" | "disabled" | "skipped" | "failed";
+    }>>;
+}
+export type CommunitySkillUsageOutcome = "success" | "fail" | "error" | "neutral";
+export interface RecordKeptSignalsOptions {
+    now?: Date;
+    retentionMs?: number;
+}
+export declare function createCommunitySignalReporter(client: Pick<CommunityConsentClient, "getConsent" | "recordSignal"> | null): CommunitySignalReporter;
+export declare function createDefaultCommunitySignalReporter(): CommunitySignalReporter | null;

package/dist/runtime/community/community-signal-reporter.js

@@ -0,0 +1,85 @@
+import { createDefaultCommunityConsentClient } from "./community-consent-client.js";
+const DEFAULT_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+export function createCommunitySignalReporter(client) {
+    return {
+        async record(input) {
+            if (!client)
+                return "disabled";
+            try {
+                const consent = await client.getConsent();
+                if (!consent.enabled || !consent.signalsEnabled)
+                    return "disabled";
+                await client.recordSignal(input);
+                return "recorded";
+            }
+            catch {
+                return "failed";
+            }
+        },
+        async recordSkillUsage(record, outcome) {
+            const resourceId = communityResourceId(record);
+            if (!resourceId)
+                return "skipped";
+            return this.record({
+                resourceId,
+                event: outcome,
+                attribution: "skill-subturn",
+                metadata: {
+                    skillName: record?.name,
+                    version: record?.registryVersion,
+                    effectiveRiskTier: record?.registryEffectiveRiskTier,
+                },
+            });
+        },
+        async recordSkillLifecycle(record, event) {
+            const resourceId = communityResourceId(record);
+            if (!resourceId)
+                return "skipped";
+            return this.record({
+                resourceId,
+                event,
+                attribution: "skill-lifecycle",
+                metadata: {
+                    skillName: record?.name,
+                    version: record?.registryVersion,
+                },
+            });
+        },
+        async recordKeptSignals(store, options = {}) {
+            const now = options.now ?? new Date();
+            const retentionMs = options.retentionMs ?? DEFAULT_RETENTION_MS;
+            const results = [];
+            for (const record of Object.values(store.records)) {
+                if (!shouldRecordKeptSignal(record, now, retentionMs))
+                    continue;
+                const status = await this.recordSkillLifecycle(record, "kept");
+                if (status === "recorded") {
+                    record.registryKeptSignalAt = now.toISOString();
+                }
+                results.push({ skillName: record.name, status });
+            }
+            return results;
+        },
+    };
+}
+export function createDefaultCommunitySignalReporter() {
+    const client = createDefaultCommunityConsentClient();
+    return client ? createCommunitySignalReporter(client) : null;
+}
+function communityResourceId(record) {
+    if (record?.source !== "installed")
+        return null;
+    if (record.registrySourceTier === "official")
+        return null;
+    return record.registryResourceId ?? record.name;
+}
+function shouldRecordKeptSignal(record, now, retentionMs) {
+    if (!communityResourceId(record))
+        return false;
+    if (record.registryKeptSignalAt)
+        return false;
+    const retainedSince = Date.parse(record.lastUsedAt ?? record.createdAt);
+    if (!Number.isFinite(retainedSince))
+        return false;
+    return now.getTime() - retainedSince >= retentionMs;
+}

package/dist/runtime/community/community-signal-reporter.test.d.ts

@@ -0,0 +1 @@
+export {};