remote-access-mcp 3.1.2 → 4.0.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 4.0.0 - Final Hardening
+
+### Security & Reliability
+- Hardened plugin registry mutations with a cross-process lock and atomic lockfile replacement.
+- Plugin installation now cleans up partial destinations on failure and revalidates the copied manifest before fingerprinting.
+- Final release verification covers build, type checking, the complete regression suite, dependency audit, diff hygiene, production boot, Codebase Memory isolation, plugin sandbox behavior, tamper detection, and concurrent plugin installation.
+- No automatic publishing or registry distribution is performed by the release process.
+
+## 3.9.0 - Plugin Isolation & Ecosystem
+
+### Added
+- Out-of-process MCP plugin hosting with short-lived child processes.
+- Plugin manifest validation, SHA-256 installation fingerprints and fail-closed integrity verification.
+- Namespaced plugin tools (`plugin_<name>__<tool>`) with token-scope and read-only gates.
+- Node filesystem permission isolation, dedicated plugin `data/` write area, optional child-process permission, Linux network namespace isolation and deny-by-default network controls.
+- Bounded plugin startup/execution time and explicit `RAMCP_PLUGIN_UNSANDBOXED=1` escape hatch for operators who intentionally accept local-trust execution.
+
+### Changed
+- The old `trusted: true` in-process plugin model is no longer a security boundary and is not accepted by the installer.
+- There is no automatic remote plugin registry/download path; plugin installation remains local and explicit.
+
 ## 3.1.2 - Critical Packaging Fix
 
 ### Fixed

package/README.md

@@ -37,7 +37,7 @@ Remote Access MCP includes a bounded local worker pool for long-running or paral
 - Structured system/service diagnostics and persistent health watchers with webhook alerts.
 - MySQL/PostgreSQL/Redis query and schema tools using credentials held in environment variables.
 - MCP Resources and Prompts for operational context.
-- Trusted local plugin manifests and lifecycle management; plugins must explicitly declare `trusted: true` and execute in-process, so only install code you trust.
+- Isolated local plugin lifecycle: manifests are validated and fingerprinted, plugin tools are namespaced, and installed plugins run out-of-process behind Node's filesystem permission model plus a Linux network sandbox. Plugin access requires the `plugins` scope; untrusted or unverifiable plugins are skipped fail-closed.
 
 ## Install
 
@@ -151,7 +151,7 @@ Get it ready-made: `ramcp url`
 
 Endpoint `https://your-domain.com/mcp` + header `Authorization: Bearer <token>`
 
-## Tools (45+ built-in operational tools, plus jobs, transfers, diagnostics, database, monitoring, change sets, resources, prompts and plugins)
+## Tools (101 built-in operational tools, plus optional integration tools)
 
 The built-in tool count is stable. Optional MCP integrations can add additional namespaced tools when their upstream packages are available.
 
@@ -185,6 +185,65 @@ The built-in tool count is stable. Optional MCP integrations can add additional
 
 **Operations** (2) `environment_inspect` `nginx_inspect`
 
+**Browser** (3) `browser_open` `browser_extract` `browser_screenshot` — optional Playwright runtime; public-URL SSRF guard; screenshots must stay inside the token path sandbox
+
+**Infrastructure** (9) `infra_probe` `docker_ps` `docker_inspect` `docker_logs` `docker_action` `kubernetes_get` `kubernetes_describe` `kubernetes_logs` `cloudflare_status` — fixed executables and validated arguments; missing CLIs degrade cleanly
+
+**Database** (2) `database_query` `database_schema` — MySQL/PostgreSQL/Redis support already provided by the existing adapter
+
+## Automation & Events
+
+Automation rules are persistent, token-isolated workflows triggered by intervals or tool/webhook/file/health events. They support typed conditions, bounded action lists, manual triggering, enable/disable/delete lifecycle, execution counters, and webhook outcome notifications. Every action is executed through the normal token policy/read-only/audit wrapper; automation cannot invoke control-plane, approval, or plugin lifecycle tools. File triggers are constrained by the owner's path policy, payloads are bounded, and recursive automation chains are capped.
+
+For external events, an authenticated webhook can POST to `/<token>/automation/webhook` with a JSON body such as `{"type":"deploy.finished","data":{"service":"api"}}`. The token selects the owner's rules; the token is never copied into the event payload. Scheduler/file/health execution is persistent and protected by a cross-process execution claim so multiple gateway processes do not intentionally execute the same rule concurrently.
+
+## Security & Autonomous Operations
+
+Phase 7 adds `security_analysis` and `autonomy_check` plus bounded self-healing
+through `recovery_rule_create`, `recovery_rule_list`, `recovery_incidents`, and
+`recovery_trigger`. Recovery state is persistent and token-isolated, with
+maximum attempts and cooldowns. Autonomous operations are **disabled by
+default** and require `RAMCP_AUTONOMOUS=1`; high-risk and critical recovery
+also require their respective explicit environment flags. Recovery actions use
+the same policy, scope, read-only, audit, and context-wrapped tool execution as
+normal requests, and cannot invoke approvals, plugins, automation lifecycle,
+or recovery lifecycle tools.
+
+## Plugin Isolation & Ecosystem
+
+Plugins are local, explicit installations. A plugin directory must contain a
+`manifest.json` with a semver-like `version` and a relative `entry` exporting
+`register(server, ctx)`. The gateway validates the tree, rejects symlinks and
+oversized packages, stores a SHA-256 fingerprint, and verifies that fingerprint
+before every child-process start. Plugin tools are exposed as
+`plugin_<name>__<tool>` and require the `plugins` token scope; declared plugin
+scopes must also be available to the token.
+
+Example manifest:
+
+```json
+{
+  "name": "my-plugin",
+  "version": "1.0.0",
+  "entry": "index.js",
+  "permissions": ["fs.write"],
+  "scopes": ["filesystem"]
+}
+```
+
+Runtime permissions are deliberately small: `fs.read` permits reads inside
+the plugin directory, `fs.write` permits writes only under the plugin's
+`data/` directory, and `process` permits child processes. Network access is
+disabled by default. On Linux the child also gets a separate network namespace
+and deny-by-default network filter. If the required sandbox is unavailable,
+the plugin is skipped unless `RAMCP_PLUGIN_UNSANDBOXED=1` is explicitly set by
+the operator. Plugin calls are short-lived and have a bounded execution time;
+there are no persistent plugin worker processes.
+
+The plugin host receives no token secret and no gateway mutation API. This is
+an intentional break from the old in-process `trusted: true` model: declaring
+trust inside a manifest is not considered a security boundary.
+
 ## Webhooks
 
 Get notified when tools run (or fail) — incident bots, Slack relays, anything that accepts a POST:
@@ -249,6 +308,49 @@ MIT — see [LICENSE](LICENSE).
 
 📚 [README فارسی](README.fa.md) | [Roadmap](ROADMAP.md) | [Security Policy](SECURITY.md) | [Changelog](CHANGELOG.md) | [Contributing](CONTRIBUTING.md)
 
+## Capability Router & Context Efficiency
+
+Phase 2 adds a capability catalog and discovery layer for agent clients:
+`capability_discover` returns only capabilities authorized for the current
+token and includes context-cost and latency hints. `capability_batch` runs up
+to eight independent read-only calls in parallel and rejects mutating actions.
+
+For tokens with explicit scopes, `RAMCP_TOOL_EXPOSURE=scoped` can also reduce
+`tools/list` itself to the authorized tool set. The default remains `all` for
+backward compatibility. In the built-in benchmark, a scoped token exposed
+14 tools instead of 77 and reduced the serialized `tools/list` response by
+80.3% (30,802 → 6,054 bytes).
+
+## Task / Workflow / Agent Engine
+
+Phase 3 adds durable orchestration through the `task` tool. A task contains a
+validated action graph and can run independent actions in parallel while
+respecting dependencies, retries, per-action timeouts, verification hooks,
+dry-run mode, and compensation rollback. `supervised` tasks pause before
+mutating actions and resume through `task_approve`; interrupted/failed tasks
+can be resumed with `task_resume` because task state is persisted under RAMCP's
+own data directory and isolated by token.
+
+Specialized profiles are available through `agent_profiles` and optional action
+assignment: `explorer`, `planner`, `implementer`, `tester`, `reviewer`,
+`security`, and `deployer`. Profiles constrain capability scopes and autonomy;
+they are deterministic execution roles, not hidden model instances. The
+existing `task_status` tool remains backward compatible with plan tracking and
+also reports workflow tasks.
+
+## Developer Intelligence
+
+Phase 4 adds a compact developer-intelligence layer without replacing the existing policy core:
+
+- `project_profile` / `project_profile_list` / `project_profile_set` keep per-token workspace knowledge under RAMCP's own data directory.
+- `impact_analysis` builds a lightweight reverse dependency graph for changed source files.
+- `git_intelligence` summarizes repository state, history, diff statistics, branches, and remotes without permitting arbitrary Git verbs.
+- `github_repo`, `github_issues`, and `github_pull_request` provide read-only GitHub intelligence when `GITHUB_TOKEN` or `GH_TOKEN` is configured.
+- `sentry_projects`, `sentry_issues`, and `sentry_issue` provide read-only Sentry intelligence when `SENTRY_AUTH_TOKEN` is configured.
+- `developer_context_status` reports the Codebase Memory isolation contract, Context7 proxy, and Context Mode's local/client-side role.
+
+GitHub and Sentry credentials are read only from environment variables and are never returned by these tools. Dynamic Context7 and Codebase Memory tools can be exposed to scoped tokens only through the explicit `integrations` scope.
+
 ## Optional MCP integrations
 
 Remote Access MCP can expose selected developer-context MCPs as namespaced tools:

package/dist/core/agent-contracts.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Stable contracts for the Agent Engine planned for 3.2+.
+ *
+ * This module intentionally contains types and small pure helpers only. It
+ * does not execute tools, inspect the host, or alter existing request
+ * semantics. Future Context/Router/Task layers build on these contracts.
+ */
+export type RiskLevel = 'none' | 'low' | 'medium' | 'high' | 'critical';
+export type ExecutionMode = 'read' | 'mutate' | 'background' | 'interactive';
+export type AutonomyLevel = 'readonly' | 'safe' | 'supervised' | 'autonomous';
+export type TaskState = 'queued' | 'planning' | 'awaiting_approval' | 'executing' | 'verifying' | 'completed' | 'failed' | 'rolled_back' | 'cancelled';
+export interface AgentResult<T = unknown> {
+    ok: boolean;
+    summary: string;
+    data?: T;
+    warnings: string[];
+    errors: string[];
+    nextActions: string[];
+    /** Approximate result size in UTF-8 bytes, when measured by the producer. */
+    sizeBytes?: number;
+    /** Optional identifier for a persisted/streamed result. */
+    resultId?: string;
+}
+export interface CapabilityDescriptor {
+    id: string;
+    category: string;
+    description: string;
+    risk: RiskLevel;
+    executionMode: ExecutionMode;
+    requiredScopes: string[];
+    contextCost: number;
+    latencyHintMs?: number;
+    dependencies: string[];
+    supportsDryRun: boolean;
+    supportsVerification: boolean;
+}
+export interface ContextBudget {
+    total: number;
+    history: number;
+    tools: number;
+    memory: number;
+    reserved: number;
+}
+export interface TaskContext {
+    taskId: string;
+    goal: string;
+    autonomy: AutonomyLevel;
+    budget: ContextBudget;
+    facts: string[];
+    decisions: string[];
+    constraints: string[];
+    completedActions: string[];
+}
+export declare function createEmptyAgentResult<T>(summary: string, ok?: boolean): AgentResult<T>;
+export declare function validateContextBudget(budget: ContextBudget): void;
+export declare function canTransitionTask(from: TaskState, to: TaskState): boolean;
+//# sourceMappingURL=agent-contracts.d.ts.map

package/dist/core/agent-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-contracts.d.ts","sourceRoot":"","sources":["../../src/core/agent-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AACxE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC;AAE9E,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,UAAU,GACV,mBAAmB,GACnB,WAAW,GACX,WAAW,GACX,WAAW,GACX,QAAQ,GACR,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,OAAO;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAEpF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CASjE;AAcD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAEzE"}

package/dist/core/agent-contracts.js

@@ -0,0 +1,35 @@
+/**
+ * Stable contracts for the Agent Engine planned for 3.2+.
+ *
+ * This module intentionally contains types and small pure helpers only. It
+ * does not execute tools, inspect the host, or alter existing request
+ * semantics. Future Context/Router/Task layers build on these contracts.
+ */
+export function createEmptyAgentResult(summary, ok = true) {
+    return { ok, summary, warnings: [], errors: [], nextActions: [] };
+}
+export function validateContextBudget(budget) {
+    const values = [budget.total, budget.history, budget.tools, budget.memory, budget.reserved];
+    if (values.some(v => !Number.isFinite(v) || v < 0)) {
+        throw new Error('context budget values must be finite non-negative numbers');
+    }
+    const allocated = budget.history + budget.tools + budget.memory + budget.reserved;
+    if (allocated > budget.total) {
+        throw new Error('context budget allocations exceed total budget');
+    }
+}
+const TASK_TRANSITIONS = {
+    queued: ['planning', 'cancelled'],
+    planning: ['awaiting_approval', 'executing', 'failed', 'cancelled'],
+    awaiting_approval: ['executing', 'cancelled', 'failed'],
+    executing: ['verifying', 'completed', 'failed', 'rolled_back', 'cancelled'],
+    verifying: ['completed', 'failed', 'rolled_back', 'executing'],
+    completed: [],
+    failed: ['planning', 'executing', 'rolled_back', 'cancelled'],
+    rolled_back: ['planning', 'cancelled'],
+    cancelled: [],
+};
+export function canTransitionTask(from, to) {
+    return TASK_TRANSITIONS[from].includes(to);
+}
+//# sourceMappingURL=agent-contracts.js.map

package/dist/core/agent-contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-contracts.js","sourceRoot":"","sources":["../../src/core/agent-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA+DH,MAAM,UAAU,sBAAsB,CAAI,OAAe,EAAE,EAAE,GAAG,IAAI;IAClE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClF,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAA4C;IAChE,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,EAAE,CAAC,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC;IACnE,iBAAiB,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC;IACvD,SAAS,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC;IAC3E,SAAS,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC;IAC9D,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC;IAC7D,WAAW,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;IACtC,SAAS,EAAE,EAAE;CACd,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAe,EAAE,EAAa;IAC9D,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC"}

package/dist/core/agent-profiles.d.ts

@@ -0,0 +1,11 @@
+export type AgentProfileId = 'explorer' | 'planner' | 'implementer' | 'tester' | 'reviewer' | 'security' | 'deployer';
+export interface AgentProfile {
+    id: AgentProfileId;
+    description: string;
+    allowedScopes: string[];
+    defaultAutonomy: 'readonly' | 'safe' | 'supervised' | 'autonomous';
+}
+export declare const AGENT_PROFILES: Record<AgentProfileId, AgentProfile>;
+export declare function getAgentProfile(id: string): AgentProfile | undefined;
+export declare function listAgentProfiles(): AgentProfile[];
+//# sourceMappingURL=agent-profiles.d.ts.map

package/dist/core/agent-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.d.ts","sourceRoot":"","sources":["../../src/core/agent-profiles.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEtH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,cAAc,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC;CACpE;AAED,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,YAAY,CAQ/D,CAAC;AAEF,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAiD;AACtH,wBAAgB,iBAAiB,IAAI,YAAY,EAAE,CAA0C"}

package/dist/core/agent-profiles.js

@@ -0,0 +1,12 @@
+export const AGENT_PROFILES = {
+    explorer: { id: 'explorer', description: 'Read-only environment and project inspection.', allowedScopes: ['system', 'logs', 'project', 'diagnostics', 'monitoring', 'filesystem', 'database', 'resources', 'context', 'router', 'intelligence', 'integrations', 'browser', 'infrastructure'], defaultAutonomy: 'readonly' },
+    planner: { id: 'planner', description: 'Read-only discovery and workflow planning.', allowedScopes: ['system', 'logs', 'project', 'diagnostics', 'filesystem', 'database', 'resources', 'context', 'router', 'intelligence', 'planning', 'integrations'], defaultAutonomy: 'readonly' },
+    implementer: { id: 'implementer', description: 'Controlled implementation using filesystem, git, jobs and planning tools.', allowedScopes: ['filesystem', 'git', 'jobs', 'planning', 'diagnostics', 'project', 'intelligence', 'browser', 'infrastructure'], defaultAutonomy: 'safe' },
+    tester: { id: 'tester', description: 'Run diagnostics and tests with bounded shell/job access.', allowedScopes: ['shell', 'jobs', 'filesystem', 'project', 'diagnostics', 'system', 'intelligence', 'browser', 'infrastructure'], defaultAutonomy: 'safe' },
+    reviewer: { id: 'reviewer', description: 'Read-only quality and regression review.', allowedScopes: ['filesystem', 'git', 'project', 'diagnostics', 'security', 'logs', 'system', 'database', 'resources', 'context', 'router', 'intelligence', 'integrations', 'browser', 'infrastructure'], defaultAutonomy: 'readonly' },
+    security: { id: 'security', description: 'Read-only security and policy analysis.', allowedScopes: ['security', 'filesystem', 'project', 'logs', 'system', 'diagnostics', 'resources', 'context', 'router', 'intelligence', 'integrations', 'browser', 'infrastructure'], defaultAutonomy: 'readonly' },
+    deployer: { id: 'deployer', description: 'Supervised deployment and service/package operations.', allowedScopes: ['filesystem', 'shell', 'git', 'jobs', 'transfer', 'planning', 'services', 'packages', 'diagnostics', 'monitoring', 'project', 'browser', 'infrastructure'], defaultAutonomy: 'supervised' },
+};
+export function getAgentProfile(id) { return AGENT_PROFILES[id]; }
+export function listAgentProfiles() { return Object.values(AGENT_PROFILES); }
+//# sourceMappingURL=agent-profiles.js.map

package/dist/core/agent-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.js","sourceRoot":"","sources":["../../src/core/agent-profiles.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,cAAc,GAAyC;IAClE,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,+CAA+C,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,EAAC,aAAa,EAAC,YAAY,EAAC,YAAY,EAAC,UAAU,EAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,cAAc,EAAC,SAAS,EAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;IAC9S,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,4CAA4C,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,EAAC,aAAa,EAAC,YAAY,EAAC,UAAU,EAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,UAAU,EAAC,cAAc,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;IAC5Q,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,2EAA2E,EAAE,aAAa,EAAE,CAAC,YAAY,EAAC,KAAK,EAAC,MAAM,EAAC,UAAU,EAAC,aAAa,EAAC,SAAS,EAAC,cAAc,EAAC,SAAS,EAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE;IAC9Q,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,0DAA0D,EAAE,aAAa,EAAE,CAAC,OAAO,EAAC,MAAM,EAAC,YAAY,EAAC,SAAS,EAAC,aAAa,EAAC,QAAQ,EAAC,cAAc,EAAC,SAAS,EAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE;IACnP,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,0CAA0C,EAAE,aAAa,EAAE,CAAC,YAAY,EAAC,KAAK,EAAC,SAAS,EAAC,aAAa,EAAC,UAAU,EAAC,MAAM,EAAC,QAAQ,EAAC,UAAU,EAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,cAAc,EAAC,SAAS,EAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;IAC7S,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yCAAyC,EAAE,aAAa,EAAE,CAAC,UAAU,EAAC,YAAY,EAAC,SAAS,EAAC,MAAM,EAAC,QAAQ,EAAC,aAAa,EAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,cAAc,EAAC,SAAS,EAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;IAC3R,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,uDAAuD,EAAE,aAAa,EAAE,CAAC,YAAY,EAAC,OAAO,EAAC,KAAK,EAAC,MAAM,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,aAAa,EAAC,YAAY,EAAC,SAAS,EAAC,SAAS,EAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE;CAClS,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,EAAU,IAA8B,OAAO,cAAc,CAAC,EAAoB,CAAC,CAAC,CAAC,CAAC;AACtH,MAAM,UAAU,iBAAiB,KAAqB,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC"}

package/dist/core/automation-engine.d.ts

@@ -0,0 +1,53 @@
+import type { RamcpConfig } from './config.js';
+export type TriggerType = 'interval' | 'file' | 'health' | 'webhook' | 'tool';
+export type ConditionOp = 'equals' | 'not_equals' | 'contains' | 'gt' | 'gte' | 'lt' | 'lte';
+export interface AutomationCondition {
+    field: string;
+    op: ConditionOp;
+    value: string | number | boolean;
+}
+export interface AutomationAction {
+    tool: string;
+    args: Record<string, unknown>;
+}
+export interface AutomationRule {
+    id: string;
+    name: string;
+    tokenFingerprint: string;
+    enabled: boolean;
+    trigger: {
+        type: TriggerType;
+        intervalSeconds?: number;
+        path?: string;
+        event?: string;
+        tool?: string;
+    };
+    conditions: AutomationCondition[];
+    actions: AutomationAction[];
+    created: string;
+    lastRun?: string;
+    nextRun?: string;
+    runs: number;
+    failures: number;
+}
+export interface AutomationEvent {
+    type: string;
+    tool?: string;
+    data?: Record<string, unknown>;
+    tokenFingerprint?: string;
+    ts: number;
+    /** Prevent an automation action from recursively creating an infinite chain. */
+    origin?: 'external' | 'automation';
+    depth?: number;
+}
+export declare function tokenRules(tokenFingerprint: string): AutomationRule[];
+export declare function automationPath(): string;
+export declare function automationLockPath(): string;
+export declare function clearAutomationRulesForTests(): void;
+export declare function createRule(rule: Omit<AutomationRule, 'id' | 'created' | 'runs' | 'failures'>): AutomationRule;
+export declare function deleteRule(tokenFingerprint: string, id: string): boolean;
+export declare function setRuleEnabled(tokenFingerprint: string, id: string, enabled: boolean): boolean;
+export declare function matchesConditions(rule: AutomationRule, event: AutomationEvent): boolean;
+export declare function dispatchAutomationEvent(event: AutomationEvent, execute: (rule: AutomationRule, action: AutomationAction) => Promise<void>, cfg?: RamcpConfig): Promise<void>;
+export declare function startAutomationEngine(execute: (rule: AutomationRule, action: AutomationAction) => Promise<void>, cfg?: RamcpConfig): NodeJS.Timeout;
+//# sourceMappingURL=automation-engine.d.ts.map

package/dist/core/automation-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation-engine.d.ts","sourceRoot":"","sources":["../../src/core/automation-engine.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAC9E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;AAE7F,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,WAAW,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvG,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,gFAAgF;IAChF,MAAM,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyED,wBAAgB,UAAU,CAAC,gBAAgB,EAAE,MAAM,GAAG,cAAc,EAAE,CAErE;AAED,wBAAgB,cAAc,IAAI,MAAM,CAAqB;AAC7D,wBAAgB,kBAAkB,IAAI,MAAM,CAAqB;AACjE,wBAAgB,4BAA4B,IAAI,IAAI,CAMnD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC,GAAG,cAAc,CAO7G;AAED,wBAAgB,UAAU,CAAC,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAQxE;AAED,wBAAgB,cAAc,CAAC,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAU9F;AAcD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAKvF;AA+CD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBlL;AA8BD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,OAAO,CA4BnJ"}