runline 0.3.1 → 0.3.2

package/dist/plugin/loader.d.ts

@@ -1,11 +1,33 @@
 import type { PluginDef } from "./types.js";
 export declare function loadPluginFromPath(path: string): Promise<PluginDef>;
 export declare function loadPluginsFromConfig(configDir: string): Promise<PluginDef[]>;
+export interface DiscoverOptions {
+    /**
+     * When supplied, only built-in plugins whose name is in this set
+     * are loaded. Plugins discovered in the project dir, `plugins.json`,
+     * or `~/.runline/plugins` are always loaded — users put them there
+     * deliberately — but the 188 bundled builtins are gated so agents
+     * don't see every possible action regardless of configuration.
+     *
+     * Omit to load every builtin (CLI default: `runline actions` etc.
+     * surfaces the full catalog).
+     */
+    builtinAllowlist?: Set<string> | null;
+    /**
+     * Override the directory where bundled plugins live. Default is
+     * `<loader>/../plugins`, which resolves to `dist/plugins/` at
+     * runtime. Tests set this so they can exercise allowlist logic
+     * without depending on the real bundled catalog.
+     */
+    builtinDir?: string;
+}
+/** Default path to the bundled plugin directory. */
+export declare function defaultBuiltinDir(): string;
 /**
  * Discover and return all plugins from a config directory and global dir.
  * Does NOT mutate any global state.
  */
-export declare function discoverPlugins(configDir?: string | null): Promise<PluginDef[]>;
+export declare function discoverPlugins(configDir?: string | null, options?: DiscoverOptions): Promise<PluginDef[]>;
 /**
  * Load all plugins and register them into the global registry.
  * Used by the CLI.

package/dist/plugin/loader.js

@@ -118,11 +118,15 @@ export async function loadPluginsFromConfig(configDir) {
     }
     return plugins;
 }
+/** Default path to the bundled plugin directory. */
+export function defaultBuiltinDir() {
+    return join(__dirname, "..", "plugins");
+}
 /**
  * Discover and return all plugins from a config directory and global dir.
  * Does NOT mutate any global state.
  */
-export async function discoverPlugins(configDir) {
+export async function discoverPlugins(configDir, options = {}) {
     const loaded = new Set();
     const result = [];
     function addIfNew(plugin) {
@@ -144,11 +148,14 @@ export async function discoverPlugins(configDir) {
     const globalPlugins = await loadFromDirectory(globalDir);
     for (const p of globalPlugins)
         addIfNew(p);
-    // Built-in plugins shipped with the package
-    const builtinDir = join(__dirname, "..", "plugins");
+    const builtinDir = options.builtinDir ?? defaultBuiltinDir();
     const builtinPlugins = await loadFromDirectory(builtinDir);
-    for (const p of builtinPlugins)
+    for (const p of builtinPlugins) {
+        if (options.builtinAllowlist && !options.builtinAllowlist.has(p.name)) {
+            continue;
+        }
         addIfNew(p);
+    }
     return result;
 }
 /**

package/dist/sdk.d.ts

@@ -34,8 +34,26 @@ export declare class Runline {
     connections(): ConnectionConfig[];
     /**
      * Load runline from a project directory.
-     * Discovers .runline/ config and installed plugins, just like the CLI.
+     *
+     * Discovers the `.runline/` config and registers:
+     *   - every plugin dropped into `.runline/plugins/`,
+     *   - every plugin listed in `.runline/plugins.json`,
+     *   - every plugin in `~/.runline/plugins/`,
+     *   - and — from the 188 builtins shipped with the package — only
+     *     the ones named in `config.connections[].plugin`.
+     *
+     * Gating the builtins keeps `runline.actions()` scoped to what the
+     * project actually configured. Without this, a project with a
+     * single connection would still expose every bundled action to an
+     * agent, which is both noisy and a privacy problem (the agent sees
+     * surface area it has no credentials for).
+     *
+     * `options.builtinDir` is a test-only hook; production callers
+     * should rely on the default path to the bundled plugins.
+     *
      * Fully self-contained — does not mutate global state.
      */
-    static fromProject(cwd?: string): Promise<Runline | null>;
+    static fromProject(cwd?: string, options?: {
+        builtinDir?: string;
+    }): Promise<Runline | null>;
 }

package/dist/sdk.js

@@ -63,16 +63,36 @@ export class Runline {
     }
     /**
      * Load runline from a project directory.
-     * Discovers .runline/ config and installed plugins, just like the CLI.
+     *
+     * Discovers the `.runline/` config and registers:
+     *   - every plugin dropped into `.runline/plugins/`,
+     *   - every plugin listed in `.runline/plugins.json`,
+     *   - every plugin in `~/.runline/plugins/`,
+     *   - and — from the 188 builtins shipped with the package — only
+     *     the ones named in `config.connections[].plugin`.
+     *
+     * Gating the builtins keeps `runline.actions()` scoped to what the
+     * project actually configured. Without this, a project with a
+     * single connection would still expose every bundled action to an
+     * agent, which is both noisy and a privacy problem (the agent sees
+     * surface area it has no credentials for).
+     *
+     * `options.builtinDir` is a test-only hook; production callers
+     * should rely on the default path to the bundled plugins.
+     *
      * Fully self-contained — does not mutate global state.
      */
-    static async fromProject(cwd) {
+    static async fromProject(cwd, options = {}) {
         const dir = cwd ?? process.cwd();
         const configDir = findRunlineDir(dir);
         if (!configDir)
             return null;
         const config = loadConfigFrom(configDir);
-        const plugins = await discoverPlugins(configDir);
+        const builtinAllowlist = new Set(config.connections.map((c) => c.plugin));
+        const plugins = await discoverPlugins(configDir, {
+            builtinAllowlist,
+            builtinDir: options.builtinDir,
+        });
         const rl = new Runline({
             connections: config.connections,
             timeoutMs: config.timeoutMs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Code mode for agents — turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",