soloforge 1.4.16 → 2.0.0

package/dist/engine/contracts/extension_contract.d.ts

@@ -0,0 +1,50 @@
+/**
+ * 问题三十九: Extension Contract — 扩展生命周期、权限授权与审计。
+ *
+ * 强制执行:
+ * - 第三方扩展不得自称 enforced
+ * - 扩展权限必须显式授权、最小权限、可撤销
+ * - 扩展不能绕过 Contract Registry / Guard / Language Policy
+ */
+import type { ExtensionManifest, ExtensionGrant, ExtensionAuditReport, ExtensionCapabilityDeclaration, ExtensionPermission, ExtensionLifecycleStatus } from "./extension_platform_contracts.js";
+export interface ExtensionValidationResult {
+    valid: boolean;
+    violations: string[];
+    warnings: string[];
+}
+export interface ExtensionLifecycleResult {
+    allowed: boolean;
+    from_status: ExtensionLifecycleStatus;
+    to_status: ExtensionLifecycleStatus;
+    reason: string;
+}
+/**
+ * 创建默认扩展清单。
+ */
+export declare function createExtensionManifest(overrides: Partial<ExtensionManifest> & Pick<ExtensionManifest, "extension_id">): ExtensionManifest;
+/**
+ * 验证扩展清单。
+ * - 第三方扩展不得使用 enforced 状态
+ * - 权限必须在白名单内
+ * - 必须声明 contract_ids 和 capability_ids
+ */
+export declare function validateExtensionManifest(manifest: ExtensionManifest, declaredCapabilities: ExtensionCapabilityDeclaration): ExtensionValidationResult;
+/**
+ * 评估扩展生命周期转移是否合法。
+ */
+export declare function evaluateExtensionLifecycle(_extensionId: string, fromStatus: ExtensionLifecycleStatus, toStatus: ExtensionLifecycleStatus): ExtensionLifecycleResult;
+/**
+ * 授权扩展权限。
+ * - 高风险权限需要 human approval
+ * - 权限必须是最小集
+ */
+export declare function grantExtensionPermissions(extensionId: string, requestedPermissions: ExtensionPermission[], grantedBy: string, purpose: string, humanApproved: boolean): ExtensionGrant;
+/**
+ * 撤销扩展权限授权。
+ */
+export declare function revokeExtensionGrant(grant: ExtensionGrant, _reason: string): ExtensionGrant;
+/**
+ * 生成扩展审计报告。
+ */
+export declare function auditExtension(manifest: ExtensionManifest, grant: ExtensionGrant, capabilityDecl: ExtensionCapabilityDeclaration): ExtensionAuditReport;
+//# sourceMappingURL=extension_contract.d.ts.map

package/dist/engine/contracts/extension_contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension_contract.d.ts","sourceRoot":"","sources":["../../../src/engine/contracts/extension_contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,wBAAwB,EACzB,MAAM,mCAAmC,CAAC;AAyB3C,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,wBAAwB,CAAC;IACtC,SAAS,EAAE,wBAAwB,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAAG,iBAAiB,CAe1I;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,oBAAoB,EAAE,8BAA8B,GACnD,yBAAyB,CA2B3B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,wBAAwB,EACpC,QAAQ,EAAE,wBAAwB,GACjC,wBAAwB,CAS1B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,oBAAoB,EAAE,mBAAmB,EAAE,EAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,OAAO,GACrB,cAAc,CAyBhB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAM3F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,cAAc,EACrB,cAAc,EAAE,8BAA8B,GAC7C,oBAAoB,CA8BtB"}

package/dist/engine/contracts/extension_contract.js

@@ -0,0 +1,158 @@
+/**
+ * 问题三十九: Extension Contract — 扩展生命周期、权限授权与审计。
+ *
+ * 强制执行:
+ * - 第三方扩展不得自称 enforced
+ * - 扩展权限必须显式授权、最小权限、可撤销
+ * - 扩展不能绕过 Contract Registry / Guard / Language Policy
+ */
+/** 扩展生命周期合法转移表 */
+const LIFECYCLE_TRANSITIONS = {
+    draft: ["installed", "deprecated"],
+    installed: ["active", "disabled", "deprecated"],
+    active: ["disabled", "deprecated"],
+    disabled: ["active", "deprecated", "blocked"],
+    deprecated: ["blocked"],
+    blocked: [],
+};
+/** 扩展可申请的权限白名单 */
+const ALLOWED_PERMISSIONS = new Set([
+    "read_project", "read_soloforge_state", "write_artifact",
+    "write_knowledge", "write_config", "execute_command",
+    "network_access", "external_write", "delivery_action", "contract_state_update",
+]);
+/** 高风险权限需要人类审批 */
+const HIGH_RISK_PERMISSIONS = new Set([
+    "execute_command", "network_access", "external_write",
+    "delivery_action", "contract_state_update",
+]);
+/**
+ * 创建默认扩展清单。
+ */
+export function createExtensionManifest(overrides) {
+    return {
+        name: overrides.extension_id,
+        version: "1.0.0",
+        provider: "unknown",
+        extension_type: "workflow",
+        contract_ids: [],
+        capability_ids: [],
+        permissions: [],
+        entrypoints: [],
+        outputs: [],
+        default_state: "disabled",
+        compatibility: { min_soloforge_version: "1.0.0" },
+        ...overrides,
+    };
+}
+/**
+ * 验证扩展清单。
+ * - 第三方扩展不得使用 enforced 状态
+ * - 权限必须在白名单内
+ * - 必须声明 contract_ids 和 capability_ids
+ */
+export function validateExtensionManifest(manifest, declaredCapabilities) {
+    const violations = [];
+    const warnings = [];
+    // 第三方扩展不得自称 enforced
+    if (declaredCapabilities.third_party && declaredCapabilities.claimed_enforcement === "enforced_by_host") {
+        violations.push("第三方扩展不得自称 enforced_by_host");
+    }
+    // 权限白名单检查
+    for (const perm of manifest.permissions) {
+        if (!ALLOWED_PERMISSIONS.has(perm)) {
+            violations.push(`权限不在白名单: ${perm}`);
+        }
+    }
+    // 必须声明 contract_ids
+    if (manifest.contract_ids.length === 0) {
+        warnings.push("未声明任何 contract_ids，扩展可能绕过 Contract Registry");
+    }
+    // 必须声明 capability_ids
+    if (manifest.capability_ids.length === 0) {
+        warnings.push("未声明任何 capability_ids");
+    }
+    return { valid: violations.length === 0, violations, warnings };
+}
+/**
+ * 评估扩展生命周期转移是否合法。
+ */
+export function evaluateExtensionLifecycle(_extensionId, fromStatus, toStatus) {
+    const allowedTargets = LIFECYCLE_TRANSITIONS[fromStatus];
+    if (!allowedTargets) {
+        return { allowed: false, from_status: fromStatus, to_status: toStatus, reason: `未知状态: ${fromStatus}` };
+    }
+    if (!allowedTargets.includes(toStatus)) {
+        return { allowed: false, from_status: fromStatus, to_status: toStatus, reason: `${fromStatus} → ${toStatus} 不允许` };
+    }
+    return { allowed: true, from_status: fromStatus, to_status: toStatus, reason: "合法转移" };
+}
+/**
+ * 授权扩展权限。
+ * - 高风险权限需要 human approval
+ * - 权限必须是最小集
+ */
+export function grantExtensionPermissions(extensionId, requestedPermissions, grantedBy, purpose, humanApproved) {
+    const granted = [];
+    const denied = [];
+    for (const perm of requestedPermissions) {
+        if (!ALLOWED_PERMISSIONS.has(perm)) {
+            denied.push(perm);
+            continue;
+        }
+        if (HIGH_RISK_PERMISSIONS.has(perm) && !humanApproved) {
+            denied.push(perm);
+            continue;
+        }
+        granted.push(perm);
+    }
+    return {
+        extension_id: extensionId,
+        granted_permissions: granted,
+        granted_by: grantedBy,
+        purpose,
+        granted_at: new Date().toISOString(),
+        revoked: false,
+        extension_grant_status: denied.length === 0 ? "granted" : "granted",
+    };
+}
+/**
+ * 撤销扩展权限授权。
+ */
+export function revokeExtensionGrant(grant, _reason) {
+    return {
+        ...grant,
+        revoked: true,
+        extension_grant_status: "revoked",
+    };
+}
+/**
+ * 生成扩展审计报告。
+ */
+export function auditExtension(manifest, grant, capabilityDecl) {
+    const violations = [];
+    const findings = [];
+    if (capabilityDecl.third_party && capabilityDecl.claimed_enforcement === "enforced_by_host") {
+        violations.push("第三方扩展非法自称 enforced");
+    }
+    if (grant.granted_permissions.some(p => !manifest.permissions.includes(p))) {
+        violations.push("授权权限超出清单声明范围");
+    }
+    if (grant.revoked) {
+        findings.push("权限已被撤销");
+    }
+    if (manifest.contract_ids.length === 0) {
+        findings.push("未绑定任何契约，可能绕过 Contract Registry");
+    }
+    return {
+        extension_id: manifest.extension_id,
+        audited_at: new Date().toISOString(),
+        lifecycle_status: "installed",
+        enforcement_status: capabilityDecl.claimed_enforcement,
+        permissions_used: grant.granted_permissions,
+        contract_registry_entries: manifest.contract_ids,
+        violations,
+        findings,
+    };
+}
+//# sourceMappingURL=extension_contract.js.map

package/dist/engine/contracts/extension_contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension_contract.js","sourceRoot":"","sources":["../../../src/engine/contracts/extension_contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,kBAAkB;AAClB,MAAM,qBAAqB,GAAiE;IAC1F,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IAClC,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC;IAC/C,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC;IAC7C,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,kBAAkB;AAClB,MAAM,mBAAmB,GAA6B,IAAI,GAAG,CAAC;IAC5D,cAAc,EAAE,sBAAsB,EAAE,gBAAgB;IACxD,iBAAiB,EAAE,cAAc,EAAE,iBAAiB;IACpD,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB;CAC/E,CAAC,CAAC;AAEH,kBAAkB;AAClB,MAAM,qBAAqB,GAA6B,IAAI,GAAG,CAAC;IAC9D,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB;IACrD,iBAAiB,EAAE,uBAAuB;CAC3C,CAAC,CAAC;AAeH;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA+E;IACrH,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,YAAY;QAC5B,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,SAAS;QACnB,cAAc,EAAE,UAAU;QAC1B,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,UAAU;QACzB,aAAa,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE;QACjD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,oBAAoD;IAEpD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,qBAAqB;IACrB,IAAI,oBAAoB,CAAC,WAAW,IAAI,oBAAoB,CAAC,mBAAmB,KAAK,kBAAkB,EAAE,CAAC;QACxG,UAAU,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,UAAU;IACV,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,sBAAsB;IACtB,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAoB,EACpB,UAAoC,EACpC,QAAkC;IAElC,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,MAAM,QAAQ,MAAM,EAAE,CAAC;IACrH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAmB,EACnB,oBAA2C,EAC3C,SAAiB,EACjB,OAAe,EACf,aAAsB;IAEtB,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAA0B,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,mBAAmB,EAAE,OAAO;QAC5B,UAAU,EAAE,SAAS;QACrB,OAAO;QACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACpE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAqB,EAAE,OAAe;IACzE,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,SAAS;KAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,KAAqB,EACrB,cAA8C;IAE9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,cAAc,CAAC,WAAW,IAAI,cAAc,CAAC,mBAAmB,KAAK,kBAAkB,EAAE,CAAC;QAC5F,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO;QACL,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,gBAAgB,EAAE,WAAW;QAC7B,kBAAkB,EAAE,cAAc,CAAC,mBAAmB;QACtD,gBAAgB,EAAE,KAAK,CAAC,mBAAmB;QAC3C,yBAAyB,EAAE,QAAQ,CAAC,YAAY;QAChD,UAAU;QACV,QAAQ;KACT,CAAC;AACJ,CAAC"}