Commit graph

133 commits

Author SHA1 Message Date
29975b2df7 feat(ans): implement @logicsrc/ans M1 — resolver + offline verifier
M1 of the ANS SDK (docs/ans-sdk.md):

- name: parse/format ans://v<semver>.<agent>.<domain>
- cbor: minimal RFC 8949 codec for the COSE_Sign1 subset
- verify/merkle: RFC 6962 leaf/node hashing, tree build, inclusion-proof
  generation + verification
- verify/es256 + cose: COSE_Sign1 build/parse, Sig_structure, ES256 (WebCrypto)
- verify/rootkeys: kid -> verifier key (JWKS entries; sumdb-note is M2)
- verify: verifyReceipt() + verifyResolution() (signature + inclusion proof +
  name binding), pure and offline
- client: AnsClient resolve/rootKeys/register/status over injectable fetch,
  with a DnsApplier hook for verify-dns

Tests (24) cover name parsing, CBOR round-trips/vectors, RFC 6962 proofs, a full
ES256+Merkle receipt round-trip with positive/negative cases, and the client
against mocked fetch. Wired into the root build script.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 14:48:24 +00:00
0ae24719e3 docs(ans): spec the @logicsrc/ans TypeScript SDK
Design doc for the LogicSRC TS SDK for the Agent Name Service (ANS): resolver +
offline transparency-log verifier + registration client + coinpay-DID bridge.
Covers scope, package layout, full API surface, the ans-verify algorithm,
milestones (M1 verifier -> M2 register -> M3 DID bridge), and risks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 14:41:00 +00:00
RissRIce
2f07f74126
fix(agentstack): reject malformed CoinPay DIDs (#83) 2026-06-22 05:24:46 -07:00
RissRIce
895bb9989e
fix(agentstack): require agent DIDs for registration (#85) 2026-06-22 05:24:33 -07:00
phucnguyen1707
41ab662afa
Reject unknown task assignees (#80) 2026-06-16 03:19:08 -07:00
phucnguyen1707
e38688f16e
Enforce AgentStack status jumps (#81) 2026-06-16 03:18:54 -07:00
82e1389b8d
docs(agentstack): add PRD (#78)
Product requirements for @logicsrc/agentstack: summary, goals/non-goals,
users, current v0.1.0 state, functional/non-functional requirements,
roadmap (M1–M6), success metrics, and open questions. Grounded in the
existing in-memory coordinator and the agentstack OpenSpec capability.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-15 08:37:33 -07:00
phucnguyen1707
59013cf0af
Sanitize rendered web content (#77) 2026-06-15 01:34:44 -07:00
phucnguyen1707
cb192906bd
Handle malformed CommandBoard paths (#76) 2026-06-15 01:25:09 -07:00
phucnguyen1707
ae371b91d0
Handle non-finite policy risk scores (#75) 2026-06-15 01:23:47 -07:00
8a86d14ffd
Merge pull request #74 from profullstack/fix/agentmail-lockfile
Fix CI: add plugin-agentmail to package-lock.json
2026-06-14 10:00:41 -07:00
61ed94b000 Add @logicsrc/plugin-agentmail to package-lock.json
The agentmail workspace was added to package.json but the lockfile was not
regenerated, so CI's `npm ci` failed (EUSAGE: missing from lock file). Regenerate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14 17:00:21 +00:00
cb05a64438
Merge pull request #73 from profullstack/feat/agentmail-plugin
Add AgentMail plugin (paid-member mailbox client for humans + agents)
2026-06-14 09:56:49 -07:00
e304eac761 Add AgentMail plugin: paid-member mailbox client for humans + agents
@logicsrc/plugin-agentmail provides read/search/compose/send/flag/delete
over an injected MailTransport, gated to Founding Lifetime (paid) members.
Returns plain JSON-serializable domain objects so the same API serves a
human TUI, the CLI, MCP, and bots.

- domain.ts: transport-agnostic types + pure helpers (parse/format address,
  normalizeDraft, isValidEmail, snippet)
- ports.ts: MailTransport seam
- service.ts: AgentMailService (inbox/list/read/search/send/reply/flag/delete)
- access.ts: paid-member gate (assertPaid) + capability constants
- transports/memory.ts: complete in-memory backend (tests/dev/reference)
- transports/mailu.ts: self-hosted Mailu seam (mail.profullstack.com IMAP +
  smtp.profullstack.com submission) with injected IMAP/SMTP drivers
- index.ts: PluginDefinition (manifest, routes, capabilities, tuiPanels)
- registered in the root build; 20 vitest tests pass

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14 15:37:17 +00:00
bf046ae280 Add AgentGit M1: agent-native git layer over a Forgejo backend
AgentGit is a thin, DID-gated source-collaboration layer over a backend
forge (default Forgejo at git.profullstack.com, BBS-members-only) — not a
new git host. M1 implements the contract and engines:

- forge/adapter.ts: ForgeAdapter interface (only forge-specific surface)
- forge/forgejo.ts: ForgejoAdapter over Forgejo/Gitea REST v1 (injectable
  fetch, typed errors), incl. ensureUser for member provisioning
- access.ts: gateAccess DID membership gate (owner/role/visibility)
- merge-policy.ts: evaluateMergePolicy pure engine (reviews, reputation
  floor, checks, escrow, merge method, agent-merge toggle)
- service.ts: AgentGitService ties gate + policy to the adapter; refuses
  policy-failing merges; provisionMember hook for AgentBBS
- schemas: logicsrc-repo + logicsrc-pull-request, registered in
  @logicsrc/validators with fixtures
- docs/agentgit.md spec; plugin wired into root build (default/disabled)

27 vitest tests pass; full monorepo build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14 15:15:06 +00:00
phucnguyen1707
14fe9d608f
Require CoinPay userinfo identity (#21) 2026-06-13 23:01:15 -07:00
RissRIce
63ccad6d2a
fix: handle invalid static path encoding (#36)
Co-authored-by: RissRIce <rissrice2105-agent@users.noreply.github.com>
2026-06-13 23:00:59 -07:00
Autowebassat-blip
3ceddaa911
Parse JSON extension case-insensitively (#29)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:59:39 -07:00
Autowebassat-blip
d9cf41e5a3
Handle malformed static paths (#31)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:59:10 -07:00
Autowebassat-blip
774d461db6
Block IPv4-compatible IPv6 feed URLs (#32)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:58:57 -07:00
Autowebassat-blip
307095d5e9
Fallback invalid CommandBoard web ports (#37)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:58:10 -07:00
Autowebassat-blip
ad3926a006
Handle empty arcade game lists (#38)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:57:56 -07:00
Autowebassat-blip
3afda8c147
Fallback invalid CommandBoard API ports (#39)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:57:43 -07:00
Autowebassat-blip
e89c10cc80
Reject malformed CoinPay webhook signatures (#41)
* Reject malformed CoinPay webhook signatures

* Fix webhook signature type guard

---------

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:56:12 -07:00
Autowebassat-blip
055cc09d14
Fallback invalid CoinPay checkout amounts (#42)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:55:53 -07:00
Autowebassat-blip
ffefd364ce
Ignore malformed feed probe candidates (#43)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:55:39 -07:00
lazyGPT07
fbf4d76372
fix(cli): validate positive numeric options (#49) 2026-06-13 22:55:18 -07:00
RissRIce
aa3fdba277
Detect podcast RSS item enclosures (#50) 2026-06-13 22:55:06 -07:00
lazyGPT07
be530ab687
fix(feeds): enforce freshness window (#52) 2026-06-13 22:54:53 -07:00
6D0N9
90fffb124e
fix(agentstack): assignTask refuses tasks in a terminal status (#47) 2026-06-13 22:54:08 -07:00
lazyGPT07
a4cc229120
fix(cli): block config prototype pollution (#54) 2026-06-13 22:52:20 -07:00
FuturMix
f8040e9736
fix(auth): remove hardcoded fallback session secret (fixes #59) (#60) 2026-06-13 22:51:24 -07:00
FuturMix
9d2c485071
fix(commandboard): add body size limit and handle JSON parse errors (fixes #61) (#62) 2026-06-13 22:51:09 -07:00
FuturMix
5cfece3b84
fix(auth): use base64url encoding in session signature verification (fixes #64) (#67) 2026-06-13 22:44:53 -07:00
FuturMix
df040f4ff0
fix(proxy): validate host against allowlist to prevent open redirect (fixes #65) (#68) 2026-06-13 22:44:26 -07:00
FuturMix
13e921c7af
fix(supabase): enable RLS on communication account tables (fixes #69) (#70) 2026-06-13 22:44:13 -07:00
lazyGPT07
7d6a033b41
Enforce trusted-agent policy conditions (#72) 2026-06-13 22:44:00 -07:00
phucnguyen1707
8f4691584c
Handle bad feed path encoding (#9) 2026-06-11 21:07:24 -07:00
6D0N9
3d4345b665
fix(validators): isSchemaKind no longer accepts inherited prototype keys (#14)
'value in schemas' walks the prototype chain, so inherited keys like
"toString" passed assertSchemaKind and then crashed ajv.compile with a
misleading 'schema must be object or boolean' error (e.g. via the CLI).
Use Object.hasOwn for an own-property check.

Adds unit tests rejecting prototype keys and asserting every real
schema kind still passes.

Fixes #13
2026-06-11 21:06:18 -07:00
Autowebassat-blip
73e2464b30
Block IPv6 unspecified feed URLs (#15) 2026-06-11 21:06:03 -07:00
Autowebassat-blip
9942ef8dc6
Ignore invalid feed discovery limits (#16) 2026-06-11 21:04:55 -07:00
Autowebassat-blip
9ed98ceaf7
Accept spaced CoinPay signature parts (#17) 2026-06-11 21:04:41 -07:00
Autowebassat-blip
d558554da3
Reject extra session token segments (#18) 2026-06-11 21:04:25 -07:00
Autowebassat-blip
aa7eb32c36
Return 400 for invalid task JSON (#19) 2026-06-11 21:04:10 -07:00
Autowebassat-blip
301b4ed535
Return 400 for invalid publish JSON (#20) 2026-06-11 21:03:19 -07:00
7cda686059
Add AgentAd ad schemas as a LogicSRC primitive (#10)
* Add AgentAd ad schemas as a LogicSRC primitive

AgentAd is a disclosed, agent-readable advertising contract for CLI tools
and AI agents. LogicSRC owns the canonical schemas; cl1s.tech is the
reference network built on them.

- packages/schemas: agentad-{ad,placement,ad-request,ad-response,
  impression,click,campaign} schemas (id under schemas.logicsrc.com) +
  ad/placement fixtures, exported from @logicsrc/schemas
- packages/validators: register the 7 agentad kinds, wire fixture
  validation, add tests (disclosure.sponsored must be true)
- docs/agentad.md: the AgentAd spec
- README: list AgentAd under v1 priorities

Validators build clean; all fixtures validate; vitest 4/4 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Prepare @logicsrc/schemas for npm publish

Add license, repository, homepage, keywords, publishConfig (public),
and a package README covering both the logicsrc-* core schemas and the
agentad-* family.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-11 21:02:43 -07:00
phucnguyen1707
ad9f3a2a29
Handle invalid JSON request bodies (#7) 2026-06-11 21:00:38 -07:00
850cf5ea44
feat(agentstack): add @logicsrc/agentstack coordination module (#5)
* feat(agentstack): add @logicsrc/agentstack coordination module

AgentStack is the LogicSRC module for portable agent, task, payment, and
reputation coordination across Profullstack apps. Reference implementation of
the `agentstack` capability in the Profullstack Shared AppKit OpenSpec.

- packages/agentstack: DID helpers (did:coinpay:user/agent), DidTask model +
  lifecycle, AgentStack in-memory coordinator (agents, tasks, delegation,
  events), and a validated LogicSRC plugin definition. 9 vitest cases.
- Wire @logicsrc/agentstack into the root build chain (after plugin-core).
- docs/agentstack.md + mention in openspec-comparison.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(agentstack): note dual-runtime support (Bun + Node.js + Workers + browser)

Matches the revised Shared AppKit PRD's Runtime Compatibility Strategy.
AgentStack is runtime-neutral (no Bun/Node-only APIs; time is injected).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-10 16:39:32 -07:00
c23ce42948 Add communication account plugin scaffolds 2026-06-09 10:02:07 +00:00
5cfeea6b57 Add feed discovery plugin 2026-06-09 09:34:31 +00:00