{"version":3,"file":"plugin-tool-names.d.ts","sourceRoot":"","sources":["../../../src/core/tools/plugin-tool-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AACxD,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AACpD,eAAO,MAAM,gCAAgC,yBAAyB,CAAC;AACvE,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AACxD,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAS5D,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AACxD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,kCAAkC,2BAA2B,CAAC;AAM3E,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD,iGAA+F;AAC/F,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAUrD,CAAC","sourcesContent":["/**\n * Canonical names of the plugin-system (capability-acquisition) tools, in one\n * dependency-free module so the tool definitions, the authoring engine, and the\n * privilege-amplification guardrail can all reference them without an import\n * cycle.\n *\n * {@link PLUGIN_SYSTEM_TOOL_NAMES} is the guardrail set: these tools live on the\n * top-level agent only and may never appear in an authored subagent's allowlist\n * (otherwise a low-trust authored agent could bootstrap privilege via an\n * author → spawn → install loop).\n */\n\n// Lifecycle tools (spec §1).\nexport const SEARCH_PLUGINS_TOOL_NAME = \"SearchPlugins\";\nexport const LIST_PLUGINS_TOOL_NAME = \"ListPlugins\";\nexport const SUGGEST_PLUGIN_INSTALL_TOOL_NAME = \"SuggestPluginInstall\";\nexport const INSTALL_PLUGIN_TOOL_NAME = \"InstallPlugin\";\nexport const UNINSTALL_PLUGIN_TOOL_NAME = \"UninstallPlugin\";\n\n// Authoring tools (spec §3). A single risk-gated authoring tool (ProposePlugin)\n// computes risk from *content* — passive skills/commands/read-only subagents run\n// autonomously; executable content (hooks, MCP servers, mutating subagents)\n// auto-triggers a human-confirmation gate in the same tool. UpdatePlugin merges\n// inline-authored content into an existing local plugin (no remote fetch, so the\n// supply-chain vector that keeps marketplace UpdatePlugin out of the model's\n// hands is structurally absent — see propose-plugin.ts).\nexport const PROPOSE_PLUGIN_TOOL_NAME = \"ProposePlugin\";\nexport const UPDATE_PLUGIN_TOOL_NAME = \"UpdatePlugin\";\nexport const REMOVE_PLUGIN_CAPABILITY_TOOL_NAME = \"RemovePluginCapability\";\n\n// Publish lane (spec §3.2). Packaging is autonomous — it gates the plugin,\n// writes a README and produces the marketplace index entry — but it stops at the\n// trust boundary: nothing here contacts a remote or publishes anything. The\n// publish itself is `/plugin publish`, a human command.\nexport const PACKAGE_PLUGIN_TOOL_NAME = \"PackagePlugin\";\n\n/** Every capability-acquisition tool — the guardrail set stripped from authored allowlists. */\nexport const PLUGIN_SYSTEM_TOOL_NAMES: readonly string[] = [\n\tSEARCH_PLUGINS_TOOL_NAME,\n\tLIST_PLUGINS_TOOL_NAME,\n\tSUGGEST_PLUGIN_INSTALL_TOOL_NAME,\n\tINSTALL_PLUGIN_TOOL_NAME,\n\tUNINSTALL_PLUGIN_TOOL_NAME,\n\tPROPOSE_PLUGIN_TOOL_NAME,\n\tUPDATE_PLUGIN_TOOL_NAME,\n\tREMOVE_PLUGIN_CAPABILITY_TOOL_NAME,\n\tPACKAGE_PLUGIN_TOOL_NAME,\n];\n"]}