Documentation
¶
Index ¶
- Constants
- func CacheReusable(observation Observation, resolved *Resolved, target TargetRef, ...) (bool, bool, string)
- func CurrentPlatform() string
- func FixturePath(resolved *Resolved, fixture string) (string, error)
- func Path(id string) (string, error)
- func Remove(id string) (string, error)
- func Root() (string, error)
- func SupportsPlatform(platforms []string, target string) bool
- func Test(id, fixture string) (*Resolved, Result, string, error)
- func ValidateID(id string) error
- type ActionResult
- type CachePolicy
- type CacheState
- type CapabilityRef
- type CreateOptions
- type CreateResult
- type Evidence
- type InstallOptions
- type InstallResult
- type Lock
- type LockEntry
- type Manifest
- type Observation
- type OutputContract
- type RedactionPolicy
- type Resolved
- type Result
- type ResultError
- type Runner
- type Summary
- type TargetRef
Constants ¶
View Source
const ( // MaxInstallBytes bounds the total payload copied from an install source. MaxInstallBytes = 8 << 20 // MaxInstallFiles bounds the number of entries copied from an install source. MaxInstallFiles = 128 )
View Source
const ( ManifestFile = "manifest.json" SchemaVersion = "sshx.dev/plugin/v1" ObservationV1 = "sshx.observation/v1" LockFile = "plugin-lock.json" MaxManifest = 1 << 20 MaxSchema = 2 << 20 MaxCollector = 2 << 20 MaxFixture = 10 << 20 DefaultTimeout = 30 * time.Second )
View Source
const MaxObservation = 10 << 20
Variables ¶
This section is empty.
Functions ¶
func CacheReusable ¶
func CurrentPlatform ¶
func CurrentPlatform() string
func SupportsPlatform ¶
func ValidateID ¶
Types ¶
type ActionResult ¶
type ActionResult struct {
Success bool `json:"success"`
Action string `json:"action"`
PluginID string `json:"plugin_id,omitempty"`
Path string `json:"path,omitempty"`
Builtin bool `json:"builtin,omitempty"`
PluginRoot string `json:"plugin_root,omitempty"`
Source string `json:"source,omitempty"`
BackupPath string `json:"backup_path,omitempty"`
Digest string `json:"digest,omitempty"`
Trusted bool `json:"trusted,omitempty"`
Valid bool `json:"valid,omitempty"`
Files []string `json:"files,omitempty"`
Plugins []Summary `json:"plugins,omitempty"`
Plugin *Summary `json:"plugin,omitempty"`
Manifest *Manifest `json:"manifest,omitempty"`
TestResult *Result `json:"test_result,omitempty"`
Fixture string `json:"fixture,omitempty"`
NextActions []string `json:"next_actions,omitempty"`
ErrorKind string `json:"error_kind,omitempty"`
Error string `json:"error,omitempty"`
}
type CachePolicy ¶
type CacheState ¶
type CapabilityRef ¶
type CreateOptions ¶
type CreateResult ¶
func Create ¶
func Create(options CreateOptions) (*CreateResult, error)
type InstallOptions ¶ added in v0.18.0
type InstallOptions struct {
Source string // local directory that holds the plugin
Replace bool // preserve an existing plugin as a backup (--replace)
Trust bool // trust the installed digest in the same step (--trust)
}
InstallOptions configures `sshx plugin install`.
type InstallResult ¶ added in v0.18.0
InstallResult reports the published plugin.
func Install ¶ added in v0.18.0
func Install(options InstallOptions) (*InstallResult, error)
Install publishes a local plugin directory into the runtime plugin root ($SSHX_HOME/plugins/<id>). The source is staged with sshx's own restrictive modes, validated through the same loader the executor uses, and only then published, so an invalid source can never replace an installed plugin. --trust records the published digest in the local trust lock in the same step.
This is the audited alternative to hand-placing files under the plugin root: it is one CLI invocation, it refuses symlinks and non-regular files, and it is bounded by MaxInstallBytes/MaxInstallFiles.
type Manifest ¶
type Manifest struct {
APIVersion string `json:"api_version"`
ID string `json:"id"`
Version string `json:"version"`
Kind string `json:"kind"`
Description string `json:"description,omitempty"`
Platforms []string `json:"platforms"`
Runner Runner `json:"runner"`
RequiredCommands []string `json:"required_commands,omitempty"`
Privilege string `json:"privilege"`
Timeout string `json:"timeout"`
Effects []string `json:"effects"`
Output OutputContract `json:"output"`
Cache CachePolicy `json:"cache"`
Redaction RedactionPolicy `json:"redaction"`
}
type Observation ¶
type Observation struct {
Schema string `json:"schema"`
Capability CapabilityRef `json:"capability"`
Target TargetRef `json:"target"`
CollectedAt time.Time `json:"collected_at"`
ExpiresAt time.Time `json:"expires_at"`
Status string `json:"status"`
Privilege string `json:"privilege"`
Parameters string `json:"parameters_digest"`
Cache CacheState `json:"cache"`
Facts map[string]any `json:"facts"`
Evidence []Evidence `json:"evidence"`
Errors []ResultError `json:"errors"`
Redaction []string `json:"redacted_fields,omitempty"`
}
func DecodeObservation ¶
func DecodeObservation(data []byte) (Observation, error)
type OutputContract ¶
type OutputContract struct {
Schema string `json:"schema"`
}
type RedactionPolicy ¶
type RedactionPolicy struct {
DenyFields []string `json:"deny_fields,omitempty"`
}
type Resolved ¶
type Result ¶
type Result struct {
Status string `json:"status"`
Facts map[string]any `json:"facts"`
Evidence []Evidence `json:"evidence"`
Errors []ResultError `json:"errors"`
}
func RedactResult ¶
func RedactResult(result Result, policy RedactionPolicy) (Result, []string)
type ResultError ¶
type Summary ¶
type Summary struct {
ID string `json:"id"`
Version string `json:"version,omitempty"`
Description string `json:"description,omitempty"`
Path string `json:"path"`
Digest string `json:"digest,omitempty"`
Trusted bool `json:"trusted"`
Builtin bool `json:"builtin"`
Valid bool `json:"valid"`
ErrorKind string `json:"error_kind,omitempty"`
Error string `json:"error,omitempty"`
}
func BuiltinSummaries ¶
func BuiltinSummaries() []Summary
func SummaryFromResolved ¶
Click to show internal directories.
Click to hide internal directories.