chore(go): audit providers copilot droid augment cline

Move the four providers onto managed_runtime.go and shell_command.go; keep the Auggie wrappers, Cline metadata wrappers, and the Copilot and Droid precondition handling provider-local. Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq
2026-09-03 01:56:07 -04:00
1 parent a7fc75bf6b
commit 1ede03d989
@@ -2,11 +2,8 @@ package plugins

 import (
 	"bytes"
-	"fmt"
 	"path/filepath"
-	"runtime"
 	"sort"
-	"strings"
 )

 func managedAugmentIDs(
@@ -17,19 +14,10 @@ func managedAugmentIDs(
 	result := map[string]string{}
 	for _, group := range groups {
 		for _, handler := range group.handlers {
-			agentID, managed := managedAugmentAgentID(
-				handler,
-				wrapperName,
-				runtimeRoot,
-			)
-			if !managed {
-				continue
+			agentID, managed := managedAugmentAgentID(handler, wrapperName, runtimeRoot)
+			if managed {
+				result[managedReferenceKey(agentID)] = agentID
 			}
-			key := agentID
-			if runtime.GOOS == "windows" {
-				key = strings.ToLower(key)
-			}
-			result[key] = agentID
 		}
 	}
 	return result
@@ -39,16 +27,8 @@ func augmentRuntimeContracts(
 	hooks augmentHooks,
 	runtimeRoot string,
 ) []augmentRuntimeContract {
-	guards := managedAugmentIDs(
-		hooks["PreToolUse"],
-		augmentGuardWrapperName(),
-		runtimeRoot,
-	)
-	audits := managedAugmentIDs(
-		hooks["PostToolUse"],
-		augmentAuditWrapperName(),
-		runtimeRoot,
-	)
+	guards := managedAugmentIDs(hooks["PreToolUse"], augmentGuardWrapperName(), runtimeRoot)
+	audits := managedAugmentIDs(hooks["PostToolUse"], augmentAuditWrapperName(), runtimeRoot)
 	keys := make([]string, 0, len(guards))
 	for key := range guards {
 		if _, exists := audits[key]; exists {
@@ -72,282 +52,47 @@ func augmentRuntimeContracts(
 	return contracts
 }

-func readAugmentRuntimeConfig(path string) (map[string]any, bool, error) {
-	snapshot, err := readManagedFile(
-		path,
-		"Elydora runtime config",
-		maxRuntimeConfigBytes,
-	)
-	if err != nil || snapshot == nil {
-		return nil, snapshot != nil, err
+func augmentWrappersMatch(contract augmentRuntimeContract, nodePath string) (bool, error) {
+	wrappers := resolveAugmentWrapperPaths(filepath.Dir(contract.guardPath))
+	if !sameManagedPath(contract.guardWrapper, wrappers.guard) ||
+		!sameManagedPath(contract.auditWrapper, wrappers.audit) {
+		return false, nil
 	}
-	label := fmt.Sprintf("Elydora runtime config at %s", path)
-	config, err := decodeStrictJSONObject(snapshot.contents, label)
-	return config, true, err
-}
-
-func requireAugmentRuntimeString(
-	config map[string]any,
-	field string,
-	configPath string,
-) (string, error) {
-	value, ok := config[field].(string)
-	if !ok || strings.TrimSpace(value) == "" {
-		return "", fmt.Errorf(
-			"Elydora runtime config %s is invalid: %s",
-			field,
-			configPath,
-		)
-	}
-	return value, nil
-}
-
-func validateAugmentRuntimeConfig(
-	config map[string]any,
-	expectedAgentID string,
-	configPath string,
-) error {
-	supported := stringSet(
-		"org_id",
-		"agent_id",
-		"kid",
-		"base_url",
-		"token",
-		"agent_name",
-	)
-	fields := make([]string, 0, len(config))
-	for field := range config {
-		fields = append(fields, field)
-	}
-	sort.Strings(fields)
-	for _, field := range fields {
-		if _, ok := supported[field]; !ok {
-			return fmt.Errorf(
-				`Elydora runtime config has unsupported field %q: %s`,
-				field,
-				configPath,
-			)
-		}
-	}
-	if _, err := requireAugmentRuntimeString(config, "org_id", configPath); err != nil {
-		return err
-	}
-	if _, err := requireAugmentRuntimeString(config, "kid", configPath); err != nil {
-		return err
-	}
-	agentID, err := requireAugmentRuntimeString(config, "agent_id", configPath)
-	if err != nil {
-		return err
-	}
-	if !sameAugmentAgentID(agentID, expectedAgentID) ||
-		config["agent_name"] != augmentAgentKey {
-		return fmt.Errorf(
-			"Elydora runtime identity does not match Auggie hooks: %s",
-			configPath,
-		)
-	}
-	if _, exists := config["token"]; exists {
-		if _, err := requireAugmentRuntimeString(config, "token", configPath); err != nil {
-			return err
-		}
-	}
-	baseURL, err := requireAugmentRuntimeString(config, "base_url", configPath)
-	if err != nil {
-		return err
-	}
-	if err := validateManagedBaseURL(baseURL); err != nil {
-		return fmt.Errorf(
-			"Elydora runtime config base URL is invalid at %s: %w",
-			configPath,
-			err,
-		)
-	}
-	return nil
-}
-
-func validateAugmentRuntimeIdentity(agentDirectory, agentID string) error {
-	runtimeRoot := filepath.Dir(agentDirectory)
-	rootExists, err := managedPhysicalDirectoryExists(
-		runtimeRoot,
-		"Elydora runtime directory",
-	)
-	if err != nil || !rootExists {
-		return err
-	}
-	directoryExists, err := managedPhysicalDirectoryExists(
-		agentDirectory,
-		"Elydora agent runtime directory",
-	)
-	if err != nil || !directoryExists {
-		return err
-	}
-	configPath := filepath.Join(agentDirectory, "config.json")
-	config, configExists, err := readAugmentRuntimeConfig(configPath)
-	if err != nil {
-		return err
-	}
-	artifactExists := false
 	for _, item := range []struct {
-		path  string
-		label string
-		limit int64
+		path, label string
+		expected    []byte
 	}{
-		{filepath.Join(agentDirectory, "private.key"), "Elydora private key", maxProtectedSecretBytes},
-		{filepath.Join(agentDirectory, augmentGuardScript), "Elydora guard runtime", maxManagedSourceBytes},
-		{filepath.Join(agentDirectory, augmentAuditScript), "Elydora audit runtime", maxManagedSourceBytes},
-		{filepath.Join(agentDirectory, augmentGuardWrapperName()), "Auggie guard wrapper", maxManagedSourceBytes},
-		{filepath.Join(agentDirectory, augmentAuditWrapperName()), "Auggie audit wrapper", maxManagedSourceBytes},
-		{filepath.Join(agentDirectory, "chain-state.json"), "Elydora chain state", maxRuntimeConfigBytes},
-		{filepath.Join(agentDirectory, "status-cache.json"), "Elydora status cache", maxRuntimeConfigBytes},
-		{filepath.Join(agentDirectory, "error.log"), "Elydora error log", maxManagedSourceBytes},
+		{contract.guardWrapper, "Auggie guard wrapper", buildAugmentWrapper(nodePath, contract.guardPath)},
+		{contract.auditWrapper, "Auggie audit wrapper", buildAugmentWrapper(nodePath, contract.auditPath)},
 	} {
-		exists, inspectErr := managedPhysicalFileExists(
-			item.path,
-			item.label,
-			item.limit,
-		)
-		if inspectErr != nil {
-			return inspectErr
+		snapshot, err := readManagedFile(item.path, item.label, maxManagedSourceBytes)
+		if err != nil || snapshot == nil || !bytes.Equal(snapshot.contents, item.expected) {
+			return false, err
 		}
-		artifactExists = artifactExists || exists
 	}
-	if !configExists {
-		if artifactExists {
-			return fmt.Errorf(
-				"Elydora runtime identity cannot be verified without config.json: %s",
-				agentDirectory,
-			)
-		}
-		return nil
-	}
-	configuredID, ok := config["agent_id"].(string)
-	if !ok || config["agent_name"] != augmentAgentKey ||
-		!sameAugmentAgentID(configuredID, agentID) {
-		return fmt.Errorf(
-			"Elydora runtime config identity does not match Auggie agent %s: %s",
-			agentID,
-			configPath,
-		)
-	}
-	return nil
-}
-
-func augmentRuntimeContractExists(
-	contract augmentRuntimeContract,
-	runtimeRoot string,
-	nodePath string,
-) (bool, error) {
-	agentDirectory := filepath.Dir(contract.guardPath)
-	wrappers := resolveAugmentWrapperPaths(agentDirectory)
-	if !sameAugmentPath(filepath.Dir(agentDirectory), runtimeRoot) ||
-		!sameAugmentPath(
-			contract.auditPath,
-			filepath.Join(agentDirectory, augmentAuditScript),
-		) ||
-		!sameAugmentPath(contract.guardWrapper, wrappers.guard) ||
-		!sameAugmentPath(contract.auditWrapper, wrappers.audit) {
-		return false, nil
-	}
-	rootExists, err := managedPhysicalDirectoryExists(
-		runtimeRoot,
-		"Elydora runtime directory",
-	)
-	if err != nil || !rootExists {
-		return false, err
-	}
-	directoryExists, err := managedPhysicalDirectoryExists(
-		agentDirectory,
-		"Elydora agent runtime directory",
-	)
-	if err != nil || !directoryExists {
-		return false, err
-	}
-	configPath := filepath.Join(agentDirectory, "config.json")
-	keyPath := filepath.Join(agentDirectory, "private.key")
-	config, configExists, err := readAugmentRuntimeConfig(configPath)
-	if err != nil {
-		return false, err
-	}
-	key, err := readManagedFile(keyPath, "Elydora private key", maxProtectedSecretBytes)
-	if err != nil {
-		return false, err
-	}
-	guard, err := readManagedFile(
-		contract.guardPath,
-		"Elydora guard runtime",
-		maxManagedSourceBytes,
-	)
-	if err != nil {
-		return false, err
-	}
-	audit, err := readManagedFile(
-		contract.auditPath,
-		"Elydora audit runtime",
-		maxManagedSourceBytes,
-	)
-	if err != nil {
-		return false, err
-	}
-	guardWrapper, err := readManagedFile(
-		contract.guardWrapper,
-		"Auggie guard wrapper",
-		maxManagedSourceBytes,
-	)
-	if err != nil {
-		return false, err
-	}
-	auditWrapper, err := readManagedFile(
-		contract.auditWrapper,
-		"Auggie audit wrapper",
-		maxManagedSourceBytes,
-	)
-	if err != nil {
-		return false, err
-	}
-	if !configExists || key == nil || guard == nil || audit == nil ||
-		guardWrapper == nil || auditWrapper == nil {
-		return false, nil
-	}
-	if err := validateAugmentRuntimeConfig(
-		config,
-		contract.agentID,
-		configPath,
-	); err != nil {
-		return false, err
-	}
-	if err := validateManagedPrivateKey(string(key.contents)); err != nil {
-		return false, fmt.Errorf("Elydora private key at %s: %w", keyPath, err)
-	}
-	return len(guard.contents) > 0 &&
-		len(audit.contents) > 0 &&
-		bytes.Equal(
-			guardWrapper.contents,
-			buildAugmentWrapper(nodePath, contract.guardPath),
-		) &&
-		bytes.Equal(
-			auditWrapper.contents,
-			buildAugmentWrapper(nodePath, contract.auditPath),
-		), nil
+	return true, nil
 }

 func augmentRuntimeFilesExist(
 	contracts []augmentRuntimeContract,
 	runtimeRoot string,
 ) (bool, error) {
-	nodePath, err := resolveNodeRuntime()
+	nodePath, err := resolveAbsoluteNodeRuntime("Auggie")
 	if err != nil {
 		return false, err
 	}
-	if err := requireAugmentAbsoluteNode(nodePath); err != nil {
-		return false, err
-	}
 	for _, contract := range contracts {
-		exists, err := augmentRuntimeContractExists(contract, runtimeRoot, nodePath)
-		if err != nil {
-			return false, err
+		runtime := managedRuntimeContract{contract.agentID, contract.guardPath, contract.auditPath}
+		exists, err := managedRuntimeContractExists(runtime, augmentAgentKey, "Auggie", nil)
+		if err != nil || !exists {
+			if err != nil {
+				return false, err
+			}
+			continue
 		}
-		if exists {
-			return true, nil
+		matches, err := augmentWrappersMatch(contract, nodePath)
+		if err != nil || matches {
+			return matches, err
 		}
 	}
 	return false, nil