diff --git a/Flowlight/Plugins/PluginEngine.swift b/Flowlight/Plugins/PluginEngine.swift index 688c9f4..5e7c53b 100644 --- a/Flowlight/Plugins/PluginEngine.swift +++ b/Flowlight/Plugins/PluginEngine.swift @@ -38,7 +38,7 @@ enum PluginEngine { let enabled = Dictionary(uniqueKeysWithValues: manifests.map { ($0.id, $0.enabled) }) let context = PluginContext(exchange: exchange) return builtInRules.flatMap { rule -> [PluginFindingDraft] in - guard enabled[rule.manifest.id] ?? rule.manifest.enabled else { return [] } + guard enabled[rule.manifest.id] == true else { return [] } return rule.evaluate(context) } } @@ -48,8 +48,10 @@ enum PluginEngine { for builtIn in builtInManifests { if var existing = byID[builtIn.id] { let enabled = existing.enabled + let configuration = existing.configuration existing = builtIn existing.enabled = enabled + existing.configuration = configuration byID[builtIn.id] = existing } else { byID[builtIn.id] = builtIn diff --git a/Flowlight/Plugins/PluginModels.swift b/Flowlight/Plugins/PluginModels.swift index 72fea8c..d528543 100644 --- a/Flowlight/Plugins/PluginModels.swift +++ b/Flowlight/Plugins/PluginModels.swift @@ -14,6 +14,7 @@ struct PluginManifest: Codable, Identifiable, Equatable, Sendable { var ruleVersion: Int = 1 var privacySummary: String var capabilities: [Capability] = [.annotate] + var configuration: [String: String] = [:] enum Kind: String, Codable, Sendable { case traffic, llmMCP } enum Source: String, Codable, Sendable { case builtIn, installed } @@ -38,7 +39,8 @@ struct PluginManifest: Codable, Identifiable, Equatable, Sendable { init(id: String, name: String, version: String, kind: Kind, enabled: Bool = true, source: Source = .builtIn, publisher: Publisher = .official, guardrailProvider: GuardrailProvider = .flowlight, description: String, - ruleVersion: Int = 1, privacySummary: String, capabilities: [Capability] = [.annotate]) { + ruleVersion: Int = 1, privacySummary: String, capabilities: [Capability] = [.annotate], + configuration: [String: String] = [:]) { self.id = id self.name = name self.version = version @@ -51,10 +53,11 @@ struct PluginManifest: Codable, Identifiable, Equatable, Sendable { self.ruleVersion = ruleVersion self.privacySummary = privacySummary self.capabilities = capabilities + self.configuration = configuration } private enum CodingKeys: String, CodingKey { - case id, name, version, kind, enabled, source, publisher, guardrailProvider, description, ruleVersion, privacySummary, capabilities + case id, name, version, kind, enabled, source, publisher, guardrailProvider, description, ruleVersion, privacySummary, capabilities, configuration } init(from decoder: Decoder) throws { @@ -71,9 +74,28 @@ struct PluginManifest: Codable, Identifiable, Equatable, Sendable { ruleVersion = try values.decodeIfPresent(Int.self, forKey: .ruleVersion) ?? 1 privacySummary = try values.decode(String.self, forKey: .privacySummary) capabilities = try values.decodeIfPresent([Capability].self, forKey: .capabilities) ?? [.annotate] + configuration = try values.decodeIfPresent([String: String].self, forKey: .configuration) ?? [:] } } +struct PluginPackage: Codable, Equatable, Sendable { + var manifest: PluginManifest + + init(manifest: PluginManifest) { + self.manifest = manifest + } + + init(from decoder: Decoder) throws { + if let package = try? decoder.container(keyedBy: CodingKeys.self), package.contains(.manifest) { + manifest = try package.decode(PluginManifest.self, forKey: .manifest) + } else { + manifest = try PluginManifest(from: decoder) + } + } + + private enum CodingKeys: String, CodingKey { case manifest } +} + struct PluginEvidence: Codable, Equatable, Sendable { var label: String var value: String diff --git a/Flowlight/Plugins/PluginStore.swift b/Flowlight/Plugins/PluginStore.swift index 94b69aa..68f0b8b 100644 --- a/Flowlight/Plugins/PluginStore.swift +++ b/Flowlight/Plugins/PluginStore.swift @@ -1,5 +1,27 @@ import Foundation +struct PluginImportResult: Sendable { + var manifest: PluginManifest + var installed: Bool +} + +struct PluginBackfillResult: Sendable { + var pluginID: String? + var findingCount: Int +} + +enum PluginPackageError: LocalizedError, Equatable { + case reservedBuiltInID + case invalidID + + var errorDescription: String? { + switch self { + case .reservedBuiltInID: return L("Installed plugin IDs cannot reuse a built-in plugin ID.") + case .invalidID: return L("Plugin IDs must contain only letters, numbers, dots, underscores, and hyphens.") + } + } +} + @MainActor final class PluginStore: ObservableObject { @Published private(set) var manifests: [PluginManifest] = [] @@ -36,6 +58,64 @@ final class PluginStore: ObservableObject { version += 1 } + func updateConfiguration(_ manifest: PluginManifest, configuration: [String: String]) { + guard let index = manifests.firstIndex(where: { $0.id == manifest.id }) else { return } + manifests[index].configuration = configuration + db?.async { try $0.updatePluginConfiguration(id: manifest.id, configuration: configuration) } + version += 1 + } + + func importPackage(data: Data, completion: @escaping @MainActor (Result) -> Void) { + guard let db else { return } + db.async { [weak self] db in + do { + var manifest = try JSONDecoder().decode(PluginPackage.self, from: data).manifest + guard manifest.id.range(of: #"^[A-Za-z0-9_.-]+$"#, options: .regularExpression) != nil else { throw PluginPackageError.invalidID } + guard !PluginEngine.builtInManifests.contains(where: { $0.id == manifest.id }) else { throw PluginPackageError.reservedBuiltInID } + manifest.source = .installed + if manifest.publisher != .official { manifest.publisher = .thirdParty } + if manifest.capabilities.isEmpty { manifest.capabilities = [.annotate] } + try db.savePluginManifest(manifest) + let merged = PluginEngine.mergedManifests(try db.loadPluginManifests()) + Task { @MainActor in + self?.manifests = merged + self?.version += 1 + completion(.success(PluginImportResult(manifest: manifest, installed: true))) + } + } catch { + Task { @MainActor in completion(.failure(error)) } + } + } + } + + func exportPackage(_ manifest: PluginManifest) throws -> Data { + let encoder = JSONEncoder() + encoder.outputFormatting = [.prettyPrinted, .sortedKeys] + return try encoder.encode(PluginPackage(manifest: manifest)) + } + + func removeInstalled(_ manifest: PluginManifest) { + guard manifest.source == .installed else { return } + manifests.removeAll { $0.id == manifest.id } + db?.async { try $0.deleteInstalledPlugin(id: manifest.id) } + version += 1 + } + + func backfill(_ manifest: PluginManifest? = nil, completion: @escaping @MainActor (Result) -> Void) { + guard let db else { return } + db.async { [weak self] db in + do { + let count = try db.backfillPluginFindings(pluginID: manifest?.id) + Task { @MainActor in + self?.version += 1 + completion(.success(PluginBackfillResult(pluginID: manifest?.id, findingCount: count))) + } + } catch { + Task { @MainActor in completion(.failure(error)) } + } + } + } + func clearFindings() { db?.async { [weak self] db in try db.clearPluginFindings() diff --git a/Flowlight/Storage/TrafficDatabase.swift b/Flowlight/Storage/TrafficDatabase.swift index 9cdd715..5c9c60e 100644 --- a/Flowlight/Storage/TrafficDatabase.swift +++ b/Flowlight/Storage/TrafficDatabase.swift @@ -1025,6 +1025,41 @@ final class TrafficDatabase: @unchecked Sendable { } } + func updatePluginConfiguration(id: String, configuration: [String: String]) throws { + guard var manifest = try loadPluginManifests().first(where: { $0.id == id }) else { return } + manifest.configuration = configuration + try savePluginManifest(manifest) + } + + func deleteInstalledPlugin(id: String) throws { + guard let manifest = try loadPluginManifests().first(where: { $0.id == id }), manifest.source == .installed else { return } + try conn.transaction { + try conn.run("DELETE FROM plugin_findings WHERE plugin_id = ?", [.text(id)]) + try conn.run("DELETE FROM plugins WHERE id = ?", [.text(id)]) + } + } + + @discardableResult + func backfillPluginFindings(pluginID: String? = nil, since: Date = Date().addingTimeInterval(-14 * 86400), limit: Int = 500) throws -> Int { + let manifests = PluginEngine.mergedManifests(try loadPluginManifests()) + let active = pluginID.map { id in manifests.filter { $0.id == id } } ?? manifests + let builtInIDs = Set(PluginEngine.builtInManifests.map(\.id)) + let evaluable = active.filter { builtInIDs.contains($0.id) } + guard !evaluable.isEmpty else { return 0 } + let exchanges = try exchanges(since: since, limit: limit) + var inserted = 0 + try conn.transaction { + if let pluginID { try conn.run("DELETE FROM plugin_findings WHERE plugin_id = ?", [.text(pluginID)]) } + else { try conn.run("DELETE FROM plugin_findings WHERE plugin_id IN (\(Array(repeating: "?", count: builtInIDs.count).joined(separator: ",")))", builtInIDs.map(SQLValue.text)) } + for exchange in exchanges { + let before = conn.changes + try insertPluginFindings(PluginEngine.evaluate(exchange, manifests: evaluable), forExchangeID: exchange.id ?? 0) + inserted += max(0, conn.changes - before) + } + } + return inserted + } + func insertPluginFindings(_ findings: [PluginFindingDraft], forExchangeID exchangeID: Int64) throws { guard !findings.isEmpty else { return } let encoder = JSONEncoder() diff --git a/Flowlight/UI/PluginSettingsView.swift b/Flowlight/UI/PluginSettingsView.swift index bd4c738..f5ba69a 100644 --- a/Flowlight/UI/PluginSettingsView.swift +++ b/Flowlight/UI/PluginSettingsView.swift @@ -1,31 +1,61 @@ +import AppKit import SwiftUI +import UniformTypeIdentifiers struct PluginSettingsView: View { @EnvironmentObject var monitor: TrafficMonitor @State private var showClearConfirmation = false + @State private var message: String? + @State private var configuring: PluginManifest? + @State private var removing: PluginManifest? var body: some View { Form { Section { Text(L("Plugins add advisory findings to inspected exchanges. They do not block, rewrite, or send traffic anywhere by themselves.")) .font(.caption).foregroundStyle(.secondary).fixedSize(horizontal: false, vertical: true) + HStack(spacing: 8) { + Button(L("Import Package…"), action: importPackage) + Button(L("Backfill Findings")) { backfill(nil) } + Button(L("Clear plugin findings…"), role: .destructive) { showClearConfirmation = true } + } + if let message { + Text(message).font(.caption).foregroundStyle(.secondary).fixedSize(horizontal: false, vertical: true) + } + } footer: { + Text(L("Import reads a local plugin manifest package and stores it as installed metadata. Until sandboxed plugins ship, installed packages are visible and configurable but only Flowlight built-ins create findings.")) + .font(.caption).foregroundStyle(.secondary) } pluginSection(L("Official"), plugins: monitor.plugins.officialPlugins, empty: L("No official plugins are installed.")) pluginSection(L("Third-party"), plugins: monitor.plugins.thirdPartyPlugins, - empty: L("Third-party plugins are not installed in this version.")) - Section { - Button(L("Clear plugin findings…"), role: .destructive) { showClearConfirmation = true } - .help(L("Delete retained plugin annotations without deleting recorded requests or plugin settings")) - } + empty: L("No third-party plugin packages are installed.")) } .formStyle(.grouped) - .frame(height: 520) + .frame(height: 620) .confirmationDialog(L("Clear plugin findings?"), isPresented: $showClearConfirmation, titleVisibility: .visible) { Button(L("Clear findings"), role: .destructive) { monitor.clearPluginFindings() } } message: { Text(L("Recorded requests, response bodies, rules, guardrails, and plugin enable settings stay in place.")) } + .confirmationDialog(L("Remove installed plugin?"), isPresented: Binding(get: { removing != nil }, set: { if !$0 { removing = nil } }), titleVisibility: .visible) { + if let plugin = removing { + Button(L("Remove %@", plugin.name), role: .destructive) { + monitor.plugins.removeInstalled(plugin) + removing = nil + } + } + } message: { + if let plugin = removing { + Text(L("%@ and its retained findings will be removed. Built-in plugins cannot be removed.", plugin.name)) + } + } + .sheet(item: $configuring) { plugin in + PluginConfigurationSheet(plugin: plugin) { configuration in + monitor.plugins.updateConfiguration(plugin, configuration: configuration) + message = L("Saved configuration for %@.", plugin.name) + } + } } private func pluginSection(_ title: String, plugins: [PluginManifest], empty: String) -> some View { @@ -34,35 +64,164 @@ struct PluginSettingsView: View { Text(empty).font(.caption).foregroundStyle(.secondary) } else { ForEach(plugins) { plugin in - PluginSettingsRow(plugin: plugin) { enabled in + PluginSettingsRow(plugin: plugin, setEnabled: { enabled in monitor.plugins.setEnabled(plugin, enabled) - } + }, configure: { + configuring = plugin + }, exportPackage: { + exportPackage(plugin) + }, backfill: { + backfill(plugin) + }, remove: plugin.source == .installed ? { + removing = plugin + } : nil) } } } } + + private func importPackage() { + let panel = NSOpenPanel() + panel.allowedContentTypes = [.json] + panel.allowsMultipleSelection = false + panel.canChooseDirectories = false + panel.prompt = L("Import") + panel.message = L("Choose a Flowlight inspection plugin manifest or package JSON file.") + guard panel.runModal() == .OK, let url = panel.url else { return } + do { + let data = try Data(contentsOf: url) + monitor.plugins.importPackage(data: data) { result in + switch result { + case .success(let imported): message = L("Installed %@.", imported.manifest.name) + case .failure(let error): message = L("Import failed: %@", error.localizedDescription) + } + } + } catch { + message = L("Import failed: %@", error.localizedDescription) + } + } + + private func exportPackage(_ plugin: PluginManifest) { + do { + let data = try monitor.plugins.exportPackage(plugin) + let panel = NSSavePanel() + panel.allowedContentTypes = [.json] + panel.nameFieldStringValue = "\(plugin.id)-plugin.json" + if panel.runModal() == .OK, let url = panel.url { + try data.write(to: url, options: .atomic) + message = L("Exported %@.", plugin.name) + } + } catch { + message = L("Export failed: %@", error.localizedDescription) + } + } + + private func backfill(_ plugin: PluginManifest?) { + monitor.plugins.backfill(plugin) { result in + switch result { + case .success(let result): + message = plugin.map { L("Backfilled %@: %lld findings.", $0.name, result.findingCount) } + ?? L("Backfilled built-in plugins: %lld findings.", result.findingCount) + case .failure(let error): message = L("Backfill failed: %@", error.localizedDescription) + } + } + } } private struct PluginSettingsRow: View { var plugin: PluginManifest var setEnabled: (Bool) -> Void + var configure: () -> Void + var exportPackage: () -> Void + var backfill: () -> Void + var remove: (() -> Void)? var body: some View { - Toggle(isOn: Binding(get: { plugin.enabled }, set: setEnabled)) { - VStack(alignment: .leading, spacing: 4) { - HStack(spacing: 6) { - Text(plugin.name).font(.callout.bold()) - PluginPill(plugin.kind.title) - PluginPill(plugin.guardrailProvider.title) - if plugin.capabilities.contains(.suggestGuardrail) { PluginPill(L("Suggests guardrails")) } + VStack(alignment: .leading, spacing: 8) { + Toggle(isOn: Binding(get: { plugin.enabled }, set: setEnabled)) { + VStack(alignment: .leading, spacing: 4) { + HStack(spacing: 6) { + Text(plugin.name).font(.callout.bold()) + PluginPill(plugin.kind.title) + PluginPill(plugin.guardrailProvider.title) + PluginPill(plugin.source.title) + if plugin.capabilities.contains(.suggestGuardrail) { PluginPill(L("Suggests guardrails")) } + } + Text(plugin.description).font(.caption).foregroundStyle(.secondary).fixedSize(horizontal: false, vertical: true) + Text(plugin.privacySummary).font(.caption2).foregroundStyle(.tertiary).fixedSize(horizontal: false, vertical: true) + Text(L("%@ · v%@ · rule v%lld", plugin.publisher.title, plugin.version, plugin.ruleVersion)) + .font(.caption2).foregroundStyle(.tertiary) + if !plugin.configuration.isEmpty { + Text(L("Configured: %@", plugin.configuration.keys.sorted().joined(separator: ", "))) + .font(.caption2).foregroundStyle(.tertiary) + } } - Text(plugin.description).font(.caption).foregroundStyle(.secondary).fixedSize(horizontal: false, vertical: true) - Text(plugin.privacySummary).font(.caption2).foregroundStyle(.tertiary).fixedSize(horizontal: false, vertical: true) - Text(L("%@ · v%@ · rule v%lld", plugin.publisher.title, plugin.version, plugin.ruleVersion)) - .font(.caption2).foregroundStyle(.tertiary) } + .toggleStyle(.switch) + HStack(spacing: 8) { + Button(L("Configure…"), action: configure) + Button(L("Export…"), action: exportPackage) + Button(L("Backfill"), action: backfill) + if let remove { Button(L("Remove"), role: .destructive, action: remove) } + } + .font(.caption) } - .toggleStyle(.switch) + .padding(.vertical, 2) + } +} + +private struct PluginConfigurationSheet: View { + @Environment(\.dismiss) private var dismiss + var plugin: PluginManifest + var save: ([String: String]) -> Void + @State private var rows: [ConfigurationRow] + + init(plugin: PluginManifest, save: @escaping ([String: String]) -> Void) { + self.plugin = plugin + self.save = save + _rows = State(initialValue: plugin.configuration.sorted { $0.key < $1.key }.map { ConfigurationRow(key: $0.key, value: $0.value) }) + } + + var body: some View { + VStack(alignment: .leading, spacing: 12) { + Text(L("Configure %@", plugin.name)).font(.headline) + Text(L("Configuration is stored locally as string key/value metadata. It does not grant a plugin network, file, or traffic mutation access.")) + .font(.caption).foregroundStyle(.secondary).fixedSize(horizontal: false, vertical: true) + ScrollView { + VStack(spacing: 8) { + ForEach($rows) { $row in + HStack(spacing: 8) { + TextField(L("Key"), text: $row.key).textFieldStyle(.roundedBorder) + TextField(L("Value"), text: $row.value).textFieldStyle(.roundedBorder) + Button { rows.removeAll { $0.id == row.id } } label: { Image(systemName: "minus.circle") } + .buttonStyle(.borderless).help(L("Remove this setting")) + } + } + } + } + HStack { + Button(L("Add Setting")) { rows.append(ConfigurationRow()) } + Spacer() + Button(L("Cancel")) { dismiss() } + Button(L("Save")) { + save(Dictionary(uniqueKeysWithValues: rows.compactMap { row in + let key = row.key.trimmingCharacters(in: .whitespacesAndNewlines) + guard !key.isEmpty else { return nil } + return (key, row.value) + })) + dismiss() + } + .keyboardShortcut(.defaultAction) + } + } + .padding(20) + .frame(width: 520, height: 360) + } + + private struct ConfigurationRow: Identifiable { + let id = UUID() + var key = "" + var value = "" } } @@ -86,3 +245,12 @@ private extension PluginManifest.Publisher { } } } + +private extension PluginManifest.Source { + var title: String { + switch self { + case .builtIn: return L("Built-in") + case .installed: return L("Installed") + } + } +} diff --git a/FlowlightTests/PluginTests.swift b/FlowlightTests/PluginTests.swift index 3836964..851f1ef 100644 --- a/FlowlightTests/PluginTests.swift +++ b/FlowlightTests/PluginTests.swift @@ -82,10 +82,65 @@ final class PluginTests: XCTestCase { description: "Detects and masks PII.", privacySummary: "Uses redacted inspection metadata.") manifest.source = .installed manifest.publisher = .official + manifest.configuration = ["policy": "default"] let data = try JSONEncoder().encode(manifest) let decoded = try JSONDecoder().decode(PluginManifest.self, from: data) XCTAssertEqual(decoded.publisher, .official) XCTAssertEqual(decoded.guardrailProvider, .presidio) + XCTAssertEqual(decoded.configuration["policy"], "default") XCTAssertEqual(PluginManifest.GuardrailProvider.prismaAIRS.title, "PANW Prisma AIRS") } + + func testPluginPackageAcceptsBareManifestAndWrappedPackage() throws { + let bare = Data(#"{"id":"thirdparty.test","name":"Test","version":"0.1.0","kind":"traffic","source":"installed","publisher":"thirdParty","guardrailProvider":"custom","description":"Test plugin.","privacySummary":"Uses metadata only.","capabilities":["annotate"]}"#.utf8) + let decodedBare = try JSONDecoder().decode(PluginPackage.self, from: bare) + XCTAssertEqual(decodedBare.manifest.id, "thirdparty.test") + + let wrapped = try JSONEncoder().encode(PluginPackage(manifest: decodedBare.manifest)) + let decodedWrapped = try JSONDecoder().decode(PluginPackage.self, from: wrapped) + XCTAssertEqual(decodedWrapped.manifest.id, "thirdparty.test") + } + + @MainActor + func testPluginStoreRejectsReservedBuiltInPackageID() { + let store = PluginStore() + let data = Data(#"{"id":"traffic.large-upload","name":"Pretend","version":"0.1.0","kind":"traffic","source":"installed","publisher":"thirdParty","guardrailProvider":"custom","description":"Pretend plugin.","privacySummary":"Uses metadata only.","capabilities":["annotate"]}"#.utf8) + let exp = expectation(description: "import completes") + store.attach(db: try! database()) + store.importPackage(data: data) { result in + if case .failure(let error as PluginPackageError) = result { + XCTAssertEqual(error, .reservedBuiltInID) + } else { + XCTFail("expected reserved built-in ID rejection") + } + exp.fulfill() + } + wait(for: [exp], timeout: 2) + } + + func testInstalledPluginConfigurationAndRemovalPersist() throws { + let db = try database() + var manifest = PluginManifest(id: "thirdparty.example", name: "Example", version: "0.1.0", kind: .traffic, + source: .installed, publisher: .thirdParty, guardrailProvider: .custom, + description: "Example plugin.", privacySummary: "Uses metadata only.") + try db.savePluginManifest(manifest) + try db.updatePluginConfiguration(id: manifest.id, configuration: ["mode": "audit"]) + manifest = try XCTUnwrap(db.loadPluginManifests().first { $0.id == "thirdparty.example" }) + XCTAssertEqual(manifest.configuration["mode"], "audit") + + try db.deleteInstalledPlugin(id: manifest.id) + XCTAssertNil(try db.loadPluginManifests().first { $0.id == "thirdparty.example" }) + } + + func testBackfillRecreatesBuiltInFindingsForRetainedExchanges() throws { + let db = try database() + let id = try db.insertExchange(exchange()) + XCTAssertFalse(try db.pluginFindings(exchangeIDs: [id]).isEmpty) + try db.clearPluginFindings() + XCTAssertTrue(try db.pluginFindings(exchangeIDs: [id], visibleOnly: false).isEmpty) + let count = try db.backfillPluginFindings(pluginID: "traffic.large-upload") + XCTAssertEqual(count, 1) + let findings = try db.pluginFindings(exchangeIDs: [id], visibleOnly: false) + XCTAssertEqual(findings[id]?.map(\.pluginID), ["traffic.large-upload"]) + } } diff --git a/docs/404.html b/docs/404.html index f4747c3..35dfc09 100644 --- a/docs/404.html +++ b/docs/404.html @@ -86,7 +86,7 @@

That page isn't here

Try the home page,

© 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.0 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.1 · Not affiliated with Apple or any AI provider named on this site.
diff --git a/docs/about/index.html b/docs/about/index.html index 27945bd..42875ad 100644 --- a/docs/about/index.html +++ b/docs/about/index.html @@ -153,7 +153,7 @@

Thanks

© 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.0 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.1 · Not affiliated with Apple or any AI provider named on this site.
diff --git a/docs/de/about/index.html b/docs/de/about/index.html index e57b0d0..8491efa 100644 --- a/docs/de/about/index.html +++ b/docs/de/about/index.html @@ -152,7 +152,7 @@

Dank

© 2026 Die Flowlight-Mitwirkenden. Flowlight ist freie Software, veröffentlicht unter der GNU General Public License v3.0. - Version 0.14.0 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter. + Version 0.14.1 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter.
diff --git a/docs/de/docs/index.html b/docs/de/docs/index.html index 2efdc76..34ae545 100644 --- a/docs/de/docs/index.html +++ b/docs/de/docs/index.html @@ -76,7 +76,7 @@

Dokumentation

Flowlight benutzen

-

Alles vom ersten Start bis zum Feinschliff an den Agentenregeln. Flowlight 0.14.0, macOS 15 oder neuer.

+

Alles vom ersten Start bis zum Feinschliff an den Agentenregeln. Flowlight 0.14.1, macOS 15 oder neuer.

© 2026 Die Flowlight-Mitwirkenden. Flowlight ist freie Software, veröffentlicht unter der GNU General Public License v3.0. - Version 0.14.0 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter. + Version 0.14.1 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter.
diff --git a/docs/de/index.html b/docs/de/index.html index 78625a4..df647c1 100644 --- a/docs/de/index.html +++ b/docs/de/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

Sieh, was deine Apps im Netz tun.
brew install --cask xinbetween/tap/flowlight

-

v0.14.0macOS 15+UniversalGPL-3.0Keine Telemetrie

+

v0.14.1macOS 15+UniversalGPL-3.0Keine Telemetrie

@@ -571,7 +571,7 @@

Wisse, was deinen Mac verlässt.

© 2026 Die Flowlight-Mitwirkenden. Flowlight ist freie Software, veröffentlicht unter der GNU General Public License v3.0. - Version 0.14.0 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter. + Version 0.14.1 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter.
diff --git a/docs/de/privacy/index.html b/docs/de/privacy/index.html index 1f86803..7f1b160 100644 --- a/docs/de/privacy/index.html +++ b/docs/de/privacy/index.html @@ -188,7 +188,7 @@

Kontakt

© 2026 Die Flowlight-Mitwirkenden. Flowlight ist freie Software, veröffentlicht unter der GNU General Public License v3.0. - Version 0.14.0 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter. + Version 0.14.1 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter.
diff --git a/docs/de/threat-model/index.html b/docs/de/threat-model/index.html index e821bfa..464cf55 100644 --- a/docs/de/threat-model/index.html +++ b/docs/de/threat-model/index.html @@ -228,7 +228,7 @@

Eine Schwachstelle melden

© 2026 Die Flowlight-Mitwirkenden. Flowlight ist freie Software, veröffentlicht unter der GNU General Public License v3.0. - Version 0.14.0 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter. + Version 0.14.1 · Nicht verbunden mit Apple oder einem der hier genannten KI-Anbieter.
diff --git a/docs/docs/index.html b/docs/docs/index.html index 737bb9a..0906bc4 100644 --- a/docs/docs/index.html +++ b/docs/docs/index.html @@ -76,7 +76,7 @@

Documentation

Using Flowlight

-

Everything from the first launch to tuning the agent rules. Flowlight 0.14.0, macOS 15 or later.

+

Everything from the first launch to tuning the agent rules. Flowlight 0.14.1, macOS 15 or later.

diff --git a/docs/es/about/index.html b/docs/es/about/index.html index 847fa3b..ec16ceb 100644 --- a/docs/es/about/index.html +++ b/docs/es/about/index.html @@ -152,7 +152,7 @@

Agradecimientos

© 2026 Quienes contribuyen a Flowlight. Flowlight es software libre, publicado bajo la GNU General Public License v3.0. - Versión 0.14.0 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio. + Versión 0.14.1 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio.
diff --git a/docs/es/docs/index.html b/docs/es/docs/index.html index 07e3a0d..281effa 100644 --- a/docs/es/docs/index.html +++ b/docs/es/docs/index.html @@ -76,7 +76,7 @@

Documentación

Usar Flowlight

-

Todo, desde el primer arranque hasta el ajuste de las reglas de agentes. Flowlight 0.14.0, macOS 15 o posterior.

+

Todo, desde el primer arranque hasta el ajuste de las reglas de agentes. Flowlight 0.14.1, macOS 15 o posterior.

© 2026 Quienes contribuyen a Flowlight. Flowlight es software libre, publicado bajo la GNU General Public License v3.0. - Versión 0.14.0 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio. + Versión 0.14.1 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio.
diff --git a/docs/es/index.html b/docs/es/index.html index c6dde3c..3d5a7d3 100644 --- a/docs/es/index.html +++ b/docs/es/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

Observa la actividad de red de tus apps.

brew install --cask xinbetween/tap/flowlight

-

v0.14.0macOS 15+UniversalGPL-3.0Sin telemetría

+

v0.14.1macOS 15+UniversalGPL-3.0Sin telemetría

@@ -571,7 +571,7 @@

Ten claro qué sale de tu Mac.

© 2026 Quienes contribuyen a Flowlight. Flowlight es software libre, publicado bajo la GNU General Public License v3.0. - Versión 0.14.0 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio. + Versión 0.14.1 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio.
diff --git a/docs/es/privacy/index.html b/docs/es/privacy/index.html index 6047cca..a7311c0 100644 --- a/docs/es/privacy/index.html +++ b/docs/es/privacy/index.html @@ -188,7 +188,7 @@

Contacto

© 2026 Quienes contribuyen a Flowlight. Flowlight es software libre, publicado bajo la GNU General Public License v3.0. - Versión 0.14.0 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio. + Versión 0.14.1 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio.
diff --git a/docs/es/threat-model/index.html b/docs/es/threat-model/index.html index 8f3a2d7..d79ecbd 100644 --- a/docs/es/threat-model/index.html +++ b/docs/es/threat-model/index.html @@ -223,7 +223,7 @@

Informar de una vulnerabilidad

© 2026 Quienes contribuyen a Flowlight. Flowlight es software libre, publicado bajo la GNU General Public License v3.0. - Versión 0.14.0 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio. + Versión 0.14.1 · Sin relación con Apple ni con ningún proveedor de IA mencionado en este sitio.
diff --git a/docs/fr/about/index.html b/docs/fr/about/index.html index 5c67fd0..5135dec 100644 --- a/docs/fr/about/index.html +++ b/docs/fr/about/index.html @@ -152,7 +152,7 @@

Remerciements

© 2026 Les contributeurs de Flowlight. Flowlight est un logiciel libre, publié sous la GNU General Public License v3.0. - Version 0.14.0 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site. + Version 0.14.1 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site.
diff --git a/docs/fr/docs/index.html b/docs/fr/docs/index.html index 3b8ad42..afd42d8 100644 --- a/docs/fr/docs/index.html +++ b/docs/fr/docs/index.html @@ -76,7 +76,7 @@

Documentation

Utiliser Flowlight

-

Tout, du premier lancement au réglage des règles des agents. Flowlight 0.14.0, macOS 15 ou version ultérieure.

+

Tout, du premier lancement au réglage des règles des agents. Flowlight 0.14.1, macOS 15 ou version ultérieure.

© 2026 Les contributeurs de Flowlight. Flowlight est un logiciel libre, publié sous la GNU General Public License v3.0. - Version 0.14.0 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site. + Version 0.14.1 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site.
diff --git a/docs/fr/index.html b/docs/fr/index.html index f46c68d..73e409a 100644 --- a/docs/fr/index.html +++ b/docs/fr/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

Voyez l’activité réseau de vos apps.

brew install --cask xinbetween/tap/flowlight

-

v0.14.0macOS 15+UniverselGPL-3.0Sans télémétrie

+

v0.14.1macOS 15+UniverselGPL-3.0Sans télémétrie

@@ -571,7 +571,7 @@

Sachez ce qui quitte votre Mac.

© 2026 Les contributeurs de Flowlight. Flowlight est un logiciel libre, publié sous la GNU General Public License v3.0. - Version 0.14.0 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site. + Version 0.14.1 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site.
diff --git a/docs/fr/privacy/index.html b/docs/fr/privacy/index.html index d8d2144..1cf8af5 100644 --- a/docs/fr/privacy/index.html +++ b/docs/fr/privacy/index.html @@ -188,7 +188,7 @@

Contact

© 2026 Les contributeurs de Flowlight. Flowlight est un logiciel libre, publié sous la GNU General Public License v3.0. - Version 0.14.0 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site. + Version 0.14.1 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site.
diff --git a/docs/fr/threat-model/index.html b/docs/fr/threat-model/index.html index d5ee24c..be339c2 100644 --- a/docs/fr/threat-model/index.html +++ b/docs/fr/threat-model/index.html @@ -226,7 +226,7 @@

Signaler une vulnérabilité

© 2026 Les contributeurs de Flowlight. Flowlight est un logiciel libre, publié sous la GNU General Public License v3.0. - Version 0.14.0 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site. + Version 0.14.1 · Sans lien avec Apple ni avec aucun fournisseur d’IA cité sur ce site.
diff --git a/docs/index.html b/docs/index.html index e986f7a..77ac820 100644 --- a/docs/index.html +++ b/docs/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

See your apps' network activity.
brew install --cask xinbetween/tap/flowlight

-

v0.14.0macOS 15+UniversalGPL-3.0No telemetry

+

v0.14.1macOS 15+UniversalGPL-3.0No telemetry

@@ -580,7 +580,7 @@

Know what leaves your Mac.

© 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.0 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.1 · Not affiliated with Apple or any AI provider named on this site.
diff --git a/docs/it/about/index.html b/docs/it/about/index.html index e762e6e..f7f490a 100644 --- a/docs/it/about/index.html +++ b/docs/it/about/index.html @@ -152,7 +152,7 @@

Ringraziamenti

© 2026 Chi contribuisce a Flowlight. Flowlight è software libero, distribuito sotto la GNU General Public License v3.0. - Versione 0.14.0 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito. + Versione 0.14.1 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito.
diff --git a/docs/it/docs/index.html b/docs/it/docs/index.html index 4908ce5..b85d191 100644 --- a/docs/it/docs/index.html +++ b/docs/it/docs/index.html @@ -76,7 +76,7 @@

Documentazione

Usare Flowlight

-

Tutto, dal primo avvio alla messa a punto delle regole per gli agenti. Flowlight 0.14.0, macOS 15 o successivo.

+

Tutto, dal primo avvio alla messa a punto delle regole per gli agenti. Flowlight 0.14.1, macOS 15 o successivo.

© 2026 Chi contribuisce a Flowlight. Flowlight è software libero, distribuito sotto la GNU General Public License v3.0. - Versione 0.14.0 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito. + Versione 0.14.1 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito.
diff --git a/docs/it/index.html b/docs/it/index.html index dd96b8c..5db92f9 100644 --- a/docs/it/index.html +++ b/docs/it/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

Vedi la rete delle tue app.
Ca Metti una stella su GitHub

brew install --cask xinbetween/tap/flowlight

-

v0.14.0macOS 15+UniversaleGPL-3.0Nessuna telemetria

+

v0.14.1macOS 15+UniversaleGPL-3.0Nessuna telemetria

@@ -571,7 +571,7 @@

Sappi che cosa esce dal tuo Mac.

© 2026 Chi contribuisce a Flowlight. Flowlight è software libero, distribuito sotto la GNU General Public License v3.0. - Versione 0.14.0 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito. + Versione 0.14.1 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito.
diff --git a/docs/it/privacy/index.html b/docs/it/privacy/index.html index 8e4253f..4f9385c 100644 --- a/docs/it/privacy/index.html +++ b/docs/it/privacy/index.html @@ -188,7 +188,7 @@

Contatti

© 2026 Chi contribuisce a Flowlight. Flowlight è software libero, distribuito sotto la GNU General Public License v3.0. - Versione 0.14.0 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito. + Versione 0.14.1 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito.
diff --git a/docs/it/threat-model/index.html b/docs/it/threat-model/index.html index 397244e..a574120 100644 --- a/docs/it/threat-model/index.html +++ b/docs/it/threat-model/index.html @@ -224,7 +224,7 @@

Segnalare una vulnerabilità

© 2026 Chi contribuisce a Flowlight. Flowlight è software libero, distribuito sotto la GNU General Public License v3.0. - Versione 0.14.0 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito. + Versione 0.14.1 · Non affiliato ad Apple né ad alcun fornitore di IA citato in questo sito.
diff --git a/docs/ja/about/index.html b/docs/ja/about/index.html index 5e4743d..14277e1 100644 --- a/docs/ja/about/index.html +++ b/docs/ja/about/index.html @@ -153,7 +153,7 @@

謝辞

© 2026 Flowlight コントリビューター。Flowlight は GNU General Public License v3.0 のもとで公開されている自由ソフトウェアです。 - バージョン 0.14.0 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。 + バージョン 0.14.1 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。
diff --git a/docs/ja/docs/index.html b/docs/ja/docs/index.html index e1b9711..b429130 100644 --- a/docs/ja/docs/index.html +++ b/docs/ja/docs/index.html @@ -76,7 +76,7 @@

ドキュメント

Flowlight の使い方

-

初回起動からエージェントのルールの調整まで、すべてここに。Flowlight 0.14.0、macOS 15 以降。

+

初回起動からエージェントのルールの調整まで、すべてここに。Flowlight 0.14.1、macOS 15 以降。

© 2026 Flowlight コントリビューター。Flowlight は GNU General Public License v3.0 のもとで公開されている自由ソフトウェアです。 - バージョン 0.14.0 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。 + バージョン 0.14.1 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。
diff --git a/docs/ja/index.html b/docs/ja/index.html index 4f6644a..1e5125b 100644 --- a/docs/ja/index.html +++ b/docs/ja/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

アプリの通信が見える。
brew install --cask xinbetween/tap/flowlight

-

v0.14.0macOS 15+ユニバーサルGPL-3.0テレメトリなし

+

v0.14.1macOS 15+ユニバーサルGPL-3.0テレメトリなし

@@ -570,7 +570,7 @@

Mac から何が出ていくのかを知る。

© 2026 Flowlight コントリビューター。Flowlight は GNU General Public License v3.0 のもとで公開されている自由ソフトウェアです。 - バージョン 0.14.0 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。 + バージョン 0.14.1 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。
diff --git a/docs/ja/privacy/index.html b/docs/ja/privacy/index.html index 539e818..5651eca 100644 --- a/docs/ja/privacy/index.html +++ b/docs/ja/privacy/index.html @@ -186,7 +186,7 @@

連絡先

© 2026 Flowlight コントリビューター。Flowlight は GNU General Public License v3.0 のもとで公開されている自由ソフトウェアです。 - バージョン 0.14.0 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。 + バージョン 0.14.1 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。
diff --git a/docs/ja/threat-model/index.html b/docs/ja/threat-model/index.html index f574417..aab950c 100644 --- a/docs/ja/threat-model/index.html +++ b/docs/ja/threat-model/index.html @@ -225,7 +225,7 @@

脆弱性を報告する

© 2026 Flowlight コントリビューター。Flowlight は GNU General Public License v3.0 のもとで公開されている自由ソフトウェアです。 - バージョン 0.14.0 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。 + バージョン 0.14.1 · Apple および本サイトに挙げた AI プロバイダとは関係ありません。
diff --git a/docs/ko/about/index.html b/docs/ko/about/index.html index 3637c4b..8dc9de4 100644 --- a/docs/ko/about/index.html +++ b/docs/ko/about/index.html @@ -153,7 +153,7 @@

감사

© 2026 Flowlight 기여자들. Flowlight는 GNU General Public License v3.0 아래 배포되는 자유 소프트웨어입니다. - 버전 0.14.0 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다. + 버전 0.14.1 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다.
diff --git a/docs/ko/docs/index.html b/docs/ko/docs/index.html index 7d3adec..a024dea 100644 --- a/docs/ko/docs/index.html +++ b/docs/ko/docs/index.html @@ -76,7 +76,7 @@

문서

Flowlight 사용하기

-

첫 실행부터 에이전트 규칙 조정까지 전부. Flowlight 0.14.0, macOS 15 이상.

+

첫 실행부터 에이전트 규칙 조정까지 전부. Flowlight 0.14.1, macOS 15 이상.

© 2026 Flowlight 기여자들. Flowlight는 GNU General Public License v3.0 아래 배포되는 자유 소프트웨어입니다. - 버전 0.14.0 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다. + 버전 0.14.1 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다.
diff --git a/docs/ko/index.html b/docs/ko/index.html index c86e5fa..fae241d 100644 --- a/docs/ko/index.html +++ b/docs/ko/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

앱이 무엇을 하는지 봅니다.

brew install --cask xinbetween/tap/flowlight

-

v0.14.0macOS 15+유니버설GPL-3.0텔레메트리 없음

+

v0.14.1macOS 15+유니버설GPL-3.0텔레메트리 없음

@@ -571,7 +571,7 @@

내 Mac에서 무엇이 나가는지 아세요.

© 2026 Flowlight 기여자들. Flowlight는 GNU General Public License v3.0 아래 배포되는 자유 소프트웨어입니다. - 버전 0.14.0 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다. + 버전 0.14.1 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다.
diff --git a/docs/ko/privacy/index.html b/docs/ko/privacy/index.html index 7c84b4b..13be8f2 100644 --- a/docs/ko/privacy/index.html +++ b/docs/ko/privacy/index.html @@ -189,7 +189,7 @@

문의

© 2026 Flowlight 기여자들. Flowlight는 GNU General Public License v3.0 아래 배포되는 자유 소프트웨어입니다. - 버전 0.14.0 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다. + 버전 0.14.1 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다.
diff --git a/docs/ko/threat-model/index.html b/docs/ko/threat-model/index.html index e751faa..741e465 100644 --- a/docs/ko/threat-model/index.html +++ b/docs/ko/threat-model/index.html @@ -223,7 +223,7 @@

취약점 신고하기

© 2026 Flowlight 기여자들. Flowlight는 GNU General Public License v3.0 아래 배포되는 자유 소프트웨어입니다. - 버전 0.14.0 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다. + 버전 0.14.1 · Apple 및 이 사이트에 언급된 어떤 AI 제공업체와도 무관합니다.
diff --git a/docs/llms-full.txt b/docs/llms-full.txt index 2755563..9fe7586 100644 --- a/docs/llms-full.txt +++ b/docs/llms-full.txt @@ -62,7 +62,7 @@ Documentation Using Flowlight - Everything from the first launch to tuning the agent rules. Flowlight 0.14.0, macOS 15 or later. + Everything from the first launch to tuning the agent rules. Flowlight 0.14.1, macOS 15 or later. On this page @@ -853,7 +853,7 @@ Understand your AI agents. brew install --cask xinbetween/tap/flowlightCopy - v0.14.0macOS 15+UniversalGPL-3.0No telemetry + v0.14.1macOS 15+UniversalGPL-3.0No telemetry connectionslive @@ -1323,7 +1323,7 @@ Plugins Flowlight plugins are scoped to HTTPS inspection. They run after a request and response have already been captured, redacted, clipped, attributed to an app or agent, and written to the local database. A plugin can add findings and suggest ordinary Flowlight guardrails, but it does not block, rewrite, mock, or transform traffic by itself. - The first shipped plugins are official built-ins. The template package below is for designing third-party or official add-on packs against the manifest and finding format while the installed plugin loader is still being hardened. + Flowlight can import and export local plugin manifest packages from Settings. Installed packages are visible and configurable today; execution remains limited to official built-in rules until sandboxed advisory plugins ship. Manifest @@ -1396,14 +1396,14 @@ Plugins Template package - The starter package lives at templates/inspection-plugin. It includes a manifest, sample findings, a policy checklist and fixtures for ordinary traffic and LLM/MCP guardrail plugins. + The starter package lives at templates/inspection-plugin. It includes a manifest, sample findings, a policy checklist and fixtures for ordinary traffic and LLM/MCP guardrail plugins. Import the manifest JSON from Settings › Plugins, then export it again to share the stored package shape. cp -R templates/inspection-plugin my-flowlight-plugin cd my-flowlight-plugin -python3 -m json.tool manifest.json -python3 validate.py +node -e "JSON.parse(require('fs').readFileSync('manifest.json'))" +node validate.js - The validator is deliberately local and boring: it checks manifest fields, provider names, capability names, evidence size limits and the absence of common secret-looking values in sample findings. + The JavaScript validator is deliberately local and boring: it checks manifest fields, provider names, capability names, evidence size limits and the absence of common secret-looking values in sample findings. Review checklist @@ -1536,9 +1536,23 @@ Releases Downloads, checksums and full notes for each version are on GitHub Releases. - 0.14.0 + 0.14.1 October 9, 2026Latest + Install local plugin packages. Settings › Plugins can now import and export Flowlight plugin + manifest packages, keep installed plugins split by official or third-party publisher, and reject packages that + try to reuse a reserved built-in plugin ID. + + Configure and maintain plugin records. Plugin packages can store local string key/value + configuration, installed packages can be removed with their retained findings, and built-in plugins preserve + enable/configuration state while the app updates their manifest metadata. + + Backfill advisory findings. The Plugins tab can rerun official built-in rules over retained + inspected exchanges so newly enabled or updated plugins can annotate recent history without recapturing traffic. + + 0.14.0 +October 9, 2026 + Official inspection plugins. Flowlight now derives advisory plugin findings from inspected exchanges after capture, redaction and attribution. The first official built-ins cover large uploads, destructive-looking HTTP requests, credential-like header names, direct HTTP MCP activity, provider-run MCP diff --git a/docs/llms.txt b/docs/llms.txt index b4bf8a6..970729c 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -1,6 +1,6 @@ # Flowlight -> Free, open-source (GPL-3.0) application-aware network monitor for macOS, with focused visibility into AI agents. It attributes observed TCP and UDP activity to the application that made it and records the destination, protocol and byte counts, keeping local history from second to year. Recognized AI agents are listed by name along with the tools and MCP servers they start, under per-agent allowlists. It can also refuse, once asked: a rule blocks an application, a destination or a URL for as long as you specify, and a guardrail withholds a tool from an agent before its model is offered it. Runs on macOS 15 or later; capture is by a sampler or a Network Extension. Current version: 0.14.0. +> Free, open-source (GPL-3.0) application-aware network monitor for macOS, with focused visibility into AI agents. It attributes observed TCP and UDP activity to the application that made it and records the destination, protocol and byte counts, keeping local history from second to year. Recognized AI agents are listed by name along with the tools and MCP servers they start, under per-agent allowlists. It can also refuse, once asked: a rule blocks an application, a destination or a URL for as long as you specify, and a guardrail withholds a tool from an agent before its model is offered it. Runs on macOS 15 or later; capture is by a sampler or a Network Extension. Current version: 0.14.1. - [Download Flowlight.dmg](https://github.com/xinbetween/flowlight/releases/latest/download/Flowlight.dmg) - [Source code](https://github.com/xinbetween/flowlight) diff --git a/docs/plugins/index.html b/docs/plugins/index.html index a0a9f17..cc34994 100644 --- a/docs/plugins/index.html +++ b/docs/plugins/index.html @@ -75,7 +75,7 @@

Write inspection plugins

The trust boundary

Flowlight plugins are scoped to HTTPS inspection. They run after a request and response have already been captured, redacted, clipped, attributed to an app or agent, and written to the local database. A plugin can add findings and suggest ordinary Flowlight guardrails, but it does not block, rewrite, mock, or transform traffic by itself.

-

The first shipped plugins are official built-ins. The template package below is for designing third-party or official add-on packs against the manifest and finding format while the installed plugin loader is still being hardened.

+

Flowlight can import and export local plugin manifest packages from Settings. Installed packages are visible and configurable today; execution remains limited to official built-in rules until sandboxed advisory plugins ship.

Manifest

A manifest tells Flowlight what the plugin is, who publishes it, what kind of inspected data it uses, and whether it can suggest guardrails.

@@ -133,12 +133,12 @@

Supported guardrail providers

Template package

-

The starter package lives at templates/inspection-plugin. It includes a manifest, sample findings, a policy checklist and fixtures for ordinary traffic and LLM/MCP guardrail plugins.

+

The starter package lives at templates/inspection-plugin. It includes a manifest, sample findings, a policy checklist and fixtures for ordinary traffic and LLM/MCP guardrail plugins. Import the manifest JSON from Settings › Plugins, then export it again to share the stored package shape.

cp -R templates/inspection-plugin my-flowlight-plugin
 cd my-flowlight-plugin
-python3 -m json.tool manifest.json
-python3 validate.py
-

The validator is deliberately local and boring: it checks manifest fields, provider names, capability names, evidence size limits and the absence of common secret-looking values in sample findings.

+node -e "JSON.parse(require('fs').readFileSync('manifest.json'))" +node validate.js +

The JavaScript validator is deliberately local and boring: it checks manifest fields, provider names, capability names, evidence size limits and the absence of common secret-looking values in sample findings.

Review checklist

    @@ -183,7 +183,7 @@

    Review checklist

    © 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.0 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.1 · Not affiliated with Apple or any AI provider named on this site.
    diff --git a/docs/privacy/index.html b/docs/privacy/index.html index 0add57e..d4372a0 100644 --- a/docs/privacy/index.html +++ b/docs/privacy/index.html @@ -195,7 +195,7 @@

    Contact

    © 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.0 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.1 · Not affiliated with Apple or any AI provider named on this site.
    diff --git a/docs/pt-PT/about/index.html b/docs/pt-PT/about/index.html index d8883b6..dee8395 100644 --- a/docs/pt-PT/about/index.html +++ b/docs/pt-PT/about/index.html @@ -152,7 +152,7 @@

    Agradecimentos

    © 2026 Quem contribui para o Flowlight. O Flowlight é software livre, publicado sob a GNU General Public License v3.0. - Versão 0.14.0 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site. + Versão 0.14.1 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site.
    diff --git a/docs/pt-PT/docs/index.html b/docs/pt-PT/docs/index.html index 069e5af..587e928 100644 --- a/docs/pt-PT/docs/index.html +++ b/docs/pt-PT/docs/index.html @@ -76,7 +76,7 @@

    Documentação

    Usar o Flowlight

    -

    Tudo, da primeira abertura ao ajuste das regras dos agentes. Flowlight 0.14.0, macOS 15 ou posterior.

    +

    Tudo, da primeira abertura ao ajuste das regras dos agentes. Flowlight 0.14.1, macOS 15 ou posterior.

    © 2026 Quem contribui para o Flowlight. O Flowlight é software livre, publicado sob a GNU General Public License v3.0. - Versão 0.14.0 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site. + Versão 0.14.1 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site.
    diff --git a/docs/pt-PT/index.html b/docs/pt-PT/index.html index bc0afe6..8aeac6e 100644 --- a/docs/pt-PT/index.html +++ b/docs/pt-PT/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

    Veja a atividade de rede das suas apps.

    brew install --cask xinbetween/tap/flowlight

    -

    v0.14.0macOS 15+UniversalGPL-3.0Sem telemetria

    +

    v0.14.1macOS 15+UniversalGPL-3.0Sem telemetria

    @@ -571,7 +571,7 @@

    Saiba o que sai do seu Mac.

    © 2026 Quem contribui para o Flowlight. O Flowlight é software livre, publicado sob a GNU General Public License v3.0. - Versão 0.14.0 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site. + Versão 0.14.1 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site.
    diff --git a/docs/pt-PT/privacy/index.html b/docs/pt-PT/privacy/index.html index 67068e7..5dd7bd1 100644 --- a/docs/pt-PT/privacy/index.html +++ b/docs/pt-PT/privacy/index.html @@ -188,7 +188,7 @@

    Contacto

    © 2026 Quem contribui para o Flowlight. O Flowlight é software livre, publicado sob a GNU General Public License v3.0. - Versão 0.14.0 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site. + Versão 0.14.1 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site.
    diff --git a/docs/pt-PT/threat-model/index.html b/docs/pt-PT/threat-model/index.html index 81f8247..7043e7b 100644 --- a/docs/pt-PT/threat-model/index.html +++ b/docs/pt-PT/threat-model/index.html @@ -225,7 +225,7 @@

    Comunicar uma vulnerabilidade

    © 2026 Quem contribui para o Flowlight. O Flowlight é software livre, publicado sob a GNU General Public License v3.0. - Versão 0.14.0 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site. + Versão 0.14.1 · Sem qualquer ligação à Apple ou a algum fornecedor de IA mencionado neste site.
    diff --git a/docs/releases/index.html b/docs/releases/index.html index 413fca4..041a871 100644 --- a/docs/releases/index.html +++ b/docs/releases/index.html @@ -61,7 +61,21 @@

    What's new

    -

    0.14.0

    Latest
    +

    0.14.1

    Latest
    +
      +
    • Install local plugin packages. Settings › Plugins can now import and export Flowlight plugin + manifest packages, keep installed plugins split by official or third-party publisher, and reject packages that + try to reuse a reserved built-in plugin ID.
      • +
    • Configure and maintain plugin records. Plugin packages can store local string key/value + configuration, installed packages can be removed with their retained findings, and built-in plugins preserve + enable/configuration state while the app updates their manifest metadata.
      • +
    • Backfill advisory findings. The Plugins tab can rerun official built-in rules over retained + inspected exchanges so newly enabled or updated plugins can annotate recent history without recapturing traffic.
      • +
    +
    + +
    +

    0.14.0

    • Official inspection plugins. Flowlight now derives advisory plugin findings from inspected exchanges after capture, redaction and attribution. The first official built-ins cover large uploads, @@ -1141,7 +1155,7 @@

      What's new

      © 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.0 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.1 · Not affiliated with Apple or any AI provider named on this site.
    diff --git a/docs/threat-model/index.html b/docs/threat-model/index.html index acc82e0..c6c7028 100644 --- a/docs/threat-model/index.html +++ b/docs/threat-model/index.html @@ -224,7 +224,7 @@

    Reporting a vulnerability

    © 2026 The Flowlight contributors. Flowlight is free software, released under the GNU General Public License v3.0. - Version 0.14.0 · Not affiliated with Apple or any AI provider named on this site. + Version 0.14.1 · Not affiliated with Apple or any AI provider named on this site.
    diff --git a/docs/zh-Hans/about/index.html b/docs/zh-Hans/about/index.html index b4b1fb0..4d14bff 100644 --- a/docs/zh-Hans/about/index.html +++ b/docs/zh-Hans/about/index.html @@ -152,7 +152,7 @@

    致谢

    © 2026 Flowlight 贡献者。Flowlight 是自由软件，依 GNU General Public License v3.0 发布。 - 版本 0.14.0 · 与 Apple 及本站提及的任何 AI 提供方均无关联。 + 版本 0.14.1 · 与 Apple 及本站提及的任何 AI 提供方均无关联。
    diff --git a/docs/zh-Hans/docs/index.html b/docs/zh-Hans/docs/index.html index 0662941..7f249dd 100644 --- a/docs/zh-Hans/docs/index.html +++ b/docs/zh-Hans/docs/index.html @@ -76,7 +76,7 @@

    文档

    使用 Flowlight

    -

    从第一次启动到调整代理规则，需要的都在这里。Flowlight 0.14.0，macOS 15 或更高版本。

    +

    从第一次启动到调整代理规则，需要的都在这里。Flowlight 0.14.1，macOS 15 或更高版本。

    © 2026 Flowlight 贡献者。Flowlight 是自由软件，依 GNU General Public License v3.0 发布。 - 版本 0.14.0 · 与 Apple 及本站提及的任何 AI 提供方均无关联。 + 版本 0.14.1 · 与 Apple 及本站提及的任何 AI 提供方均无关联。
    diff --git a/docs/zh-Hans/index.html b/docs/zh-Hans/index.html index e2b771d..acb32d0 100644 --- a/docs/zh-Hans/index.html +++ b/docs/zh-Hans/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

    看清应用的网络活动。

    brew install --cask xinbetween/tap/flowlight

    -

    v0.14.0macOS 15+通用架构GPL-3.0无遥测

    +

    v0.14.1macOS 15+通用架构GPL-3.0无遥测

    @@ -568,7 +568,7 @@

    知道什么离开了你的 Mac。

    © 2026 Flowlight 贡献者。Flowlight 是自由软件，依 GNU General Public License v3.0 发布。 - 版本 0.14.0 · 与 Apple 及本站提及的任何 AI 提供方均无关联。 + 版本 0.14.1 · 与 Apple 及本站提及的任何 AI 提供方均无关联。
    diff --git a/docs/zh-Hans/privacy/index.html b/docs/zh-Hans/privacy/index.html index c3e380f..6ee7508 100644 --- a/docs/zh-Hans/privacy/index.html +++ b/docs/zh-Hans/privacy/index.html @@ -186,7 +186,7 @@

    联系方式

    © 2026 Flowlight 贡献者。Flowlight 是自由软件，依 GNU General Public License v3.0 发布。 - 版本 0.14.0 · 与 Apple 及本站提及的任何 AI 提供方均无关联。 + 版本 0.14.1 · 与 Apple 及本站提及的任何 AI 提供方均无关联。
    diff --git a/docs/zh-Hans/threat-model/index.html b/docs/zh-Hans/threat-model/index.html index 57a6440..37c06da 100644 --- a/docs/zh-Hans/threat-model/index.html +++ b/docs/zh-Hans/threat-model/index.html @@ -212,7 +212,7 @@

    报告漏洞

    © 2026 Flowlight 贡献者。Flowlight 是自由软件，依 GNU General Public License v3.0 发布。 - 版本 0.14.0 · 与 Apple 及本站提及的任何 AI 提供方均无关联。 + 版本 0.14.1 · 与 Apple 及本站提及的任何 AI 提供方均无关联。
    diff --git a/docs/zh-Hant/about/index.html b/docs/zh-Hant/about/index.html index d02fd5a..1eb5663 100644 --- a/docs/zh-Hant/about/index.html +++ b/docs/zh-Hant/about/index.html @@ -152,7 +152,7 @@

    致謝

    © 2026 Flowlight 貢獻者。Flowlight 是自由軟體，依 GNU General Public License v3.0 發布。 - 版本 0.14.0 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。 + 版本 0.14.1 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。
    diff --git a/docs/zh-Hant/docs/index.html b/docs/zh-Hant/docs/index.html index a9300eb..93bd875 100644 --- a/docs/zh-Hant/docs/index.html +++ b/docs/zh-Hant/docs/index.html @@ -76,7 +76,7 @@

    說明文件

    使用 Flowlight

    -

    從第一次啟動到調整代理規則，全都在這裡。Flowlight 0.14.0，macOS 15 或以上版本。

    +

    從第一次啟動到調整代理規則，全都在這裡。Flowlight 0.14.1，macOS 15 或以上版本。

    © 2026 Flowlight 貢獻者。Flowlight 是自由軟體，依 GNU General Public License v3.0 發布。 - 版本 0.14.0 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。 + 版本 0.14.1 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。
    diff --git a/docs/zh-Hant/index.html b/docs/zh-Hant/index.html index 3636e88..7ae94d6 100644 --- a/docs/zh-Hant/index.html +++ b/docs/zh-Hant/index.html @@ -48,7 +48,7 @@ - + @@ -90,7 +90,7 @@

    看見每個 App 的網路活動。
    brew install --cask xinbetween/tap/flowlight

    -

    v0.14.0macOS 15+通用架構GPL-3.0無遙測

    +

    v0.14.1macOS 15+通用架構GPL-3.0無遙測

    @@ -569,7 +569,7 @@

    知道有什麼離開了你的 Mac。

    © 2026 Flowlight 貢獻者。Flowlight 是自由軟體，依 GNU General Public License v3.0 發布。 - 版本 0.14.0 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。 + 版本 0.14.1 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。
    diff --git a/docs/zh-Hant/privacy/index.html b/docs/zh-Hant/privacy/index.html index 71bb783..fd60d2f 100644 --- a/docs/zh-Hant/privacy/index.html +++ b/docs/zh-Hant/privacy/index.html @@ -186,7 +186,7 @@

    聯絡

    © 2026 Flowlight 貢獻者。Flowlight 是自由軟體，依 GNU General Public License v3.0 發布。 - 版本 0.14.0 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。 + 版本 0.14.1 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。
    diff --git a/docs/zh-Hant/threat-model/index.html b/docs/zh-Hant/threat-model/index.html index bafba42..b6a6cb9 100644 --- a/docs/zh-Hant/threat-model/index.html +++ b/docs/zh-Hant/threat-model/index.html @@ -213,7 +213,7 @@

    回報漏洞

    © 2026 Flowlight 貢獻者。Flowlight 是自由軟體，依 GNU General Public License v3.0 發布。 - 版本 0.14.0 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。 + 版本 0.14.1 · 與 Apple 及本站提及的任何 AI 供應商均無關聯。
    diff --git a/project.yml b/project.yml index ad0d9e0..721bdbe 100644 --- a/project.yml +++ b/project.yml @@ -11,8 +11,8 @@ settings: DEVELOPMENT_TEAM: "" CODE_SIGN_STYLE: Automatic ENABLE_HARDENED_RUNTIME: YES - MARKETING_VERSION: "0.14.0" - CURRENT_PROJECT_VERSION: "30" + MARKETING_VERSION: "0.14.1" + CURRENT_PROJECT_VERSION: "31" targets: Flowlight: type: application diff --git a/site/pages/plugins.html b/site/pages/plugins.html index d67e6a6..2761ab2 100644 --- a/site/pages/plugins.html +++ b/site/pages/plugins.html @@ -27,7 +27,7 @@

    Write inspection plugins

    The trust boundary

    Flowlight plugins are scoped to HTTPS inspection. They run after a request and response have already been captured, redacted, clipped, attributed to an app or agent, and written to the local database. A plugin can add findings and suggest ordinary Flowlight guardrails, but it does not block, rewrite, mock, or transform traffic by itself.

    -

    The first shipped plugins are official built-ins. The template package below is for designing third-party or official add-on packs against the manifest and finding format while the installed plugin loader is still being hardened.

    +

    Flowlight can import and export local plugin manifest packages from Settings. Installed packages are visible and configurable today; execution remains limited to official built-in rules until sandboxed advisory plugins ship.

    Manifest

    A manifest tells Flowlight what the plugin is, who publishes it, what kind of inspected data it uses, and whether it can suggest guardrails.

    @@ -85,12 +85,12 @@

    Supported guardrail providers

    Template package

    -

    The starter package lives at templates/inspection-plugin. It includes a manifest, sample findings, a policy checklist and fixtures for ordinary traffic and LLM/MCP guardrail plugins.

    +

    The starter package lives at templates/inspection-plugin. It includes a manifest, sample findings, a policy checklist and fixtures for ordinary traffic and LLM/MCP guardrail plugins. Import the manifest JSON from Settings › Plugins, then export it again to share the stored package shape.

    cp -R templates/inspection-plugin my-flowlight-plugin
 cd my-flowlight-plugin
-python3 -m json.tool manifest.json
-python3 validate.py
    -

    The validator is deliberately local and boring: it checks manifest fields, provider names, capability names, evidence size limits and the absence of common secret-looking values in sample findings.

    +node -e "JSON.parse(require('fs').readFileSync('manifest.json'))" +node validate.js +

    The JavaScript validator is deliberately local and boring: it checks manifest fields, provider names, capability names, evidence size limits and the absence of common secret-looking values in sample findings.

    Review checklist

      diff --git a/site/pages/releases.html b/site/pages/releases.html index a1b4e29..7f33e7f 100644 --- a/site/pages/releases.html +++ b/site/pages/releases.html @@ -13,7 +13,21 @@

      What's new

      -

      0.14.0

      Latest
      +

      0.14.1

      Latest
      +
        +
      • Install local plugin packages. Settings › Plugins can now import and export Flowlight plugin + manifest packages, keep installed plugins split by official or third-party publisher, and reject packages that + try to reuse a reserved built-in plugin ID.
        • +
      • Configure and maintain plugin records. Plugin packages can store local string key/value + configuration, installed packages can be removed with their retained findings, and built-in plugins preserve + enable/configuration state while the app updates their manifest metadata.
        • +
      • Backfill advisory findings. The Plugins tab can rerun official built-in rules over retained + inspected exchanges so newly enabled or updated plugins can annotate recent history without recapturing traffic.
        • +
      +
      + +
      +

      0.14.0

      • Official inspection plugins. Flowlight now derives advisory plugin findings from inspected exchanges after capture, redaction and attribution. The first official built-ins cover large uploads, diff --git a/templates/inspection-plugin/README.md b/templates/inspection-plugin/README.md index ea7d109..2693683 100644 --- a/templates/inspection-plugin/README.md +++ b/templates/inspection-plugin/README.md @@ -1,6 +1,6 @@ # Flowlight Inspection Plugin Template -This template describes an advisory Flowlight inspection plugin package. The first app release with plugins ships official built-in Swift plugins only; this package is the authoring shape for official add-on packs and future installed third-party plugins. +This template describes an advisory Flowlight inspection plugin package. Flowlight can import and export this manifest shape today; installed packages are visible and configurable, while executable plugin logic remains limited to official built-in Swift rules until the sandbox phase. ## Trust boundary @@ -10,9 +10,9 @@ Evidence must be bounded and redacted. Do not include raw request or response bo ## Files -- `manifest.json`: plugin identity, publisher category, guardrail provider, privacy summary and capabilities. +- `manifest.json`: plugin identity, publisher category, guardrail provider, privacy summary, optional `configuration` string map and capabilities. - `findings.example.json`: sample findings the plugin may produce. -- `validate.py`: local schema and privacy sanity checks for the template package. +- `validate.js`: local schema and privacy sanity checks for the template package. ## Supported guardrail providers @@ -28,5 +28,5 @@ Evidence must be bounded and redacted. Do not include raw request or response bo ## Validate ```sh -python3 validate.py +node validate.js ``` diff --git a/templates/inspection-plugin/validate.js b/templates/inspection-plugin/validate.js new file mode 100644 index 0000000..779b349 --- /dev/null +++ b/templates/inspection-plugin/validate.js @@ -0,0 +1,71 @@ +#!/usr/bin/env node +const fs = require('fs'); +const path = require('path'); + +const root = __dirname; +const kinds = new Set(['traffic', 'llmMCP']); +const sources = new Set(['builtIn', 'installed']); +const publishers = new Set(['official', 'thirdParty']); +const providers = new Set(['flowlight', 'presidio', 'bedrock', 'lakera', 'aporia', 'noma', 'prismaAIRS', 'custom']); +const capabilities = new Set(['annotate', 'suggestGuardrail']); +const severities = new Set(['info', 'low', 'medium', 'high']); +const secretPattern = /(sk-[A-Za-z0-9_-]{8,}|bearer\s+\S+|api[_-]?key\s*[:=]|secret\s*[:=]|token\s*[:=])/i; + +function load(name) { + return JSON.parse(fs.readFileSync(path.join(root, name), 'utf8')); +} + +function fail(message) { + console.error(`error: ${message}`); + process.exit(1); +} + +function requireCondition(condition, message) { + if (!condition) fail(message); +} + +function isPlainObject(value) { + return value !== null && typeof value === 'object' && !Array.isArray(value); +} + +function checkManifest(manifest) { + for (const key of ['id', 'name', 'version', 'kind', 'source', 'publisher', 'guardrailProvider', 'description', 'privacySummary', 'capabilities']) { + requireCondition(Object.prototype.hasOwnProperty.call(manifest, key), `manifest missing ${key}`); + } + requireCondition(/^[A-Za-z0-9_.-]+$/.test(manifest.id), 'manifest id must use letters, numbers, dots, underscores, and hyphens'); + requireCondition(kinds.has(manifest.kind), 'manifest kind must be traffic or llmMCP'); + requireCondition(sources.has(manifest.source), 'manifest source must be builtIn or installed'); + requireCondition(publishers.has(manifest.publisher), 'manifest publisher must be official or thirdParty'); + requireCondition(providers.has(manifest.guardrailProvider), 'unsupported guardrailProvider'); + requireCondition(Array.isArray(manifest.capabilities), 'manifest capabilities must be an array'); + requireCondition(manifest.capabilities.every(capability => capabilities.has(capability)), 'unsupported capability'); + requireCondition(manifest.privacySummary.length <= 500, 'privacySummary should stay concise'); + if (manifest.configuration !== undefined) { + requireCondition(isPlainObject(manifest.configuration), 'configuration must be an object'); + for (const [key, value] of Object.entries(manifest.configuration)) { + requireCondition(typeof value === 'string', `configuration ${key} must be a string`); + } + } +} + +function checkFindings(findings) { + requireCondition(Array.isArray(findings), 'findings.example.json must be an array'); + findings.forEach((finding, index) => { + requireCondition(severities.has(finding.severity), `finding ${index} has unsupported severity`); + for (const key of ['title', 'summary', 'evidence']) { + requireCondition(Object.prototype.hasOwnProperty.call(finding, key), `finding ${index} missing ${key}`); + } + requireCondition(finding.title.length <= 120, `finding ${index} title is too long`); + requireCondition(finding.summary.length <= 500, `finding ${index} summary is too long`); + requireCondition(Array.isArray(finding.evidence) && finding.evidence.length <= 8, `finding ${index} evidence must be a short array`); + requireCondition(!secretPattern.test(JSON.stringify(finding)), `finding ${index} appears to contain a secret-like value`); + finding.evidence.forEach(evidence => { + requireCondition((evidence.label || '').length <= 80, `finding ${index} evidence label is too long`); + requireCondition((evidence.value || '').length <= 240, `finding ${index} evidence value is too long`); + }); + }); +} + +checkManifest(load('manifest.json')); +checkFindings(load('findings.example.json')); +console.log('ok'); diff --git a/templates/inspection-plugin/validate.py b/templates/inspection-plugin/validate.py deleted file mode 100644 index 8000fa6..0000000 --- a/templates/inspection-plugin/validate.py +++ /dev/null @@ -1,65 +0,0 @@ -#!/usr/bin/env python3 -import json -import re -import sys -from pathlib import Path - -ROOT = Path(__file__).resolve().parent -KINDS = {"traffic", "llmMCP"} -SOURCES = {"builtIn", "installed"} -PUBLISHERS = {"official", "thirdParty"} -PROVIDERS = {"flowlight", "presidio", "bedrock", "lakera", "aporia", "noma", "prismaAIRS", "custom"} -CAPABILITIES = {"annotate", "suggestGuardrail"} -SEVERITIES = {"info", "low", "medium", "high"} -SECRET_RE = re.compile(r"(sk-[A-Za-z0-9_-]{8,}|bearer\s+\S+|api[_-]?key\s*[:=]|secret\s*[:=]|token\s*[:=])", re.I) - - -def load(name): - return json.loads((ROOT / name).read_text()) - - -def fail(message): - print(f"error: {message}", file=sys.stderr) - sys.exit(1) - - -def require(condition, message): - if not condition: - fail(message) - - -def check_manifest(manifest): - for key in ["id", "name", "version", "kind", "source", "publisher", "guardrailProvider", "description", "privacySummary", "capabilities"]: - require(key in manifest, f"manifest missing {key}") - require(manifest["kind"] in KINDS, "manifest kind must be traffic or llmMCP") - require(manifest["source"] in SOURCES, "manifest source must be builtIn or installed") - require(manifest["publisher"] in PUBLISHERS, "manifest publisher must be official or thirdParty") - require(manifest["guardrailProvider"] in PROVIDERS, "unsupported guardrailProvider") - require(set(manifest["capabilities"]).issubset(CAPABILITIES), "unsupported capability") - require(len(manifest["privacySummary"]) <= 500, "privacySummary should stay concise") - - -def check_findings(findings): - require(isinstance(findings, list), "findings.example.json must be an array") - for i, finding in enumerate(findings): - require(finding.get("severity") in SEVERITIES, f"finding {i} has unsupported severity") - for key in ["title", "summary", "evidence"]: - require(key in finding, f"finding {i} missing {key}") - require(len(finding["title"]) <= 120, f"finding {i} title is too long") - require(len(finding["summary"]) <= 500, f"finding {i} summary is too long") - require(isinstance(finding["evidence"], list) and len(finding["evidence"]) <= 8, f"finding {i} evidence must be a short array") - text = json.dumps(finding, ensure_ascii=False) - require(not SECRET_RE.search(text), f"finding {i} appears to contain a secret-like value") - for evidence in finding["evidence"]: - require(len(evidence.get("label", "")) <= 80, f"finding {i} evidence label is too long") - require(len(evidence.get("value", "")) <= 240, f"finding {i} evidence value is too long") - - -def main(): - check_manifest(load("manifest.json")) - check_findings(load("findings.example.json")) - print("ok") - - -if __name__ == "__main__": - main()