feat(plugins): Network Pack — HTTP + WebSocket with URL allowlist

[rrader26]

Summary

• New `createNetworkPlugin()` adds 5 outbound network tools (HTTP + WebSocket).
• Bounded by a glob-style URL allowlist that is empty by default — refuses every call until the operator explicitly configures one.
• Pure Node, no external dependencies (native global `WebSocket` from Node 22+).

Why

Closes a real gap: today an agent can drive a running app, drive a browser, or hit Microsoft Graph, but has no way to call an arbitrary JSON API or stay connected to a realtime stream. Lots of agent workflows boil down to "look up a record in our system, then..." — that needs an HTTP call.

The allowlist is non-negotiable. Default deny prevents the AI from being a data-exfil vector to attacker-controlled endpoints.

Tools

Tool	Use
`agentmark_http_request`	Any HTTP method; auto-encoded JSON/string/base64 body; text/json/base64 response
`agentmark_websocket_connect`	Open WS; returns `ws_id`
`agentmark_websocket_send`	Text or base64 binary
`agentmark_websocket_receive`	Pull queued OR wait for next message with timeout
`agentmark_websocket_close`	Send close frame + release

Allowlist patterns

Glob-style on full URL:

• `*` matches any character except `/`
• `**` matches any character including `/`
• `https://api.example.com/**\` — any path under that host
• `https://*.example.com/**` — any subdomain
• `wss://*.realtime.example.com/**` — WebSocket allowlist

Patterns come from `createNetworkPlugin({ urlAllowlist })` and `AGENTMARK_HTTP_ALLOWLIST` (colon-separated), merged.

Usage

```ts
const network = createNetworkPlugin({
urlAllowlist: [
'https://api.github.com/',
'https://*.internal.example.com/',
'wss://stream.example.com/**',
],
})
createMcpServer({ plugins: [web, pdf, desktop, network, meta] })
```

Test plan

• `pnpm build` clean
• `pnpm test` — 359 pass / 10 skip (17 new tests via mocked `fetch`: allowlist matching, HTTP body encoding, JSON/base64 response paths, refusal paths, WS allowlist boundary)
• Manual: full WS round-trip against a real echo server (integration suite — separate)

🤖 Generated with Claude Code