Add plugin bio-research-forge

[Presisitence]

What changes

New Plugin Presisitence/bio-research-forge — evidence-first life-science workbench: public bio APIs, local RNA figures (PNG/PDF + plotted data), bounded PyMOL/SnapGene/Cytoscape/Fiji actions, and independent review skills.

Path: plugins/Presisitence/bio-research-forge. Standalone source: https://github.com/Presisitence/bio-research-forge (AGPL-3.0-or-later).

This PR only adds that directory. Existing plant-public, rnaseq-plot, and microbe are unchanged.

User value

A MiniMax Code user can look up public gene/protein/structure records with provenance, draw local RNA volcano/PCA/heatmap figures from their own tables (no upload), and gate design or manuscript work through specialist Skills.

Example prompt:

Look up Arabidopsis FLC in UniProt and NCBI. Then, using my local DEG table deg.csv
(columns gene, log2FoldChange, padj), draw a volcano plot (padj < 0.05, |log2FC| > 1)
and show the PNG in the conversation.

Expected result: bio_api_query then rna_figure_create; API replies include source URL and retrieval time; local CSV is not uploaded; PNG/PDF/plot-data paths returned.

Plugin submission checklist

• Plugin lives at plugins/<github-owner>/<plugin-name>.
• plugin.json name matches the Plugin directory.
• README.md includes a real example prompt and expected result.
• LICENSE and plugin.json declare an open-source license.
• Required executables, accounts, paid services, and supported platforms are disclosed.
• Network destinations and data handled by the plugin are disclosed.
• No credentials, private endpoints, hidden telemetry, installers, symlinks, or native binaries are included.
• Every scaffold placeholder has been replaced.
• Validator accepts this Plugin (validateHostedPluginDirectory).

Dependencies and platforms

• Node.js 18+ on PATH (mcp.json: node, cwd: ${PLUGIN_ROOT}).
• Optional NCBI_API_KEY (environment only; not shipped).
• Optional R/Rscript (or RSCRIPT_EXE) plus jsonlite, ggplot2, pheatmap for RNA figures.
• Optional PyMOL / SnapGene / Cytoscape / Fiji (or PYMOL_EXE / SNAPGENE_EXE / CYTOSCAPE_EXE / FIJI_EXE). Software is never installed by the plugin.
• Windows, macOS, Linux.

Network and data behavior

public-bio-api is read-only allowlist: eutils.ncbi.nlm.nih.gov, rest.uniprot.org, www.ebi.ac.uk (InterPro, Europe PMC), rest.ensembl.org, alphafold.ebi.ac.uk, data.rcsb.org, string-db.org, jaspar.elixir.no, solgenomics.net (generic BrAPI crop-name metadata). Arbitrary URLs, local files, credentials, and pepper-specific queries are blocked.

rna-figure and local-bio-tools are local-only. No telemetry. No credentials in the package.

Evidence

validateHostedPluginDirectory plugins/Presisitence/bio-research-forge
OK Presisitence/bio-research-forge skills=bio-research-orchestrator,evidence-review,experimental-design-gate,local-bio-toolkit,manuscript-argument,omics-workflow,public-bio-databases,quantitative-research,reproducible-analysis,rna-figure-workflow,scientific-figure-delivery,secure-compute-routing mcp=local-bio-tools,public-bio-api,rna-figure

npm run check
Validated 21 hosted Plugins and all examples.
128 tests pass.

plugin protocol smokes: protocol-smoke, rna-figure-protocol-smoke, local-tools-protocol-smoke, privacy-boundary — ok

License note: this Plugin keeps the upstream AGPL-3.0-or-later license (DAWN Science provenance; see ATTRIBUTION.md). It is not relicensed to MIT like plant-public / rnaseq-plot / microbe.

Overlap note: public-API coverage overlaps plant-public; RNA volcano/PCA/heatmap overlap rnaseq-plot. This Plugin is a broader workbench (skills + three MCP servers) rather than a replacement of those plugins.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[hetaoBackend]

Current head 05cd207 passes repository validation and the bundled protocol/privacy smoke tests, but public-bio-api still has credential and resource-boundary blockers. In plugins/Presisitence/bio-research-forge/mcp/public-bio-api.mjs:283-299, response.text() buffers the entire response before enforcing MAX_RESPONSE_BYTES; a permitted endpoint/intermediary can therefore cause unbounded memory use before rejection. Enforce the byte cap while streaming and abort when exceeded. The NCBI_API_KEY is also embedded in the outbound URL at :208-209 and the returned sourceUrl at :319-328, exposing the credential to the MCP client/logs; redact it from all returned URLs and errors. Finally set redirect:"error" or validate every redirect target against the same allowlist, otherwise an allowlisted endpoint can redirect to localhost/private address space. [code]smith is SKIPPED.

[Presisitence]

@hetaoBackend Thanks for the review — addressed on the latest push (d34f977):

1. Stream response body with a running byte cap (readBodyLimited) before full buffering
2. Redact NCBI_API_KEY and other *API_KEY / TOKEN / SECRET env values from returned sourceUrl, tool text, and errors
3. fetch with redirect: "error" + HTTPS allowlist host checks

Could you take another look when you have a moment?

[hetaoBackend]

Reviewed against exact current head d34f977.

Approval basis:

• The prior three blockers are fixed in the submitted implementation: readBodyLimited() enforces the response cap while streaming and cancels the reader on overflow; fetchJson() uses redirect: "error"; returned URLs and error/tool text redact API keys, tokens, and secret query parameters.
• Local evidence on this exact head: protocol smoke passed, privacy-boundary passed, repository validator passed, and an independent black-box probe verified redirect: "error", NCBI key redaction in sourceUrl, and streaming overflow cancellation.
• GitHub validate, CodeQL/analyze, and CodeQL checks are successful. [code]smith is SKIPPED and was not used as evidence.
• No unresolved review threads remain.

This approval is for the exact head above only; merge must still be protected by a fresh server-side MERGEABLE/CLEAN read.