@agent-delivery-harness/action 0.1.0 → 0.2.0

package/package.json

@@ -1,14 +1,19 @@
 {
   "name": "@agent-delivery-harness/action",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "GitHub Action verifying a tracked delivery record on pull requests",
   "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kwam1na/agent-delivery-harness.git",
+    "directory": "packages/action"
+  },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.6.0"
   },
   "dependencies": {
-    "@agent-delivery-harness/kernel": "0.1.0"
+    "@agent-delivery-harness/kernel": "0.2.0"
   },
   "exports": {
     ".": "./src/index.ts"

package/src/main.ts

@@ -64,6 +64,8 @@ import {
   createBlocker,
   createInternalErrorBlocker,
   deliveryRecordPathFor,
+  needsCommittedSymlinkTarget,
+  parseCandidateTreeListing,
   parseDeliveryRecord,
   renderBlockers,
   runGitCommand,
@@ -73,6 +75,7 @@ import {
   type Blocker,
   type BlockerSource,
   type CandidateCommandRunner,
+  type CandidateTreeEntry,
   type DeliveryRecordCheck,
   type DeliveryRecordClaim,
   type DeliveryRecordFile,
@@ -170,9 +173,6 @@ export interface ActionResult {
 
 // ── Blockers ─────────────────────────────────────────────────────────────────
 
-/** `git ls-tree -z` separates records with NUL, so a path containing a newline stays one record. */
-const NUL = "\u0000";
-
 const ACTION_SOURCE: BlockerSource = { kind: "command", id: "delivery-harness.action" };
 
 const RECORD_AND_COMMIT: Remediation = {
@@ -476,6 +476,13 @@ interface DiscoveredRecords {
   /** Parse failures. Findings, never skips — see below. */
   readonly blockers: readonly Blocker[];
   readonly trackedCount: number;
+  /**
+   * Every tracked entry in the head tree, for the protected-path check —
+   * mode and, for a delivery-owned symlink, the target read from its committed
+   * blob, because the one admitted exception under `.claude/skills/` turns on
+   * both and neither is visible in a name-only listing.
+   */
+  readonly allPaths: readonly CandidateTreeEntry[];
 }
 
 /**
@@ -503,11 +510,12 @@ async function readTrackedRecords(git: GitPort, headSha: string, config: Harness
   // from a root-level path of that name — a path/content confusion. The two
   // sides of this check must be anchored identically or they are not comparing
   // the same tree.
-  const listing = await git(["ls-tree", "-r", "--name-only", "-z", "--full-tree", headSha]);
+  const listing = await git(["ls-tree", "-r", "-z", "--full-tree", headSha]);
   if (listing.exitCode !== 0) {
     return {
       files: [],
       trackedCount: 0,
+      allPaths: [],
       blockers: [
         actionBlocker({
           code: "tracked_tree_unreadable",
@@ -525,7 +533,20 @@ async function readTrackedRecords(git: GitPort, headSha: string, config: Harness
     };
   }
 
-  const paths = listing.stdout.split(NUL).filter((entry) => entry.length > 0 && isRecordPath(entry, shape));
+  const listed = parseCandidateTreeListing(listing.stdout);
+  const allPaths: CandidateTreeEntry[] = [];
+  for (const entry of listed) {
+    if (!needsCommittedSymlinkTarget(entry)) {
+      allPaths.push(entry);
+      continue;
+    }
+    // Read out of the commit, like every other byte this verifier judges: the
+    // link under review is the one in the tree. A blob that will not read
+    // leaves the target absent, and an entry with no target cannot be admitted.
+    const link = await git(["cat-file", "blob", entry.objectSha]);
+    allPaths.push(link.exitCode === 0 ? { ...entry, symlinkTarget: link.stdout } : entry);
+  }
+  const paths = listed.map((entry) => entry.path).filter((entry) => isRecordPath(entry, shape));
   const files: DeliveryRecordFile[] = [];
   const blockers: Blocker[] = [];
   for (const recordPath of paths.sort()) {
@@ -548,7 +569,7 @@ async function readTrackedRecords(git: GitPort, headSha: string, config: Harness
     }
     files.push({ path: recordPath, record: parsed.record });
   }
-  return { files, blockers, trackedCount: paths.length };
+  return { files, blockers, trackedCount: paths.length, allPaths };
 }
 
 // ── The summary ──────────────────────────────────────────────────────────────
@@ -949,7 +970,7 @@ export async function runAction(runtime: ActionRuntime): Promise<ActionResult> {
     }
 
     recordPath = selected.path;
-    check = verifyDeliveryRecord(config, selected.record, identity, base);
+    check = verifyDeliveryRecord(config, selected.record, identity, base, { candidateTreePaths: discovered.allPaths });
     blockers.push(...check.blockers);
     return await settle();
   } catch (error) {
@@ -990,7 +1011,7 @@ async function workspaceHas(runtime: ActionRuntime, repoRoot: string, relativePa
  *
  * The Action carries its own loader rather than importing the CLI's: the Action
  * is a wrapper over the *kernel*, and a dependency on the operator CLI would put
- * seven commands and an interactive prompt behind a read-only check. The
+ * eleven commands and an interactive prompt behind a read-only check. The
  * validation itself is the kernel's single implementation; only the import and
  * the blocker's source id are local, so the two loaders cannot disagree about
  * what a valid config is.