@agilno-tech/rivet 0.1.0-alpha.0

package/src/support/bundle.js

@@ -0,0 +1,195 @@
+import { execFile } from 'node:child_process';
+import { access, lstat, realpath } from 'node:fs/promises';
+import { delimiter, dirname, isAbsolute, join, parse, relative, resolve, sep } from 'node:path';
+import { types } from 'node:util';
+import metadata from '../../package.json' with { type: 'json' };
+import { diagnoseDoctor } from '../commands/doctor.js';
+import { discoverHarnesses } from '../runtime/harness-discovery.js';
+import { CliError } from '../cli/output.js';
+const TOOLS = ['node','npm','pnpm','yarn','bun','git'];
+const PLATFORM = new Set(['aix','darwin','freebsd','linux','openbsd','sunos','win32']);
+const INTEGRATION_READINESS = ['disabled','out-of-scope','unsupported-transport','host-unavailable','authentication-unavailable','unsupported-tools','host-observed','credentials-present'];
+const ARCH = new Set(['arm','arm64','ia32','loong64','mips','mipsel','ppc','ppc64','riscv64','s390','s390x','x64']);
+const BAD = () => { throw new Error('Invalid diagnostic data'); };
+function snapshot(input) {
+  let nodes=0,bytes=0;
+  function copy(value,depth=0) {
+    if (++nodes>20000 || depth>20 || types.isProxy(value)) BAD();
+    if (value===null || typeof value==='boolean')return value;
+    if (typeof value==='string') { bytes+=Buffer.byteLength(value); if(bytes>1024*1024 || value.length>65536)BAD(); return value; }
+    if (typeof value==='number') {if(!Number.isSafeInteger(value))BAD();return value;}
+    if (!value || typeof value!=='object')BAD();
+    const array=Array.isArray(value);
+    if(![Object.prototype,null,...(array?[Array.prototype]:[])].includes(Object.getPrototypeOf(value)))BAD();
+    const keys=Reflect.ownKeys(value);if(keys.length>2048)BAD();
+    const result=array?[]:{};
+    for(const key of keys) {
+      if(array&&key==='length')continue;
+      const descriptor=Object.getOwnPropertyDescriptor(value,key);
+      if(typeof key!=='string'||key==='__proto__'||!descriptor?.enumerable||!Object.hasOwn(descriptor,'value'))BAD();
+      if(array&&(!/^(?:0|[1-9][0-9]*)$/.test(key)||Number(key)>=value.length))BAD();
+      result[key]=copy(descriptor.value,depth+1);
+    }
+    if(array&&(result.length!==value.length||Object.keys(result).length!==value.length))BAD();
+    return result;
+  }
+  return copy(input);
+}
+function environmentSnapshot(environment) {
+  if(!environment||typeof environment!=='object'||Array.isArray(environment)||types.isProxy(environment))BAD();
+  const values=Object.create(null),keys=Reflect.ownKeys(environment);if(keys.length>1024)BAD();
+  for(const key of keys) {
+    const descriptor=Object.getOwnPropertyDescriptor(environment,key);
+    if(typeof key!=='string'||!descriptor?.enumerable||!Object.hasOwn(descriptor,'value')||typeof descriptor.value!=='string'||descriptor.value.length>65536)BAD();
+    values[key]=descriptor.value;
+  }
+  return Object.freeze(values);
+}
+function version(value, forbidden=[]) {
+  if(typeof value!=='string'||value.length>1024)return null;
+  const match=/^(?:v|codex-cli |git version )?(\d{1,6}\.\d{1,6}\.\d{1,6})(?:[-+][A-Za-z0-9.-]+)?(?: \(Claude Code\))?$/.exec(value);
+  const core=match?.[1]??null;
+  return core&&forbidden.some(secret=>secret&&secret.includes(core))?null:core;
+}
+const count=(items,predicate)=>Array.isArray(items)?Math.min(2048,items.filter(predicate).length):0;
+function normalDoctor(input,environment) {
+  const report=snapshot(input);
+  if(!report||typeof report!=='object'||Array.isArray(report)||!['pass','warn','fail'].includes(report.status)
+    ||!report.checks||!['pass','fail'].includes(report.checks.configuration?.status))BAD();
+  const checks=report.checks;
+  for(const key of ['credentials','providers','integrations'])if(checks[key]!==undefined&&!Array.isArray(checks[key]))BAD();
+  const forbidden=(Array.isArray(checks.credentials)?checks.credentials:[]).map(item=>typeof item.name==='string'?environment[item.name]:'').filter(Boolean);
+  return {
+    configuration:{status:checks.configuration.status==='pass'?'valid':'missing-or-invalid'},
+    readiness:{status:report.status,
+      credentials:{required:count(checks.credentials,item=>item.required===true),missing:count(checks.credentials,item=>item.required===true&&item.present===false)},
+      providers:{configured:count(checks.providers,()=>true),unavailable:count(checks.providers,item=>['unavailable','timeout','error'].includes(item.connectivity)),disabled:count(checks.providers,item=>item.readiness==='disabled')},
+      commands:{status:checks.commands?.ready===true?'ready':checks.commands?.ready===false?'not-ready':'unknown',unready:count(checks.commands?.steps,item=>item.status!=='ready')},
+      integrations:{configured:Array.isArray(checks.integrations)?Math.min(checks.integrations.length,2048):0,
+        readiness:Object.fromEntries([...INTEGRATION_READINESS,'unknown'].map(state=>[state,count(checks.integrations,item=>state==='unknown'?!INTEGRATION_READINESS.includes(item.readiness):item.readiness===state)]))}},
+    tools:TOOLS.filter(name=>Object.hasOwn(checks.tools??{},name)).map(name=>{
+      const tool=checks.tools[name];if(!tool||typeof tool!=='object'||Array.isArray(tool)
+        ||(tool.present!==undefined&&typeof tool.present!=='boolean')||(tool.supported!==undefined&&typeof tool.supported!=='boolean')
+        ||(tool.version!==undefined&&tool.version!==null&&typeof tool.version!=='string'))BAD();
+      return {name,present:tool.present===true,supported:tool.supported===true,version:version(tool.version,forbidden)};
+    }),
+    forbidden,
+  };
+}
+function normalHarnesses(input,forbidden) {
+  const rows=snapshot(input);if(!Array.isArray(rows)||rows.length!==2)BAD();
+  const seen=new Set();
+  return rows.map(row=>{
+    if(!row||!['claude','codex'].includes(row.kind)||seen.has(row.kind))BAD();seen.add(row.kind);
+    const present=typeof row.executable==='string'&&row.executable.length>0;
+    const reasons=new Set(['not-installed','capability-probe-failed','interpreter-required','interpreter-unneeded','interpreter-unavailable','interpreter-incompatible','executable-unsafe']);
+    const reason=present?'available':typeof row.reason==='string'&&row.reason.startsWith('missing-options:')?'missing-options':reasons.has(row.reason)?row.reason:'probe-failed';
+    return {kind:row.kind,present,supported:present,version:version(row.version,forbidden),reason};
+  });
+}
+export async function resolveSupportProject(cwd,explicit) {
+  if(typeof cwd!=='string'||!isAbsolute(cwd)||/[\0\r\n]/.test(cwd)
+    ||(explicit!==undefined&&(typeof explicit!=='string'||!explicit||/[\0\r\n]/.test(explicit))))throw new CliError('Project directory is invalid.','INVALID_INPUT');
+  let selected;
+  try {selected=await realpath(resolve(cwd,explicit??'.'));if(!(await lstat(selected)).isDirectory())throw new Error();}
+  catch {throw new CliError('Project directory is unavailable.','INVALID_INPUT');}
+  if(explicit!==undefined)return selected;
+  let current=selected;
+  for(let depth=0;depth<64;depth++) {
+    for(const marker of ['.rivet','.git']) {
+      try {await lstat(join(current,marker));return current;}catch(error){if(error.code!=='ENOENT')throw new CliError('Project discovery is unavailable.','INVALID_INPUT');}
+    }
+    const parent=dirname(current);if(parent===current)break;current=parent;
+  }
+  return selected;
+}
+function versionRunner(signal,environment,projectRoot) {
+  const outside = path => { const rel=relative(projectRoot,path);return rel==='..'||rel.startsWith(`..${sep}`)||isAbsolute(rel); };
+  let directoriesPromise;
+  const directories = () => directoriesPromise ??= (async()=>{
+    const choices=[...(environment.PATH??'').split(delimiter).slice(0,128),'/opt/homebrew/bin','/usr/local/bin','/usr/bin','/bin'];
+    const safe=[];
+    for(const path of choices) {
+      if(signal.aborted)break;
+      if(!isAbsolute(path)||/[\0\r\n]/.test(path))continue;
+      try {const canonical=await realpath(path);if(outside(canonical)&&(await lstat(canonical)).isDirectory()&&!safe.includes(canonical))safe.push(canonical);}catch{}
+    }
+    return safe;
+  })();
+  return async (command,args,options={})=>{
+    const unavailable={code:1,stdout:'',stderr:'',timedOut:false};
+    if(signal.aborted||!TOOLS.includes(command)||!Array.isArray(args)||args.length!==1||args[0]!=='--version')return unavailable;
+    const paths=await directories();let executable;
+    for(const directory of paths) {
+      if(signal.aborted)return unavailable;
+      try {
+        const candidate=await realpath(join(directory,command));
+        if(!outside(candidate)||!(await lstat(candidate)).isFile())continue;
+        await access(candidate,1);executable=candidate;break;
+      }catch{}
+    }
+    if(!executable||signal.aborted)return unavailable;
+    const probeEnvironment=Object.fromEntries(['LANG','LC_ALL','TZ','TERM','HOME','USER','LOGNAME','TMPDIR','SystemRoot','WINDIR']
+      .filter(key=>environment[key]!==undefined).map(key=>[key,environment[key]]));
+    probeEnvironment.PATH=paths.join(delimiter);
+    // A globally installed Yarn/Corepack shim can still redirect from a project
+    // packageManager/yarnPath setting. Probe from the system root instead, disable
+    // project redirection and downloads, and never permit automatic project pins.
+    Object.assign(probeEnvironment, {
+      YARN_IGNORE_PATH: '1', COREPACK_ENABLE_PROJECT_SPEC: '0',
+      COREPACK_ENABLE_NETWORK: '0', COREPACK_ENABLE_AUTO_PIN: '0',
+      COREPACK_DEFAULT_TO_LATEST: '0',
+    });
+    const probeCwd=parse(process.execPath).root;
+    return new Promise(resolvePromise=>{
+      execFile(executable,args,{cwd:probeCwd,env:probeEnvironment,shell:false,timeout:3000,maxBuffer:16384,signal,killSignal:'SIGKILL'},(error,stdout)=>{
+        resolvePromise({code:error?1:0,stdout:typeof stdout==='string'?stdout:'',stderr:'',timedOut:error?.killed===true});
+      });
+    });
+  };
+}
+export async function collectSupportBundle(projectRoot,options={}) {
+  const controller=new AbortController(),abort=()=>controller.abort();
+  let timer,timedOut=false,environment,forbidden=[];
+  const bundle={schemaVersion:1,versions:{rivet:version(metadata.version),node:version(process.version),platform:PLATFORM.has(process.platform)?process.platform:'unknown',architecture:ARCH.has(process.arch)?process.arch:'unknown'},
+    collection:{status:'complete',errors:[]},configuration:{status:'unknown'},readiness:{status:'unknown'},tools:[],harnesses:{status:'not-requested',results:[]}};
+  const incomplete=reason=>{bundle.collection.status='incomplete';if(!bundle.collection.errors.includes(reason))bundle.collection.errors.push(reason)};
+  const bounded=operation=>new Promise((resolvePromise,reject)=>{
+    if(controller.signal.aborted){reject(new Error());return;}
+    const cancel=()=>reject(new Error());controller.signal.addEventListener('abort',cancel,{once:true});
+    Promise.resolve().then(()=>{if(controller.signal.aborted)throw new Error();return operation()}).then(resolvePromise,reject)
+      .finally(()=>controller.signal.removeEventListener('abort',cancel));
+  });
+  try {
+    environment=environmentSnapshot(options.environment??process.env);
+    if(options.signal!==undefined){
+      const getter=Object.getOwnPropertyDescriptor(AbortSignal.prototype,'aborted').get;
+      if(Reflect.apply(getter,options.signal,[]))abort();
+      Reflect.apply(EventTarget.prototype.addEventListener,options.signal,['abort',abort,{once:true}]);
+    }
+    const timeoutMs=options.timeoutMs??15000;
+    if(!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>15000)BAD();
+    timer=setTimeout(()=>{timedOut=true;abort()},timeoutMs);
+    let unsafe=false;
+    try {const marker=await lstat(join(projectRoot,'.rivet'));unsafe=marker.isSymbolicLink()||!marker.isDirectory();}catch(error){if(error.code!=='ENOENT')unsafe=true;}
+    if(unsafe)bundle.configuration.status='unsafe';
+    else try {
+      const diagnostic=await bounded(()=>(options.diagnose??diagnoseDoctor)(projectRoot,{env:environment,runner:versionRunner(controller.signal,environment,projectRoot),providerProbe:undefined}));
+      const normalized=normalDoctor(diagnostic,environment);forbidden=normalized.forbidden;delete normalized.forbidden;Object.assign(bundle,normalized);
+      bundle.versions.rivet=version(metadata.version,forbidden);bundle.versions.node=version(process.version,forbidden);
+    }catch {incomplete(controller.signal.aborted?(timedOut?'timeout':'cancelled'):'doctor-failed')}
+    if(options.probeHarnesses===true){
+      bundle.harnesses.status='failed';
+      try {
+        const rows=await bounded(()=>(options.discoverHarnesses??discoverHarnesses)({env:environment,projectRoot,signal:controller.signal}));
+        bundle.harnesses={status:'complete',results:normalHarnesses(rows,forbidden)};
+      }catch {incomplete(controller.signal.aborted?(timedOut?'timeout':'cancelled'):'harness-probe-failed')}
+    }
+    if(controller.signal.aborted)incomplete(timedOut?'timeout':'cancelled');
+  }catch {incomplete('collector-failed')}
+  finally {
+    clearTimeout(timer);controller.abort();
+    if(options.signal!==undefined)try{Reflect.apply(EventTarget.prototype.removeEventListener,options.signal,['abort',abort])}catch{}
+  }
+  return Object.freeze(bundle);
+}

package/src/support/failure-report.js

@@ -0,0 +1,96 @@
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdtemp, open, readFile, realpath } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join } from 'node:path';
+import metadata from '../../package.json' with { type: 'json' };
+import { EXIT_CODES } from '../cli/output.js';
+import { collectSupportBundle } from './bundle.js';
+
+const COMMANDS = new Set(['doctor','support','delivery','evidence','feature','goals','init','install','models','integrations','repositories','orchestrate','preflight','protocols','run','status','setup','uninstall','verify','work','task','worktrees']);
+const SUBCOMMANDS = new Set(['status','start','approve','resume','deps','recover','propose','watch','prepare','publish','review','merge','deploy','inspect','list','check','discover','configure','intake','add','remove','show','validate','plan','activate','cancel','stop','next','complete','submit','verify','record','sync','doctor','create','clean']);
+const PLATFORMS = new Set(['aix','darwin','freebsd','linux','openbsd','sunos','win32']);
+const ARCHITECTURES = new Set(['arm','arm64','ia32','loong64','mips','mipsel','ppc','ppc64','riscv64','s390','s390x','x64']);
+// Deliberately closed: arbitrary provider/OS codes can contain private input.
+// These values correspond to fixed error constructors/reasons in Rivet source.
+const CAUSE_CODES = new Set([
+  'ERR_HOST_RUN_BUSY', 'ERR_HOST_RUN_STALE_LOCK', 'ERR_HOST_RUN_RECOVERY_STATE',
+  'ERR_FEATURE_RUN_VERSION_CONFLICT', 'ERR_INVALID_FEATURE_RUN', 'ERR_INVALID_FEATURE_PLAN',
+  'ERR_INVALID_FEATURE_DECOMPOSITION', 'ERR_FEATURE_RUNTIME_BRIDGE', 'ERR_VERIFICATION_REPORT_VERSION_CONFLICT',
+  'ERR_FEATURE_WORKFLOW_CONFIGURATION', 'ERR_FEATURE_WORKFLOW_PROPOSAL_MISMATCH',
+  'ERR_FEATURE_WORKFLOW_STATE_CONFLICT', 'ERR_FEATURE_WORKFLOW_REPOSITORY', 'ERR_FEATURE_WORKFLOW_RUN_MISSING',
+  'ERR_HOST_EXECUTION_VERIFICATION_FAILED', 'ERR_HOST_EXECUTION_STATE_CONFLICT', 'ERR_HOST_EXECUTION_REPOSITORY',
+  'ERR_LOCAL_APPROVAL_INVALID', 'ERR_LOCAL_APPROVAL_CONFIGURATION', 'ERR_LOCAL_APPROVAL_INTERRUPTED', 'ERR_LOCAL_APPROVAL_CANCELLED',
+  'ERR_GIT_NON_FAST_FORWARD', 'ERR_GIT_REPOSITORY_CHANGED', 'ERR_GIT_REPOSITORY_PATH_UNSAFE',
+  'ERR_GIT_UNSAFE_EXECUTABLE', 'ERR_GIT_GIT_OUTPUT_INVALID', 'ERR_GIT_REVIEW_DIFF_UNAVAILABLE',
+  'ERR_AGENT_TIMEOUT', 'ERR_AGENT_PROVIDER_UNAVAILABLE', 'ERR_AGENT_ABORTED', 'ERR_AGENT_OUTPUT_INVALID',
+  'ERR_AGENT_EXECUTABLE_UNSAFE', 'ERR_AGENT_CWD_UNSAFE', 'ERR_AGENT_TEMPLATE_INVALID',
+  'ERR_APPLICATION_CONFIGURATION', 'ERR_STATE_VERSION_CONFLICT', 'ERR_RUNTIME_APPROVAL_REQUIRED',
+  'ERR_RUNTIME_NOT_ACTIVATED', 'ERR_RUNTIME_VERSION_CONFLICT', 'ERR_RUNTIME_CLIENT_OUTPUT',
+]);
+const ISSUE_URL = 'https://github.com/Agilno-Tech/rivet/issues/new';
+let fingerprint;
+async function runtimeFingerprint() {
+  // Only installed Rivet source files, never the user's repository or runtime state.
+  return fingerprint ??= Promise.all(['../../package.json','../cli/main.js','../cli/parse-args.js'].map(path=>readFile(new URL(path,import.meta.url))))
+    .then(files=>{const hash=createHash('sha256');for(const file of files)hash.update(String(file.length)).update(':').update(file);return hash.digest('hex');})
+    .catch(()=>null);
+}
+function version(value) { return typeof value==='string' && /^v?\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[A-Za-z0-9.-]{1,64})?$/.test(value) ? value.replace(/^v/,'') : 'unknown'; }
+async function safeParent(temporaryDirectory) {
+  const selected=temporaryDirectory??tmpdir();
+  if(typeof selected!=='string'||!isAbsolute(selected)||/[\0\r\n]/.test(selected))throw new Error();
+  const initial=await lstat(selected);
+  if(!initial.isDirectory()||initial.isSymbolicLink())throw new Error();
+  const parent=await realpath(selected),uid=process.getuid?.();
+  for(let current=parent;;current=dirname(current)) {
+    const stat=await lstat(current);
+    if(!stat.isDirectory()||stat.isSymbolicLink())throw new Error();
+    if(uid!==undefined && stat.uid!==uid && stat.uid!==0)throw new Error();
+    // A root-owned sticky system temp directory is safe for a private mkdtemp child.
+    if(uid!==undefined && (stat.mode&0o022)!==0 && !(stat.uid===0 && (stat.mode&0o1000)!==0))throw new Error();
+    if(dirname(current)===current)break;
+  }
+  return parent;
+}
+async function savePrivate(report,{temporaryDirectory}={}) {
+  const serialized=`${JSON.stringify(report,null,2)}\n`;
+  if(Buffer.byteLength(serialized)>64*1024)throw new Error();
+  const parent=await safeParent(temporaryDirectory);
+  const directory=await mkdtemp(join(parent,'rivet-support-'));
+  await chmod(directory,0o700);
+  const stat=await lstat(directory);
+  if(!stat.isDirectory()||stat.isSymbolicLink()||(process.getuid && stat.uid!==process.getuid())||(stat.mode&0o777)!==0o700)throw new Error();
+  const path=join(directory,'report.json');
+  const file=await open(path,constants.O_WRONLY|constants.O_CREAT|constants.O_EXCL|(constants.O_NOFOLLOW??0),0o600);
+  try {
+    const opened=await file.stat();
+    if(!opened.isFile()||opened.nlink!==1||(opened.mode&0o777)!==0o600||(process.getuid && opened.uid!==process.getuid()))throw new Error();
+    await file.writeFile(serialized,'utf8');await file.sync();
+  } finally { await file.close(); }
+  return {path,report};
+}
+
+/** Best effort: accepts only fixed public categories; never records raw error data. */
+export async function saveFailureReport(input={},storage={}) {
+  try {
+    const code=typeof input.code==='string' && Object.hasOwn(EXIT_CODES,input.code) && input.code!=='SUCCESS' ? input.code : 'INTERNAL_ERROR';
+    const command=COMMANDS.has(input.command)?input.command:'unknown';
+    const report={schemaVersion:1,format:'rivet-failure-report',createdAt:new Date().toISOString(),
+      versions:{rivet:version(metadata.version),node:version(process.version),platform:PLATFORMS.has(process.platform)?process.platform:'unknown',architecture:ARCHITECTURES.has(process.arch)?process.arch:'unknown'},
+      runtimeFingerprint:await runtimeFingerprint(),command:{name:command,subcommand:command!=='unknown'&&SUBCOMMANDS.has(input.subcommand)?input.subcommand:null},
+      failure:{code,exitCode:EXIT_CODES[code],causeCode:CAUSE_CODES.has(input.causeCode)?input.causeCode:null},
+      sharing:{issueUrl:ISSUE_URL,instructions:'Review this file before attaching it to an issue. Add reproduction steps and expected behavior. No upload is performed.'}};
+    return await savePrivate(report,storage);
+  } catch { return null; }
+}
+
+/** Persist only the existing allowlisted collector's output, never a raw caller bundle. */
+export async function saveSupportReport(projectRoot,collectorOptions={},storage={}) {
+  try {
+    const collected=await collectSupportBundle(projectRoot,collectorOptions);
+    const report={...collected,format:'rivet-support-report',createdAt:new Date().toISOString(),runtimeFingerprint:await runtimeFingerprint(),
+      versions:{...collected.versions,rivet:collected.versions.rivet===null?null:version(metadata.version)}};
+    return await savePrivate(report,storage);
+  } catch { throw new Error('Support report could not be saved.'); }
+}

package/src/work-request/contract.js

@@ -0,0 +1,250 @@
+import { createHash } from 'node:crypto';
+import { isIP } from 'node:net';
+
+import { containsSecretMaterial, immutableJson } from '../clients/contract.js';
+
+const INPUT_KEYS = new Set([
+  'source', 'title', 'description', 'acceptanceCriteria', 'contextRefs', 'capturedAt',
+]);
+const OPTIONAL_KEYS = ['context', 'criteriaProvenance'];
+const REQUEST_KEYS = new Set(['schemaVersion', ...INPUT_KEYS, 'digest']);
+const SOURCE_KEYS = new Set(['kind', 'ref', 'revision', 'url']);
+const SOURCE_KINDS = new Set(['inline', 'markdown', 'jira', 'linear', 'host-observation']);
+const TICKET = /^[A-Z][A-Z0-9]{0,31}-[1-9][0-9]{0,15}$/;
+const SHA256_REVISION = /^sha256:[a-f0-9]{64}$/;
+const PRIVATE_IPV4 = /^(?:0|10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168|224|240)(?:\.|$)/;
+
+export class WorkRequestError extends Error {
+  constructor() {
+    super('Work request is invalid.');
+    this.name = 'WorkRequestError';
+    this.code = 'ERR_INVALID_WORK_REQUEST';
+    this.safeMessage = this.message;
+  }
+}
+
+function fail() { throw new WorkRequestError(); }
+
+function captureRecord(input, allowed, required = allowed) {
+  let array;
+  let prototype;
+  let keys;
+  try {
+    array = Array.isArray(input);
+    prototype = Object.getPrototypeOf(input);
+    keys = Reflect.ownKeys(input);
+  } catch { fail(); }
+  if (!input || typeof input !== 'object' || array
+    || (prototype !== Object.prototype && prototype !== null)
+    || keys.length > allowed.size || keys.some(key => typeof key !== 'string' || !allowed.has(key))) fail();
+  const output = Object.create(null);
+  for (const key of keys) {
+    let descriptor;
+    let value;
+    try {
+      descriptor = Object.getOwnPropertyDescriptor(input, key);
+      value = input[key];
+    } catch { fail(); }
+    if (!descriptor?.enumerable) fail();
+    output[key] = value;
+  }
+  if ([...required].some(key => !Object.hasOwn(output, key))) fail();
+  return output;
+}
+
+function string(value, maximum) {
+  if (typeof value !== 'string' || value.length < 1 || value.length > maximum
+    || value.normalize('NFKC') !== value || /[\u0000\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value)
+    || containsSecretMaterial(value)) fail();
+  return value;
+}
+
+function list(value, { maximum, itemMaximum }) {
+  let array;
+  let prototype;
+  let length;
+  let keys;
+  try {
+    array = Array.isArray(value);
+    prototype = Object.getPrototypeOf(value);
+    length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+    keys = Reflect.ownKeys(value);
+  } catch { fail(); }
+  if (!array || prototype !== Array.prototype || !Number.isSafeInteger(length)
+    || length < 0 || length > maximum || keys.length !== length + 1) fail();
+  const output = [];
+  for (let index = 0; index < length; index += 1) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    if (!descriptor?.enumerable || !Object.hasOwn(descriptor, 'value')) fail();
+    output.push(string(descriptor.value, itemMaximum));
+  }
+  if (new Set(output).size !== output.length) fail();
+  return Object.freeze(output);
+}
+
+// User additions remain explicit, bounded data, never inferred tracker content.
+export function userAcceptanceCriteria(input) {
+  const values = list(input, { maximum: 256, itemMaximum: 4096 });
+  if (!values.length || Buffer.byteLength(JSON.stringify(values), 'utf8') > 64 * 1024
+    || values.some(value => !value.trim() || /[\u0000-\u001f\u007f]/.test(value))) fail();
+  return values;
+}
+
+export function parseAcceptanceCriteriaText(input) {
+  if (typeof input !== 'string' || Buffer.byteLength(input, 'utf8') > 64 * 1024
+    || /[\u0000-\u0009\u000b\u000c\u000e-\u001f\u007f]/.test(input)) fail();
+  const normalized = input.replaceAll('\r\n', '\n');
+  if (normalized.includes('\r')) fail();
+  return userAcceptanceCriteria(normalized.split('\n').map(value => value.trim()));
+}
+
+function criteriaProvenance(input, output) {
+  const value = captureRecord(input, new Set(['sourceAcceptanceCriteria', 'userAcceptanceCriteria']));
+  if (!['jira', 'linear'].includes(output.source.kind)) fail();
+  const sourceAcceptanceCriteria = list(value.sourceAcceptanceCriteria, { maximum: 256, itemMaximum: 4096 });
+  const additions = userAcceptanceCriteria(value.userAcceptanceCriteria);
+  if (JSON.stringify([...new Set([...sourceAcceptanceCriteria, ...additions])]) !== JSON.stringify(output.acceptanceCriteria)) fail();
+  return Object.freeze({ sourceAcceptanceCriteria, userAcceptanceCriteria: additions });
+}
+
+function safeRelativePath(value) {
+  const normalized = string(value, 512).replaceAll('\\', '/');
+  if (normalized === '.' || normalized.startsWith('/') || normalized.endsWith('/')
+    || normalized.includes('//') || /^[A-Za-z]:/.test(normalized)
+    || normalized.split('/').some(part => !part || part === '.' || part === '..')) fail();
+  return normalized;
+}
+
+function safeUrl(value, host = false) {
+  string(value, 2048);
+  let parsed;
+  try { parsed = new URL(value); } catch { fail(); }
+  const hostname = parsed.hostname.toLowerCase();
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || (!host && parsed.search) || parsed.hash
+    || hostname === 'localhost' || hostname.endsWith('.localhost')
+    || (isIP(hostname) === 4 && PRIVATE_IPV4.test(hostname))
+    || (isIP(hostname) === 6 && (hostname === '::1' || hostname.startsWith('fc') || hostname.startsWith('fd') || hostname.startsWith('fe80:')))) fail();
+  if (host && [...parsed.searchParams].some(([key, item]) => !['node-id', 'pageId'].includes(key) || !/^[A-Za-z0-9:_-]{1,128}$/.test(item))) fail();
+  return parsed.toString();
+}
+
+function timestamp(value) {
+  string(value, 64);
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime()) || date.toISOString() !== value) fail();
+  return value;
+}
+
+function source(input) {
+  const value = captureRecord(input, SOURCE_KEYS, new Set(['kind', 'ref']));
+  const kind = string(value.kind, 16);
+  if (!SOURCE_KINDS.has(kind)) fail();
+  let ref = string(value.ref, 512);
+  if (kind === 'inline' && ref !== 'inline') fail();
+  if (kind === 'markdown') ref = safeRelativePath(ref);
+  if ((kind === 'jira' || kind === 'linear') && !TICKET.test(ref)) fail();
+  let revision;
+  if (value.revision !== undefined) {
+    revision = string(value.revision, 256);
+    if (kind === 'markdown' && !SHA256_REVISION.test(revision)) fail();
+  }
+  const result = {
+    kind,
+    ref,
+    ...(revision === undefined ? {} : { revision }),
+    ...(value.url === undefined ? {} : { url: safeUrl(value.url, kind === 'host-observation') }),
+  };
+  if ((kind === 'inline' || kind === 'markdown') && result.url !== undefined) fail();
+  return Object.freeze(result);
+}
+
+function canonical(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+}
+
+function context(input) {
+  let value;
+  try { value = immutableJson(input); } catch { fail(); }
+  if (Buffer.byteLength(JSON.stringify(value), 'utf8') > 64 * 1024) fail();
+  captureRecord(value, new Set(['sources', 'userAcceptanceCriteria']));
+  if (!Array.isArray(value.sources) || value.sources.length < 1 || value.sources.length > 16) fail();
+  const identities = new Set();
+  for (const item of value.sources) {
+    captureRecord(item, new Set(['provider', 'providerId', 'projectId', 'resourceId', 'url', 'revision',
+      'capturedAt', 'transport', 'assurance', 'tool', 'content', 'contentDigest']));
+    if (!['jira', 'linear', 'figma', 'confluence', 'generic'].includes(item.provider)
+      || item.transport !== 'harness-mcp' || item.assurance !== 'harness-observed') fail();
+    for (const key of ['providerId', 'projectId', 'resourceId', 'revision', 'tool']) string(item[key], 200);
+    safeUrl(item.url, true);
+    timestamp(item.capturedAt);
+    if (!item.content || typeof item.content !== 'object' || Array.isArray(item.content)
+      || containsSecretMaterial(JSON.stringify(item.content))) fail();
+    const digest = createHash('sha256').update(canonical(item.content)).digest('hex');
+    if (item.contentDigest !== digest) fail();
+    const identity = `${item.providerId}:${item.resourceId}`;
+    if (identities.has(identity)) fail();
+    identities.add(identity);
+  }
+  list(value.userAcceptanceCriteria, { maximum: 256, itemMaximum: 4096 });
+  return value;
+}
+
+function capturedInput(input, request = false) {
+  const required = request ? REQUEST_KEYS : INPUT_KEYS;
+  const value = captureRecord(input, new Set([...required, ...OPTIONAL_KEYS]), required);
+  if (request && value.schemaVersion !== 1) fail();
+  const acceptanceCriteria = list(value.acceptanceCriteria, { maximum: 256, itemMaximum: 4096 });
+  if (acceptanceCriteria.length === 0) fail();
+  const contextRefs = list(value.contextRefs, { maximum: 256, itemMaximum: 2048 });
+  const output = {
+    schemaVersion: 1,
+    source: source(value.source),
+    title: string(value.title, 500),
+    description: string(value.description, 131072),
+    acceptanceCriteria,
+    contextRefs,
+    capturedAt: timestamp(value.capturedAt),
+  };
+  if (value.context !== undefined) output.context = context(value.context);
+  if (value.criteriaProvenance !== undefined) output.criteriaProvenance = criteriaProvenance(value.criteriaProvenance, output);
+  if (output.source.kind === 'host-observation') {
+    const primary = output.context?.sources[0];
+    if (!primary || output.source.ref !== `${primary.providerId}:${primary.resourceId}`
+      || output.source.revision !== `sha256:${primary.contentDigest}` || output.source.url !== primary.url) fail();
+  }
+  if (request) output.digest = string(value.digest, 64);
+  return output;
+}
+
+function digestPayload(value) {
+  return {
+    schemaVersion: value.schemaVersion,
+    source: value.source,
+    title: value.title,
+    description: value.description,
+    acceptanceCriteria: value.acceptanceCriteria,
+    contextRefs: value.contextRefs,
+    capturedAt: value.capturedAt,
+    ...(value.context === undefined ? {} : { context: value.context }),
+    ...(value.criteriaProvenance === undefined ? {} : { criteriaProvenance: value.criteriaProvenance }),
+  };
+}
+
+export function workRequestDigest(input) {
+  const value = capturedInput(input, Object.hasOwn(input ?? {}, 'digest'));
+  return createHash('sha256').update(canonical(digestPayload(value))).digest('hex');
+}
+
+export function createWorkRequest(input) {
+  const value = capturedInput(input);
+  return Object.freeze({ ...value, digest: createHash('sha256').update(canonical(value)).digest('hex') });
+}
+
+export function validateWorkRequest(input) {
+  const value = capturedInput(input, true);
+  if (!/^[a-f0-9]{64}$/.test(value.digest)
+    || createHash('sha256').update(canonical(digestPayload(value))).digest('hex') !== value.digest) fail();
+  return input;
+}

package/src/work-request/host.js

@@ -0,0 +1,78 @@
+import { createIntegrationRegistry } from '../integrations/registry.js';
+import { normalizeHostObservation } from '../integrations/host-observation.js';
+import { fields, snapshot } from '../integrations/capabilities.js';
+import { createWorkRequest, WorkRequestError } from './contract.js';
+
+const CAPABILITIES = { jira: 'issues-read', linear: 'issues-read', figma: 'files-read', confluence: 'pages-read', generic: 'context-read' };
+const TICKET = /^[A-Z][A-Z0-9]{0,31}-[1-9][0-9]{0,15}$/;
+function fail() { throw new WorkRequestError(); }
+
+function requestId(value, provider) {
+  if (typeof value !== 'string') fail();
+  if (!value.startsWith('https://')) return value;
+  let url;
+  try { url = new URL(value); } catch { fail(); }
+  if (!provider.endpoint || url.origin !== new URL(provider.endpoint).origin || url.username || url.password || url.search || url.hash) fail();
+  const expression = provider.kind === 'jira' ? /^\/browse\/([A-Z][A-Z0-9]*-[1-9][0-9]*)\/?$/
+    : provider.kind === 'linear' ? /^\/[^/]+\/issue\/([A-Z][A-Z0-9]*-[1-9][0-9]*)(?:\/[^/]+)?\/?$/ : null;
+  const match = expression?.exec(url.pathname);
+  if (!match) fail();
+  return match[1];
+}
+
+export function resolveHostWorkRequest({ config, bundle: raw, capturedAt }) {
+  const bundle = snapshot(raw);
+  fields(bundle, ['schemaVersion', 'projectId', 'host', 'request', 'observations', 'userAcceptanceCriteria'],
+    ['schemaVersion', 'projectId', 'host', 'request', 'observations']);
+  if (bundle.schemaVersion !== 1 || bundle.projectId !== config.project.id
+    || !Array.isArray(bundle.observations) || bundle.observations.length < 1 || bundle.observations.length > 16) fail();
+  fields(bundle.request, ['providerId', 'resourceId']);
+  const registry = createIntegrationRegistry({ config, projectId: config.project.id, host: bundle.host });
+  const primaryProvider = registry.list().find(p => p.id === bundle.request.providerId);
+  if (!primaryProvider || !['jira', 'linear'].includes(primaryProvider.kind)) fail();
+  const primaryId = requestId(bundle.request.resourceId, primaryProvider);
+  if (!TICKET.test(primaryId)) fail();
+  const sources = bundle.observations.map(observation => {
+    const descriptor = registry.list().find(p => p.id === observation.providerId);
+    if (!descriptor || !CAPABILITIES[descriptor.kind]) fail();
+    const provider = registry.resolve({ providerId: descriptor.id, capability: CAPABILITIES[descriptor.kind], tool: observation.tool });
+    const normalized = normalizeHostObservation(observation, { provider, projectId: config.project.id });
+    const { schemaVersion, sourceUrl, ...source } = normalized;
+    if (!source.content || typeof source.content !== 'object' || Array.isArray(source.content)) fail();
+    const url = new URL(sourceUrl);
+    const segments = url.pathname.split('/').filter(Boolean);
+    if (source.provider === 'jira' && (segments.length !== 2 || segments[0] !== 'browse' || segments[1] !== source.resourceId)) fail();
+    if (source.provider === 'linear' && (segments[1] !== 'issue' || segments[2] !== source.resourceId)) fail();
+    if (source.provider === 'figma' && (!['file', 'design', 'board', 'proto'].includes(segments[0]) || segments[1] !== source.resourceId)) fail();
+    if (source.provider === 'confluence' && !(url.searchParams.get('pageId') === source.resourceId
+      || segments.some((part, index) => part === 'pages' && segments[index + 1] === source.resourceId))) fail();
+    if (['jira', 'linear'].includes(source.provider)) {
+      fields(source.content, ['title', 'description', 'acceptanceCriteria']);
+      if (!Array.isArray(source.content.acceptanceCriteria) || !TICKET.test(source.resourceId)) fail();
+    } else {
+      fields(source.content, ['title', 'text']);
+      if (typeof source.content.title !== 'string' || !source.content.title || typeof source.content.text !== 'string' || !source.content.text) fail();
+    }
+    return { ...source, url: sourceUrl };
+  });
+  const selected = sources.filter(s => s.providerId === bundle.request.providerId && s.resourceId === primaryId);
+  if (selected.length !== 1) fail();
+  const primary = selected[0];
+  const additions = bundle.userAcceptanceCriteria ?? [];
+  if (!Array.isArray(additions)) fail();
+  const acceptanceCriteria = [...new Set([...primary.content.acceptanceCriteria, ...additions])];
+  if (!acceptanceCriteria.length) {
+    const error = new WorkRequestError();
+    error.safeMessage = 'The source has no acceptance criteria. Ask the user and supply explicit userAcceptanceCriteria before proposing work.';
+    throw error;
+  }
+  return createWorkRequest({
+    source: { kind: 'host-observation', ref: `${primary.providerId}:${primary.resourceId}`, revision: `sha256:${primary.contentDigest}`, url: primary.url },
+    title: primary.content.title,
+    description: primary.content.description,
+    acceptanceCriteria,
+    contextRefs: sources.map(s => `${s.providerId}:${s.resourceId}:sha256:${s.contentDigest}`),
+    capturedAt,
+    context: { sources: [primary, ...sources.filter(s => s !== primary)], userAcceptanceCriteria: additions },
+  });
+}