@awak-app/simy-cli 0.5.6 → 0.5.7

package/README.md

@@ -380,3 +380,14 @@ Publishing is handled by GitHub Actions in `.github/workflows/publish.yml`.
   `@awak-app/simy-cli`.
 - The package check inspects the final npm tarball contents and fails if any
   source map file would be published.
+
+### Repository system scopes
+
+Version 0.5.7 supports signed `system_scope` snapshots from Quality Monitor.
+Each check pins the repository's connected component and graph revision. A new
+check revalidates scoped bundles online; a stale or unavailable scope cannot fall
+back to an older cached component. Minimum and full check proofs retain the
+original snapshot. A scope revision change requires a fresh minimum check.
+Deploy this CLI and the web capability proxy before enabling the backend scope
+requirement. Older clients receive an explicit upgrade error, never an expanded
+organization-wide bundle.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.6";
+export const CLI_VERSION = "0.5.7";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/sqm/bundle-store.js

@@ -41,13 +41,13 @@ export async function loadKnowledgeBundle({
   }
   const cacheIdentity = normalizedCacheIdentity({ endpoint, accountId, organizationId, repository });
   const location = cacheLocation(cacheRoot, cacheIdentity);
-  const validation = { cliVersion, publicKeys, organizationId };
+  const validation = { cliVersion, publicKeys, organizationId, repository };
   const cached = await readVerifiedCache(location, validation, cacheIdentity);
   const fresh =
     cached &&
     now - cached.fetchedAt < ttlMs &&
     Date.parse(cached.bundle.expires_at) > now;
-  if (!offline && endpoint && (!fresh || refresh)) {
+  if (!offline && endpoint && (!fresh || refresh || cached?.bundle.system_scope)) {
     try {
       const fetched = await fetchBundle({ endpoint, repository, cliVersion, token, organizationId, etag: cached?.etag, fetchImpl });
       if (fetched.notModified) {
@@ -56,6 +56,7 @@ export async function loadKnowledgeBundle({
         await writeMetadata(location, { ...cached.metadata, fetched_at: new Date(now).toISOString(), etag: fetched.etag || cached.etag });
         return result(cached.bundle, [], "cache_revalidated");
       }
+      if (cached?.bundle.system_scope && !fetched.bundle?.system_scope) throw nonFallbackError("SQM Cloud attempted to remove the pinned system scope contract.");
       const discoveredTrust = signingTrustForFetch({
         bundle: fetched.bundle,
         endpoint,
@@ -81,11 +82,12 @@ export async function loadKnowledgeBundle({
       return result(bundle, [], "cloud");
     } catch (error) {
       if (error?.code === "incompatible_cli") throw error;
-      if (error?.fallbackAllowed !== false && cached && Date.parse(cached.bundle.expires_at) > now) return result(cached.bundle, [`SQM Cloud unavailable; using last verified bundle: ${message(error)}`], "stale_cache");
+      if (error?.fallbackAllowed !== false && cached && !cached.bundle.system_scope && Date.parse(cached.bundle.expires_at) > now) return result(cached.bundle, [`SQM Cloud unavailable; using last verified bundle: ${message(error)}`], "stale_cache");
       return result(null, [`SQM knowledge could not be used; shadow checks were skipped: ${message(error)}`], "unavailable");
     }
   }
   if (cached) {
+    if (cached.bundle.system_scope) return result(null, ["SQM system scope must be revalidated online before a new check."], "unavailable");
     if (Date.parse(cached.bundle.expires_at) <= now) return result(null, ["The cached SQM knowledge bundle is expired; shadow checks were skipped."], "unavailable");
     const warnings = [];
     if (offline) warnings.push("SQM is offline; using the last verified knowledge bundle.");
@@ -96,10 +98,12 @@ export async function loadKnowledgeBundle({
   return result(null, [`SQM has no verified cache (${reason}); shadow checks were skipped.`], "unavailable");
 }
 
-export function verifyAndValidate(bundle, { cliVersion, publicKeys, organizationId } = {}) {
+export function verifyAndValidate(bundle, { cliVersion, publicKeys, organizationId, repository } = {}) {
   try { validateKnowledgeBundle(bundle, { cliVersion }); } catch (error) { throw nonFallbackError(message(error), error); }
   if (organizationId && bundle.organization_id !== organizationId) throw nonFallbackError(`SQM bundle organization mismatch: expected ${organizationId}.`);
+  if (bundle.system_scope && repository && bundle.system_scope.repository !== repository.toLowerCase()) throw nonFallbackError("SQM bundle repository system scope does not match this repository.");
   for (const module of bundle.modules) {
+    if (bundle.system_scope && module.scope.visibility === "organization" && !module.scope.repositories.some((repo) => bundle.system_scope.repositories.includes(repo.toLowerCase()))) throw nonFallbackError(`SQM module ${module.id} is outside the repository system.`);
     if (module.scope.visibility === "organization" && module.scope.organization_id !== bundle.organization_id) throw nonFallbackError(`SQM module ${module.id} is scoped to a different organization.`);
   }
   const keyId = bundle.integrity.key_id;
@@ -166,6 +170,7 @@ async function fetchBundle({ endpoint, repository, cliVersion, token, organizati
   const url = new URL(endpoint);
   url.searchParams.set("repository", repository);
   url.searchParams.set("cli_version", cliVersion);
+  url.searchParams.set("scope_version", "1");
   const headers = { Accept: "application/json" };
   if (token) headers.Authorization = `Bearer ${token}`;
   if (organizationId) headers["x-simy-org-id"] = organizationId;

package/src/sqm/index.js

@@ -132,7 +132,7 @@ function toLegacyCheck(minCheck, loaded) {
 }
 
 function bundleIdentity(bundle) {
-  return { id: bundle.bundle_id, version: bundle.version, digest: bundle.integrity.digest, signing_key_id: bundle.integrity.key_id };
+  return { id: bundle.bundle_id, version: bundle.version, digest: bundle.integrity.digest, signing_key_id: bundle.integrity.key_id, ...(bundle.system_scope ? { system_scope: bundle.system_scope } : {}) };
 }
 
 function unavailable(warning, repository = null) {

package/src/sqm/proof.js

@@ -57,6 +57,7 @@ export function buildProof({ organizationId, repository, bundle, minCheck, evalu
       version: bundle.version,
       digest: bundle.integrity.digest,
       signing_key_id: bundle.integrity.key_id,
+      ...(bundle.system_scope ? { system_scope: bundle.system_scope } : {}),
     },
     min_check: {
       result_digest: minCheck.result_digest,

package/src/sqm/validation.js

@@ -17,13 +17,27 @@ const SCENARIO_REQUIREMENTS = new Set(["local", "requires_human", "requires_post
 export function validateKnowledgeBundle(bundle, { cliVersion }) {
   const errors = [];
   object(bundle, "$", errors);
-  exactKeys(bundle, ["schema_version", "bundle_id", "version", "organization_id", "generated_at", "expires_at", "modules", "integrity"], "$", errors);
+  exactKeys(bundle, ["schema_version", "bundle_id", "version", "organization_id", "generated_at", "expires_at", "modules", "integrity", "system_scope"], "$", errors);
   equal(bundle?.schema_version, "1.0.0", "$.schema_version", errors);
   stringPattern(bundle?.bundle_id, /^[a-z][a-z0-9._-]{2,127}$/, "$.bundle_id", errors);
   stringPattern(bundle?.version, /^[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.[0-9]+$/, "$.version", errors);
   nullableString(bundle?.organization_id, 200, "$.organization_id", errors);
   dateTime(bundle?.generated_at, "$.generated_at", errors);
   dateTime(bundle?.expires_at, "$.expires_at", errors);
+  if (bundle?.system_scope !== undefined) {
+    const scope = bundle.system_scope;
+    object(scope, "$.system_scope", errors);
+    exactKeys(scope, ["organization_id", "repository", "graph_revision", "repositories"], "$.system_scope", errors);
+    equal(scope?.organization_id, bundle.organization_id, "$.system_scope.organization_id", errors);
+    stringPattern(scope?.repository, REPOSITORY, "$.system_scope.repository", errors);
+    if (!Number.isSafeInteger(scope?.graph_revision) || scope.graph_revision < 0) errors.push("$.system_scope.graph_revision must be a nonnegative integer");
+    if (!Array.isArray(scope?.repositories) || !scope.repositories.length || !scope.repositories.includes(scope.repository)) {
+      errors.push("$.system_scope.repositories must contain the target repository");
+    } else {
+      for (const repo of scope.repositories) stringPattern(repo, REPOSITORY, "$.system_scope.repositories[]", errors);
+      if (new Set(scope.repositories).size !== scope.repositories.length) errors.push("$.system_scope.repositories must be unique");
+    }
+  }
   if (!Array.isArray(bundle?.modules)) errors.push("$.modules must be an array");
   for (const [index, module] of (bundle?.modules || []).entries()) {
     validateModule(module, `$.modules[${index}]`, errors, cliVersion);