@bradheitmann/odin-sentinel 0.4.11 → 0.4.13

package/scripts/audit/verify-pack.mjs

@@ -1,5 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 
 export const MINIMUM_COMPATIBLE_CHILD_MCP_VERSION = "0.4.5";
@@ -13,7 +14,11 @@ const requiredProtocolFiles = [
   "protocol/delegation.yaml",
   "protocol/receipts/boot-receipt.yaml",
   "protocol/receipts/team-manifest.yaml",
-  "protocol/bootstrap-skill.md"
+  "protocol/bootstrap-skill.md",
+  "protocol/skill-references/boot-receipt-examples.md",
+  "protocol/skill-references/canonical-introduction-prompt.md",
+  "protocol/skill-references/harness-skill-targets.md",
+  "protocol/skill-references/team-bootstrap-runbook.md"
 ];
 
 const requiredTemplateFiles = [
@@ -24,6 +29,7 @@ const requiredTemplateFiles = [
 ];
 
 export const requiredPackageFiles = [
+  ".claude-plugin/marketplace.json",
   "dist/src/bin/index.js",
   "dist/src/mcp/server.js",
   "dist/src/protocol/index.js",
@@ -40,9 +46,22 @@ export const requiredPackageFiles = [
   "docs/reference/distribution.md",
   "docs/reference/public-surface-audit.md",
   ...requiredProtocolFiles,
+  "plugins/odin-scp/.claude-plugin/plugin.json",
+  "plugins/odin-scp/skills/odin-scp/SKILL.md",
+  "plugins/odin-scp/skills/odin-scp/CHANGELOG.md",
+  "plugins/odin-scp/skills/odin-scp/agents/openai.yaml",
+  "plugins/odin-scp/skills/odin-scp/references/boot-receipt-examples.md",
+  "plugins/odin-scp/skills/odin-scp/references/canonical-introduction-prompt.md",
+  "plugins/odin-scp/skills/odin-scp/references/harness-skill-targets.md",
+  "plugins/odin-scp/skills/odin-scp/references/team-bootstrap-runbook.md",
+  "plugins/odin-scp/skills/odin-scp/scripts/sync-installations.sh",
+  "plugins/odin-scp/README.md",
   ...requiredTemplateFiles,
   "scripts/audit/public-surface.mjs",
   "scripts/audit/verify-pack.mjs",
+  "scripts/protocol/install-activation-hooks.mjs",
+  "scripts/protocol/verify-governed-context.mjs",
+  "scripts/protocol/verify-instruction-read.mjs",
   "AGENTS.md",
   "CLAUDE.md",
   "README.md",
@@ -67,14 +86,20 @@ const protocolResourceVersionLockedFiles = new Set([
   "protocol/topology.yaml"
 ]);
 
-const forbiddenPackagePrefixes = ["project/" + "planning" + "/", "." + "edge-" + "agentic" + "/local/"];
+const forbiddenPackagePrefixes = ["docs/handoffs/", "project/" + "planning" + "/", "." + "edge-" + "agentic" + "/local/"];
+const AUDIT_SCRIPT_EXEMPTIONS = new Set(["scripts/audit/public-surface.mjs", "scripts/audit/verify-pack.mjs"]);
+const INTERNAL_HANDOFF_REFERENCE_EXEMPTIONS = new Set([...AUDIT_SCRIPT_EXEMPTIONS, "docs/reference/distribution.md"]);
 const forbiddenPackagedContentRules = [
   { name: "local evidence path", pattern: new RegExp(`\\.${"edge-" + "agentic"}/local`, "i") },
   { name: "local ODIN audit path", pattern: /\.odin\/local\//i },
   { name: "private planning path", pattern: new RegExp(`project/${"planning"}/`, "i") },
+  { name: "internal handoff path reference", pattern: /docs\/handoffs\//i, exemptFiles: INTERNAL_HANDOFF_REFERENCE_EXEMPTIONS },
   { name: "macOS home path", pattern: new RegExp(`/${"Users"}/[A-Za-z0-9._-]+/`) },
   { name: "Linux home path", pattern: /\/home\/[A-Za-z0-9._-]+\// },
-  { name: "secret-looking assignment", pattern: /(api[_-]?key|secret|token|password)\s*[:=]\s*["'][^"']+["']/i }
+  { name: "secret-looking quoted assignment", pattern: /(api[_-]?key|secret|token|password)\s*[:=]\s*["'][^"']+["']/i },
+  { name: "secret-looking unquoted assignment", pattern: /(api[_-]?key|secret|token|password)\s*[:=]\s*[A-Za-z0-9._~+/=-]{16,}/i },
+  { name: "bearer token literal", pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
+  { name: "URI credential literal", pattern: /[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s:@]+@/i }
 ];
 
 function asPathSet(paths) {
@@ -89,7 +114,10 @@ export function validatePackageMetadata(packageJson) {
   if (!packageJson.license) errors.push("package.json missing license");
   if (!packageJson.engines?.node) errors.push("package.json missing engines.node");
   if (!Array.isArray(packageJson.files) || packageJson.files.length === 0) errors.push("package.json missing files allowlist");
-  for (const file of ["docs", "protocol", "templates", "AGENTS.md", "CLAUDE.md", "README.md", "LICENSE"]) {
+  if (packageJson.scripts?.prepublishOnly !== "pnpm run validate") {
+    errors.push("package.json prepublishOnly must run pnpm run validate");
+  }
+  for (const file of [".claude-plugin", "docs", "plugins", "protocol", "templates", "AGENTS.md", "CLAUDE.md", "README.md", "LICENSE"]) {
     if (!packageJson.files?.includes(file)) errors.push(`package.json files allowlist missing ${file}`);
   }
   if (packageJson.odin?.publicVersion !== packageJson.version) {
@@ -106,6 +134,30 @@ export function validatePackageMetadata(packageJson) {
   return errors;
 }
 
+function walkFiles(dir) {
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).flatMap((entry) => {
+    const path = join(dir, entry);
+    return statSync(path).isDirectory() ? walkFiles(path) : [path];
+  });
+}
+
+function expectedGeneratedDistFiles() {
+  const expected = new Set();
+  for (const file of walkFiles("src")) {
+    if (!file.endsWith(".ts") || file.endsWith(".d.ts")) continue;
+    const jsFile = file.replace(/^src\//, "dist/src/").replace(/\.ts$/, ".js");
+    expected.add(jsFile);
+    expected.add(`${jsFile}.map`);
+    expected.add(jsFile.replace(/\.js$/, ".d.ts"));
+  }
+  return expected;
+}
+
+function allowedGeneratedDistFiles() {
+  return new Set([...requiredPackageFiles.filter((file) => file.startsWith("dist/")), ...expectedGeneratedDistFiles()]);
+}
+
 export function validatePackFileList(pathsInput) {
   const paths = asPathSet(pathsInput);
   const errors = [];
@@ -118,6 +170,10 @@ export function validatePackFileList(pathsInput) {
   const privatePaths = Array.from(paths).filter((file) => forbiddenPackagePrefixes.some((prefix) => file.startsWith(prefix)));
   if (privatePaths.length > 0) errors.push(`Package includes private local paths: ${privatePaths.join(", ")}`);
 
+  const allowed = new Set([...requiredPackageFiles, ...allowedGeneratedDistFiles()]);
+  const unexpected = Array.from(paths).filter((file) => !allowed.has(file));
+  if (unexpected.length > 0) errors.push(`Package includes unexpected files: ${unexpected.join(", ")}`);
+
   return errors;
 }
 
@@ -125,6 +181,7 @@ export function validatePackFileContents(fileTextByPath) {
   const findings = [];
   for (const [file, text] of Object.entries(fileTextByPath)) {
     for (const rule of forbiddenPackagedContentRules) {
+      if (rule.exemptFiles?.has(file)) continue;
       if (rule.pattern.test(text)) findings.push(`${file}: ${rule.name}`);
     }
   }
@@ -186,6 +243,56 @@ export function findStaleVersionReferences(fileTextByPath, currentVersion, minim
   return findings;
 }
 
+export function findUnpinnedInstallReferences(fileTextByPath, currentVersion) {
+  const findings = [];
+  const packageName = "@bradheitmann/odin-sentinel";
+  const pinned = `${packageName}@${currentVersion}`;
+  const commandMarkers = [
+    "pnpm",
+    "npx",
+    "npm",
+    "claude mcp",
+    "--package",
+    "installurl",
+    "\"args\"",
+    "args =",
+    "command"
+  ];
+
+  for (const [file, text] of Object.entries(fileTextByPath)) {
+    if (AUDIT_SCRIPT_EXEMPTIONS.has(file)) continue;
+    const lines = text.split("\n");
+    for (const [index, line] of lines.entries()) {
+      if (!line.includes(packageName)) continue;
+      const windowText = lines.slice(Math.max(0, index - 2), Math.min(lines.length, index + 3)).join(" ");
+      const lowerWindow = windowText.toLowerCase();
+      if (!commandMarkers.some((marker) => lowerWindow.includes(marker))) continue;
+      if (windowText.includes(pinned)) continue;
+      findings.push(`${file}:${index + 1}: install command must pin ${pinned}`);
+    }
+  }
+
+  return findings;
+}
+
+export function validateRuntimeVersionConstants(versionText, currentVersion, minimumCompatibleVersion = MINIMUM_COMPATIBLE_CHILD_MCP_VERSION, file = "src/protocol/version.ts") {
+  const errors = [];
+  const required = [
+    [`PROTOCOL_SCHEMA_VERSION`, currentVersion],
+    [`PUBLIC_LATEST_VERSION`, currentVersion],
+    [`MINIMUM_COMPATIBLE_MCP_VERSION`, minimumCompatibleVersion]
+  ];
+
+  for (const [constant, expected] of required) {
+    const pattern = new RegExp(`\\b${constant}\\s*=\\s*["']${expected.replaceAll(".", "\\.")}["']`);
+    if (!pattern.test(versionText)) {
+      errors.push(`${file}: ${constant} must be ${expected}`);
+    }
+  }
+
+  return errors;
+}
+
 export function validatePublicProtocolSync({ scpText, bootstrapText, currentVersion, minimumCompatibleVersion = MINIMUM_COMPATIBLE_CHILD_MCP_VERSION }) {
   const errors = [];
   const requiredMarkers = [
@@ -217,6 +324,9 @@ export function validatePluginSync({ pluginManifestText, pluginSkillText, plugin
     manifest = {};
   }
 
+  if (manifest.name !== "odin-scp") {
+    errors.push(`Claude plugin manifest name ${manifest.name ?? "<missing>"} must be odin-scp`);
+  }
   if (manifest.version !== currentVersion) {
     errors.push(`Claude plugin manifest version ${manifest.version ?? "<missing>"} must match package version ${currentVersion}`);
   }
@@ -226,9 +336,13 @@ export function validatePluginSync({ pluginManifestText, pluginSkillText, plugin
   } else {
     if (server.command !== "pnpm") errors.push("Claude plugin odin-sentinel server must use pnpm");
     const args = Array.isArray(server.args) ? server.args : [];
-    for (const requiredArg of ["dlx", "--package", `@bradheitmann/odin-sentinel@${currentVersion}`, "odin-sentinel-mcp"]) {
+    const expectedArgs = ["dlx", "--package", `@bradheitmann/odin-sentinel@${currentVersion}`, "odin-sentinel-mcp"];
+    for (const requiredArg of expectedArgs) {
       if (!args.includes(requiredArg)) errors.push(`Claude plugin odin-sentinel args missing ${requiredArg}`);
     }
+    if (JSON.stringify(args) !== JSON.stringify(expectedArgs)) {
+      errors.push(`Claude plugin odin-sentinel args must exactly equal ${JSON.stringify(expectedArgs)}`);
+    }
   }
 
   for (const marker of [`SCP_PUBLIC_VERSION: ${currentVersion}`, `MIN_COMPATIBLE_CHILD_MCP: ${minimumCompatibleVersion}`]) {
@@ -244,6 +358,39 @@ export function validatePluginSync({ pluginManifestText, pluginSkillText, plugin
   return errors;
 }
 
+export function validateMarketplaceSync({ marketplaceText, currentVersion }) {
+  const errors = [];
+  let marketplace;
+  try {
+    marketplace = JSON.parse(marketplaceText);
+  } catch {
+    errors.push("Claude marketplace manifest must be valid JSON");
+    marketplace = {};
+  }
+
+  const plugins = Array.isArray(marketplace.plugins) ? marketplace.plugins : [];
+  const odinScp = plugins.find((plugin) => plugin?.name === "odin-scp");
+  if (!odinScp) {
+    errors.push("Claude marketplace manifest must advertise odin-scp");
+  } else {
+    if (odinScp.source !== "./plugins/odin-scp") {
+      errors.push(`Claude marketplace odin-scp source ${odinScp.source ?? "<missing>"} must be ./plugins/odin-scp`);
+    }
+    if (odinScp.version !== currentVersion) {
+      errors.push(`Claude marketplace odin-scp version ${odinScp.version ?? "<missing>"} must match package version ${currentVersion}`);
+    }
+  }
+
+  const legacyName = `sentinel-${"coordination"}-${"protocol"}`;
+  const legacySource = `./plugins/${legacyName}`;
+  const staleLegacy = plugins.find((plugin) => plugin?.name === legacyName || plugin?.source === legacySource);
+  if (staleLegacy) {
+    errors.push("Claude marketplace manifest must not advertise the legacy long-name plugin");
+  }
+
+  return errors;
+}
+
 export function validatePackagedProtocolVersions(fileTextByPath, currentVersion) {
   const errors = [];
   for (const [file, text] of Object.entries(fileTextByPath)) {
@@ -280,11 +427,20 @@ function readPublicVersionFiles() {
     "docs/reference/client-compatibility.md",
     "docs/reference/distribution.md",
     "docs/reference/public-surface-audit.md",
+    "src/protocol/version.ts",
+    ".claude-plugin/marketplace.json",
     "protocol/SCP.md",
     "protocol/bootstrap-skill.md",
-    "plugins/sentinel-coordination-protocol/.claude-plugin/plugin.json",
-    "plugins/sentinel-coordination-protocol/skills/sentinel-coordination-protocol/SKILL.md",
-    "plugins/sentinel-coordination-protocol/README.md"
+    "plugins/odin-scp/.claude-plugin/plugin.json",
+    "plugins/odin-scp/skills/odin-scp/SKILL.md",
+    "plugins/odin-scp/skills/odin-scp/CHANGELOG.md",
+    "plugins/odin-scp/skills/odin-scp/agents/openai.yaml",
+    "plugins/odin-scp/skills/odin-scp/references/boot-receipt-examples.md",
+    "plugins/odin-scp/skills/odin-scp/references/canonical-introduction-prompt.md",
+    "plugins/odin-scp/skills/odin-scp/references/harness-skill-targets.md",
+    "plugins/odin-scp/skills/odin-scp/references/team-bootstrap-runbook.md",
+    "plugins/odin-scp/skills/odin-scp/scripts/sync-installations.sh",
+    "plugins/odin-scp/README.md"
   ].map((file) => [file, readFileSync(file, "utf8")]));
 }
 
@@ -304,15 +460,22 @@ export function runVerifyPack({ pack, packageJson, publicVersionFiles, costPriva
     ...validatePackFileContents(packFileTexts),
     ...validatePackagedProtocolVersions(packFileTexts, packageJson.version),
     ...findStaleVersionReferences(publicVersionFiles, packageJson.version),
+    ...findUnpinnedInstallReferences(packFileTexts, packageJson.version),
+    ...validateRuntimeVersionConstants(publicVersionFiles["src/protocol/version.ts"], packageJson.version),
+    ...validateRuntimeVersionConstants(packFileTexts["dist/src/protocol/version.js"] ?? "", packageJson.version, MINIMUM_COMPATIBLE_CHILD_MCP_VERSION, "dist/src/protocol/version.js"),
     ...validatePublicProtocolSync({
       scpText: publicVersionFiles["protocol/SCP.md"],
       bootstrapText: publicVersionFiles["protocol/bootstrap-skill.md"],
       currentVersion: packageJson.version
     }),
+    ...validateMarketplaceSync({
+      marketplaceText: publicVersionFiles[".claude-plugin/marketplace.json"],
+      currentVersion: packageJson.version
+    }),
     ...validatePluginSync({
-      pluginManifestText: publicVersionFiles["plugins/sentinel-coordination-protocol/.claude-plugin/plugin.json"],
-      pluginSkillText: publicVersionFiles["plugins/sentinel-coordination-protocol/skills/sentinel-coordination-protocol/SKILL.md"],
-      pluginReadmeText: publicVersionFiles["plugins/sentinel-coordination-protocol/README.md"],
+      pluginManifestText: publicVersionFiles["plugins/odin-scp/.claude-plugin/plugin.json"],
+      pluginSkillText: publicVersionFiles["plugins/odin-scp/skills/odin-scp/SKILL.md"],
+      pluginReadmeText: publicVersionFiles["plugins/odin-scp/README.md"],
       currentVersion: packageJson.version,
       expectedToolCount: extractToolCount(packageJson.description)
     }),

package/templates/team-manifest-template.yaml

@@ -30,7 +30,7 @@ role_slots:
       workspace: "<workspace-ref>"
       pane: "<pane-ref>"
       surface: "<surface-ref>"
-    scp_context_source: "native sentinel-coordination-protocol skill"
+    scp_context_source: "native odin-scp skill"
     mcp_available: true
     mcp_version: "0.4.5"
     scp_skill_available: true
@@ -43,7 +43,7 @@ role_slots:
       workspace: "<workspace-ref>"
       pane: "<pane-ref>"
       surface: "<surface-ref>"
-    scp_context_source: "native sentinel-coordination-protocol skill"
+    scp_context_source: "native odin-scp skill"
     mcp_available: true
     mcp_version: "0.4.5"
     scp_skill_available: true
@@ -58,7 +58,7 @@ role_slots:
       workspace: "<workspace-ref>"
       pane: "<pane-ref>"
       surface: "<surface-ref>"
-    scp_context_source: "native sentinel-coordination-protocol skill"
+    scp_context_source: "native odin-scp skill"
     mcp_available: true
     mcp_version: "0.4.5"
     scp_skill_available: true
@@ -73,7 +73,7 @@ role_slots:
       workspace: "<workspace-ref>"
       pane: "<pane-ref>"
       surface: "<surface-ref>"
-    scp_context_source: "native sentinel-coordination-protocol skill"
+    scp_context_source: "native odin-scp skill"
     mcp_available: true
     mcp_version: "0.4.5"
     scp_skill_available: true
@@ -121,7 +121,7 @@ user_defined_criteria:
 #       workspace: "workspace:1"
 #       pane: "pane:1"
 #       surface: "surface:1"
-#     scp_context_source: "native sentinel-coordination-protocol skill"
+#     scp_context_source: "native odin-scp skill"
 #     mcp_available: true
 #     mcp_version: "0.4.5"
 #     scp_skill_available: true
@@ -134,7 +134,7 @@ user_defined_criteria:
 #       workspace: "workspace:1"
 #       pane: "pane:2"
 #       surface: "surface:2"
-#     scp_context_source: "native sentinel-coordination-protocol skill"
+#     scp_context_source: "native odin-scp skill"
 #     mcp_available: true
 #     mcp_version: "0.4.5"
 #     scp_skill_available: true