@claude-flow/cli 3.7.0-alpha.7 → 3.7.0-alpha.71

package/dist/src/commands/benchmark-cosign.js

@@ -0,0 +1,222 @@
+/**
+ * ADR-121 Phase 26 — `ruflo benchmark cosign` CLI subcommand.
+ *
+ * Phase 24 shipped the M-of-N cryptographic primitive (`coSign()`).
+ * Phase 25 shipped the consumer-facing verify command. This phase
+ * closes the loop with the **third-party-verifier workflow**:
+ *
+ *   # vendor publishes ledger.json + a benchmark claim
+ *   # third party reviews + co-signs
+ *   npx ruflo benchmark cosign vendor-ledger.json \
+ *       --entry 11 \
+ *       --label "independent-auditor" \
+ *       --out audited-ledger.json
+ *
+ *   # downstream consumers check the audited ledger requires
+ *   # two signatures per entry
+ *   npx ruflo benchmark verify audited-ledger.json --threshold 2
+ *
+ * Auto-generates an ephemeral Ed25519 keypair (writes the public
+ * key alongside the cosignature in the output ledger; private key
+ * not persisted by default). Pass `--key <path>` to persist the
+ * keypair (or read from a previously-persisted file) so the same
+ * signer can attest multiple entries / multiple ledgers with a
+ * stable identity.
+ */
+import { promises as fs } from 'node:fs';
+import { resolve } from 'node:path';
+import { generateKeyPairSync, createPrivateKey, createPublicKey } from 'node:crypto';
+import { output } from '../output.js';
+async function loadOrGenerateKeypair(keyPath) {
+    if (keyPath) {
+        const abs = resolve(process.cwd(), keyPath);
+        try {
+            const raw = await fs.readFile(abs, 'utf8');
+            const parsed = JSON.parse(raw);
+            const privateKey = createPrivateKey({ key: Buffer.from(parsed.privateKey, 'hex'), format: 'der', type: 'pkcs8' });
+            const publicKey = createPublicKey({ key: Buffer.from(parsed.publicKey, 'hex'), format: 'der', type: 'spki' });
+            return { keypair: { privateKey, publicKey }, source: 'loaded' };
+        }
+        catch (err) {
+            // File doesn't exist yet — generate a fresh keypair and persist it.
+            const kp = generateKeyPairSync('ed25519');
+            const pkcs8 = kp.privateKey.export({ type: 'pkcs8', format: 'der' }).toString('hex');
+            const spki = kp.publicKey.export({ type: 'spki', format: 'der' }).toString('hex');
+            await fs.writeFile(abs, JSON.stringify({ privateKey: pkcs8, publicKey: spki }, null, 2));
+            return { keypair: kp, source: 'persisted' };
+        }
+    }
+    return { keypair: generateKeyPairSync('ed25519'), source: 'generated' };
+}
+export const benchmarkCosignCommand = {
+    name: 'cosign',
+    description: 'Add a third-party co-signature to an entry in a benchmark ledger (Phase 24 M-of-N attestation)',
+    options: [
+        {
+            name: 'entry',
+            short: 'e',
+            type: 'number',
+            description: 'Entry sequence number to co-sign (1-based). Default: last entry.',
+        },
+        {
+            name: 'label',
+            short: 'l',
+            type: 'string',
+            description: 'Human-readable label for this signer (e.g. "third-party-verifier")',
+        },
+        {
+            name: 'out',
+            short: 'o',
+            type: 'string',
+            description: 'Output path for the updated ledger. Default: overwrite the input.',
+        },
+        {
+            name: 'key',
+            short: 'k',
+            type: 'string',
+            description: 'Path to a JSON keypair file (pkcs8 + spki hex). If missing, a fresh ephemeral key is generated; if path doesn\'t exist, a new key is generated and persisted there.',
+        },
+        {
+            name: 'all',
+            type: 'boolean',
+            description: 'Co-sign EVERY entry in the ledger (useful for batch attestation by a single signer).',
+            default: 'false',
+        },
+        {
+            name: 'json',
+            type: 'boolean',
+            description: 'Output JSON instead of human-readable',
+            default: 'false',
+        },
+    ],
+    examples: [
+        { command: 'ruflo benchmark cosign ledger.json --entry 11 --label "auditor-A"', description: 'Co-sign entry 11 with an ephemeral key' },
+        { command: 'ruflo benchmark cosign ledger.json --all --label "release-gate" --key ./auditor.key.json', description: 'Co-sign every entry with a persisted key' },
+        { command: 'ruflo benchmark cosign ledger.json -e 11 -o audited.json', description: 'Write the cosigned ledger to a new file' },
+    ],
+    action: async (ctx) => {
+        const pathArg = ctx.args[0];
+        const asJson = ctx.flags.json === true || ctx.flags.json === 'true';
+        const all = ctx.flags.all === true || ctx.flags.all === 'true';
+        const entryFlag = ctx.flags.entry !== undefined ? Number(ctx.flags.entry) : undefined;
+        const label = ctx.flags.label;
+        const outPath = ctx.flags.out;
+        const keyPath = ctx.flags.key;
+        if (!pathArg || typeof pathArg !== 'string') {
+            const err = 'usage: ruflo benchmark cosign <path-to-ledger.json> [--entry N | --all] [--label "name"] [--out path] [--key path] [--json]';
+            if (asJson)
+                output.printJson({ ok: false, error: err });
+            else
+                output.printError(err);
+            return { success: false, exitCode: 1 };
+        }
+        if (!all && entryFlag !== undefined && (!Number.isFinite(entryFlag) || entryFlag < 1)) {
+            const err = `--entry must be a positive integer, got: ${ctx.flags.entry}`;
+            if (asJson)
+                output.printJson({ ok: false, error: err });
+            else
+                output.printError(err);
+            return { success: false, exitCode: 1 };
+        }
+        const inPath = resolve(process.cwd(), pathArg);
+        let raw;
+        try {
+            raw = await fs.readFile(inPath, 'utf8');
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                output.printJson({ ok: false, error: `cannot read ${inPath}: ${msg}` });
+            else
+                output.printError(`Cannot read ${inPath}: ${msg}`);
+            return { success: false, exitCode: 1 };
+        }
+        let ledger;
+        try {
+            ledger = JSON.parse(raw);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                output.printJson({ ok: false, error: `not valid JSON: ${msg}` });
+            else
+                output.printError(`Not valid JSON: ${msg}`);
+            return { success: false, exitCode: 1 };
+        }
+        if (typeof ledger.version !== 'number' || !Array.isArray(ledger.entries) || ledger.entries.length === 0) {
+            const err = `not a benchmark ledger — expected { version: number, entries: [non-empty] }`;
+            if (asJson)
+                output.printJson({ ok: false, error: err });
+            else
+                output.printError(err);
+            return { success: false, exitCode: 1 };
+        }
+        // Load or generate the signing keypair.
+        const { keypair, source: keypairSource } = await loadOrGenerateKeypair(keyPath);
+        // Determine which entries to co-sign.
+        let targetIndices;
+        if (all) {
+            targetIndices = ledger.entries.map((_, i) => i);
+        }
+        else {
+            const seq = entryFlag ?? ledger.entries[ledger.entries.length - 1].sequence;
+            const idx = ledger.entries.findIndex(e => e.sequence === seq);
+            if (idx === -1) {
+                const err = `entry sequence ${seq} not found in ledger (chain has ${ledger.entries.length} entries with sequences 1..${ledger.entries.length})`;
+                if (asJson)
+                    output.printJson({ ok: false, error: err });
+                else
+                    output.printError(err);
+                return { success: false, exitCode: 1 };
+            }
+            targetIndices = [idx];
+        }
+        // Lazy-load the cosign primitive from the published embeddings package.
+        const { coSign } = await import('@claude-flow/embeddings/witness-ledger');
+        // Mutate a copy of the ledger.
+        const newEntries = ledger.entries.map((e, i) => targetIndices.includes(i)
+            ? coSign(e, keypair, label ? { signerLabel: label } : {})
+            : e);
+        const newLedger = { ...ledger, entries: newEntries };
+        // Write output.
+        const writePath = resolve(process.cwd(), outPath ?? pathArg);
+        await fs.writeFile(writePath, JSON.stringify(newLedger, null, 2));
+        const publicKeyHex = keypair.publicKey.export({ type: 'spki', format: 'der' }).toString('hex');
+        if (asJson) {
+            output.printJson({
+                ok: true,
+                inPath,
+                outPath: writePath,
+                entriesCosigned: targetIndices.length,
+                targetSequences: targetIndices.map(i => ledger.entries[i].sequence),
+                signerLabel: label ?? null,
+                publicKey: publicKeyHex,
+                keypairSource,
+            });
+            return { success: true, exitCode: 0 };
+        }
+        output.writeln();
+        output.writeln(output.bold(`Co-signed ${targetIndices.length} entr${targetIndices.length === 1 ? 'y' : 'ies'}`));
+        output.writeln(output.dim('─'.repeat(60)));
+        output.writeln(`  input:        ${inPath}`);
+        output.writeln(`  output:       ${writePath}`);
+        output.writeln(`  signer label: ${label ?? '(unlabeled)'}`);
+        output.writeln(`  signer pubkey: ${publicKeyHex.slice(0, 32)}...`);
+        output.writeln(`  keypair:      ${keypairSource}${keyPath ? ` → ${keyPath}` : ''}`);
+        output.writeln();
+        output.writeln('  entries:');
+        for (const i of targetIndices) {
+            const e = newEntries[i];
+            const cosigCount = Array.isArray(e.cosignatures) ? e.cosignatures.length : 0;
+            const hashShort = e.contentHash.slice(0, 12) + '…';
+            output.writeln(`    [${String(e.sequence).padStart(2)}] ${e.benchmark.padEnd(28)} now ${1 + cosigCount} sigs (${hashShort})`);
+        }
+        output.writeln();
+        output.writeln(`Next: verify the cosigned ledger with the new threshold:`);
+        output.writeln(output.dim(`  npx ruflo benchmark verify ${writePath} --threshold 2`));
+        output.writeln();
+        return { success: true, exitCode: 0 };
+    },
+};
+export default benchmarkCosignCommand;
+//# sourceMappingURL=benchmark-cosign.js.map

package/dist/src/commands/benchmark-cosign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark-cosign.js","sourceRoot":"","sources":["../../../src/commands/benchmark-cosign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AActC,KAAK,UAAU,qBAAqB,CAAC,OAA2B;IAC9D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8C,CAAC;YAC5E,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAClH,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9G,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClF,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACzF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAY;IAC7C,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,gGAAgG;IAC7G,OAAO,EAAE;QACP;YACE,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,kEAAkE;SAChF;QACD;YACE,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,oEAAoE;SAClF;QACD;YACE,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,mEAAmE;SACjF;QACD;YACE,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qKAAqK;SACnL;QACD;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,sFAAsF;YACnG,OAAO,EAAE,OAAO;SACjB;QACD;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE,OAAO;SACjB;KACF;IACD,QAAQ,EAAE;QACR,EAAE,OAAO,EAAE,mEAAmE,EAAE,WAAW,EAAE,wCAAwC,EAAE;QACvI,EAAE,OAAO,EAAE,0FAA0F,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAChK,EAAE,OAAO,EAAE,0DAA0D,EAAE,WAAW,EAAE,yCAAyC,EAAE;KAChI;IACD,MAAM,EAAE,KAAK,EAAE,GAAmB,EAA0B,EAAE;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;QACpE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAyB,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAyB,CAAC;QAEpD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,6HAA6H,CAAC;YAC1I,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,GAAG,GAAG,4CAA4C,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1E,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,MAAM,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;;gBAC/E,MAAM,CAAC,UAAU,CAAC,eAAe,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC;;gBACxE,MAAM,CAAC,UAAU,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxG,MAAM,GAAG,GAAG,6EAA6E,CAAC;YAC1F,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,wCAAwC;QACxC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAEhF,sCAAsC;QACtC,IAAI,aAAuB,CAAC;QAC5B,IAAI,GAAG,EAAE,CAAC;YACR,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;YAC9D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,kBAAkB,GAAG,mCAAmC,MAAM,CAAC,OAAO,CAAC,MAAM,8BAA8B,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChJ,IAAI,MAAM;oBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;oBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACzC,CAAC;YACD,aAAa,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAE1E,+BAA+B;QAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7C,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,CAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,CAAC,CACN,CAAC;QACF,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAErD,gBAAgB;QAChB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE/F,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,SAAS,CAAC;gBACf,EAAE,EAAE,IAAI;gBACR,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,eAAe,EAAE,aAAa,CAAC,MAAM;gBACrC,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;gBACpE,WAAW,EAAE,KAAK,IAAI,IAAI;gBAC1B,SAAS,EAAE,YAAY;gBACvB,aAAa;aACd,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,aAAa,CAAC,MAAM,QAAQ,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,mBAAmB,KAAK,IAAI,aAAa,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,oBAAoB,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,mBAAmB,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;YACzB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAI,CAAC,CAAC,WAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;YAC/D,MAAM,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,SAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,UAAU,UAAU,SAAS,GAAG,CAAC,CAAC;QAC5I,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,SAAS,gBAAgB,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,OAAO,EAAE,CAAC;QAEjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/commands/benchmark-verify.d.ts

@@ -0,0 +1,21 @@
+/**
+ * ADR-121 Phase 25 — `ruflo benchmark verify` CLI subcommand.
+ *
+ * Makes the Phase 15-24 witness story end-user-accessible. Anyone
+ * publishing benchmark numbers with a witness manifest (single
+ * `.json`) or a chained ledger (`bench-witness/ledger.json`) can
+ * tell consumers:
+ *
+ *   npx ruflo benchmark verify ./ledger.json
+ *
+ * The command auto-detects whether the input is a single witness or
+ * a ledger (presence of `version` + `entries[]` → ledger), runs the
+ * appropriate verifier, and prints a human-readable or JSON report.
+ *
+ * For Phase 24 multi-signer entries, pass `--threshold N` to require
+ * N or more valid signatures per entry.
+ */
+import type { Command } from '../types.js';
+export declare const benchmarkVerifyCommand: Command;
+export default benchmarkVerifyCommand;
+//# sourceMappingURL=benchmark-verify.d.ts.map

package/dist/src/commands/benchmark-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark-verify.d.ts","sourceRoot":"","sources":["../../../src/commands/benchmark-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AAkC1E,eAAO,MAAM,sBAAsB,EAAE,OAuKpC,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/commands/benchmark-verify.js

@@ -0,0 +1,202 @@
+/**
+ * ADR-121 Phase 25 — `ruflo benchmark verify` CLI subcommand.
+ *
+ * Makes the Phase 15-24 witness story end-user-accessible. Anyone
+ * publishing benchmark numbers with a witness manifest (single
+ * `.json`) or a chained ledger (`bench-witness/ledger.json`) can
+ * tell consumers:
+ *
+ *   npx ruflo benchmark verify ./ledger.json
+ *
+ * The command auto-detects whether the input is a single witness or
+ * a ledger (presence of `version` + `entries[]` → ledger), runs the
+ * appropriate verifier, and prints a human-readable or JSON report.
+ *
+ * For Phase 24 multi-signer entries, pass `--threshold N` to require
+ * N or more valid signatures per entry.
+ */
+import { promises as fs } from 'node:fs';
+import { resolve } from 'node:path';
+import { output } from '../output.js';
+function isLedger(parsed) {
+    return typeof parsed.version === 'number' && Array.isArray(parsed.entries);
+}
+function isWrappedWitness(parsed) {
+    return parsed.witness !== undefined && typeof parsed.witness === 'object';
+}
+function isRawWitness(parsed) {
+    return typeof parsed.contentHash === 'string' && typeof parsed.signature === 'string';
+}
+export const benchmarkVerifyCommand = {
+    name: 'verify',
+    description: 'Verify a benchmark witness manifest or chained ledger via the published @claude-flow/embeddings cryptographic primitives',
+    options: [
+        {
+            name: 'threshold',
+            short: 't',
+            type: 'number',
+            description: 'Phase 24 M-of-N: minimum signatures required per entry. Default 1.',
+            default: '1',
+        },
+        {
+            name: 'json',
+            type: 'boolean',
+            description: 'Output JSON instead of human-readable',
+            default: 'false',
+        },
+    ],
+    examples: [
+        { command: 'ruflo benchmark verify ./bench-witness/ledger.json', description: 'Verify a chained ledger' },
+        { command: 'ruflo benchmark verify ./bench-witness/rag-real-text-*.json', description: 'Verify a single witness manifest' },
+        { command: 'ruflo benchmark verify ledger.json --threshold 3', description: 'Require ≥3 signatures per entry (M-of-N)' },
+        { command: 'ruflo benchmark verify ledger.json --json', description: 'Machine-readable output for CI gating' },
+    ],
+    action: async (ctx) => {
+        const pathArg = ctx.args[0];
+        const threshold = Number(ctx.flags.threshold ?? 1);
+        const asJson = ctx.flags.json === true || ctx.flags.json === 'true';
+        if (!pathArg || typeof pathArg !== 'string') {
+            const err = 'usage: ruflo benchmark verify <path-to-ledger.json-or-witness.json> [--threshold N] [--json]';
+            if (asJson)
+                output.printJson({ ok: false, error: err });
+            else
+                output.printError(err);
+            return { success: false, exitCode: 1 };
+        }
+        if (!Number.isFinite(threshold) || threshold < 1) {
+            const err = `--threshold must be a positive integer, got: ${ctx.flags.threshold}`;
+            if (asJson)
+                output.printJson({ ok: false, error: err });
+            else
+                output.printError(err);
+            return { success: false, exitCode: 1 };
+        }
+        const absPath = resolve(process.cwd(), pathArg);
+        let raw;
+        try {
+            raw = await fs.readFile(absPath, 'utf8');
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                output.printJson({ ok: false, error: `cannot read ${absPath}: ${msg}` });
+            else
+                output.printError(`Cannot read ${absPath}: ${msg}`);
+            return { success: false, exitCode: 1 };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                output.printJson({ ok: false, error: `not valid JSON: ${msg}` });
+            else
+                output.printError(`Not valid JSON: ${msg}`);
+            return { success: false, exitCode: 1 };
+        }
+        // Lazy-import the embeddings verifiers so the CLI startup stays fast
+        // when this command isn't used.
+        const { verify } = await import('@claude-flow/embeddings/witness');
+        const { verifyLedger, verifyEntry } = await import('@claude-flow/embeddings/witness-ledger');
+        // === Path 1: chained ledger ===
+        if (isLedger(parsed)) {
+            const ledger = parsed;
+            const result = verifyLedger(ledger, { minSignatures: threshold });
+            if (asJson) {
+                output.printJson({
+                    ok: result.valid,
+                    kind: 'ledger',
+                    entryCount: result.entryCount,
+                    firstFailureAt: result.firstFailureAt,
+                    reason: result.reason,
+                    threshold,
+                    path: absPath,
+                });
+                return { success: result.valid, exitCode: result.valid ? 0 : 1 };
+            }
+            output.writeln();
+            output.writeln(output.bold(`Ledger verification (${absPath})`));
+            output.writeln(output.dim('─'.repeat(60)));
+            output.writeln(`  entries:        ${result.entryCount}`);
+            output.writeln(`  threshold:      minSignatures = ${threshold}`);
+            output.writeln(`  verifyLedger(): ${result.valid ? output.success('TRUE') : output.error('FALSE')}`);
+            if (!result.valid) {
+                output.writeln(`  failure at:     entry ${result.firstFailureAt}`);
+                output.writeln(`  reason:         ${result.reason}`);
+            }
+            // Per-entry summary table
+            const entries = ledger.entries;
+            output.writeln();
+            output.writeln('  per-entry:');
+            for (const e of entries) {
+                const cosigCount = Array.isArray(e.cosignatures) ? e.cosignatures.length : 0;
+                const ok = verifyEntry(e, { minSignatures: threshold });
+                const verdict = ok ? output.success('✓') : output.error('✗');
+                const hashShort = e.contentHash.slice(0, 12) + '…';
+                output.writeln(`    [${String(e.sequence).padStart(2)}] ${e.benchmark.padEnd(28)} sigs=${1 + cosigCount}  ${hashShort}  ${verdict}`);
+            }
+            output.writeln();
+            return { success: result.valid, exitCode: result.valid ? 0 : 1 };
+        }
+        // === Path 2: wrapped single witness (the bench scripts' output shape) ===
+        if (isWrappedWitness(parsed)) {
+            const w = parsed.witness;
+            const ok = verify(w);
+            if (asJson) {
+                output.printJson({
+                    ok,
+                    kind: 'witness',
+                    benchmark: w.benchmark,
+                    contentHash: w.contentHash,
+                    path: absPath,
+                });
+                return { success: ok, exitCode: ok ? 0 : 1 };
+            }
+            output.writeln();
+            output.writeln(output.bold(`Witness verification (${absPath})`));
+            output.writeln(output.dim('─'.repeat(60)));
+            output.writeln(`  benchmark:    ${w.benchmark}`);
+            output.writeln(`  contentHash:  ${w.contentHash}`);
+            output.writeln(`  signature:    ${w.signature.slice(0, 32)}...`);
+            output.writeln(`  publicKey:    ${w.publicKey.slice(0, 32)}...`);
+            output.writeln(`  algorithm:    ${w.signatureAlgorithm}`);
+            output.writeln(`  verify():     ${ok ? output.success('TRUE') : output.error('FALSE')}`);
+            output.writeln();
+            return { success: ok, exitCode: ok ? 0 : 1 };
+        }
+        // === Path 3: raw single witness (top-level fields, no wrapper) ===
+        if (isRawWitness(parsed)) {
+            const w = parsed;
+            const ok = verify(w);
+            if (asJson) {
+                output.printJson({
+                    ok,
+                    kind: 'witness-raw',
+                    benchmark: w.benchmark,
+                    contentHash: w.contentHash,
+                    path: absPath,
+                });
+                return { success: ok, exitCode: ok ? 0 : 1 };
+            }
+            output.writeln();
+            output.writeln(output.bold(`Witness verification (${absPath})`));
+            output.writeln(output.dim('─'.repeat(60)));
+            output.writeln(`  benchmark:    ${w.benchmark}`);
+            output.writeln(`  contentHash:  ${w.contentHash}`);
+            output.writeln(`  verify():     ${ok ? output.success('TRUE') : output.error('FALSE')}`);
+            output.writeln();
+            return { success: ok, exitCode: ok ? 0 : 1 };
+        }
+        // === Path 4: unknown shape ===
+        const err = `unrecognized file shape — expected a benchmark ledger ({version, entries}), a wrapped witness ({witness: {...}}), or a raw witness ({contentHash, signature, publicKey})`;
+        if (asJson)
+            output.printJson({ ok: false, error: err, path: absPath });
+        else
+            output.printError(err);
+        return { success: false, exitCode: 1 };
+    },
+};
+export default benchmarkVerifyCommand;
+//# sourceMappingURL=benchmark-verify.js.map

package/dist/src/commands/benchmark-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark-verify.js","sourceRoot":"","sources":["../../../src/commands/benchmark-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAyBtC,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,gBAAgB,CAAC,MAAiB;IACzC,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;AAC5E,CAAC;AACD,SAAS,YAAY,CAAC,MAAiB;IACrC,OAAO,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAY;IAC7C,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,0HAA0H;IACvI,OAAO,EAAE;QACP;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,oEAAoE;YACjF,OAAO,EAAE,GAAG;SACb;QACD;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE,OAAO;SACjB;KACF;IACD,QAAQ,EAAE;QACR,EAAE,OAAO,EAAE,oDAAoD,EAAE,WAAW,EAAE,yBAAyB,EAAE;QACzG,EAAE,OAAO,EAAE,6DAA6D,EAAE,WAAW,EAAE,kCAAkC,EAAE;QAC3H,EAAE,OAAO,EAAE,kDAAkD,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxH,EAAE,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,uCAAuC,EAAE;KAC/G;IACD,MAAM,EAAE,KAAK,EAAE,GAAmB,EAA0B,EAAE;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;QAEpE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,8FAA8F,CAAC;YAC3G,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,gDAAgD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAClF,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACnD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;QAEhD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,OAAO,KAAK,GAAG,EAAE,EAAE,CAAC,CAAC;;gBAChF,MAAM,CAAC,UAAU,CAAC,eAAe,OAAO,KAAK,GAAG,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC;;gBACxE,MAAM,CAAC,UAAU,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACnE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAE7F,iCAAiC;QACjC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAe,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,SAAS,CAAC;oBACf,EAAE,EAAE,MAAM,CAAC,KAAK;oBAChB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS;oBACT,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,qBAAqB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,OAAO,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,CAAC,2BAA2B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;gBACnE,MAAM,CAAC,OAAO,CAAC,qBAAqB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,0BAA0B;YAC1B,MAAM,OAAO,GAAI,MAAM,CAAC,OAAyG,CAAC;YAClI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,MAAM,EAAE,GAAG,WAAW,CAAC,CAAU,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;gBACjE,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;gBACnD,MAAM,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,UAAU,KAAK,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,CAAC;QAED,2EAA2E;QAC3E,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAQ,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAU,CAAC,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,SAAS,CAAC;oBACf,EAAE;oBACF,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,CAAC;QAED,oEAAoE;QACpE,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAyC,CAAC;YACpD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAU,CAAC,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,SAAS,CAAC;oBACf,EAAE;oBACF,IAAI,EAAE,aAAa;oBACnB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,IAAI,EAAE,OAAO;iBACd,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,GAAG,CAAC,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,CAAC;QAED,gCAAgC;QAChC,MAAM,GAAG,GAAG,0KAA0K,CAAC;QACvL,IAAI,MAAM;YAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;;YAClE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/commands/daemon.d.ts

@@ -3,6 +3,26 @@
  * Manages background worker daemon (Node.js-based, similar to shell helpers)
  */
 import type { Command } from '../types.js';
+/**
+ * #1914: Resolve the `--workspace` flag to an absolute path, or return null
+ * if it is absent / not a usable string. Rejects values with null bytes or
+ * shell metacharacters (defence-in-depth — the value is later embedded in a
+ * forked child's argv and compared against `ps`/`tasklist` output).
+ */
+export declare function resolveWorkspaceFlag(raw: unknown): string | null;
+/**
+ * #1914: True when a process command line (from `ps -eo command` on POSIX or
+ * the tasklist Window Title column on Windows) belongs to a daemon started
+ * for `workspaceRoot`. The launcher (`startBackgroundDaemon`) always appends
+ * `--workspace <root>` as the FINAL argv entry, so an exact trailing match
+ * after stripping trailing whitespace/quotes is unambiguous — even for
+ * workspace paths containing spaces — and never a bare path-prefix match,
+ * so workspace `/a/proj` does not reap `/a/proj-other`'s daemon. A daemon
+ * whose argv puts `--workspace` mid-list (only possible via a hand-rolled
+ * invocation) simply won't be auto-reaped — `daemon stop` still handles it
+ * via the PID file.
+ */
+export declare function daemonCommandLineBelongsToWorkspace(commandLine: string, workspaceRoot: string): boolean;
 export declare const daemonCommand: Command;
 export default daemonCommand;
 //# sourceMappingURL=daemon.d.ts.map

package/dist/src/commands/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AAyuB1E,eAAO,MAAM,aAAa,EAAE,OA6D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AA2O1E;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEvG;AAq0BD,eAAO,MAAM,aAAa,EAAE,OA+D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}