@connexum/ai-governance 1.0.0-beta.28 → 1.0.0-beta.30
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/index.d.ts +7 -0
- package/dist/cli/index.d.ts.map +1 -1
- package/dist/cli/index.js +151 -1
- package/dist/cli/index.js.map +1 -1
- package/dist/cli/sync.d.ts.map +1 -1
- package/dist/cli/sync.js +90 -3
- package/dist/cli/sync.js.map +1 -1
- package/dist/esm/cli/index.js +150 -1
- package/dist/esm/cli/index.js.map +1 -1
- package/dist/esm/cli/sync.js +90 -3
- package/dist/esm/cli/sync.js.map +1 -1
- package/package.json +1 -1
package/dist/cli/index.d.ts
CHANGED
|
@@ -128,6 +128,13 @@ export declare function generateConfig(packs: string[], license: LicenseInfo, li
|
|
|
128
128
|
* the new config so they survive the rewrite regardless of step ordering.
|
|
129
129
|
*/
|
|
130
130
|
export declare function carryForwardPerAgentIdentity(config: GovernanceJsonConfig, configPath: string): void;
|
|
131
|
+
/**
|
|
132
|
+
* Best-effort check for the 'inst' (installation-scope) claim in a JWT payload.
|
|
133
|
+
* NO signature verification — used only to decide whether a more-scoped token
|
|
134
|
+
* should be preserved over a less-scoped one. Returns false on any malformed
|
|
135
|
+
* input (Invariant 2: never throws).
|
|
136
|
+
*/
|
|
137
|
+
export declare function tokenHasInstClaim(token: string): boolean;
|
|
131
138
|
/**
|
|
132
139
|
* P0 install-safety guard. Governance is a PROJECT-LOCAL install: hooks are
|
|
133
140
|
* written to `<projectDir>/.claude/settings.json`. If `init` runs from the
|
package/dist/cli/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAIrC,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA4D7E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAA6B,GAC5C,OAAO,CAAC,wBAAwB,CAAC,CAwEnC;AAWD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAAC,CA2EhF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,IAAI,CAsBjH;AAmDD,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,QAAQ,GACR,UAAU,GACV,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,OAAO,GACP,SAAS,CAAC;AAEd,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CA2BzD;AAkBD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAyCrE;AAsBD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,KAAK,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,yEAAyE;QACzE,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,WAAW,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACxC,oBAAoB,CA8BtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,oBAAoB,EAC5B,UAAU,EAAE,MAAM,GACjB,IAAI,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAIrC,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA4D7E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAA6B,GAC5C,OAAO,CAAC,wBAAwB,CAAC,CAwEnC;AAWD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAAC,CA2EhF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,IAAI,CAsBjH;AAmDD,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,QAAQ,GACR,UAAU,GACV,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,OAAO,GACP,SAAS,CAAC;AAEd,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CA2BzD;AAkBD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAyCrE;AAsBD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,KAAK,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,yEAAyE;QACzE,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,WAAW,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACxC,oBAAoB,CA8BtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,oBAAoB,EAC5B,UAAU,EAAE,MAAM,GACjB,IAAI,CAqCN;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAWxD;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAgC7D;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA2EtH;AAsFD;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACvB,QAAQ,SAAI,GACX,IAAI,CAuBN;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAiLjF;AAmmBD,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE;QACV,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAwFrE;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAmEtE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CA4CtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAqC9D;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CA0DnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAkCvF;AAMD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,4BAA4B,EAAE,EAC1C,WAAW,EAAE,aAAa,EAAE,EAC5B,IAAI,GAAE;IACJ;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,IAAI,CAmEN;AAGD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAuED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;KAAE,CAAC,CAAC;IACzG,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,oBAAoB,CA0DvB;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CA6QrE;AA6JD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,aAAa,EAAE,EAC/B,UAAU,EAAE,MAAM,GACjB,IAAI,CA0GN"}
|
package/dist/cli/index.js
CHANGED
|
@@ -56,6 +56,7 @@ exports.validateLegacyLicense = validateLegacyLicense;
|
|
|
56
56
|
exports.readLicenseServerUrl = readLicenseServerUrl;
|
|
57
57
|
exports.generateConfig = generateConfig;
|
|
58
58
|
exports.carryForwardPerAgentIdentity = carryForwardPerAgentIdentity;
|
|
59
|
+
exports.tokenHasInstClaim = tokenHasInstClaim;
|
|
59
60
|
exports.assertSafeInstallDir = assertSafeInstallDir;
|
|
60
61
|
exports.installHooks = installHooks;
|
|
61
62
|
exports.removePerAgentRuntime = removePerAgentRuntime;
|
|
@@ -573,10 +574,51 @@ function carryForwardPerAgentIdentity(config, configPath) {
|
|
|
573
574
|
if (Array.isArray(prior.agents) && prior.agents.length > 0) {
|
|
574
575
|
cfgRec['agents'] = prior.agents;
|
|
575
576
|
}
|
|
577
|
+
// F3-2: preserve the pinned org public key across a config rewrite. The pin
|
|
578
|
+
// is a one-time trusted exchange (init-time TLS); a fresh generateConfig
|
|
579
|
+
// object has no orgPublicKey, so writing it verbatim would DROP the key and
|
|
580
|
+
// every subsequent `sync` would fail-closed ("cannot verify authenticity").
|
|
581
|
+
if (typeof prior.orgPublicKey === 'string' && prior.orgPublicKey.length > 0) {
|
|
582
|
+
cfgRec['orgPublicKey'] = prior.orgPublicKey;
|
|
583
|
+
}
|
|
576
584
|
const priorAgentDir = prior.runtime?.agentDir;
|
|
577
585
|
if (typeof priorAgentDir === 'string' && config.runtime) {
|
|
578
586
|
config.runtime['agentDir'] = priorAgentDir;
|
|
579
587
|
}
|
|
588
|
+
// F3-3: preserve a prior inst-bearing runtime.serviceToken when the fresh
|
|
589
|
+
// config's runtime token lacks the 'inst' claim. sync persists an
|
|
590
|
+
// inst-bearing token into runtime.serviceToken (so /cli/agent-governance
|
|
591
|
+
// stops 400-ing); a later init/generateConfig rewrite with the original
|
|
592
|
+
// org-scoped token would undo that. Keep the more-scoped token.
|
|
593
|
+
const priorRuntimeToken = prior.runtime?.serviceToken;
|
|
594
|
+
if (typeof priorRuntimeToken === 'string' && priorRuntimeToken.length > 0 && config.runtime) {
|
|
595
|
+
const freshToken = config.runtime['serviceToken'];
|
|
596
|
+
const priorHasInst = tokenHasInstClaim(priorRuntimeToken);
|
|
597
|
+
const freshHasInst = typeof freshToken === 'string' ? tokenHasInstClaim(freshToken) : false;
|
|
598
|
+
if (priorHasInst && !freshHasInst) {
|
|
599
|
+
config.runtime['serviceToken'] = priorRuntimeToken;
|
|
600
|
+
}
|
|
601
|
+
}
|
|
602
|
+
}
|
|
603
|
+
/**
|
|
604
|
+
* Best-effort check for the 'inst' (installation-scope) claim in a JWT payload.
|
|
605
|
+
* NO signature verification — used only to decide whether a more-scoped token
|
|
606
|
+
* should be preserved over a less-scoped one. Returns false on any malformed
|
|
607
|
+
* input (Invariant 2: never throws).
|
|
608
|
+
*/
|
|
609
|
+
function tokenHasInstClaim(token) {
|
|
610
|
+
try {
|
|
611
|
+
const parts = token.split('.');
|
|
612
|
+
if (parts.length !== 3)
|
|
613
|
+
return false;
|
|
614
|
+
const parsed = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
|
|
615
|
+
return !!parsed && typeof parsed === 'object' && !Array.isArray(parsed)
|
|
616
|
+
&& typeof parsed['inst'] === 'string'
|
|
617
|
+
&& parsed['inst'].length > 0;
|
|
618
|
+
}
|
|
619
|
+
catch {
|
|
620
|
+
return false;
|
|
621
|
+
}
|
|
580
622
|
}
|
|
581
623
|
// --- Hook installation ---
|
|
582
624
|
/**
|
|
@@ -1955,7 +1997,19 @@ async function nonInteractiveInit(projectDir, opts) {
|
|
|
1955
1997
|
}
|
|
1956
1998
|
const config = generateConfig(validPacks, license, opts.licenseServerUrl, opts.runtime);
|
|
1957
1999
|
const configPath = path.join(projectDir, '.governance.json');
|
|
1958
|
-
|
|
2000
|
+
// PRESERVE per-agent identity data on rewrite (Thomas 2026-06-12, F3-1): the
|
|
2001
|
+
// --agent-dir IIFE's writePerAgentIdentities() landed agents[] + runtime.agentDir
|
|
2002
|
+
// (and possibly a pinned orgPublicKey + inst-bearing runtime token) into this
|
|
2003
|
+
// SAME file. generateConfig builds a FRESH object that has NONE of them, so
|
|
2004
|
+
// writing it verbatim here clobbers the reconciled fleet — leaving sync --apply
|
|
2005
|
+
// with only the single runtime.agentId (1 of N agents). carryForwardPerAgentIdentity
|
|
2006
|
+
// re-merges those fields regardless of which path wrote first (ordering-robust).
|
|
2007
|
+
carryForwardPerAgentIdentity(config, configPath);
|
|
2008
|
+
fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 0o600 });
|
|
2009
|
+
try {
|
|
2010
|
+
fs.chmodSync(configPath, 0o600);
|
|
2011
|
+
}
|
|
2012
|
+
catch { /* best-effort on Windows */ }
|
|
1959
2013
|
const { installed, errors } = installHooks(projectDir, config);
|
|
1960
2014
|
// Create directories
|
|
1961
2015
|
const govDir = path.join(projectDir, '.governance');
|
|
@@ -3177,6 +3231,67 @@ if (isDirectRun) {
|
|
|
3177
3231
|
});
|
|
3178
3232
|
process.stdout.write(`[CLI] per-agent identities written to .governance.json ` +
|
|
3179
3233
|
`(${safeRegistered.length} agent(s)).\n`);
|
|
3234
|
+
// F3-2 + F3-4: pin the org public key AND adopt an
|
|
3235
|
+
// inst-bearing runtime token straight from THIS register-fleet
|
|
3236
|
+
// response — INSIDE the IIFE, before the early process.exit(0)
|
|
3237
|
+
// below can terminate the run. Two reasons this must happen here:
|
|
3238
|
+
// (1) the --agent-dir IIFE may process.exit(0) at the bottom
|
|
3239
|
+
// before the synchronous nonInteractiveInit's pin runs, so
|
|
3240
|
+
// pinning only there would leave .governance.json with no
|
|
3241
|
+
// orgPublicKey → every later `sync` bundle REJECTED.
|
|
3242
|
+
// (2) the runtime token from exchange-install-link is
|
|
3243
|
+
// org-scoped (no 'inst' claim); if the server returns an
|
|
3244
|
+
// inst-bearing installToken, persist it so GET
|
|
3245
|
+
// /cli/agent-governance stops 400-ing at sync time.
|
|
3246
|
+
// Both come from the SAME trusted TLS exchange that registered
|
|
3247
|
+
// the fleet — no extra unauthenticated fetch. Non-fatal: a
|
|
3248
|
+
// missing field falls back to the post-init pin path (Invariant 2).
|
|
3249
|
+
try {
|
|
3250
|
+
const cfgPath = path.join(projectDir, '.governance.json');
|
|
3251
|
+
let cfg = {};
|
|
3252
|
+
if (fs.existsSync(cfgPath)) {
|
|
3253
|
+
try {
|
|
3254
|
+
cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
|
|
3255
|
+
}
|
|
3256
|
+
catch { /* fresh */ }
|
|
3257
|
+
}
|
|
3258
|
+
let dirty = false;
|
|
3259
|
+
if (typeof resp.orgPublicKey === 'string' && resp.orgPublicKey.length > 0) {
|
|
3260
|
+
// Sanity: must decode to a 32-byte Ed25519 raw key before pinning.
|
|
3261
|
+
let okKey = false;
|
|
3262
|
+
try {
|
|
3263
|
+
okKey = Buffer.from(resp.orgPublicKey, 'base64url').length === 32;
|
|
3264
|
+
}
|
|
3265
|
+
catch {
|
|
3266
|
+
okKey = false;
|
|
3267
|
+
}
|
|
3268
|
+
if (okKey && cfg['orgPublicKey'] !== resp.orgPublicKey) {
|
|
3269
|
+
cfg['orgPublicKey'] = resp.orgPublicKey;
|
|
3270
|
+
dirty = true;
|
|
3271
|
+
process.stderr.write(`[CLI] org public key pinned from register-fleet (${resp.orgPublicKey.slice(0, 8)}...).\n`);
|
|
3272
|
+
}
|
|
3273
|
+
}
|
|
3274
|
+
if (typeof resp.installToken === 'string' && tokenHasInstClaim(resp.installToken)) {
|
|
3275
|
+
const rt = cfg['runtime'] ?? {};
|
|
3276
|
+
const cur = rt['serviceToken'];
|
|
3277
|
+
if (typeof cur !== 'string' || !tokenHasInstClaim(cur)) {
|
|
3278
|
+
rt['serviceToken'] = resp.installToken;
|
|
3279
|
+
cfg['runtime'] = rt;
|
|
3280
|
+
dirty = true;
|
|
3281
|
+
process.stderr.write('[CLI] runtime token upgraded to installation scope (inst claim) from register-fleet.\n');
|
|
3282
|
+
}
|
|
3283
|
+
}
|
|
3284
|
+
if (dirty) {
|
|
3285
|
+
fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2), { mode: 0o600 });
|
|
3286
|
+
try {
|
|
3287
|
+
fs.chmodSync(cfgPath, 0o600);
|
|
3288
|
+
}
|
|
3289
|
+
catch { /* best-effort on Windows */ }
|
|
3290
|
+
}
|
|
3291
|
+
}
|
|
3292
|
+
catch (pinErr) {
|
|
3293
|
+
process.stderr.write(`[CLI] org-key/inst-token pin from register-fleet skipped (non-fatal): ${pinErr.message}\n`);
|
|
3294
|
+
}
|
|
3180
3295
|
// Identity RFC B1 (Pass 1): land each agent's identity in
|
|
3181
3296
|
// ITS OWN folder — <agent>/.connexum/identity.json. No
|
|
3182
3297
|
// secret at this pass (tokens are minted at payment
|
|
@@ -3286,6 +3401,41 @@ if (isDirectRun) {
|
|
|
3286
3401
|
else if (skipPreflight) {
|
|
3287
3402
|
process.stdout.write('\nPreflight skipped (--skip-preflight).\n');
|
|
3288
3403
|
}
|
|
3404
|
+
// F3-2 FALLBACK: if register-fleet did NOT carry the org public key in
|
|
3405
|
+
// its response (older server, or option B not chosen), pin it here via
|
|
3406
|
+
// the dedicated public-key endpoint — still BEFORE the early exit below,
|
|
3407
|
+
// so a pure --agent-dir --link run never leaves .governance.json without
|
|
3408
|
+
// a pinned key. Idempotent with the in-IIFE pin above (skips if already
|
|
3409
|
+
// pinned). Non-fatal (Invariant 2): a failed fetch leaves sync to
|
|
3410
|
+
// fail-closed until the operator re-runs init when the server is reachable.
|
|
3411
|
+
if (runtimeConfig?.govServerUrl && runtimeConfig?.orgId) {
|
|
3412
|
+
try {
|
|
3413
|
+
const cfgPath = path.join(projectDir, '.governance.json');
|
|
3414
|
+
let alreadyPinned = false;
|
|
3415
|
+
if (fs.existsSync(cfgPath)) {
|
|
3416
|
+
try {
|
|
3417
|
+
const cur = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
|
|
3418
|
+
alreadyPinned = typeof cur['orgPublicKey'] === 'string' && cur['orgPublicKey'].length > 0;
|
|
3419
|
+
}
|
|
3420
|
+
catch { /* fresh */ }
|
|
3421
|
+
}
|
|
3422
|
+
if (!alreadyPinned) {
|
|
3423
|
+
const { fetchAndPinOrgPublicKey } = require('./sync.js');
|
|
3424
|
+
const pinned = fetchAndPinOrgPublicKey(runtimeConfig.govServerUrl, runtimeConfig.orgId, cfgPath);
|
|
3425
|
+
if (pinned) {
|
|
3426
|
+
process.stderr.write(`[CLI] org public key pinned to .governance.json (${pinned.slice(0, 8)}...).\n`);
|
|
3427
|
+
}
|
|
3428
|
+
else {
|
|
3429
|
+
process.stderr.write('[CLI] WARNING: could not fetch org public key for pinning. ' +
|
|
3430
|
+
'`ai-governance sync` will fail closed until the key is pinned. ' +
|
|
3431
|
+
'Re-run `ai-governance init` when the server is reachable to pin the key.\n');
|
|
3432
|
+
}
|
|
3433
|
+
}
|
|
3434
|
+
}
|
|
3435
|
+
catch (e) {
|
|
3436
|
+
process.stderr.write(`[CLI] org public key pin (fallback) skipped (non-fatal): ${e.message}\n`);
|
|
3437
|
+
}
|
|
3438
|
+
}
|
|
3289
3439
|
// --agent-dir is a standalone operation — do not fall through to interactive init
|
|
3290
3440
|
// unless --ci or interactive flow flags are also explicitly set.
|
|
3291
3441
|
if (!ciMode && !vendorCodeFlag && !offlineFlag) {
|