@dharma-ai-labs/agent-fabric 0.2.49 → 0.2.51

package/dist/skillSyncPolicy.test.js

@@ -0,0 +1,156 @@
+import assert from 'node:assert/strict';
+import { generateKeyPairSync, createHash } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
+import { applyServerEvidencePolicy, loadSkillSynchronizationPolicy, materializeWorkspacePolicy, run } from './index.js';
+import { saveDeviceEnrollmentAnchor } from '@dharma-ai-labs/agent-fabric-relay-client';
+async function fixture() {
+    const home = await mkdtemp(join(tmpdir(), 'af-skill-policy-'));
+    const workspace = join(home, 'work');
+    await mkdir(workspace);
+    const generated = await materializeWorkspacePolicy({ workspace, organizationId: 'org_test', revision: 'policy-test' });
+    const keys = generateKeyPairSync('ed25519');
+    const publicKey = keys.publicKey.export({ format: 'jwk' }).x;
+    const unsigned = {
+        schema: 'dharma.workspace-policy-authorization/v1', organizationId: 'org_test', workspaceId: 'workspace-test',
+        policy: { revision: 'policy-test', evidence: generated.policy.evidence },
+        issuedAt: new Date(Date.now() - 60_000).toISOString(), expiresAt: new Date(Date.now() + 3_600_000).toISOString(), keyVersion: 'test',
+    };
+    const authorization = { ...unsigned, signature: signCanonicalObject(unsigned, keys.privateKey) };
+    const signedPolicy = applyServerEvidencePolicy(generated.policy, authorization, publicKey, 'org_test', 'workspace-test');
+    const policyPath = join(workspace, '.dharma', 'approved-policy.json');
+    await mkdir(join(home, 'registry', 'workspace-authorizations'), { recursive: true });
+    await writeFile(join(home, 'registry', 'workspaces.json'), JSON.stringify([{
+            workspaceId: 'workspace-test', organizationId: 'org_test', name: 'Test', path: workspace, status: 'active',
+            routeHash: 'a'.repeat(64), repositoryRemoteHash: 'b'.repeat(64), repositoryAgentId: '11111111-1111-4111-8111-111111111111',
+        }]));
+    await writeFile(join(home, 'device.json'), JSON.stringify({
+        schema: 'dharma.device-config/v1', organizationId: 'org_test', deviceId: '22222222-2222-4222-8222-222222222222',
+        hqUrl: 'https://example.invalid', relayUrl: 'wss://example.invalid', serverPublicKeyEd25519: publicKey,
+        publicKeyEd25519: publicKey, enrolledAt: new Date().toISOString(),
+    }));
+    const statePath = join(home, 'registry', 'workspace-authorizations', 'workspace-test.json');
+    await writeFile(statePath, JSON.stringify({ issuedAt: authorization.issuedAt, signature: authorization.signature }));
+    await writeFile(policyPath, JSON.stringify(signedPolicy));
+    return { home, workspace, generated, keys, unsigned, authorization, signedPolicy, policyPath, statePath };
+}
+const cases = [
+    { name: 'noncanonical policy path', expected: /Skill synchronization requires the canonical registered workspace policy path/, mutate: async (f) => {
+            const other = join(f.home, 'other-policy.json');
+            await writeFile(other, JSON.stringify(f.signedPolicy));
+            return other;
+        } },
+    { name: 'unsigned local policy', expected: /Server workspace policy authorization is required/, mutate: async (f) => {
+            await writeFile(f.policyPath, JSON.stringify(f.generated.policy));
+        } },
+    { name: 'tampered signature', expected: /signature is invalid/, mutate: async (f) => {
+            await writeFile(f.policyPath, JSON.stringify({ ...f.signedPolicy, serverAuthorization: { ...f.authorization, signature: 'tampered' } }));
+        } },
+    { name: 'expired signed authorization', expected: /invalid or expired/, mutate: async (f) => {
+            const expired = { ...f.unsigned, issuedAt: new Date(Date.now() - 120_000).toISOString(), expiresAt: new Date(Date.now() - 60_000).toISOString() };
+            await writeFile(f.policyPath, JSON.stringify({ ...f.signedPolicy, serverAuthorization: { ...expired, signature: signCanonicalObject(expired, f.keys.privateKey) } }));
+        } },
+    { name: 'foreign enrolled organization', expected: /Skill policy does not match the enrolled organization and workspace/, mutate: async (f) => {
+            const config = JSON.parse(await readFile(join(f.home, 'device.json'), 'utf8'));
+            await writeFile(join(f.home, 'device.json'), JSON.stringify({ ...config, organizationId: 'org_foreign' }));
+        } },
+    { name: 'foreign signed workspace', expected: /invalid or expired/, mutate: async (f) => {
+            const foreign = { ...f.unsigned, workspaceId: 'workspace-foreign' };
+            await writeFile(f.policyPath, JSON.stringify({ ...f.signedPolicy, serverAuthorization: { ...foreign, signature: signCanonicalObject(foreign, f.keys.privateKey) } }));
+        } },
+    { name: 'replayed older authorization', expected: /older than the last accepted authorization/, mutate: async (f) => {
+            await writeFile(f.statePath, JSON.stringify({ issuedAt: new Date(Date.now() - 30_000).toISOString(), signature: 'newer-accepted' }));
+        } },
+    ...[null, false, 0].map(value => ({ name: `invalid replay state ${JSON.stringify(value)}`,
+        expected: /Workspace authorization replay state is missing or invalid/,
+        mutate: async (f) => { await writeFile(f.statePath, JSON.stringify(value)); } })),
+];
+for (const scenario of cases)
+    test(`actual skill sync rejects ${scenario.name} before transport or installation`, async () => {
+        const f = await fixture();
+        const path = await scenario.mutate(f) || f.policyPath;
+        const previousHome = process.env.DHARMA_HOME, previousFetch = globalThis.fetch;
+        const before = await readFile(f.policyPath), stateBefore = await readFile(f.statePath);
+        let networkCalls = 0;
+        process.env.DHARMA_HOME = f.home;
+        globalThis.fetch = async () => { networkCalls += 1; throw new Error('unexpected_skill_network'); };
+        try {
+            await assert.rejects(() => run(['skills', 'sync', '--workspace-id', 'workspace-test', '--provider', 'codex', '--policy', path]), scenario.expected);
+            assert.equal(networkCalls, 0);
+            assert.deepEqual(await readFile(f.policyPath), before);
+            assert.deepEqual(await readFile(f.statePath), stateBefore);
+            assert.equal(createHash('sha256').update(before).digest('hex').length, 64);
+        }
+        finally {
+            globalThis.fetch = previousFetch;
+            if (previousHome === undefined)
+                delete process.env.DHARMA_HOME;
+            else
+                process.env.DHARMA_HOME = previousHome;
+        }
+    });
+test('skill policy loader rejects authorization expiring during the secure enrollment read', async () => {
+    const f = await fixture(), previousHome = process.env.DHARMA_HOME, OriginalDate = Date;
+    const values = new Map();
+    let clock = OriginalDate.now(), advanceOnRead = false;
+    class FixtureDate extends OriginalDate {
+        constructor(value) { super(value === undefined ? clock : value); }
+        static now() { return clock; }
+    }
+    const store = { backend: 'linux-secret-service',
+        get: async (account) => { if (advanceOnRead)
+            clock += 3_600_001; return values.get(account) ?? null; },
+        put: async (account, value) => { values.set(account, value); },
+        delete: async (account) => { values.delete(account); } };
+    process.env.DHARMA_HOME = f.home;
+    try {
+        const config = JSON.parse(await readFile(join(f.home, 'device.json'), 'utf8'));
+        await saveDeviceEnrollmentAnchor({ config, store });
+        globalThis.Date = FixtureDate;
+        advanceOnRead = true;
+        await assert.rejects(() => loadSkillSynchronizationPolicy(f.policyPath, 'workspace-test', store), /invalid or expired/);
+    }
+    finally {
+        globalThis.Date = OriginalDate;
+        if (previousHome === undefined)
+            delete process.env.DHARMA_HOME;
+        else
+            process.env.DHARMA_HOME = previousHome;
+    }
+});
+test('skill policy loader accepts anchored signed scope without discarding local skill or command controls', async () => {
+    const f = await fixture(), previousHome = process.env.DHARMA_HOME;
+    const values = new Map();
+    const store = { backend: 'linux-secret-service',
+        get: async (account) => values.get(account) ?? null,
+        put: async (account, value) => { values.set(account, value); },
+        delete: async (account) => { values.delete(account); } };
+    process.env.DHARMA_HOME = f.home;
+    try {
+        const config = JSON.parse(await readFile(join(f.home, 'device.json'), 'utf8'));
+        await saveDeviceEnrollmentAnchor({ config, store });
+        f.signedPolicy.skills.automaticInstall = false;
+        f.signedPolicy.tasks.allowedCommands['approved.smoke'] = { argv: ['node', '--version'], timeoutSeconds: 10 };
+        await writeFile(f.policyPath, JSON.stringify(f.signedPolicy));
+        const loaded = await loadSkillSynchronizationPolicy(f.policyPath, 'workspace-test', store);
+        assert.equal(loaded.policy.skills.automaticInstall, false);
+        assert.deepEqual(loaded.policy.tasks.allowedCommands['approved.smoke']?.argv, ['node', '--version']);
+        assert.equal(loaded.enrollment.organizationId, 'org_test');
+        const oldState = await readFile(f.statePath);
+        const again = await loadSkillSynchronizationPolicy(f.policyPath, 'workspace-test', store);
+        assert.deepEqual(again.policy, loaded.policy);
+        assert.deepEqual(await readFile(f.statePath), oldState);
+        await writeFile(join(f.home, 'device.json'), JSON.stringify({ ...config, enrolledAt: new Date(Date.now() - 60_000).toISOString() }));
+        await assert.rejects(() => loadSkillSynchronizationPolicy(f.policyPath, 'workspace-test', store), /secure enrollment anchor/);
+    }
+    finally {
+        if (previousHome === undefined)
+            delete process.env.DHARMA_HOME;
+        else
+            process.env.DHARMA_HOME = previousHome;
+    }
+});
+//# sourceMappingURL=skillSyncPolicy.test.js.map

package/dist/skillSyncPolicy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skillSyncPolicy.test.js","sourceRoot":"","sources":["../src/skillSyncPolicy.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAA6C,MAAM,2CAA2C,CAAC;AAElI,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACvH,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,0CAA0C,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB;QAC7G,MAAM,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QACxE,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM;KACrI,CAAC;IACF,MAAM,aAAa,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IACjG,MAAM,YAAY,GAAG,yBAAyB,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACzH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACtE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACzE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ;YAC1G,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,sCAAsC;SAC3H,CAAC,CAAC,CAAC,CAAC;IACL,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;QACxD,MAAM,EAAE,yBAAyB,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,sCAAsC;QAC/G,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,SAAS;QACtG,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClE,CAAC,CAAC,CAAC;IACJ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACrH,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC5G,CAAC;AAED,MAAM,KAAK,GAAG;IACZ,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,+EAA+E,EAAE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE;YACtL,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAChD,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC,EAAE;IACH,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,mDAAmD,EAAE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE;YACvJ,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC,EAAE;IACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE;YACvH,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3I,CAAC,EAAE;IACH,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE;YAC/H,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAClJ,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxK,CAAC,EAAE;IACH,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,qEAAqE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE;YACjL,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/E,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAC7G,CAAC,EAAE;IACH,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE;YAC3H,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;YACpE,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxK,CAAC,EAAE;IACH,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,4CAA4C,EAAE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE;YACvJ,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACvI,CAAC,EAAE;IACH,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACvF,QAAQ,EAAE,4DAA4D;QACtE,MAAM,EAAE,KAAK,EAAE,CAAsC,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;CACzH,CAAC;AAEF,KAAK,MAAM,QAAQ,IAAI,KAAK;IAAE,IAAI,CAAC,6BAA6B,QAAQ,CAAC,IAAI,mCAAmC,EAAE,KAAK,IAAI,EAAE;QAC3H,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QACtD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,WAAW,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;QACjC,UAAU,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACpJ,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;YACjC,IAAI,YAAY,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;;gBAAM,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,YAAY,CAAC;QAC9G,CAAC;IACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,aAAa,GAAG,KAAK,CAAC;IACtD,MAAM,WAAY,SAAQ,YAAY;QACpC,YAAY,KAAuB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC;KAC/B;IACD,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,sBAAsB;QAChE,GAAG,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,GAAG,IAAI,aAAa;YAAE,KAAK,IAAI,SAAS,CAAC,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACpG,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QAC/F,MAAM,0BAA0B,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,UAAU,CAAC,IAAI,GAAG,WAA8B,CAAC;QACjD,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC1H,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,IAAI,GAAG,YAAY,CAAC;QAC/B,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;;YAAM,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,YAAY,CAAC;IAC9G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;IACtH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,sBAAsB;QAChE,GAAG,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;QACjD,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QAC/F,MAAM,0BAA0B,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAC/C,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QAC7G,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC3F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QACrG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC1F,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACrI,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAChI,CAAC;YAAS,CAAC;QACT,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;;YAAM,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,YAAY,CAAC;IAC9G,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/usage.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_USAGE = "Usage: dharma <bootstrap|onboard|login|status|providers list|repositories discover|repositories connect|repositories list|repositories status|workspace add|workspace sync|evidence preview|evidence capture|evidence capture-batch|evidence sync|evidence run-request|relay probe|relay start|assistant chat|assistant history|assistant status|assistant approve|assistant reject|organization status|agents list|agents bind-runtime|evaluations validate|evaluations launch|evaluations status|evaluations results|experiments list|experiments run|failures list|remediations list|remediations act|tasks list|tasks dispatch|handoffs list|handoffs dispatch|skills list|skills release|skills rollout|skills rollback|skills sync|skills status|skills verify|usage list> [options]";
+export declare const CLI_USAGE = "Usage: dharma <bootstrap|onboard|login|status|providers list|repositories discover|repositories connect|repositories list|repositories status|repositories snapshot|repositories role-register|repositories role-discover|repositories ask|repositories reply|workspace add|workspace sync|evidence preview|evidence capture|evidence capture-batch|evidence sync|evidence run-request|relay probe|relay start|assistant chat|assistant history|assistant status|assistant approve|assistant reject|organization status|agents list|agents bind-runtime|evaluations validate|evaluations launch|evaluations status|evaluations results|experiments list|experiments run|failures list|remediations list|remediations act|tasks list|tasks dispatch|handoffs list|handoffs dispatch|skills list|skills release|skills rollout|skills rollback|skills sync|skills status|skills verify|usage list> [options]";
 //# sourceMappingURL=usage.d.ts.map

package/dist/usage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,SAAS,+vBAA+vB,CAAC"}
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,SAAS,+2BAA+2B,CAAC"}

package/dist/usage.js

@@ -1,2 +1,2 @@
-export const CLI_USAGE = 'Usage: dharma <bootstrap|onboard|login|status|providers list|repositories discover|repositories connect|repositories list|repositories status|workspace add|workspace sync|evidence preview|evidence capture|evidence capture-batch|evidence sync|evidence run-request|relay probe|relay start|assistant chat|assistant history|assistant status|assistant approve|assistant reject|organization status|agents list|agents bind-runtime|evaluations validate|evaluations launch|evaluations status|evaluations results|experiments list|experiments run|failures list|remediations list|remediations act|tasks list|tasks dispatch|handoffs list|handoffs dispatch|skills list|skills release|skills rollout|skills rollback|skills sync|skills status|skills verify|usage list> [options]';
+export const CLI_USAGE = 'Usage: dharma <bootstrap|onboard|login|status|providers list|repositories discover|repositories connect|repositories list|repositories status|repositories snapshot|repositories role-register|repositories role-discover|repositories ask|repositories reply|workspace add|workspace sync|evidence preview|evidence capture|evidence capture-batch|evidence sync|evidence run-request|relay probe|relay start|assistant chat|assistant history|assistant status|assistant approve|assistant reject|organization status|agents list|agents bind-runtime|evaluations validate|evaluations launch|evaluations status|evaluations results|experiments list|experiments run|failures list|remediations list|remediations act|tasks list|tasks dispatch|handoffs list|handoffs dispatch|skills list|skills release|skills rollout|skills rollback|skills sync|skills status|skills verify|usage list> [options]';
 //# sourceMappingURL=usage.js.map

package/dist/usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"usage.js","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,SAAS,GAAG,4vBAA4vB,CAAC"}
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../src/usage.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,SAAS,GAAG,42BAA42B,CAAC"}

package/dist/windowsProcessPortability.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=windowsProcessPortability.test.d.ts.map

package/dist/windowsProcessPortability.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsProcessPortability.test.d.ts","sourceRoot":"","sources":["../src/windowsProcessPortability.test.ts"],"names":[],"mappings":""}

package/dist/windowsProcessPortability.test.js

@@ -0,0 +1,14 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import test from 'node:test';
+test('Windows paths never require process.getuid before the platform guard', async () => {
+    const implementation = await readFile(new URL('../src/skillPreparationTransaction.ts', import.meta.url), 'utf8');
+    const privatePath = implementation.slice(implementation.indexOf('export async function assertPrivatePath('), implementation.indexOf('async function preflightAncestors('));
+    assert.ok(privatePath.indexOf("process.platform !== 'win32'") < privatePath.indexOf('process.getuid'));
+    const fixture = await readFile(new URL('../src/skillPreparation.test.ts', import.meta.url), 'utf8');
+    const getuid = fixture.indexOf('const getuid = process.getuid');
+    assert.ok(getuid > fixture.lastIndexOf("process.platform !== 'win32'", getuid));
+    if (process.platform === 'win32')
+        assert.equal(process.getuid, undefined);
+});
+//# sourceMappingURL=windowsProcessPortability.test.js.map

package/dist/windowsProcessPortability.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsProcessPortability.test.js","sourceRoot":"","sources":["../src/windowsProcessPortability.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,IAAI,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,uCAAuC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACjH,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,0CAA0C,CAAC,EACzG,cAAc,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,8BAA8B,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dharma-ai-labs/agent-fabric",
-  "version": "0.2.49",
+  "version": "0.2.51",
   "description": "Local-first CLI for connecting coding agents to Dharma evaluation, orchestration, and signed Skill delivery",
   "license": "MIT",
   "homepage": "https://github.com/dharma-ai-labs/dharma-agent-fabric/tree/main/packages/cli#readme",
@@ -38,9 +38,12 @@
     "@dharma-ai-labs/agent-fabric-local-vault": "0.1.15",
     "@dharma-ai-labs/agent-fabric-policy": "0.1.4",
     "@dharma-ai-labs/agent-fabric-provider-adapters": "0.1.16",
-    "@dharma-ai-labs/agent-fabric-relay-client": "0.2.17",
+    "@dharma-ai-labs/agent-fabric-relay-client": "0.2.19",
     "@dharma-ai-labs/agent-fabric-sdk": "0.1.10",
-    "@dharma-ai-labs/agent-fabric-skill-manager": "0.2.8",
-    "@dharma-ai-labs/agent-fabric-task-runner": "0.1.17"
+    "@dharma-ai-labs/agent-fabric-skill-manager": "0.2.9",
+    "@dharma-ai-labs/agent-fabric-task-runner": "0.1.17",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "fs-native-extensions": "1.5.1"
   }
 }