@dharma-ai-labs/agent-fabric 0.2.55 → 0.2.58

package/dist/index.test.js

@@ -7,11 +7,23 @@ import { join } from 'node:path';
 import test from 'node:test';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
-import { acceptedTrajectoryHead, activateAgyPlugin, attestAgySkillActivation, attestHermesSkillBundleActivation, actionDecisionCapabilityFreshUntil, canonicalFilesystemPath, controlAgentDecisionUrl, installAvailableNativeAgentFabricBootstraps, assertCapsuleAuthorizedByCurrentPolicy, assertRecoveredTaskWorkspacePolicy, assertTaskWorkspacePolicy, assertTaskSkillPin, installNativeAgentFabricBootstrap, installClaudeReadOnlyProjectPermissions, installRepositoryAgentFabricSkill, isDirectExecution, isTransientBootstrapError, materializeWorkspacePolicy, applyServerEvidencePolicy, materializeInlineSkillFiles, validateSkillBundleSources, nativeSkillDirectory, normalizeGitRemoteIdentity, postTaskOutcome, parseCliOptions, parseSelectedProviderIds, pathExistsOrThrow, portalUrl, providerHintFromEnvironment, providerHintFromProcessArgv, probeRelayConnection, preflightBootstrapWorkspaceIdentity, rawLocalRetentionDays, requireCompletedBootstrapEvidence, retryBootstrapOnboarding, synchronizeBootstrapEvidence, deferUnavailableRelayRetention, recoverLegacySkillBundleIdAfterAuthorizationFailure, installedBundleIdForSkillPollAfterAuthorizationFailure, recoveredTaskPolicyWasSuperseded, relayProcessState, releaseDailyContentUpload, reserveDailyContentUpload, run, runAssistantCommand, sourceRepositoryFingerprint, stableRepositoryLauncherContents, summarizeBootstrapOrganizationApi, ensureAgyReadOnlyAttestationPermission, attestAgySkillBundleActivation, responseTextFromEvent, taskResponsePreview, taskReceiptSession, taskSkillPinFailureCode, verifyAgentFabricSkillInstallation, waitForRelayReadiness, withWorkspacePolicyRefreshLock, withWorkspaceSkillActivationLock, } from './index.js';
+import { acceptedTrajectoryHead, activateAgyPlugin, attestAgySkillActivation, attestHermesSkillBundleActivation, actionDecisionCapabilityFreshUntil, canonicalFilesystemPath, controlAgentDecisionUrl, installAvailableNativeAgentFabricBootstraps, assertCapsuleAuthorizedByCurrentPolicy, assertRecoveredTaskWorkspacePolicy, assertTaskWorkspacePolicy, assertTaskSkillPin, installNativeAgentFabricBootstrap, installClaudeReadOnlyProjectPermissions, installRepositoryAgentFabricSkill, isDirectExecution, isTransientBootstrapError, loadOrCreateInstallationId, materializeWorkspacePolicy, applyServerEvidencePolicy, materializeInlineSkillFiles, validateSkillBundleSources, nativeSkillDirectory, normalizeGitRemoteIdentity, postTaskOutcome, parseCliOptions, parseSelectedProviderIds, pathExistsOrThrow, portalUrl, providerHintFromEnvironment, providerHintFromProcessArgv, probeRelayConnection, preflightBootstrapWorkspaceIdentity, rawLocalRetentionDays, requireCompletedBootstrapEvidence, retryBootstrapOnboarding, synchronizeBootstrapEvidence, deferUnavailableRelayRetention, recoverLegacySkillBundleIdAfterAuthorizationFailure, installedBundleIdForSkillPollAfterAuthorizationFailure, recoveredTaskPolicyWasSuperseded, relayProcessState, releaseDailyContentUpload, reserveDailyContentUpload, run, runAssistantCommand, sourceRepositoryFingerprint, stableRepositoryLauncherContents, summarizeBootstrapOrganizationApi, ensureAgyReadOnlyAttestationPermission, attestAgySkillBundleActivation, responseTextFromEvent, taskResponsePreview, taskReceiptSession, taskSkillPinFailureCode, verifyAgentFabricSkillInstallation, waitForRelayReadiness, withWorkspacePolicyRefreshLock, withWorkspaceSkillActivationLock, } from './index.js';
 import { canonicalize, signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
 import { buildTrajectoryCapsule } from '@dharma-ai-labs/agent-fabric-evidence-reduction';
 import { CLI_USAGE } from './usage.js';
 import { isSupportedNodeVersion, launchWithRuntime, nodeRuntimeCandidates, runtimeBootstrapHint, } from './runtime-bootstrap.js';
+test('installation identity is durable per DHARMA_HOME and rejects corrupt state', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-installation-identity-'));
+    const path = join(root, 'installation.json');
+    const first = await loadOrCreateInstallationId(path);
+    const second = await loadOrCreateInstallationId(path);
+    assert.match(first, /^[0-9a-f-]{36}$/i);
+    assert.equal(second, first);
+    if (process.platform !== 'win32')
+        assert.equal((await stat(path)).mode & 0o777, 0o600);
+    await writeFile(path, '{"schema":"dharma.installation-identity/v1","installationId":"invalid"}\n');
+    await assert.rejects(loadOrCreateInstallationId(path), /Installation identity is invalid/);
+});
 const execFileAsync = promisify(execFile);
 test('bootstrap retries transient relay failures without retrying validation failures', async () => {
     const waits = [];
@@ -1555,13 +1567,13 @@ test('relay probe opens an authenticated session without polling or leasing work
         },
         openSession: async (version) => {
             sessions += 1;
-            assert.equal(version, '0.2.55');
+            assert.equal(version, '0.2.58');
             return { ok: true };
         },
     }));
     assert.equal(sessions, 1);
     assert.deepEqual(result, {
-        ok: true, connected: true, organizationId: 'org_test', deviceId: 'device_test', relayVersion: '0.2.55',
+        ok: true, connected: true, organizationId: 'org_test', deviceId: 'device_test', relayVersion: '0.2.58',
     });
 });
 test('relay probe fails closed when the server does not acknowledge the session', async () => {
@@ -1681,6 +1693,59 @@ test('native bootstrap installation makes the repository skill verifiable by Cod
     assert.equal(verified.repositoryInstalled, true);
     assert.equal(verified.nativeInstalled, true);
 });
+test('signed native ownership remains installed after bootstrap replacement', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-signed-native-skill-'));
+    const home = join(root, 'home');
+    const workspace = join(root, 'repo');
+    const workspaceId = 'workspace_test';
+    await mkdir(workspace, { recursive: true });
+    await installRepositoryAgentFabricSkill({
+        workspace,
+        hqUrl: 'https://www.dharma-ai.io',
+        organizationId: 'org_test',
+        workspaceId,
+        policyRevision: 'agent-fabric-policy-v1',
+    });
+    const skillRoot = join(nativeSkillDirectory('codex', {}, home), 'dharma-agent-fabric');
+    await mkdir(skillRoot, { recursive: true });
+    await writeFile(join(skillRoot, 'SKILL.md'), '# Signed managed skill\n');
+    await writeFile(join(skillRoot, '.dharma-agent-fabric.json'), JSON.stringify({
+        bundleId: '11111111-1111-4111-8111-111111111111',
+        skillId: 'dharma-agent-fabric',
+        workspaceId,
+    }));
+    const verified = await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace, home });
+    assert.equal(verified.ready, true);
+    assert.equal(verified.nativeInstalled, true);
+    assert.equal(verified.nativeManaged, true);
+    assert.equal(verified.nativeDiscovered, true);
+    assert.equal(verified.signedLifecycleReady, false);
+});
+test('signed native ownership rejects a foreign workspace marker', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-foreign-signed-native-skill-'));
+    const home = join(root, 'home');
+    const workspace = join(root, 'repo');
+    await mkdir(workspace, { recursive: true });
+    await installRepositoryAgentFabricSkill({
+        workspace,
+        hqUrl: 'https://www.dharma-ai.io',
+        organizationId: 'org_test',
+        workspaceId: 'workspace_test',
+        policyRevision: 'agent-fabric-policy-v1',
+    });
+    const skillRoot = join(nativeSkillDirectory('codex', {}, home), 'dharma-agent-fabric');
+    await mkdir(skillRoot, { recursive: true });
+    await writeFile(join(skillRoot, 'SKILL.md'), '# Foreign managed skill\n');
+    await writeFile(join(skillRoot, '.dharma-agent-fabric.json'), JSON.stringify({
+        bundleId: '11111111-1111-4111-8111-111111111111',
+        skillId: 'dharma-agent-fabric',
+        workspaceId: 'workspace_foreign',
+    }));
+    const verified = await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace, home });
+    assert.equal(verified.ready, false);
+    assert.equal(verified.nativeInstalled, false);
+    assert.equal(verified.nativeManaged, false);
+});
 test('native Claude bootstrap installs the bounded project completion policy', async () => {
     const root = await mkdtemp(join(tmpdir(), 'dharma-native-claude-skill-'));
     const home = join(root, 'home');