@dharma-ai-labs/agent-fabric 0.2.74 → 0.2.76

package/dist/index.test.js

@@ -7,7 +7,7 @@ import { join } from 'node:path';
 import test from 'node:test';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
-import { acceptedTrajectoryHead, activateAgyPlugin, attestAgySkillActivation, attestHermesSkillBundleActivation, actionDecisionCapabilityFreshUntil, canonicalFilesystemPath, controlAgentDecisionUrl, installAvailableNativeAgentFabricBootstraps, assertCapsuleAuthorizedByCurrentPolicy, assertRecoveredTaskWorkspacePolicy, assertTaskWorkspacePolicy, assertTaskSkillPin, installNativeAgentFabricBootstrap, installClaudeReadOnlyProjectPermissions, installRepositoryAgentFabricSkill, isDirectExecution, isTransientBootstrapError, loadAgentFabricOnboardingContract, loadOrCreateInstallationId, materializeWorkspacePolicy, applyServerEvidencePolicy, materializeInlineSkillFiles, validateSkillBundleSources, nativeSkillDirectory, nativeSkillDirectoryForWorkspace, normalizeGitRemoteIdentity, postTaskOutcome, parseCliOptions, parseSelectedProviderIds, pathExistsOrThrow, portalUrl, providerHintFromEnvironment, providerHintFromProcessArgv, probeRelayConnection, preflightBootstrapWorkspaceIdentity, rawLocalRetentionDays, requireCompletedBootstrapEvidence, retryBootstrapOnboarding, synchronizeBootstrapEvidence, deferUnavailableRelayRetention, recoverLegacySkillBundleIdAfterAuthorizationFailure, installedBundleIdForSkillPollAfterAuthorizationFailure, recoveredTaskPolicyWasSuperseded, relayProcessState, releaseDailyContentUpload, reserveDailyContentUpload, run, runAssistantCommand, sourceRepositoryFingerprint, stableRepositoryLauncherContents, summarizeBootstrapOrganizationApi, ensureAgyReadOnlyAttestationPermission, attestAgySkillBundleActivation, responseTextFromEvent, taskResponsePreview, taskReceiptSession, taskSkillPinFailureCode, verifyAgentFabricSkillInstallation, waitForRelayReadiness, withWorkspacePolicyRefreshLock, withWorkspaceSkillActivationLock, } from './index.js';
+import { acceptedTrajectoryHead, activateAgyPlugin, attestAgySkillActivation, attestHermesSkillBundleActivation, actionDecisionCapabilityFreshUntil, canonicalFilesystemPath, controlAgentDecisionUrl, installAvailableNativeAgentFabricBootstraps, assertCapsuleAuthorizedByCurrentPolicy, assertRecoveredTaskWorkspacePolicy, assertTaskWorkspacePolicy, assertTaskSkillPin, installNativeAgentFabricBootstrap, installClaudeReadOnlyProjectPermissions, installRepositoryAgentFabricSkill, isDirectExecution, isTransientBootstrapError, loadAgentFabricOnboardingContract, loadOrCreateInstallationId, materializeWorkspacePolicy, applyServerEvidencePolicy, materializeInlineSkillFiles, validateSkillBundleSources, nativeSkillDirectory, nativeSkillDirectoryForWorkspace, nativeSkillRootMatchingAuthorization, normalizeGitRemoteIdentity, postTaskOutcome, parseCliOptions, parseSelectedProviderIds, pathExistsOrThrow, portalUrl, providerHintFromEnvironment, providerHintFromProcessArgv, probeRelayConnection, preflightBootstrapWorkspaceIdentity, rawLocalRetentionDays, requireCompletedBootstrapEvidence, retryBootstrapOnboarding, synchronizeBootstrapEvidence, deferUnavailableRelayRetention, recoverLegacySkillBundleIdAfterAuthorizationFailure, installedBundleIdForSkillPollAfterAuthorizationFailure, recoveredTaskPolicyWasSuperseded, relayProcessState, releaseDailyContentUpload, reserveDailyContentUpload, run, runAssistantCommand, sourceRepositoryFingerprint, stableRepositoryLauncherContents, summarizeBootstrapOrganizationApi, ensureAgyReadOnlyAttestationPermission, attestAgySkillBundleActivation, responseTextFromEvent, taskResponsePreview, taskReceiptSession, taskSkillPinFailureCode, verifyAgentFabricSkillInstallation, waitForRelayReadiness, withWorkspacePolicyRefreshLock, withWorkspaceSkillActivationLock, } from './index.js';
 import { canonicalize, signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
 import { buildTrajectoryCapsule } from '@dharma-ai-labs/agent-fabric-evidence-reduction';
 import { CLI_USAGE } from './usage.js';
@@ -1570,13 +1570,13 @@ test('relay probe opens an authenticated session without polling or leasing work
         },
         openSession: async (version) => {
             sessions += 1;
-            assert.equal(version, '0.2.74');
+            assert.equal(version, '0.2.76');
             return { ok: true };
         },
     }));
     assert.equal(sessions, 1);
     assert.deepEqual(result, {
-        ok: true, connected: true, organizationId: 'org_test', deviceId: 'device_test', relayVersion: '0.2.74',
+        ok: true, connected: true, organizationId: 'org_test', deviceId: 'device_test', relayVersion: '0.2.76',
     });
 });
 test('relay probe fails closed when the server does not acknowledge the session', async () => {
@@ -1791,6 +1791,38 @@ test('a second Codex workspace uses its repository skill without replacing the f
     assert.equal(await readFile(join(projectSkill, 'SKILL.md'), 'utf8'), '# Second signed workspace\n');
     assert.equal(await readFile(join(globalSkill, 'SKILL.md'), 'utf8'), '# First signed workspace\n');
 });
+test('duplicate native skill roots select the receipt pinned by protected authorization', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-duplicate-native-roots-'));
+    const globalRoot = join(root, 'global');
+    const projectRoot = join(root, 'project');
+    const workspaceId = 'workspace_shared';
+    const oldBundleId = '11111111-1111-4111-8111-111111111111';
+    const currentBundleId = '22222222-2222-4222-8222-222222222222';
+    const oldHash = `sha256:${'a'.repeat(64)}`;
+    const currentHash = `sha256:${'b'.repeat(64)}`;
+    const writeReceipt = async (nativeRoot, bundleId, receiptHash) => {
+        const managed = join(nativeRoot, '.dharma-managed', 'workspaces', workspaceId);
+        await mkdir(join(managed, 'active'), { recursive: true });
+        await writeFile(join(managed, 'ACTIVE_BUNDLE'), bundleId);
+        await writeFile(join(managed, 'active', 'INSTALL_RECEIPT.json'), JSON.stringify({ bundleId, receiptHash }));
+    };
+    await writeReceipt(globalRoot, oldBundleId, oldHash);
+    await writeReceipt(projectRoot, currentBundleId, currentHash);
+    const roots = [projectRoot, globalRoot];
+    assert.equal(await nativeSkillRootMatchingAuthorization({
+        roots, workspaceId, bundleId: currentBundleId, receiptHash: currentHash,
+    }), projectRoot);
+    assert.equal(await nativeSkillRootMatchingAuthorization({
+        roots, workspaceId, bundleId: oldBundleId, receiptHash: oldHash,
+    }), globalRoot);
+    assert.equal(await nativeSkillRootMatchingAuthorization({
+        roots, workspaceId, bundleId: currentBundleId, receiptHash: oldHash,
+    }), null);
+    await writeReceipt(projectRoot, currentBundleId, oldHash);
+    assert.equal(await nativeSkillRootMatchingAuthorization({
+        roots, workspaceId, bundleId: currentBundleId, receiptHash: currentHash,
+    }), null);
+});
 test('Claude uses its project skill when another workspace owns the global skill', async () => {
     const root = await mkdtemp(join(tmpdir(), 'dharma-claude-multiworkspace-'));
     const home = join(root, 'home');