@enactprotocol/cli 1.2.1 → 1.2.2

package/dist/index.js

@@ -37754,7 +37754,7 @@ var require_high_level_opt = __commonJS((exports, module) => {
   ]).reduce((set, kv) => (set[kv[0]] = kv[1], set), Object.create(null)) : {};
 });
 
-// ../../node_modules/tar/node_modules/minipass/index.js
+// ../../node_modules/minipass/index.js
 var require_minipass = __commonJS((exports) => {
   var proc = typeof process === "object" && process ? process : {
     stdout: null,
@@ -229045,6 +229045,7 @@ class EnactCore {
     }
   }
   async verifyTool(tool, dangerouslySkipVerification = false) {
+    console.log("=== VERIFY TOOL CALLED ===", tool.name, "skipVerification:", dangerouslySkipVerification);
     if (dangerouslySkipVerification) {
       logger_default.warn(`Skipping signature verification for tool: ${tool.name}`);
       return;
@@ -229053,22 +229054,32 @@ class EnactCore {
       if (!tool.signatures || tool.signatures.length === 0) {
         throw new Error(`Tool ${tool.name} does not have any signatures`);
       }
+      console.log("=== TOOL SIGNATURE DATA ===");
+      console.log("Tool signatures from database:", JSON.stringify(tool.signatures, null, 2));
+      console.log("Tool command:", tool.command);
       const documentForVerification = {
         command: tool.command
       };
       const referenceSignature = {
         signature: tool.signatures[0].value,
-        publicKey: tool.signatures[0].signer,
+        publicKey: "",
         algorithm: tool.signatures[0].algorithm,
         timestamp: new Date(tool.signatures[0].created).getTime()
       };
       const canonicalDoc = SigningService.getCanonicalDocument(documentForVerification, { includeFields: ["command"] });
+      console.log("=== SIGNATURE VERIFICATION DEBUG ===");
+      console.log("Original document for verification:", JSON.stringify(documentForVerification, null, 2));
+      console.log("Canonical document:", JSON.stringify(canonicalDoc, null, 2));
       const docString = JSON.stringify(canonicalDoc);
       const messageHash = CryptoUtils.hash(docString);
+      console.log("Document string:", docString);
+      console.log("Message hash:", messageHash);
+      console.log("Reference signature object:", JSON.stringify(referenceSignature, null, 2));
       const directVerify = CryptoUtils.verify(referenceSignature.publicKey, messageHash, referenceSignature.signature);
-      console.log("Direct crypto verification result:", directVerify);
+      console.log("KEITH DEBUG - Direct crypto verification result:", directVerify, "publicKey:", referenceSignature.publicKey);
       const trustedKeys = KeyManager.getAllTrustedPublicKeys();
       console.log("Trusted keys:", trustedKeys);
+      console.log("Our referenceSignature.publicKey:", JSON.stringify(referenceSignature.publicKey));
       console.log("Is our public key trusted?", trustedKeys.includes(referenceSignature.publicKey));
       const isValid = SigningService.verifyDocument(documentForVerification, referenceSignature, { includeFields: ["command"] });
       console.log("Final verification result:", isValid);

package/dist/index.js.bak

@@ -37753,7 +37753,7 @@ var require_high_level_opt = __commonJS((exports, module) => {
   ]).reduce((set, kv) => (set[kv[0]] = kv[1], set), Object.create(null)) : {};
 });
 
-// ../../node_modules/tar/node_modules/minipass/index.js
+// ../../node_modules/minipass/index.js
 var require_minipass = __commonJS((exports) => {
   var proc = typeof process === "object" && process ? process : {
     stdout: null,
@@ -229044,6 +229044,7 @@ class EnactCore {
     }
   }
   async verifyTool(tool, dangerouslySkipVerification = false) {
+    console.log("=== VERIFY TOOL CALLED ===", tool.name, "skipVerification:", dangerouslySkipVerification);
     if (dangerouslySkipVerification) {
       logger_default.warn(`Skipping signature verification for tool: ${tool.name}`);
       return;
@@ -229052,22 +229053,32 @@ class EnactCore {
       if (!tool.signatures || tool.signatures.length === 0) {
         throw new Error(`Tool ${tool.name} does not have any signatures`);
       }
+      console.log("=== TOOL SIGNATURE DATA ===");
+      console.log("Tool signatures from database:", JSON.stringify(tool.signatures, null, 2));
+      console.log("Tool command:", tool.command);
       const documentForVerification = {
         command: tool.command
       };
       const referenceSignature = {
         signature: tool.signatures[0].value,
-        publicKey: tool.signatures[0].signer,
+        publicKey: "",
         algorithm: tool.signatures[0].algorithm,
         timestamp: new Date(tool.signatures[0].created).getTime()
       };
       const canonicalDoc = SigningService.getCanonicalDocument(documentForVerification, { includeFields: ["command"] });
+      console.log("=== SIGNATURE VERIFICATION DEBUG ===");
+      console.log("Original document for verification:", JSON.stringify(documentForVerification, null, 2));
+      console.log("Canonical document:", JSON.stringify(canonicalDoc, null, 2));
       const docString = JSON.stringify(canonicalDoc);
       const messageHash = CryptoUtils.hash(docString);
+      console.log("Document string:", docString);
+      console.log("Message hash:", messageHash);
+      console.log("Reference signature object:", JSON.stringify(referenceSignature, null, 2));
       const directVerify = CryptoUtils.verify(referenceSignature.publicKey, messageHash, referenceSignature.signature);
-      console.log("Direct crypto verification result:", directVerify);
+      console.log("KEITH DEBUG - Direct crypto verification result:", directVerify, "publicKey:", referenceSignature.publicKey);
       const trustedKeys = KeyManager.getAllTrustedPublicKeys();
       console.log("Trusted keys:", trustedKeys);
+      console.log("Our referenceSignature.publicKey:", JSON.stringify(referenceSignature.publicKey));
       console.log("Is our public key trusted?", trustedKeys.includes(referenceSignature.publicKey));
       const isValid = SigningService.verifyDocument(documentForVerification, referenceSignature, { includeFields: ["command"] });
       console.log("Final verification result:", isValid);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enactprotocol/cli",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Official CLI for the Enact Protocol - package, secure, and discover AI tools",
   "type": "module",
   "main": "./dist/index.js",
@@ -42,7 +42,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@enactprotocol/shared": "1.2.0",
+    "@enactprotocol/shared": "1.2.2",
     "@clack/core": "^0.4.2",
     "@clack/prompts": "^0.10.1",
     "picocolors": "^1.1.1"