@entrorove/skill 0.1.69 → 0.1.71

package/scope-context-client.mjs

@@ -1,34 +1,16 @@
 import path from 'node:path';
-import { randomUUID, sign } from 'node:crypto';
-import { canonical, sha256 } from './local-integrity.mjs';
+import { sign } from 'node:crypto';
+import { canonical } from './local-integrity.mjs';
 import { withStateLock } from './local-state-lock.mjs';
-import { atomicMutationJson14, readMutationJson14 } from './local-mutation-files.mjs';
 import { bootstrapCloudMutationAuthority } from './cloud-mutation-authority.mjs';
 import { contextInput, contextFail, retainedContexts, originalContextDigest, contextChallenge } from './scope-context-wire.mjs';
 import { scopeContextLocation, effectiveScopeContexts, retainContextAuthority,
-  readContextJournal, saveContextJournal } from './scope-context-state.mjs';
+  saveContextJournal } from './scope-context-state.mjs';
 import { contextRemote } from './scope-context-remote.mjs';
-import { inspectContextEvidence, observeScopeContext } from './scope-context-observer.mjs';
+import { inspectContextEvidence, observeScopeContext, prepareScopeContext } from './scope-context-observer.mjs';
+import { contextJournal, renewContextChallenge } from './scope-context-journal.mjs';
 
 const schemaVersion = 'entrorove.scope-context-connection/1.0';
-async function archive(location, state) {
-  if (!state.attemptId) return;
-  const file = path.join(location.directory, `${state.attemptId}-${sha256(canonical(state))}.json`);
-  try { if (canonical(await readMutationJson14(file)) !== canonical(state)) contextFail('Context attempt history changed'); }
-  catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(file, state, { privateFrom: location.stateRoot }); }
-}
-async function journal(location, input) {
-  let state = await readContextJournal(location, input);
-  if (state.previous || input.action === 'status' && state.completed
-    || input.action === 'apply' && state.completed && !state.applied || state.rejection && !state.pending) {
-    await archive(location, state.previous ?? state); state = {};
-  }
-  if (!state.attemptId) {
-    state = { schemaVersion: 'entrorove.scope-context-journal/1.0', localBindingDigest: location.localBindingDigest,
-      input, attemptId: randomUUID() }; await saveContextJournal(location, state);
-  }
-  return state;
-}
 function proposalFor(status, input, location) {
   const proposal = status.proposal;
   if (!proposal || proposal.proposalId !== input.proposalId || proposal.proposalDigest !== input.proposalDigest
@@ -73,7 +55,7 @@ async function review(location, state, dependencies) {
 }
 async function applied(location, state) {
   const effective = state.applied.contextAuthority;
-  const challenge = contextChallenge(state.challenged.challenge, location, state.proposal, { allowExpired: true });
+  const challenge = contextChallenge((state.signingChallenge ?? state.challenged).challenge, location, state.proposal, { allowExpired: true });
   if (state.applied.grantsExecutionAuthority !== false || !effective?.record
     || canonical(effective.record.attestation) !== canonical(state.attestation)
     || ['proposalId', 'proposalDigest', 'ownerId', 'taskDigest', 'chainDigest'].some(field => effective.record[field] !== challenge[field])
@@ -94,16 +76,18 @@ async function apply(location, state, dependencies) {
   state.proposal = proposal; await saveContextJournal(location, state);
   if (!state.challenged) await contextRemote('challenged', 'scope-runner-context-challenge', { flowId: location.binding.flowId,
     proposalId: proposal.proposalId, proposalDigest: proposal.proposalDigest, attemptId: state.attemptId }, state, location, dependencies);
-  contextChallenge(state.challenged.challenge, location, proposal);
   if (!state.attestation) {
-    state.attestation = await observeScopeContext(location, state, proposal); await saveContextJournal(location, state);
+    const prepared = await prepareScopeContext(location, state, proposal);
+    state.attestation = await observeScopeContext(location, state, proposal, prepared,
+      () => renewContextChallenge(location, state, proposal, dependencies));
+    await saveContextJournal(location, state);
   }
   await contextRemote('applied', 'scope-runner-context-apply', { flowId: location.binding.flowId,
     proposalId: proposal.proposalId, proposalDigest: proposal.proposalDigest, attestation: state.attestation }, state, location, dependencies);
   return applied(location, state);
 }
 async function run(location, input, dependencies) {
-  const state = await journal(location, input);
+  const state = await contextJournal(location, input);
   if (state.pending) await contextRemote(state.pending.stage, state.pending.operation, state.pending.input, state, location, dependencies);
   try {
     if (input.action === 'review') return await review(location, state, dependencies);

package/scope-context-journal.mjs

@@ -0,0 +1,44 @@
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { atomicMutationJson14, readMutationJson14 } from './local-mutation-files.mjs';
+import { contextFail } from './scope-context-wire.mjs';
+import { readContextJournal, saveContextJournal } from './scope-context-state.mjs';
+import { contextRemote } from './scope-context-remote.mjs';
+
+export async function archiveContextAttempt(location, state) {
+  if (!state.attemptId) return;
+  const file = path.join(location.directory, `${state.attemptId}-${sha256(canonical(state))}.json`);
+  try { if (canonical(await readMutationJson14(file)) !== canonical(state)) contextFail('Context attempt history changed'); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(file, state, { privateFrom: location.stateRoot }); }
+}
+function reusableSnapshot(state, input) {
+  return input.action === 'apply' && state.snapshot && state.challenged && !state.pending && !state.completed && !state.applied
+    && state.rejection && !state.rejection.requestId && !state.rejection.output;
+}
+export async function contextJournal(location, input) {
+  let state = await readContextJournal(location, input);
+  if (!state.previous && reusableSnapshot(state, input)) {
+    await archiveContextAttempt(location, state);
+    for (const field of ['rejection', 'checked', 'attestation', 'signingChallenge', 'signingAttemptId']) delete state[field];
+    await saveContextJournal(location, state);
+  } else if (state.previous || !state.pending && !state.applied && (state.rejection
+    || input.action === 'status' && state.completed || input.action === 'apply' && state.completed)) {
+    await archiveContextAttempt(location, state.previous ?? state); state = {};
+  }
+  if (!state.attemptId) {
+    state = { schemaVersion: 'entrorove.scope-context-journal/1.0', localBindingDigest: location.localBindingDigest,
+      input, attemptId: randomUUID() }; await saveContextJournal(location, state);
+  }
+  return state;
+}
+export async function renewContextChallenge(location, state, proposal, dependencies) {
+  if (state.pending) contextFail('Recover the original pending request before any challenge renewal');
+  await archiveContextAttempt(location, state);
+  delete state.signingChallenge;
+  state.signingAttemptId = randomUUID(); await saveContextJournal(location, state);
+  const output = await contextRemote('signingChallenge', 'scope-runner-context-challenge', { flowId: location.binding.flowId,
+    proposalId: proposal.proposalId, proposalDigest: proposal.proposalDigest, attemptId: state.signingAttemptId },
+  state, location, dependencies);
+  return output.challenge;
+}

package/scope-context-observer.mjs

@@ -1,6 +1,6 @@
 import { randomUUID, sign } from 'node:crypto';
 import { canonical } from './local-integrity.mjs';
-import { scopeRead, scopeTarget } from './local-scope-files.mjs';
+import { scopeBuildSourceRead, scopeTarget } from './local-scope-files.mjs';
 import { snapshotPlan, snapshotVerify } from './local-execution.mjs';
 import { collectScopeFacts } from './local-scope-repository.mjs';
 import { readScopeSnapshot, verifyFreshScopeSnapshot } from './local-scope-snapshot.mjs';
@@ -20,22 +20,27 @@ export async function inspectContextEvidence(location, contexts, evidencePaths)
   for (const relative of [...paths].sort()) {
     const target = await scopeTarget(location.root, relative);
     if (!target.stat.isFile() || target.stat.size > 1_048_576) contextFail('Build evidence must be an actual ordinary bounded repository file');
-    const read = await scopeRead(location.root, relative, { repositoryRoot: location.root });
+    const read = await scopeBuildSourceRead(location.root, relative, { repositoryRoot: location.root });
+    if (read.bytes > 1_048_576) contextFail('Build evidence exceeds its actual 1 MiB inspection bound');
     evidence.push({ path: relative, sha256: read.sha256 });
   }
   return evidence;
 }
-export async function observeScopeContext(location, state, proposal) {
-  const challenge = contextChallenge(state.challenged.challenge, location, proposal);
-  const evidence = await inspectContextEvidence(location, challenge.importContexts, challenge.evidence.map(file => file.path));
-  if (canonical(evidence) !== canonical(challenge.evidence)) contextFail('Actual build configuration or loader evidence changed since review');
-  if (!state.snapshotId) { state.snapshotId = `context-${randomUUID()}`; await saveContextJournal(location, state); }
-  const input = { repositoryRoot: location.root, home: location.home, flowId: challenge.flowId, stepId: challenge.stepId,
+function observationInput(location, state, proposal, challenge) {
+  return { repositoryRoot: location.root, home: location.home, flowId: challenge.flowId, stepId: challenge.stepId,
     snapshotId: state.snapshotId, paths: [...location.binding.targetPaths], importContexts: challenge.importContexts,
     contextRevisionDigest: proposal.proposalDigest, contextEvidence: challenge.evidence,
     signerConfigPath: location.signerConfigPath, ownerId: challenge.ownerId,
     task: challenge.task, taskDigest: challenge.taskDigest, chainDigest: challenge.chainDigest,
     repositoryId: challenge.repositoryId, challenge: challenge.challenge };
+}
+export async function prepareScopeContext(location, state, proposal) {
+  // An expired server challenge can still identify read-only preparation; it cannot sign or apply.
+  const challenge = contextChallenge(state.challenged.challenge, location, proposal, { allowExpired: true });
+  const evidence = await inspectContextEvidence(location, challenge.importContexts, challenge.evidence.map(file => file.path));
+  if (canonical(evidence) !== canonical(challenge.evidence)) contextFail('Actual build configuration or loader evidence changed since review');
+  if (!state.snapshotId) { state.snapshotId = `context-${randomUUID()}`; await saveContextJournal(location, state); }
+  const input = observationInput(location, state, proposal, challenge);
   if (!state.snapshot) {
     if (state.snapshotStarted) contextFail('Interrupted context snapshot must be inspected before another observation; preserve its files');
     state.snapshotStarted = true; await saveContextJournal(location, state);
@@ -48,13 +53,34 @@ export async function observeScopeContext(location, state, proposal) {
   const snapshot = await readScopeSnapshot(input, location.root);
   const facts = await collectScopeFacts(location.root, input.paths, undefined, snapshot.known, input);
   facts.snapshotEvidence = await verifyFreshScopeSnapshot(input, location.root, facts);
+  return { input, facts, evidence };
+}
+function sameObservation(candidate, input, challenge) {
+  const withoutNonce = value => Object.fromEntries(Object.entries(value).filter(([field]) => field !== 'challenge'));
+  if (canonical(withoutNonce(candidate.input)) !== canonical(withoutNonce(input))
+    || canonical(candidate.evidence) !== canonical(challenge.evidence)) contextFail('Fresh challenge replaced original preparation identity');
+}
+export async function observeScopeContext(location, state, proposal, prepared, renewChallenge) {
+  const candidate = prepared ?? await prepareScopeContext(location, state, proposal);
+  let challenge = contextChallenge((state.signingChallenge ?? state.challenged).challenge, location, proposal,
+    { allowExpired: typeof renewChallenge === 'function' });
+  const input = observationInput(location, state, proposal, challenge);
+  sameObservation(candidate, input, challenge);
+  const beforeSign = renewChallenge && (async () => {
+    challenge = contextChallenge(await renewChallenge(), location, proposal);
+    sameObservation(candidate, observationInput(location, state, proposal, challenge), challenge);
+    return { challenge: challenge.challenge, maximumExpiresAt: Date.parse(challenge.expiresAt) };
+  });
+  const facts = candidate.facts;
   const observed = await attestScopeFacts(input, { repositoryRoot: location.root, facts,
-    snapshotDigest: facts.snapshotEvidence.snapshotDigest }, { maximumExpiresAt: Date.parse(challenge.expiresAt) });
-  if (!observed.attestation || canonical(observed.attestation.importContexts) !== canonical(challenge.importContexts)
+    snapshotDigest: facts.snapshotEvidence.snapshotDigest }, beforeSign ? { beforeSign }
+      : { maximumExpiresAt: Date.parse(challenge.expiresAt) });
+  if (!observed.attestation || observed.attestation.challenge !== challenge.challenge
+    || canonical(observed.attestation.importContexts) !== canonical(challenge.importContexts)
     || observed.attestation.contextRevisionDigest !== proposal.proposalDigest
     || Date.parse(observed.attestation.expiresAt) > Date.parse(challenge.expiresAt)) contextFail('Context candidate requires its actual purpose-bound original S proof');
   const after = await inspectContextEvidence(location, challenge.importContexts, challenge.evidence.map(file => file.path));
-  if (canonical(after) !== canonical(evidence)) contextFail('Build evidence changed while observing its actual imports');
+  if (canonical(after) !== canonical(candidate.evidence)) contextFail('Build evidence changed while observing its actual imports');
   const core = { schemaVersion: 'entrorove.scope-context-attestation/1.0', challengeId: challenge.challengeId,
     proposalDigest: proposal.proposalDigest, scopeAttestation: observed.attestation };
   return { ...core, signature: sign(null, Buffer.from(canonical(core)), location.key).toString('base64url') };

package/scope-context-release.mjs

@@ -1,6 +1,6 @@
 export const SCOPE_CONTEXT_SOURCE_FILES = [
   'scope-context-client.mjs', 'scope-context-observer.mjs', 'scope-context-observation.mjs', 'scope-context-remote.mjs',
-  'scope-context-state.mjs', 'scope-context-wire.mjs', 'scope-context-release.mjs',
+  'scope-context-state.mjs', 'scope-context-wire.mjs', 'scope-context-journal.mjs', 'scope-context-release.mjs',
 ]
 export const scopeContextReleaseNote = {
   zh: '新增首次范围门禁前的构建上下文纠正：原账号审核真实配置和构建证据，原 S 签名完整路径快照，通过服务挑战追加上下文权威记录；保留原 flow、绑定、旧上下文和失败历史，不授予写入或完成权限。',