@fitlab-ai/agent-infra 0.9.5 → 0.9.7

package/dist/lib/process-data/store.js

@@ -47,12 +47,39 @@ function canonicalJsonBytes(value) {
     return Buffer.from(canonicalString(value, new Set()), 'utf8');
 }
 function ensurePrivateDirectory(directory) {
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    if (process.platform !== 'win32')
-        fs.chmodSync(directory, 0o700);
+    const missing = [];
+    let current = path.resolve(directory);
+    while (!fs.existsSync(current)) {
+        missing.push(current);
+        const parent = path.dirname(current);
+        if (parent === current)
+            throw new Error(`cannot create directory tree: ${directory}`);
+        current = parent;
+    }
+    for (const target of missing.reverse()) {
+        fs.mkdirSync(target, { mode: 0o700 });
+        if (process.platform !== 'win32')
+            fs.chmodSync(target, 0o700);
+        fsyncDirectory(path.dirname(target));
+    }
+}
+function fsyncDirectory(directory) {
+    if (process.platform === 'win32')
+        return;
+    const fd = fs.openSync(directory, 'r');
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
 }
 function writeExclusive(filePath, bytes) {
-    ensurePrivateDirectory(path.dirname(filePath));
+    const directory = path.dirname(filePath);
+    const directoryExisted = fs.existsSync(directory);
+    ensurePrivateDirectory(directory);
+    if (!directoryExisted)
+        fsyncDirectory(path.dirname(directory));
     try {
         const fd = fs.openSync(filePath, 'wx', 0o600);
         try {
@@ -62,6 +89,7 @@ function writeExclusive(filePath, bytes) {
         finally {
             fs.closeSync(fd);
         }
+        fsyncDirectory(directory);
         return true;
     }
     catch (error) {
@@ -100,7 +128,14 @@ function jsonLine(value) {
     return `${canonicalJsonBytes(value).toString('utf8')}\n`;
 }
 function writePrivateFile(filePath, content) {
-    fs.writeFileSync(filePath, content, { mode: 0o600, flag: 'wx' });
+    const fd = fs.openSync(filePath, 'wx', 0o600);
+    try {
+        fs.writeFileSync(fd, content);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
     if (process.platform !== 'win32')
         fs.chmodSync(filePath, 0o600);
 }
@@ -153,9 +188,82 @@ function publishSnapshot(root, input) {
             if (existing !== jsonLine(manifest))
                 throw new Error(`snapshot collision: ${snapshotId}`);
             fs.rmSync(staging, { recursive: true, force: true });
+            fsyncDirectory(stagingRoot);
+            return { snapshotId, path: destination, created: false };
+        }
+        fsyncDirectory(staging);
+        fs.renameSync(staging, destination);
+        fsyncDirectory(stagingRoot);
+        fsyncDirectory(path.dirname(destination));
+        return { snapshotId, path: destination, created: true };
+    }
+    catch (error) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        throw error;
+    }
+}
+function publishSnapshotV2(root, input) {
+    ensurePrivateDirectory(root);
+    ensurePrivateDirectory(path.join(root, 'repairs'));
+    const date = new Date(input.observedTo);
+    if (!Number.isFinite(date.getTime()))
+        throw new Error('observedTo must be an ISO timestamp');
+    const identity = {
+        scope: 'github',
+        repository: input.repository,
+        observedFrom: input.observedFrom,
+        observedTo: input.observedTo,
+        objects: input.objects,
+        endpoints: input.endpoints,
+        excerptsEnabled: false,
+        dispositionCounts: dispositionCounts(input.objects),
+        recordCount: input.records.length,
+        findingCount: input.quality.length,
+        repairCount: input.repairs.length,
+        snapshotKind: input.snapshotKind,
+        parentSnapshotId: input.parentSnapshotId,
+        checkpointBefore: input.checkpointBefore,
+        watermark: input.watermark,
+        window: input.window,
+        observation: input.observation,
+        coverage: input.coverage,
+        reconciliation: input.reconciliation,
+        operations: input.operations
+    };
+    const snapshotId = `${input.watermark.replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z')}-${sha256(canonicalJsonBytes(identity)).slice(0, 12)}`;
+    const partialManifest = {
+        schema: 'raw-manifest/v2',
+        snapshotId,
+        ...identity,
+        observedFrom: input.observedFrom,
+        observedTo: input.observedTo,
+        privacyPolicyVersion: 'process-data-privacy/v1'
+    };
+    const manifest = { ...partialManifest, manifestSha256: manifestDigest(partialManifest) };
+    const stagingRoot = path.join(root, '.staging');
+    ensurePrivateDirectory(stagingRoot);
+    const staging = fs.mkdtempSync(path.join(stagingRoot, `${snapshotId}-`));
+    if (process.platform !== 'win32')
+        fs.chmodSync(staging, 0o700);
+    try {
+        writePrivateFile(path.join(staging, 'manifest.json'), jsonLine(manifest));
+        writePrivateFile(path.join(staging, 'normalized.jsonl'), input.records.map((record) => jsonLine({ schema: 'normalized/v2', ...record })).join(''));
+        writePrivateFile(path.join(staging, 'quality.json'), jsonLine({ schema: 'quality/v1', findings: input.quality }));
+        writePrivateFile(path.join(staging, 'repair-manifest.jsonl'), input.repairs.map((repair) => jsonLine({ schema: 'repair/v1', ...repair })).join(''));
+        const destination = path.join(root, 'snapshots', String(date.getUTCFullYear()), String(date.getUTCMonth() + 1).padStart(2, '0'), String(date.getUTCDate()).padStart(2, '0'), snapshotId);
+        ensurePrivateDirectory(path.dirname(destination));
+        if (fs.existsSync(destination)) {
+            const existing = fs.readFileSync(path.join(destination, 'manifest.json'), 'utf8');
+            if (existing !== jsonLine(manifest))
+                throw new Error(`snapshot collision: ${snapshotId}`);
+            fs.rmSync(staging, { recursive: true, force: true });
+            fsyncDirectory(stagingRoot);
             return { snapshotId, path: destination, created: false };
         }
+        fsyncDirectory(staging);
         fs.renameSync(staging, destination);
+        fsyncDirectory(stagingRoot);
+        fsyncDirectory(path.dirname(destination));
         return { snapshotId, path: destination, created: true };
     }
     catch (error) {
@@ -181,7 +289,224 @@ function findSnapshot(root, snapshotId) {
     }
     return null;
 }
-function verifySnapshot(root, snapshotId) {
+function verifyV2Snapshot(root, snapshotId, snapshotPath, manifest, seen) {
+    const errors = [];
+    if (seen.has(snapshotId))
+        return { ok: false, snapshotId, snapshotPath, errors: ['snapshot lineage cycle detected'], manifest };
+    seen.add(snapshotId);
+    if (manifest.snapshotId !== snapshotId)
+        errors.push('snapshot identity mismatch');
+    if (manifest.scope !== 'github')
+        errors.push('v2 snapshot scope must be github');
+    if (manifest.snapshotKind === 'base' && manifest.parentSnapshotId !== null)
+        errors.push('base snapshot must not have a parent');
+    if (manifest.snapshotKind === 'delta' && !manifest.parentSnapshotId)
+        errors.push('delta snapshot must have a parent');
+    if (manifest.checkpointBefore !== manifest.parentSnapshotId)
+        errors.push('checkpoint and parent lineage mismatch');
+    if (manifest.parentSnapshotId) {
+        const parentPath = findSnapshot(root, manifest.parentSnapshotId);
+        if (!parentPath)
+            errors.push('parent snapshot is missing');
+        else {
+            const parentVerification = verifySnapshot(root, manifest.parentSnapshotId, seen);
+            if (!parentVerification.ok || !parentVerification.manifest) {
+                errors.push(`parent snapshot is invalid: ${parentVerification.errors.join('; ')}`);
+            }
+            else if (parentVerification.manifest.schema !== 'raw-manifest/v2') {
+                errors.push('v2 snapshot parent is not v2');
+            }
+            else {
+                const parent = parentVerification.manifest;
+                if (parent.repository !== manifest.repository)
+                    errors.push('parent repository mismatch');
+                if (new Date(parent.watermark).getTime() >= new Date(manifest.watermark).getTime())
+                    errors.push('snapshot watermark is not monotonic');
+            }
+        }
+    }
+    if (manifest.watermark !== manifest.window.toExclusive)
+        errors.push('watermark and window cutoff mismatch');
+    const watermark = new Date(manifest.watermark);
+    const from = manifest.window.fromInclusive ? new Date(manifest.window.fromInclusive) : null;
+    const queryAfter = manifest.window.queryAfter ? new Date(manifest.window.queryAfter) : null;
+    if (!Number.isFinite(watermark.getTime()) || (from && !Number.isFinite(from.getTime())) || (queryAfter && !Number.isFinite(queryAfter.getTime()))) {
+        errors.push('v2 observation window contains an invalid timestamp');
+    }
+    if (from && queryAfter && queryAfter.getTime() !== from.getTime() - 1000)
+        errors.push('queryAfter does not equal watermark minus one second');
+    if (!from && queryAfter)
+        errors.push('base/full window cannot have queryAfter without fromInclusive');
+    const strictSinceEndpoints = manifest.endpoints.filter((endpoint) => endpoint.queryMode === 'strict-since');
+    const expectedQueryAfter = from && Number.isFinite(from.getTime()) ? new Date(from.getTime() - 1000).toISOString() : null;
+    if (manifest.snapshotKind === 'base' && from)
+        errors.push('base snapshot must not have fromInclusive');
+    if (queryAfter && strictSinceEndpoints.length === 0)
+        errors.push('queryAfter requires a strict-since endpoint');
+    if (strictSinceEndpoints.length > 0 && (manifest.snapshotKind !== 'delta' || manifest.reconciliation !== 'incremental')) {
+        errors.push('strict-since is only valid for incremental delta snapshots');
+    }
+    if (strictSinceEndpoints.length > 0 && manifest.window.queryAfter !== expectedQueryAfter) {
+        errors.push('incremental strict-since queryAfter proof is invalid');
+    }
+    if (manifest.coverage.mode !== 'boundary-reread-with-full-reconcile' || manifest.coverage.absoluteCompleteness !== false)
+        errors.push('coverage declaration is invalid');
+    const preflight = new Date(manifest.observation.preflightDate);
+    if (!Number.isFinite(preflight.getTime()))
+        errors.push('preflight Date is invalid');
+    for (const responseDate of manifest.observation.responseDates) {
+        const parsed = new Date(responseDate);
+        if (!Number.isFinite(parsed.getTime()) || parsed.getTime() < preflight.getTime())
+            errors.push('response Date evidence is invalid');
+    }
+    for (const endpoint of manifest.endpoints) {
+        if (!endpoint.queryMode)
+            errors.push(`endpoint query mode missing: ${endpoint.endpoint}`);
+        if (endpoint.queryMode !== 'strict-since' && endpoint.queryMode !== 'full-enumeration') {
+            errors.push(`endpoint query mode is invalid: ${endpoint.endpoint}`);
+        }
+        else if (endpoint.queryMode === 'strict-since') {
+            if (endpoint.requestedSince !== expectedQueryAfter)
+                errors.push(`endpoint since proof mismatch: ${endpoint.endpoint}`);
+        }
+        else if (endpoint.requestedSince !== undefined) {
+            errors.push(`full-enumeration endpoint has requestedSince: ${endpoint.endpoint}`);
+        }
+        for (const page of endpoint.pages) {
+            if (page.queryMode !== 'strict-since' && page.queryMode !== 'full-enumeration') {
+                errors.push(`page query mode is invalid: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (page.queryMode !== endpoint.queryMode)
+                errors.push(`page query mode mismatch: ${endpoint.endpoint}#${page.index}`);
+            if (endpoint.queryMode === 'strict-since') {
+                if (page.requestedSince !== expectedQueryAfter)
+                    errors.push(`page since proof mismatch: ${endpoint.endpoint}#${page.index}`);
+            }
+            else if (page.requestedSince !== undefined) {
+                errors.push(`full-enumeration page has requestedSince: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (page.responseDate && new Date(page.responseDate).getTime() < preflight.getTime())
+                errors.push(`page Date precedes preflight: ${endpoint.endpoint}#${page.index}`);
+        }
+    }
+    for (const endpoint of manifest.endpoints) {
+        for (const page of endpoint.pages) {
+            const matches = manifest.objects.filter((object) => object.role === 'page-evidence'
+                && object.endpoint === endpoint.endpoint
+                && object.page === page.index
+                && object.sha256 === page.canonicalSha256);
+            if (matches.length !== 1) {
+                errors.push(`page evidence CAS reference is missing or ambiguous: ${endpoint.endpoint}#${page.index}`);
+                continue;
+            }
+            const object = matches[0];
+            if (object.queryMode !== 'strict-since' && object.queryMode !== 'full-enumeration') {
+                errors.push(`page evidence query mode is invalid: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (object.queryMode !== page.queryMode
+                || object.requestedSince !== page.requestedSince
+                || object.responseDate !== page.responseDate) {
+                errors.push(`page evidence metadata mismatch: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (endpoint.queryMode === 'strict-since' && object.requestedSince !== expectedQueryAfter) {
+                errors.push(`page evidence since proof mismatch: ${endpoint.endpoint}#${page.index}`);
+            }
+        }
+    }
+    const { manifestSha256, ...partial } = manifest;
+    if (manifestDigest(partial) !== manifestSha256)
+        errors.push('manifest hash mismatch');
+    const checkMode = (target, expected, label) => {
+        if (process.platform === 'win32' || !fs.existsSync(target))
+            return;
+        const actual = fs.statSync(target).mode & 0o777;
+        if (actual !== expected)
+            errors.push(`${label} permission mismatch: expected ${expected.toString(8)}, got ${actual.toString(8)}`);
+    };
+    checkMode(snapshotPath, 0o700, 'snapshot directory');
+    for (const file of ['manifest.json', 'normalized.jsonl', 'quality.json', 'repair-manifest.jsonl'])
+        checkMode(path.join(snapshotPath, file), 0o600, file);
+    const store = createObjectStore(root);
+    const normalizedEvidence = [];
+    try {
+        const lines = fs.readFileSync(path.join(snapshotPath, 'normalized.jsonl'), 'utf8').split('\n').filter(Boolean);
+        const ids = new Set();
+        const operationCounts = { upsert: 0, supersede: 0, tombstone: 0, unavailable: 0 };
+        for (const line of lines) {
+            const record = JSON.parse(line);
+            if (record.schema !== 'normalized/v2' || typeof record.recordId !== 'string')
+                errors.push('normalized v2 record schema is invalid');
+            if (typeof record.recordId === 'string' && ids.has(record.recordId))
+                errors.push(`duplicate normalized record: ${record.recordId}`);
+            if (typeof record.recordId === 'string')
+                ids.add(record.recordId);
+            if (!record.operation || !(record.operation in operationCounts))
+                errors.push('normalized v2 operation is invalid');
+            else
+                operationCounts[record.operation] += 1;
+            if ((record.operation === 'upsert' || record.operation === 'supersede')
+                && (!Array.isArray(record.evidence) || record.evidence.length !== 1)) {
+                errors.push(`resource evidence is required for ${record.operation}: ${record.recordId ?? 'unknown'}`);
+            }
+            for (const evidence of record.evidence ?? []) {
+                if (typeof evidence.resourceIdentity === 'string' && typeof evidence.resourceSha256 === 'string' && typeof evidence.pageSha256 === 'string') {
+                    if (record.resourceIdentity !== evidence.resourceIdentity || record.sourceSha256 !== evidence.resourceSha256) {
+                        errors.push(`normalized v2 evidence does not match record source: ${record.recordId ?? 'unknown'}`);
+                    }
+                    normalizedEvidence.push({ resourceIdentity: evidence.resourceIdentity, resourceSha256: evidence.resourceSha256, pageSha256: evidence.pageSha256 });
+                }
+                else {
+                    errors.push('normalized v2 evidence reference is invalid');
+                }
+            }
+        }
+        if (lines.length !== manifest.recordCount)
+            errors.push('normalized record count mismatch');
+        if (canonicalJsonBytes(operationCounts).toString('utf8') !== canonicalJsonBytes(manifest.operations).toString('utf8'))
+            errors.push('operation count mismatch');
+        const quality = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'quality.json'), 'utf8'));
+        if (quality.schema !== 'quality/v1' || !Array.isArray(quality.findings))
+            errors.push('quality schema is invalid');
+        else if (quality.findings.length !== manifest.findingCount)
+            errors.push('quality finding count mismatch');
+        const repairLines = fs.readFileSync(path.join(snapshotPath, 'repair-manifest.jsonl'), 'utf8').split('\n').filter(Boolean);
+        if (repairLines.length !== manifest.repairCount)
+            errors.push('repair manifest count mismatch');
+        for (const line of repairLines)
+            if (JSON.parse(line).schema !== 'repair/v1')
+                errors.push('repair manifest schema is invalid');
+    }
+    catch {
+        errors.push('snapshot derived files are missing or invalid');
+    }
+    for (const object of manifest.objects) {
+        if (object.role !== 'page-evidence' && object.role !== 'resource')
+            errors.push(`object role is invalid: ${object.sourceIdentity}`);
+        if (object.disposition?.state && object.disposition.state !== 'included')
+            continue;
+        try {
+            const objectPath = store.pathFor(object.sha256);
+            const bytes = fs.readFileSync(objectPath);
+            if (sha256(bytes) !== object.sha256 || bytes.length !== object.bytes)
+                errors.push(`object integrity mismatch: ${object.sourceIdentity}`);
+        }
+        catch {
+            errors.push(`object missing: ${object.sourceIdentity}`);
+        }
+    }
+    for (const evidence of normalizedEvidence) {
+        const resources = manifest.objects.filter((object) => object.role === 'resource'
+            && object.resourceIdentity === evidence.resourceIdentity
+            && object.sha256 === evidence.resourceSha256);
+        const pages = manifest.objects.filter((object) => object.role === 'page-evidence' && object.sha256 === evidence.pageSha256);
+        if (resources.length !== 1)
+            errors.push(`resource evidence reference is missing or ambiguous: ${evidence.resourceIdentity}`);
+        if (pages.length === 0)
+            errors.push(`resource page evidence reference is missing: ${evidence.resourceIdentity}`);
+    }
+    return { ok: errors.length === 0, snapshotId, snapshotPath, errors, manifest };
+}
+function verifySnapshot(root, snapshotId, seen = new Set()) {
     const snapshotPath = findSnapshot(root, snapshotId);
     if (!snapshotPath)
         return { ok: false, snapshotId, snapshotPath: null, errors: ['snapshot not found'] };
@@ -197,15 +522,20 @@ function verifySnapshot(root, snapshotId) {
     for (const file of ['manifest.json', 'normalized.jsonl', 'quality.json', 'repair-manifest.jsonl']) {
         checkMode(path.join(snapshotPath, file), 0o600, file);
     }
-    let manifest;
+    let rawManifest;
     try {
-        manifest = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'manifest.json'), 'utf8'));
+        rawManifest = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'manifest.json'), 'utf8'));
     }
     catch {
         return { ok: false, snapshotId, snapshotPath, errors: ['manifest is invalid JSON'] };
     }
-    if (manifest.schema !== 'raw-manifest/v1')
-        errors.push(`unsupported manifest schema: ${manifest.schema}`);
+    if (rawManifest.schema === 'raw-manifest/v2') {
+        return verifyV2Snapshot(root, snapshotId, snapshotPath, rawManifest, seen);
+    }
+    if (rawManifest.schema !== 'raw-manifest/v1') {
+        return { ok: false, snapshotId, snapshotPath, errors: [`unsupported manifest schema: ${String(rawManifest.schema)}`] };
+    }
+    const manifest = rawManifest;
     if (manifest.snapshotId !== snapshotId)
         errors.push('snapshot identity mismatch');
     if (typeof manifest.excerptsEnabled !== 'boolean')
@@ -278,5 +608,5 @@ function verifySnapshot(root, snapshotId) {
     }
     return { ok: errors.length === 0, snapshotId, snapshotPath, errors, manifest };
 }
-export { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshot, sha256, verifySnapshot };
+export { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshot, publishSnapshotV2, sha256, verifySnapshot };
 //# sourceMappingURL=store.js.map

package/dist/lib/release/workflow.js

@@ -1,34 +1,42 @@
+import crypto from 'node:crypto';
+function byteSort(values) {
+    return [...values].sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
+}
 function deriveReleasePhase(facts) {
     if (!facts.localTag && !facts.localTagAncestor)
         return 'unprepared';
+    if (facts.post.commit)
+        return facts.post.published ? 'complete' : 'post-prepared';
     if (!facts.remoteBranch && !facts.remoteTag)
         return 'prepared';
     if (!facts.remoteBranch || !facts.remoteTag)
         return 'partially-published';
     if (facts.githubRelease !== true || facts.npm !== true || facts.homebrew !== true)
         return 'published';
-    if (facts.smoke !== 'success' || !facts.postCommit)
-        return 'post-pending';
-    return 'complete';
+    return 'post-pending';
 }
-function releaseSnapshot(version, facts) {
-    return { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+function createPostConfirmation(version, post) {
+    if (!post.commit || !post.isHead || post.worktree.length || post.staged.length)
+        return null;
+    const canonical = {
+        version,
+        commit: post.commit,
+        branch: post.branch,
+        upstream: post.upstream,
+        remoteHead: post.remoteHead,
+        newVersion: post.newVersion,
+        changedPaths: byteSort(post.changedPaths),
+        demoInputSha256: post.demoInputSha256,
+        worktree: byteSort(post.worktree),
+        staged: byteSort(post.staged)
+    };
+    const sha256 = `sha256:${crypto.createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
+    return { ...canonical, sha256 };
 }
-async function runReleaseAction(input) {
-    const before = releaseSnapshot(input.version, await input.inspect());
-    if (input.action === 'inspect')
-        return { status: 'no-op', changed: false, before, snapshot: before, error: null };
-    if (before.facts.localTagConflict)
-        return { status: 'failed', changed: false, before, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag ${before.tag} is not reachable from HEAD` } };
-    const allowed = input.action === 'prepare' ? before.phase === 'unprepared'
-        : input.action === 'publish' ? before.facts.localTag && ['prepared', 'partially-published'].includes(before.phase)
-            : ['published', 'post-pending'].includes(before.phase);
-    if (!allowed)
-        return { status: before.phase === 'complete' ? 'no-op' : 'failed', changed: false, before, snapshot: before, error: before.phase === 'complete' ? null : { code: 'RELEASE_PHASE_INVALID', message: `Cannot ${input.action} from ${before.phase}` } };
-    await input[input.action]?.();
-    const snapshot = releaseSnapshot(input.version, await input.inspect());
-    const progressed = snapshot.phase !== before.phase;
-    return { status: progressed ? 'applied' : 'blocked', changed: progressed, before, snapshot, error: progressed ? null : { code: 'RELEASE_PROGRESS_PENDING', message: `${input.action} has not reached the next observable phase` } };
+function releaseSnapshot(version, facts) {
+    const snapshot = { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+    const postConfirmation = createPostConfirmation(version, facts.post);
+    return postConfirmation ? { ...snapshot, postConfirmation } : snapshot;
 }
-export { deriveReleasePhase, releaseSnapshot, runReleaseAction };
+export { createPostConfirmation, deriveReleasePhase, releaseSnapshot };
 //# sourceMappingURL=workflow.js.map