@geraldmaron/construct 1.4.0 → 1.4.2

package/lib/install/stage-project.mjs

@@ -11,7 +11,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, copyFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { existsSync, readFileSync, copyFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
 import path from 'node:path';
 
 export function stageProjectAdapters({ projectRoot, packageRoot, pkgVersion, log, hosts = null }) {
@@ -27,7 +27,7 @@ export function stageProjectAdapters({ projectRoot, packageRoot, pkgVersion, log
 
   if (!existsSync(syncScript)) {
     emit(`sync-specialists.mjs not found at ${syncScript}; skipping adapter sync`);
-    return { staged: true, synced: false };
+    return finishStage({ projectRoot, pkgVersion, synced: false, reason: 'sync-script-missing' });
   }
 
   // A `hosts` array restricts which adapter sets sync writes (construct-4xy6);
@@ -45,9 +45,46 @@ export function stageProjectAdapters({ projectRoot, packageRoot, pkgVersion, log
 
   if (result.status !== 0) {
     emit(`sync failed (exit ${result.status}); project left in a clean state`);
-    return { staged: true, synced: false };
+    return finishStage({ projectRoot, pkgVersion, synced: false, reason: `sync-exit-${result.status}` });
   }
-  return { staged: true, synced: true };
+  return finishStage({ projectRoot, pkgVersion, synced: true, reason: null });
+}
+
+const STAGE_STATE_FILE = 'stage-state.json';
+
+// Record the staging outcome under .construct/ so a half-stage (launcher present,
+// adapters not synced) is detectable and repairable instead of re-derived from
+// filesystem heuristics. The marker write is best-effort — a state-write failure must
+// never turn a successful stage into a reported failure.
+
+function finishStage({ projectRoot, pkgVersion, synced, reason }) {
+  const dotConstruct = path.join(projectRoot, '.construct');
+  try {
+    mkdirSync(dotConstruct, { recursive: true });
+    const state = { staged: true, synced, reason, pkgVersion: pkgVersion ?? null, ts: new Date().toISOString() };
+    writeFileSync(path.join(dotConstruct, STAGE_STATE_FILE), JSON.stringify(state, null, 2) + '\n');
+  } catch { /* marker is advisory */ }
+  return { staged: true, synced };
+}
+
+export function readStageState(projectRoot) {
+  try {
+    return JSON.parse(readFileSync(path.join(projectRoot, '.construct', STAGE_STATE_FILE), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// Re-drive a half-staged project to a synced state. stageProjectAdapters is idempotent,
+// so re-running the sync is the repair; an already-synced project is a no-op.
+
+export function repairStagedProject({ projectRoot, packageRoot, pkgVersion, log, hosts = null }) {
+  const state = readStageState(projectRoot);
+  if (state && state.synced === true) {
+    return { staged: true, synced: true, repaired: false };
+  }
+  const result = stageProjectAdapters({ projectRoot, packageRoot, pkgVersion, log, hosts });
+  return { ...result, repaired: result.synced === true };
 }
 
 function ensureProjectLauncher({ projectRoot, templateDir, pkgVersion }) {

package/lib/intake/prepare.mjs

@@ -123,6 +123,8 @@ export async function prepareIntakeForIngestedFile({
   const tagSuggestions = suggestTags(triage, related, vocab);
 
   const baseEntry = {
+    // OWASP LLM01: externally-ingested document bodies are untrusted data, not instructions
+    trust: 'untrusted',
     intake: {
       sourcePath: ingestedFile.sourcePath,
       outputPath: ingestedFile.outputPath,

package/lib/mcp/destructive-approval.mjs

@@ -0,0 +1,57 @@
+/**
+ * lib/mcp/destructive-approval.mjs — out-of-band approval tokens for destructive MCP tools.
+ *
+ * storage_reset and delete_ingested_artifacts are reachable only through the model's
+ * argument channel, so a confirm flag the model itself supplies cannot authorize
+ * irreversible deletion. Tokens are issued out-of-band by an operator action (never the
+ * model), persisted with 0600 under the user state dir — outside any project root, so a
+ * root-contained file tool cannot read them — and consumed one-time. consumeApprovalToken
+ * returns false unless a live, unexpired token for the scope matches, and never writes
+ * when no token is supplied.
+ */
+import { randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { doctorRoot } from '../config/xdg.mjs';
+
+const TOKEN_TTL_MS = 5 * 60 * 1000;
+
+function storePath(env) {
+  return path.join(doctorRoot(undefined, env), 'destructive-approvals.json');
+}
+
+function readStore(file) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+function writeStore(file, tokens) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(tokens), { mode: 0o600 });
+  try { fs.chmodSync(file, 0o600); } catch { /* non-posix filesystems */ }
+}
+
+export function issueApprovalToken(scope, { env = process.env, now = Date.now() } = {}) {
+  if (typeof scope !== 'string' || !scope) throw new Error('scope required');
+  const file = storePath(env);
+  const token = randomBytes(24).toString('hex');
+  const live = readStore(file).filter((t) => t.expiresAt > now);
+  live.push({ token, scope, expiresAt: now + TOKEN_TTL_MS });
+  writeStore(file, live);
+  return token;
+}
+
+export function consumeApprovalToken(scope, token, { env = process.env, now = Date.now() } = {}) {
+  if (typeof token !== 'string' || !token) return false;
+  const file = storePath(env);
+  const tokens = readStore(file);
+  const idx = tokens.findIndex((t) => t.scope === scope && t.token === token && t.expiresAt > now);
+  if (idx === -1) return false;
+  tokens.splice(idx, 1);
+  writeStore(file, tokens.filter((t) => t.expiresAt > now));
+  return true;
+}