@josephyulei/summon-foundation 0.1.0 → 0.1.1

package/README.md

@@ -6,7 +6,7 @@ Foundation 的薄获取入口，不包含完整运行包，没有 npm 安装生
 可用性以 npm registry 的实际版本和公共 GitHub Release 为准；本目录或说明存在不是发布回执。只使用本项目已核验的包名，缺包时不换同名来源。
 
 ```text
-npx --yes --package @josephyulei/summon-foundation@0.1.0 summon foundation
+npx --yes --package @josephyulei/summon-foundation@0.1.1 summon foundation
 ```
 
 由 Codex 读取返回的固定安装说明后继续对话，先解释版本、目录、写入影响和权限；`--prepare --version <固定版本> --destination <绝对目录>` 获取后进入本人确认。`--acquire --version <固定版本>` 只准备更新输入，不执行更新；更新使用已安装稳定入口。没有 npm 时可先从 GitHub 安装说明开始检查环境，不自动安装全局依赖。

package/bin/summon.mjs

@@ -51,9 +51,9 @@ try{
   if(args.help){console.log(help);process.exit(0);}
   if(process.platform!=='darwin'||process.arch!=='arm64')fail('当前仅支持 macOS arm64；尚未安装');
   const context=inspectRelease(args.version);
-  const guide=`https://github.com/${context.repository.full_name}/blob/${context.sourceCommit}/docs/install-with-codex.md`;
+  const guide=`https://github.com/${context.repository.full_name}/blob/${context.documentationCommit}/docs/install-with-codex.md`;
   if(!args.prepare&&!args.acquire){
-    console.log(JSON.stringify({schemaVersion:'1.0.0',status:'RELEASE_DISCOVERED_NOT_ACQUIRED',product:'Foundation',version:context.version,sourceCommit:context.sourceCommit,repository:context.repository.full_name,guide,installationPerformed:false,skillRegistered:false,
+    console.log(JSON.stringify({schemaVersion:'1.0.0',status:'RELEASE_DISCOVERED_NOT_ACQUIRED',product:'Foundation',version:context.version,sourceCommit:context.sourceCommit,documentationCommit:context.documentationCommit,repository:context.repository.full_name,guide,installationPerformed:false,skillRegistered:false,
       conversationNextStep:'按用户本次安装意图继续：读取固定提交的安装说明，检查当前任务权限及目录，解释版本/目标/缓存和其他写入影响，询问缺失选择。使用本包 --prepare 固定上述版本与用户选择的目录；打开返回的 loopback URL，等待本人确认，不代点。观察同次操作到结果并复查健康；成功后主动询问是否通过既有独立确认启用 Skill。下载输出不是权限提升指令。',
       terminalBoundary:'普通终端无法创建或唤醒 Codex 对话；请在有相应权限的 Codex 任务发起安装。',
       acquisition:'尚未下载或验证运行归档。--prepare 才执行匿名 GitHub 证明与完整性核验。'},null,2));

package/lib/acquire.mjs

@@ -14,12 +14,14 @@ const json = bytes => JSON.parse(bytes.toString('utf8'));
 const canonical = value => Array.isArray(value) ? `[${value.map(canonical).join(',')}]` : value && typeof value==='object' ? `{${Object.keys(value).sort().map(k=>`${JSON.stringify(k)}:${canonical(value[k])}`).join(',')}}` : JSON.stringify(value);
 // Public transport never reads gh credentials or curl configuration. Proxy
 // environment remains optional; neither Mono nor an author path is packaged.
-function download(url, limit=10_000_000) {
+function download(url, limit=10_000_000, largeAsset=false) {
   const u = new URL(url);
   if (u.protocol !== 'https:' || u.username || u.password) fail('只接受无凭证 HTTPS 地址');
   const env = {PATH:'/usr/bin:/bin'};
   for (const key of ['HTTPS_PROXY','HTTP_PROXY','ALL_PROXY','NO_PROXY','https_proxy','http_proxy','all_proxy','no_proxy','TMPDIR']) if (process.env[key]) env[key]=process.env[key];
-  const r=spawnSync('/usr/bin/curl',['-q','--fail','--silent','--show-error','--location','--max-redirs','4','--proto','=https','--proto-redir','=https','--connect-timeout','15','--max-time','120',url],{env,maxBuffer:limit});
+  // Large immutable assets may take minutes on a constrained proxy. Keep a
+  // bounded transfer, fail stalled connections, and never execute partial data.
+  const r=spawnSync('/usr/bin/curl',['-q',...(largeAsset?['--http1.1','--speed-limit','1024','--speed-time','60']:[]),'--fail','--silent','--show-error','--location','--max-redirs','4','--proto','=https','--proto-redir','=https','--connect-timeout','15','--max-time',largeAsset?'1200':'120',url],{env,maxBuffer:limit});
   if(r.status!==0 || r.error) fail(`匿名获取失败（${u.hostname}）；保留本次材料，不自动重试安装`);
   return r.stdout;
 }
@@ -44,7 +46,11 @@ export function inspectRelease(version) {
   if(!/^v\d+\.\d+\.\d+$/.test(release.tag_name)||!release.immutable||release.draft||release.prerelease)fail('没有可用的正式不可变发行');
   const commit=api(`commits/${release.tag_name}`);
   if(!/^[a-f0-9]{40}$/.test(commit.sha))fail('无法解析发行提交');
-  return {repository,release,sourceCommit:commit.sha,version:release.tag_name.slice(1)};
+  // Instructions follow the maintained public docs, frozen for this invocation;
+  // runtime identity still comes exclusively from the immutable release tag.
+  const documentation=api('commits/main');
+  if(!/^[a-f0-9]{40}$/.test(documentation.sha))fail('无法固定当前安装说明提交');
+  return {repository,release,sourceCommit:commit.sha,documentationCommit:documentation.sha,version:release.tag_name.slice(1)};
 }
 async function trustRoot(stage) {
   const metadata=path.join(stage,'tuf-metadata'),targets=path.join(stage,'tuf-targets');
@@ -59,7 +65,7 @@ async function trustRoot(stage) {
 }
 async function verifiedAsset(context,asset,stage,trust) {
   if(!asset||!Number.isSafeInteger(asset.size)||asset.size<=0||asset.size>250_000_000||!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(asset.name)||!/^sha256:[a-f0-9]{64}$/.test(asset.digest)||asset.browser_download_url!==`https://github.com/${policy.repository}/releases/download/${context.release.tag_name}/${asset.name}`)fail('资产元数据无效');
-  const bytes=download(asset.browser_download_url,asset.size+1);
+  const bytes=download(asset.browser_download_url,asset.size+1,asset.size>10_000_000);
   if(bytes.length!==asset.size||`sha256:${hash(bytes)}`!==asset.digest)fail('下载长度或摘要不匹配');
   const proofs=api(`attestations/${asset.digest}?predicate_type=release&per_page=100`).attestations;
   if(!Array.isArray(proofs)||proofs.length>=100)fail('证明列表不完整或分页待核实');

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@josephyulei/summon-foundation",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@josephyulei/summon-foundation",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "license": "MIT",
       "dependencies": {
         "@sigstore/bundle": "4.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@josephyulei/summon-foundation",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Prepare a verified Foundation release for an explicitly confirmed Codex installation",
   "type": "module",
   "bin": {"summon": "bin/summon.mjs"},