@lamentis/naome 1.2.0 → 1.2.1

package/installer/filesystem.js

@@ -0,0 +1,166 @@
+import {
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  statSync,
+} from "node:fs";
+import { dirname, join, relative } from "node:path";
+
+import { printError } from "./output.js";
+
+export function walk(dir) {
+  const entries = readdirSync(dir, { withFileTypes: true });
+  const files = [];
+
+  for (const entry of entries) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walk(fullPath));
+    } else if (entry.isFile()) {
+      files.push(fullPath);
+    }
+  }
+
+  return files;
+}
+
+export function copyTemplateFile(ctx, sourcePath) {
+  const relativePath = relative(ctx.templateRoot, sourcePath);
+  const targetPath = join(ctx.targetRoot, relativePath);
+
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    ctx.skipped.push(relativePath);
+    ctx.unsafeSkipped.push(relativePath);
+    return;
+  }
+
+  if (existsSync(targetPath)) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  mkdirSync(dirname(targetPath), { recursive: true });
+  copyFileSync(sourcePath, targetPath);
+  ctx.installed.push(relativePath);
+}
+
+export function assertTemplateRoot(ctx) {
+  if (!existsSync(ctx.templateRoot) || !statSync(ctx.templateRoot).isDirectory()) {
+    printError(ctx, "NAOME installer templates are missing from this package.");
+    process.exit(1);
+  }
+}
+
+export function removeSkipped(ctx, relativePath) {
+  const index = ctx.skipped.indexOf(relativePath);
+  if (index !== -1) {
+    ctx.skipped.splice(index, 1);
+  }
+}
+
+export function archiveUpgradePath(ctx, archiveDirName, relativePath) {
+  return join(ctx.targetRoot, ".naome", "archive", archiveDirName, relativePath);
+}
+
+export function ensureArchiveDirectory(ctx) {
+  const archivePath = ".naome/archive";
+  const targetPath = join(ctx.targetRoot, archivePath);
+  if (hasSymlinkInTargetPath(ctx, archivePath)) {
+    printError(ctx, "NAOME cannot create .naome/archive safely.");
+    console.error(".naome/archive must be a regular directory or must not exist.");
+    process.exit(1);
+  }
+
+  if (existsSync(targetPath)) {
+    if (!lstatSync(targetPath).isDirectory()) {
+      printError(ctx, "NAOME cannot create .naome/archive because that path is not a directory.");
+      console.error(".naome/archive must be a regular directory or must not exist.");
+      process.exit(1);
+    }
+
+    ctx.skipped.push(`${archivePath}/`);
+    return;
+  }
+
+  mkdirSync(targetPath, { recursive: true });
+  ctx.installed.push(`${archivePath}/`);
+}
+
+export function nextArchivePath(ctx, baseName) {
+  const archiveDir = ".naome/archive";
+
+  if (!isArchiveDirectoryAvailable(ctx)) {
+    ctx.skipped.push(`${archiveDir}/${baseName}`);
+    ctx.unsafeSkipped.push(`${archiveDir}/${baseName}`);
+    return null;
+  }
+
+  mkdirSync(join(ctx.targetRoot, archiveDir), { recursive: true });
+
+  for (let index = 0; index < 1000; index += 1) {
+    const fileName = index === 0 ? baseName : baseName.replace(/\.md$/, `.${index}.md`);
+    const archivePath = join(ctx.targetRoot, archiveDir, fileName);
+
+    if (!existsSync(archivePath)) {
+      return archivePath;
+    }
+  }
+
+  return null;
+}
+
+export function assertArchiveDirectoryAvailableForTakeover(ctx) {
+  if (isArchiveDirectoryAvailable(ctx)) {
+    return;
+  }
+
+  printError(ctx, "NAOME cannot archive AGENTS.md safely.");
+  console.error(".naome/archive must be a regular directory or must not exist.");
+  console.error("Fix that path before installing NAOME.");
+  process.exit(1);
+}
+
+export function isArchiveDirectoryAvailable(ctx) {
+  const parts = [".naome", "archive"];
+  let current = ctx.targetRoot;
+
+  for (const part of parts) {
+    current = join(current, part);
+    try {
+      const stats = lstatSync(current);
+      if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        return false;
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return true;
+      }
+      throw error;
+    }
+  }
+
+  return true;
+}
+
+export function hasSymlinkInTargetPath(ctx, relativePath) {
+  const parts = relativePath.split(/[\\/]+/);
+  let current = ctx.targetRoot;
+
+  for (const part of parts) {
+    current = join(current, part);
+    try {
+      if (lstatSync(current).isSymbolicLink()) {
+        return true;
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        continue;
+      }
+      throw error;
+    }
+  }
+
+  return false;
+}

package/installer/flows.js

@@ -0,0 +1,84 @@
+import { ensureArchiveDirectory, copyTemplateFile, walk } from "./filesystem.js";
+import {
+  ensureBuiltInVerificationChecks,
+  ensureCoreHarnessFiles,
+  ensureHarnessHealthFiles,
+  ensureRepositoryStructurePolicyFiles,
+  ensureTaskControlHarnessFiles,
+  ensureTestingProofHarnessSections,
+} from "./harness-files.js";
+import { ensureLocalOnlySourceControlBoundary } from "./git-local.js";
+import {
+  ensureCompleteUpgradeState,
+  patchManifestDate,
+  refreshManifestHealthMetadata,
+} from "./manifest-state.js";
+import { installNativeDecisionBinary, patchInstalledMachineOwnedIntegrity } from "./native.js";
+import { printError } from "./output.js";
+import { compareVersions } from "./version.js";
+import { confirmAgentsTakeover, takeoverExistingAgents } from "./agents.js";
+
+export async function runFreshInstall(ctx) {
+  await confirmAgentsTakeover(ctx);
+
+  for (const sourcePath of walk(ctx.templateRoot)) {
+    copyTemplateFile(ctx, sourcePath);
+  }
+
+  installNativeDecisionBinary(ctx);
+  patchInstalledMachineOwnedIntegrity(ctx);
+  ensureBuiltInVerificationChecks(ctx);
+  patchManifestDate(ctx);
+  ensureCompleteUpgradeState(ctx, null);
+  ensureArchiveDirectory(ctx);
+  takeoverExistingAgents(ctx);
+  ensureLocalOnlySourceControlBoundary(ctx);
+}
+
+export function runExistingInstall(ctx, existingInstall) {
+  const comparison = compareVersions(ctx, existingInstall.version, ctx.packageVersion);
+
+  if (comparison > 0) {
+    printError(ctx, "This repository already uses a newer NAOME harness.");
+    console.error(`Installed: v${existingInstall.version}`);
+    console.error(`Package:   v${ctx.packageVersion}`);
+    console.error("Run `naome update`, then rerun `naome sync` from the repository root.");
+    process.exit(1);
+  }
+
+  if (comparison < 0) {
+    if (compareVersions(ctx, existingInstall.version, ctx.minimumSupportedUpgradeVersion) < 0) {
+      rejectUnsupportedHistoricalInstall(ctx, existingInstall.version);
+    }
+
+    ensureArchiveDirectory(ctx);
+    runRepair(ctx, existingInstall.version, { fromVersion: existingInstall.version });
+  } else {
+    ensureArchiveDirectory(ctx);
+    runRepair(ctx, existingInstall.version);
+  }
+}
+
+function rejectUnsupportedHistoricalInstall(ctx, version) {
+  printError(ctx, "Installed NAOME harness version is outside the supported upgrade range.");
+  console.error(`Installed: v${version}`);
+  console.error(`Package:   v${ctx.packageVersion}`);
+  console.error(`Minimum supported upgrade version: v${ctx.minimumSupportedUpgradeVersion}`);
+  console.error("Create a clean NAOME baseline instead of upgrading a pre-Rust harness in place.");
+  process.exit(1);
+}
+
+function runRepair(ctx, version, options = {}) {
+  ctx.summaryTitle = "NAOME harness checked";
+  ensureCoreHarnessFiles(ctx, `repair-${version}`);
+  ensureTaskControlHarnessFiles(ctx, `repair-${version}`);
+  ensureHarnessHealthFiles(ctx, `repair-${version}`);
+  installNativeDecisionBinary(ctx);
+  patchInstalledMachineOwnedIntegrity(ctx);
+  ensureBuiltInVerificationChecks(ctx);
+  ensureTestingProofHarnessSections(ctx);
+  ensureRepositoryStructurePolicyFiles(ctx);
+  refreshManifestHealthMetadata(ctx);
+  ensureCompleteUpgradeState(ctx, options.fromVersion ?? null);
+  ensureLocalOnlySourceControlBoundary(ctx);
+}

package/installer/git-boundary.js

@@ -0,0 +1,170 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { ensureWritableRegularFile, absoluteGitDir } from "./git-shared.js";
+import { printCommandFailure, printError } from "./output.js";
+
+export function ensureLocalOnlySourceControlBoundary(ctx) {
+  if (!isInsideGitWorkTree(ctx)) {
+    ensureLocalOnlyGitIgnoreFallback(ctx);
+    ctx.skipped.push("local git exclude");
+    ctx.skipped.push("local-only git index cleanup");
+    return;
+  }
+
+  cleanupLegacyLocalOnlyGitIgnore(ctx);
+  ensureLocalOnlyGitExclude(ctx);
+  untrackLocalOnlyGitPaths(ctx);
+}
+
+export function isInsideGitWorkTree(ctx) {
+  const result = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+
+  return result.status === 0 && result.stdout.trim() === "true";
+}
+
+function ensureLocalOnlyGitIgnoreFallback(ctx) {
+  const relativePath = ".gitignore";
+  const targetPath = join(ctx.targetRoot, relativePath);
+  ensureWritableRegularFile(ctx, relativePath, ".gitignore");
+
+  const content = existsSync(targetPath) ? readFileSync(targetPath, "utf8") : "";
+  const existingLines = new Set(content.split(/\r?\n/).map((line) => line.trim()));
+  const missingEntries = legacyLocalOnlyGitIgnoreEntries(ctx).filter((entry) => !existingLines.has(entry));
+
+  if (missingEntries.length === 0) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  const nextContent = `${content.trimEnd()}${content.trimEnd() ? "\n\n" : ""}${missingEntries.join("\n")}\n`;
+  writeFileSync(targetPath, nextContent);
+  if (content.length === 0) {
+    ctx.installed.push(relativePath);
+  } else {
+    ctx.updated.push(relativePath);
+  }
+}
+
+function cleanupLegacyLocalOnlyGitIgnore(ctx) {
+  const relativePath = ".gitignore";
+  const targetPath = join(ctx.targetRoot, relativePath);
+  if (!existsSync(targetPath)) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+  ensureWritableRegularFile(ctx, relativePath, ".gitignore");
+
+  const content = readFileSync(targetPath, "utf8");
+  const legacyEntries = new Set(legacyLocalOnlyGitIgnoreEntries(ctx));
+  const nextContent = cleanBlankLines(
+    content
+      .split(/\r?\n/)
+      .filter((line) => !legacyEntries.has(line.trim()))
+      .join("\n"),
+  );
+
+  if (nextContent === content) {
+    ctx.skipped.push(relativePath);
+    return;
+  }
+
+  if (nextContent.trim().length === 0) {
+    unlinkSync(targetPath);
+  } else {
+    writeFileSync(targetPath, nextContent);
+  }
+  ctx.updated.push(relativePath);
+}
+
+function ensureLocalOnlyGitExclude(ctx) {
+  const gitDir = absoluteGitDir(ctx, "local git exclude");
+  if (!gitDir) {
+    return;
+  }
+
+  const excludePath = join(gitDir, "info", "exclude");
+  mkdirSync(dirname(excludePath), { recursive: true });
+
+  if (existsSync(excludePath) && !lstatSync(excludePath).isFile()) {
+    printError(ctx, "NAOME cannot update local git exclude because that path is not a file.");
+    process.exit(1);
+  }
+
+  const content = existsSync(excludePath) ? readFileSync(excludePath, "utf8") : "";
+  const existingLines = new Set(content.split(/\r?\n/).map((line) => line.trim()));
+  const missingEntries = ctx.localOnlyGitExcludeEntries.filter((entry) => !existingLines.has(entry));
+
+  if (missingEntries.length === 0) {
+    ctx.skipped.push(".git/info/exclude");
+    return;
+  }
+
+  const nextContent = `${content.trimEnd()}${content.trimEnd() ? "\n\n" : ""}${missingEntries.join("\n")}\n`;
+  writeFileSync(excludePath, nextContent);
+  ctx.updated.push(".git/info/exclude");
+}
+
+function untrackLocalOnlyGitPaths(ctx) {
+  const tracked = trackedLocalOnlyGitPaths(ctx);
+  if (tracked.length === 0) {
+    ctx.skipped.push("local-only git index cleanup");
+    return;
+  }
+
+  const result = spawnSync("git", ["rm", "--cached", "-q", "--", ...tracked], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+  if (result.status !== 0) {
+    printCommandFailure(ctx, "NAOME could not remove local-only harness files from the git index.", result);
+  }
+
+  ctx.updated.push(...tracked.map((path) => `git index: ${path}`));
+}
+
+function trackedLocalOnlyGitPaths(ctx) {
+  const result = spawnSync("git", ["ls-files", "-z", "--", ...ctx.localOnlyGitUntrackPaths], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+
+  if (result.status !== 0) {
+    printError(ctx, "NAOME could not inspect tracked local-only harness files.");
+    if (result.stderr.trim()) {
+      console.error(result.stderr.trim());
+    }
+    process.exit(1);
+  }
+
+  return result.stdout.split("\0").filter(Boolean);
+}
+
+function legacyLocalOnlyGitIgnoreEntries(ctx) {
+  return [
+    "# NAOME local machine-owned harness files.",
+    ".naome/archive/",
+    ".naome/bin/naome-rust*",
+    ...ctx.localOnlyMachineOwnedPaths,
+    ...ctx.localOnlyGitIgnoreEntries,
+  ];
+}
+
+function cleanBlankLines(content) {
+  const lines = content.split(/\r?\n/);
+  const cleaned = [];
+
+  for (const line of lines) {
+    if (line.trim() === "" && cleaned.at(-1)?.trim() === "") {
+      continue;
+    }
+    cleaned.push(line);
+  }
+
+  const trimmed = cleaned.join("\n").trimEnd();
+  return trimmed ? `${trimmed}\n` : "";
+}

package/installer/git-hook-content.js

@@ -0,0 +1,36 @@
+import { templateIntegrity } from "./native.js";
+
+export function localGitHookContent(ctx, hookName, mode, localNative) {
+  const expectedIntegrityJson = JSON.stringify(templateIntegrity(ctx));
+  return `#!/bin/sh
+# NAOME managed local git hook: ${hookName}
+# Run naome sync after reviewing harness changes to refresh this hook.
+set -eu
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$REPO_ROOT"
+
+NODE_BIN=${shellSingleQuote(process.execPath)}
+if [ ! -x "$NODE_BIN" ]; then
+  NODE_BIN="node"
+fi
+
+NATIVE_BIN=${shellSingleQuote(localNative.path)}
+EXPECTED_SHA=${shellSingleQuote(localNative.hash)}
+NAOME_EXPECTED_INTEGRITY_JSON=${shellSingleQuote(expectedIntegrityJson)}
+export NAOME_EXPECTED_INTEGRITY_JSON
+ACTUAL_SHA="$("$NODE_BIN" -e 'const fs = require("node:fs"); const crypto = require("node:crypto"); const file = process.argv[1]; process.stdout.write(crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex"));' "$NATIVE_BIN" 2>/dev/null || true)"
+
+if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
+  echo "NAOME hook refused to run because its local native binary integrity does not match the installed hook." >&2
+  echo "Run naome sync after reviewing harness changes." >&2
+  exit 1
+fi
+
+exec "$NATIVE_BIN" check-task-state --root "$REPO_ROOT" ${mode}
+`;
+}
+
+function shellSingleQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}

package/installer/git-hooks.js

@@ -0,0 +1,134 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { hasSymlinkInTargetPath } from "./filesystem.js";
+import { localGitHookContent } from "./git-hook-content.js";
+import { absoluteGitDir } from "./git-shared.js";
+import { findNativeDecisionBinary, sha256 } from "./native.js";
+
+export function ensureExecutableMachineOwnedFiles(ctx) {
+  for (const relativePath of ctx.executableMachineOwnedPaths) {
+    const targetPath = join(ctx.targetRoot, relativePath);
+    if (!existsSync(targetPath) || hasSymlinkInTargetPath(ctx, relativePath)) {
+      continue;
+    }
+
+    chmodSync(targetPath, 0o755);
+  }
+}
+
+export function configureGitHooks(ctx) {
+  const gitCheck = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+
+  if (gitCheck.status !== 0 || gitCheck.stdout.trim() !== "true") {
+    ctx.skipped.push("local git hooks");
+    return;
+  }
+  if (!clearLegacyHooksPath(ctx)) {
+    return;
+  }
+
+  const gitDir = absoluteGitDir(ctx, "local git hooks");
+  if (!gitDir) {
+    return;
+  }
+
+  const hooksDir = join(gitDir, "hooks");
+  mkdirSync(hooksDir, { recursive: true });
+  const localNative = installLocalGitNativeBinary(ctx, gitDir);
+  if (!localNative) {
+    ctx.skipped.push("local git hooks native binary");
+    ctx.unsafeSkipped.push("local git hooks native binary");
+    return;
+  }
+
+  installLocalGitHook(ctx, hooksDir, "pre-commit", "--commit-gate", localNative);
+  installLocalGitHook(ctx, hooksDir, "pre-push", "--push-gate", localNative);
+}
+
+function clearLegacyHooksPath(ctx) {
+  const currentHooksPath = spawnSync("git", ["config", "--local", "--get", "core.hooksPath"], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+  const currentValue = currentHooksPath.status === 0 ? currentHooksPath.stdout.trim() : "";
+
+  if (currentValue && currentValue !== ".naome/git-hooks") {
+    ctx.skipped.push(`git core.hooksPath (${currentValue})`);
+    return false;
+  }
+  if (currentValue !== ".naome/git-hooks") {
+    return true;
+  }
+
+  const unsetResult = spawnSync("git", ["config", "--local", "--unset", "core.hooksPath"], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+  if (unsetResult.status !== 0) {
+    ctx.skipped.push("git core.hooksPath unset");
+    ctx.unsafeSkipped.push("git core.hooksPath unset");
+    return false;
+  }
+
+  ctx.updated.push("git core.hooksPath unset");
+  return true;
+}
+
+function installLocalGitNativeBinary(ctx, gitDir) {
+  const sourcePath = findNativeDecisionBinary(ctx);
+  if (!sourcePath) {
+    return null;
+  }
+
+  const localDir = join(gitDir, "naome");
+  const localPath = join(localDir, process.platform === "win32" ? "naome-rust.exe" : "naome-rust");
+  const sourceContent = readFileSync(sourcePath);
+  const sourceHash = sha256(sourceContent);
+  mkdirSync(localDir, { recursive: true });
+
+  const currentHash =
+    existsSync(localPath) && lstatSync(localPath).isFile() ? sha256(readFileSync(localPath)) : null;
+  if (currentHash !== sourceHash) {
+    copyFileSync(sourcePath, localPath);
+    ctx.updated.push(".git/naome/naome-rust");
+  } else {
+    ctx.skipped.push(".git/naome/naome-rust");
+  }
+
+  chmodSync(localPath, 0o755);
+  return { path: localPath, hash: sourceHash };
+}
+
+function installLocalGitHook(ctx, hooksDir, hookName, mode, localNative) {
+  const hookPath = join(hooksDir, hookName);
+  const nextContent = localGitHookContent(ctx, hookName, mode, localNative);
+
+  if (existsSync(hookPath) && !canReplaceLocalHook(ctx, hookPath, hookName, nextContent)) {
+    return;
+  }
+
+  writeFileSync(hookPath, nextContent);
+  chmodSync(hookPath, 0o755);
+  ctx.updated.push(`.git/hooks/${hookName}`);
+}
+
+function canReplaceLocalHook(ctx, hookPath, hookName, nextContent) {
+  const stats = lstatSync(hookPath);
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    ctx.skipped.push(`.git/hooks/${hookName}`);
+    ctx.unsafeSkipped.push(`.git/hooks/${hookName}`);
+    return false;
+  }
+
+  const currentContent = readFileSync(hookPath, "utf8");
+  if (!currentContent.includes("NAOME managed local git hook") || currentContent === nextContent) {
+    ctx.skipped.push(`.git/hooks/${hookName}`);
+    return false;
+  }
+  return true;
+}

package/installer/git-local.js

@@ -0,0 +1,2 @@
+export { ensureExecutableMachineOwnedFiles, configureGitHooks } from "./git-hooks.js";
+export { ensureLocalOnlySourceControlBoundary, isInsideGitWorkTree } from "./git-boundary.js";

package/installer/git-shared.js

@@ -0,0 +1,35 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync } from "node:fs";
+import { join } from "node:path";
+
+import { hasSymlinkInTargetPath } from "./filesystem.js";
+import { printError } from "./output.js";
+
+export function absoluteGitDir(ctx, label) {
+  const result = spawnSync("git", ["rev-parse", "--absolute-git-dir"], {
+    cwd: ctx.targetRoot,
+    encoding: "utf8",
+  });
+
+  if (result.status !== 0 || !result.stdout.trim()) {
+    ctx.skipped.push(label);
+    ctx.unsafeSkipped.push(label);
+    return null;
+  }
+
+  return result.stdout.trim();
+}
+
+export function ensureWritableRegularFile(ctx, relativePath, label) {
+  const targetPath = join(ctx.targetRoot, relativePath);
+  if (hasSymlinkInTargetPath(ctx, relativePath)) {
+    printError(ctx, `NAOME cannot write ${label} safely.`);
+    console.error(`${label} must be a regular file or must not exist.`);
+    process.exit(1);
+  }
+
+  if (existsSync(targetPath) && !lstatSync(targetPath).isFile()) {
+    printError(ctx, `NAOME cannot update ${label} because that path is not a file.`);
+    process.exit(1);
+  }
+}