@lamentis/naome 1.4.0 → 1.4.2

package/crates/naome-core/tests/task_status_git.rs

@@ -0,0 +1,141 @@
+#![allow(dead_code, unused_imports)]
+
+use std::fs;
+
+use naome_core::{task_status_exit_code, task_status_report};
+use serde_json::json;
+
+mod task_state_support;
+
+use task_state_support::{active_task, task_state_with_status, TaskFixture};
+
+#[test]
+fn task_status_reports_git_recovery_findings() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["**"],
+            "requiredCheckIds": [],
+            "proofResults": []
+        })),
+    ));
+    repo.init_git();
+    repo.set_admission_head("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+
+    let status = task_status_report(repo.path()).unwrap();
+
+    assert_eq!(status.git.admission_head_reachable, false);
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.git.admission_head_missing"));
+}
+
+#[test]
+fn task_status_reports_unreachable_existing_admission_head() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({})),
+    ));
+    repo.init_git();
+    let admission_head = repo.git(["rev-parse", "HEAD"]).trim().to_string();
+    repo.git(["checkout", "--orphan", "other"]);
+    repo.write("OTHER.md", "other\n");
+    repo.git(["add", "."]);
+    repo.git(["commit", "-m", "other"]);
+    repo.set_admission_head(&admission_head);
+
+    let status = task_status_report(repo.path()).unwrap();
+
+    assert!(status.findings.iter().any(|finding| {
+        finding.id == "task.git.admission_head_not_reachable"
+            && finding.suggested_fix.contains("Rebase")
+    }));
+}
+
+#[test]
+fn task_status_reports_operation_in_progress_and_conflict_markers() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({})),
+    ));
+    repo.init_git();
+    let merge_head = repo.git(["rev-parse", "--git-path", "MERGE_HEAD"]);
+    fs::write(repo.path().join(merge_head.trim()), "deadbeef\n").unwrap();
+
+    let status = task_status_report(repo.path()).unwrap();
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.git.operation_in_progress"));
+
+    fs::write(
+        repo.path().join(".naome/task-state.json"),
+        "<<<<<<< HEAD\n{}\n=======\n{}\n>>>>>>> branch\n",
+    )
+    .unwrap();
+    let status = task_status_report(repo.path()).unwrap();
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.state.conflict_markers"));
+}
+
+#[test]
+fn task_status_reports_branch_divergence_when_upstream_split() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["**"],
+            "requiredCheckIds": [],
+            "proofResults": []
+        })),
+    ));
+    repo.init_git();
+    let remote = repo.path().join("remote.git");
+    let branch = repo.git(["rev-parse", "--abbrev-ref", "HEAD"]);
+    let branch = branch.trim();
+    repo.git(["init", "--bare", remote.to_str().unwrap()]);
+    repo.git(["remote", "add", "origin", remote.to_str().unwrap()]);
+    repo.git(["push", "-u", "origin", branch]);
+
+    repo.write("LOCAL.md", "local\n");
+    repo.git(["add", "."]);
+    repo.git(["commit", "-m", "local"]);
+
+    let clone = std::env::temp_dir().join(format!(
+        "naome-task-status-remote-work-{}",
+        std::process::id()
+    ));
+    let _ = fs::remove_dir_all(&clone);
+    repo.git(["clone", remote.to_str().unwrap(), clone.to_str().unwrap()]);
+    git_in(&clone, ["config", "user.email", "naome@example.com"]);
+    git_in(&clone, ["config", "user.name", "NAOME Test"]);
+    fs::write(clone.join("REMOTE.md"), "remote\n").unwrap();
+    git_in(&clone, ["add", "."]);
+    git_in(&clone, ["commit", "-m", "remote"]);
+    git_in(&clone, ["push"]);
+    repo.git(["fetch", "origin"]);
+
+    let status = task_status_report(repo.path()).unwrap();
+    assert_eq!(status.git.ahead, 1);
+    assert_eq!(status.git.behind, 1);
+    assert!(status
+        .findings
+        .iter()
+        .any(|finding| finding.id == "task.git.branch_diverged"));
+    assert_eq!(task_status_exit_code(&status.findings, &status.proof), 0);
+}
+
+fn git_in<const N: usize>(root: &std::path::Path, args: [&str; N]) {
+    let output = std::process::Command::new("git")
+        .args(args)
+        .current_dir(root)
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}

package/installer/context.js

@@ -49,7 +49,7 @@ export function createInstallerContext() {
     normalizedIntegrityBlock:
       "const expectedMachineOwnedIntegrity = Object.freeze({\n  __generated__: \"sha256:generated\"\n});\n",
     nativeIntegrityPattern:
-      /^const expectedNativeBinaryIntegrity = "(?:sha256:[a-f0-9]{64}|sha256:generated)";\n/m,
+      /^const expectedNativeBinaryIntegrity = "sha256:[a-f0-9]{64}";\n/m,
     normalizedNativeIntegrity: 'const expectedNativeBinaryIntegrity = "sha256:generated";\n',
     executableMachineOwnedPaths: new Set([
       ".naome/bin/naome.js",

package/installer/harness-verification.js

@@ -3,7 +3,6 @@ import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFile
 import { dirname, join } from "node:path";
 
 import { hasSymlinkInTargetPath, removeSkipped } from "./filesystem.js";
-import { findNativeDecisionBinary, usesSourceNativeFallback } from "./native.js";
 import { printCommandFailure, printError } from "./output.js";
 
 export function ensureBuiltInVerificationChecks(ctx) {
@@ -71,13 +70,10 @@ function ensureVerificationFileExists(ctx, relativePath, targetPath) {
 }
 
 function verificationSeederBinary(ctx) {
-  const nativePath = usesSourceNativeFallback(ctx)
-    ? findNativeDecisionBinary(ctx)
-    : join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
+  const nativePath = join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
   if (
-    !nativePath ||
     !existsSync(nativePath) ||
-    (!usesSourceNativeFallback(ctx) && hasSymlinkInTargetPath(ctx, ctx.nativeBinaryRelativePath)) ||
+    hasSymlinkInTargetPath(ctx, ctx.nativeBinaryRelativePath) ||
     !lstatSync(nativePath).isFile()
   ) {
     printError(ctx, "NAOME native decision binary is unavailable for verification seeding.");

package/installer/manifest-state.js

@@ -2,7 +2,7 @@ import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { dirname, join } from "node:path";
 
 import { hasSymlinkInTargetPath } from "./filesystem.js";
-import { installedMachineOwnedIntegrity, installedNativeBinaryHash, usesSourceNativeFallback } from "./native.js";
+import { installedMachineOwnedIntegrity, installedNativeBinaryHash } from "./native.js";
 import { printError } from "./output.js";
 import { isVersion } from "./version.js";
 
@@ -121,7 +121,7 @@ function applyManifestHealthMetadata(ctx, manifest) {
   manifest.integrity = installedMachineOwnedIntegrity(ctx);
 
   const nativeHash = installedNativeBinaryHash(ctx);
-  if (!usesSourceNativeFallback(ctx) && nativeHash) {
+  if (nativeHash) {
     if (!manifest.machineOwned.includes(ctx.nativeBinaryRelativePath)) {
       manifest.machineOwned.push(ctx.nativeBinaryRelativePath);
     }

package/installer/native.js

@@ -6,7 +6,6 @@ import {
   lstatSync,
   mkdirSync,
   readFileSync,
-  unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -32,12 +31,6 @@ export function installNativeDecisionBinary(ctx) {
     process.exit(1);
   }
 
-  if (usesSourceNativeFallback(ctx)) {
-    removeInstalledNativeDecisionBinary(ctx);
-    patchInstalledNativeIntegrity(ctx, "sha256:generated");
-    return;
-  }
-
   mkdirSync(dirname(targetPath), { recursive: true });
   const sourceHash = sha256(readFileSync(sourcePath));
   const targetHash =
@@ -93,11 +86,6 @@ export function patchInstalledMachineOwnedIntegrity(ctx) {
   }
 }
 
-export function usesSourceNativeFallback(ctx) {
-  return existsSync(join(ctx.targetRoot, "packages", "naome", "Cargo.toml"))
-    && existsSync(join(ctx.targetRoot, "packages", "naome", "crates", "naome-cli", "src", "main.rs"));
-}
-
 export function installedNativeBinaryHash(ctx) {
   const targetPath = join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
   if (
@@ -111,23 +99,6 @@ export function installedNativeBinaryHash(ctx) {
   return sha256(readFileSync(targetPath));
 }
 
-function removeInstalledNativeDecisionBinary(ctx) {
-  const targetPath = join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
-  if (!existsSync(targetPath)) {
-    ctx.skipped.push(ctx.nativeBinaryRelativePath);
-    return;
-  }
-
-  if (hasSymlinkInTargetPath(ctx, ctx.nativeBinaryRelativePath) || !lstatSync(targetPath).isFile()) {
-    ctx.skipped.push(ctx.nativeBinaryRelativePath);
-    ctx.unsafeSkipped.push(ctx.nativeBinaryRelativePath);
-    return;
-  }
-
-  unlinkSync(targetPath);
-  ctx.updated.push(ctx.nativeBinaryRelativePath);
-}
-
 export function templateIntegrity(ctx) {
   const integrity = {};
 
@@ -143,7 +114,7 @@ export function installedMachineOwnedIntegrity(ctx) {
   const integrity = templateIntegrity(ctx);
   const nativeHash = installedNativeBinaryHash(ctx);
 
-  if (!usesSourceNativeFallback(ctx) && nativeHash) {
+  if (nativeHash) {
     integrity[ctx.nativeBinaryRelativePath] = `sha256:${nativeHash}`;
   }
 
@@ -181,6 +152,7 @@ export function hasGeneratedNativeIntegrity(ctx, relativePath) {
 }
 
 function patchInstalledNativeIntegrity(ctx, expectedIntegrity) {
+  const nativeIntegrityPatchPattern = /^const expectedNativeBinaryIntegrity = "(?:sha256:[a-f0-9]{64}|sha256:generated)";\n/m;
   const nativeIntegrityPaths = [
     ctx.healthCheckerRelativePath,
     ctx.taskStateCheckerRelativePath,
@@ -195,7 +167,7 @@ function patchInstalledNativeIntegrity(ctx, expectedIntegrity) {
 
     const content = readFileSync(targetPath, "utf8");
     const nextContent = content.replace(
-      ctx.nativeIntegrityPattern,
+      nativeIntegrityPatchPattern,
       `const expectedNativeBinaryIntegrity = "${expectedIntegrity}";\n`,
     );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "Apache-2.0",
   "type": "module",

package/templates/naome-root/.naome/bin/check-harness-health.js

@@ -11,8 +11,8 @@ const expectedNativeBinaryIntegrity = "sha256:generated";
 
 const expectedMachineOwnedIntegrity = Object.freeze({
   ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
-  ".naome/bin/check-task-state.js": "sha256:2612577b7e4ab45d9d39dd5ac54c8e7ed749d237d78f1a8d252f4dfa0b4eaaab",
-  ".naome/bin/naome.js": "sha256:f129c580fb70b3a1d92d0ab0de9fa6c131b2fc51a8dcdebe9d6f5a812a3be61b",
+  ".naome/bin/check-task-state.js": "sha256:d1c12ba6d8a0ffc3fd28c6900b675c4bbc9c54b6bd287d219f6e9104bfb9621e",
+  ".naome/bin/naome.js": "sha256:8a9d9ed783981ef9750021fa30e92460283775bb4a0eacdea60b63041a9c6a05",
   ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
   ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
   "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",

package/templates/naome-root/.naome/bin/check-task-state.js

@@ -11,8 +11,8 @@ const expectedNativeBinaryIntegrity = "sha256:generated";
 
 const expectedMachineOwnedIntegrity = Object.freeze({
   ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
-  ".naome/bin/check-task-state.js": "sha256:2612577b7e4ab45d9d39dd5ac54c8e7ed749d237d78f1a8d252f4dfa0b4eaaab",
-  ".naome/bin/naome.js": "sha256:f129c580fb70b3a1d92d0ab0de9fa6c131b2fc51a8dcdebe9d6f5a812a3be61b",
+  ".naome/bin/check-task-state.js": "sha256:d1c12ba6d8a0ffc3fd28c6900b675c4bbc9c54b6bd287d219f6e9104bfb9621e",
+  ".naome/bin/naome.js": "sha256:8a9d9ed783981ef9750021fa30e92460283775bb4a0eacdea60b63041a9c6a05",
   ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
   ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
   "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",
@@ -67,9 +67,7 @@ function resolveNativeDecisionBinary(root) {
   const expectedIntegrity = expectedNativeIntegrity();
   const candidates = [
     process.env.NAOME_NATIVE_BIN,
-    join(root, nativeBinaryRelativePath),
-    join(root, "packages", "naome", "target", "release", nativeBinaryName),
-    join(root, "packages", "naome", "target", "debug", nativeBinaryName)
+    expectedIntegrity && join(root, nativeBinaryRelativePath)
   ].filter(Boolean);
 
   if (expectedIntegrity) {
@@ -82,12 +80,7 @@ function resolveNativeDecisionBinary(root) {
     fail(`No runnable NAOME native task-state binary matched ${expectedIntegrity}. Run naome sync again.`);
   }
 
-  const built = buildSourceNativeBinary(root);
-  if (built && isUsableNativeBinary(built, root, null)) {
-    return built;
-  }
-
-  fail("NAOME native task-state binary is missing or incompatible. Run naome sync again.");
+  fail("NAOME native task-state binary is missing trusted integrity. Run naome sync again.");
 }
 
 function expectedNativeIntegrity() {
@@ -118,34 +111,6 @@ function isUsableNativeBinary(candidate, root, expectedIntegrity) {
   return !probe.error && probe.status !== null;
 }
 
-function buildSourceNativeBinary(root) {
-  if (expectedNativeBinaryIntegrity !== "sha256:generated") {
-    return null;
-  }
-
-  const packageRoot = join(root, "packages", "naome");
-  const manifestPath = join(packageRoot, "Cargo.toml");
-  if (!existsSync(manifestPath)) {
-    return null;
-  }
-
-  const result = spawnSync(
-    "cargo",
-    ["build", "--release", "--manifest-path", manifestPath, "-p", "naome-cli"],
-    {
-      cwd: root,
-      encoding: "utf8",
-      stdio: "ignore"
-    }
-  );
-  if (result.status !== 0) {
-    return null;
-  }
-
-  const builtPath = join(packageRoot, "target", "release", nativeBinaryName);
-  return existsSync(builtPath) ? builtPath : null;
-}
-
 function findHarnessRoot(startPath) {
   let current = resolve(startPath);
 

package/templates/naome-root/.naome/bin/naome.js

@@ -66,9 +66,7 @@ function spawnNative(root, args, options = {}) {
 function resolveNativeDecisionBinary(root) {
   const candidates = [
     process.env.NAOME_NATIVE_BIN,
-    join(root, nativeBinaryRelativePath),
-    join(root, "packages", "naome", "target", "release", nativeBinaryName),
-    join(root, "packages", "naome", "target", "debug", nativeBinaryName)
+    expectedNativeBinaryIntegrity !== "sha256:generated" && join(root, nativeBinaryRelativePath)
   ].filter(Boolean);
 
   for (const candidate of candidates) {
@@ -77,11 +75,6 @@ function resolveNativeDecisionBinary(root) {
     }
   }
 
-  const built = buildSourceNativeBinary(root);
-  if (built && isUsableNativeBinary(built, root)) {
-    return built;
-  }
-
   fail("NAOME native decision binary is missing or incompatible. Run naome sync again, or set NAOME_NATIVE_BIN to a built naome binary.");
 }
 
@@ -91,7 +84,7 @@ function isUsableNativeBinary(candidate, root) {
   }
 
   if (expectedNativeBinaryIntegrity === "sha256:generated") {
-    return isRunnableNativeBinary(candidate, root);
+    return candidate === process.env.NAOME_NATIVE_BIN && isRunnableNativeBinary(candidate, root);
   }
 
   const actual = `sha256:${createHash("sha256").update(readFileSync(candidate)).digest("hex")}`;
@@ -111,27 +104,6 @@ function isRunnableNativeBinary(candidate, root) {
   return !probe.error && probe.status !== null;
 }
 
-function buildSourceNativeBinary(root) {
-  if (expectedNativeBinaryIntegrity !== "sha256:generated") {
-    return null;
-  }
-
-  const sourcePath = (...parts) => join(root, "packages", "naome", ...parts);
-  const manifestPath = sourcePath("Cargo.toml");
-  if (!existsSync(manifestPath)) {
-    return null;
-  }
-
-  const buildArgs = ["build", "--release", "--manifest-path", manifestPath, "-p", "naome-cli"];
-  const result = spawnSync("cargo", buildArgs, { cwd: root, encoding: "utf8", stdio: "ignore" });
-  if (result.status !== 0) {
-    return null;
-  }
-
-  const builtPath = sourcePath("target", "release", nativeBinaryName);
-  return existsSync(builtPath) ? builtPath : null;
-}
-
 function commit(args) {
   const root = findHarnessRoot(process.cwd());
   if (!root) {

package/templates/naome-root/.naome/manifest.json

@@ -3,8 +3,8 @@
   "installedAt": null,
   "integrity": {
     ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
-    ".naome/bin/check-task-state.js": "sha256:2612577b7e4ab45d9d39dd5ac54c8e7ed749d237d78f1a8d252f4dfa0b4eaaab",
-    ".naome/bin/naome.js": "sha256:f129c580fb70b3a1d92d0ab0de9fa6c131b2fc51a8dcdebe9d6f5a812a3be61b",
+    ".naome/bin/check-task-state.js": "sha256:d1c12ba6d8a0ffc3fd28c6900b675c4bbc9c54b6bd287d219f6e9104bfb9621e",
+    ".naome/bin/naome.js": "sha256:8a9d9ed783981ef9750021fa30e92460283775bb4a0eacdea60b63041a9c6a05",
     ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
     ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
     "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",