@litfamily/litopencode 1.0.0

package/tools/check-version-lockstep.mjs

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+
+const REGISTRY_FILE = "tools/version-manifests.json";
+const REGISTRY_KINDS = new Set(["pinned", "history", "derived"]);
+
+class VersionLockstepError extends Error {
+  constructor(message, exitCode) {
+    super(message);
+    this.name = "VersionLockstepError";
+    this.exitCode = exitCode;
+  }
+}
+
+function parseArgs(argv) {
+  const options = {
+    packagePath: "package.json",
+    lockfilePath: "package-lock.json"
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    const next = argv[index + 1];
+    if (arg === "--package" && next !== undefined) {
+      options.packagePath = next;
+      index += 1;
+    } else if (arg === "--lockfile" && next !== undefined) {
+      options.lockfilePath = next;
+      index += 1;
+    } else {
+      throw new VersionLockstepError(`unknown or incomplete argument: ${arg}`, 2);
+    }
+  }
+
+  return options;
+}
+
+async function readJson(filePath, label) {
+  try {
+    return JSON.parse(await fs.readFile(filePath, "utf8"));
+  } catch (error) {
+    if (label === "package-lock.json" && error && error.code === "ENOENT") {
+      return undefined;
+    }
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new VersionLockstepError(`cannot read or parse ${label}: ${detail}`, 2);
+  }
+}
+
+function requireObject(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new VersionLockstepError(`${label} must be a JSON object`, 2);
+  }
+  return value;
+}
+
+function requireString(object, field, label) {
+  const value = object[field];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new VersionLockstepError(`${label} ${field} must be a non-empty string`, 2);
+  }
+  return value;
+}
+
+function readPackageIdentity(parsedPackage) {
+  const packageObject = requireObject(parsedPackage, "package.json");
+  return {
+    name: requireString(packageObject, "name", "package.json"),
+    version: requireString(packageObject, "version", "package.json")
+  };
+}
+
+function readLockfileIdentity(parsedLockfile) {
+  if (parsedLockfile === undefined) {
+    return undefined;
+  }
+  const lockfileObject = requireObject(parsedLockfile, "package-lock.json");
+  return {
+    name: requireString(lockfileObject, "name", "package-lock.json"),
+    version: requireString(lockfileObject, "version", "package-lock.json"),
+    packages: lockfileObject.packages
+  };
+}
+
+function readRootPackageEntry(packages) {
+  if (packages === undefined) {
+    return undefined;
+  }
+  const packagesObject = requireObject(packages, "package-lock.json packages");
+  const rootEntry = packagesObject[""];
+  if (rootEntry === undefined) {
+    return undefined;
+  }
+  const rootObject = requireObject(rootEntry, 'package-lock.json packages[""]');
+  return {
+    name: requireString(rootObject, "name", 'package-lock.json packages[""]'),
+    version: requireString(rootObject, "version", 'package-lock.json packages[""]')
+  };
+}
+
+function assertEqual(actual, expected, label) {
+  if (actual !== expected) {
+    throw new VersionLockstepError(`${label} mismatch: expected ${expected}, found ${actual}`, 1);
+  }
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+function countOccurrences(text, needle) {
+  let count = 0;
+  let offset = 0;
+  while (true) {
+    const index = text.indexOf(needle, offset);
+    if (index === -1) return count;
+    count += 1;
+    offset = index + needle.length;
+  }
+}
+
+function countVersionOccurrences(text, version) {
+  const escaped = version.replace(/\./gu, "\\.");
+  return countOccurrences(text, version) + countOccurrences(text, escaped);
+}
+
+function countJsonIdentityVersionOccurrences(relativePath, text, version) {
+  if (relativePath !== "package.json" && relativePath !== "package-lock.json") return undefined;
+
+  const parsed = requireObject(JSON.parse(text), relativePath);
+  if (relativePath === "package.json") return parsed.version === version ? 1 : 0;
+
+  const rootEntry = readRootPackageEntry(parsed.packages);
+  return Number(parsed.version === version) + Number(rootEntry?.version === version);
+}
+
+async function checkVersionRegistry(packagePath, version) {
+  const repoRoot = path.dirname(packagePath);
+  const registryPath = path.resolve(repoRoot, REGISTRY_FILE);
+  const registry = requireObject(await readJson(registryPath, REGISTRY_FILE), REGISTRY_FILE);
+  if (!Array.isArray(registry.manifests)) {
+    throw new VersionLockstepError(`${REGISTRY_FILE} manifests must be an array`, 2);
+  }
+
+  const seen = new Set();
+  for (const rawEntry of registry.manifests) {
+    const entry = requireObject(rawEntry, `${REGISTRY_FILE} entry`);
+    const relativePath = requireString(entry, "path", `${REGISTRY_FILE} entry`);
+    const kind = requireString(entry, "kind", `${REGISTRY_FILE} entry ${relativePath}`);
+    if (!REGISTRY_KINDS.has(kind)) {
+      throw new VersionLockstepError(`${REGISTRY_FILE} entry ${relativePath} has unsupported kind ${kind}`, 2);
+    }
+    if (seen.has(relativePath)) {
+      throw new VersionLockstepError(`${REGISTRY_FILE} contains duplicate path ${relativePath}`, 2);
+    }
+    seen.add(relativePath);
+    if (!Number.isInteger(entry.occurrences) || entry.occurrences < 1) {
+      throw new VersionLockstepError(`${REGISTRY_FILE} entry ${relativePath} occurrences must be a positive integer`, 2);
+    }
+    requireString(entry, "why", `${REGISTRY_FILE} entry ${relativePath}`);
+
+    const absolutePath = path.resolve(repoRoot, relativePath);
+    const relativeToRoot = path.relative(repoRoot, absolutePath);
+    if (relativeToRoot === "" || relativeToRoot === ".." || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)) {
+      throw new VersionLockstepError(`${REGISTRY_FILE} entry ${relativePath} escapes the repository`, 2);
+    }
+
+    let text;
+    try {
+      text = await fs.readFile(absolutePath, "utf8");
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      throw new VersionLockstepError(`cannot read registered file ${relativePath}: ${detail}`, 2);
+    }
+
+    if (kind === "history") {
+      const heading = new RegExp(`^##\\s+${escapeRegExp(version)}(?:\\s|$)`, "mu");
+      if (!heading.test(text)) {
+        throw new VersionLockstepError(`${relativePath} has no heading for the current package version`, 1);
+      }
+      continue;
+    }
+
+    const actual = countJsonIdentityVersionOccurrences(relativePath, text, version)
+      ?? countVersionOccurrences(text, version);
+    if (actual !== entry.occurrences) {
+      throw new VersionLockstepError(`${relativePath} version occurrence mismatch: expected ${entry.occurrences}, found ${actual}`, 1);
+    }
+  }
+
+  return registry.manifests.length;
+}
+
+async function main() {
+  try {
+    const options = parseArgs(process.argv.slice(2));
+    const packagePath = path.resolve(options.packagePath);
+    const lockfilePath = path.resolve(options.lockfilePath);
+    const [parsedPackage, parsedLockfile] = await Promise.all([
+      readJson(packagePath, "package.json"),
+      readJson(lockfilePath, "package-lock.json")
+    ]);
+    const packageIdentity = readPackageIdentity(parsedPackage);
+    const lockfileIdentity = readLockfileIdentity(parsedLockfile);
+    if (lockfileIdentity === undefined) {
+      console.log(`version lockstep skipped: package-lock.json not present for ${packageIdentity.name}@${packageIdentity.version}`);
+      return;
+    }
+    const rootEntryIdentity = readRootPackageEntry(lockfileIdentity.packages);
+
+    assertEqual(lockfileIdentity.name, packageIdentity.name, "lockfile root name");
+    assertEqual(lockfileIdentity.version, packageIdentity.version, "lockfile root version");
+
+    if (rootEntryIdentity !== undefined) {
+      assertEqual(rootEntryIdentity.name, packageIdentity.name, 'lockfile packages[""] name');
+      assertEqual(rootEntryIdentity.version, packageIdentity.version, 'lockfile packages[""] version');
+    }
+
+    if (options.packagePath === "package.json" && options.lockfilePath === "package-lock.json") {
+      await checkVersionRegistry(packagePath, packageIdentity.version);
+    }
+
+    console.log(`version lockstep passed: ${packageIdentity.name}@${packageIdentity.version}`);
+  } catch (error) {
+    if (error instanceof VersionLockstepError) {
+      console.error(`version lockstep failed: ${error.message}`);
+      process.exitCode = error.exitCode;
+      return;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`version lockstep failed: ${message}`);
+    process.exitCode = 2;
+  }
+}
+
+await main();

package/tools/gen-canonical-frontend-manifest.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+const root = path.resolve("skills/frontend-ui-ux/references");
+const roots = ["design", "designpowers", "perfection", "ui-ux-db"];
+const expected = Object.freeze({
+  count: 167,
+  bytes: 2_596_349,
+  digest: "f6959eeae02685102df9fbedafb2c437be4d51df8e102f9fcf32298f7674e7d7"
+});
+const legal = Object.freeze([
+  { path: "_canonical-corpus/LICENSE", sha256: "b083425948376611de9b92b0aeb7377e604505756ea427e541a34d9b030d4dc1" },
+  { path: "_canonical-corpus/ATTRIBUTION.md", sha256: "a73cd147a533442218a9adef53d99e0eaf15c10d8db4819d9d1542727f077b92" },
+  { path: "_canonical-corpus/LICENSE-Apache-2.0.txt", sha256: "9d95806a26532623360eb84bb17d298f394b55ef73fb4c0796d99b4319b2b0da" }
+]);
+
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+async function walk(directory, prefix) {
+  const files = [];
+  for (const entry of await fs.readdir(directory, { withFileTypes: true })) {
+    const relative = path.posix.join(prefix, entry.name);
+    const absolute = path.join(root, ...relative.split("/"));
+    if (entry.isDirectory()) files.push(...await walk(absolute, relative));
+    else if (entry.isFile()) files.push(relative);
+    else throw new Error(`canonical source contains a symbolic link or special file: ${relative}`);
+  }
+  return files;
+}
+
+const paths = (await Promise.all(roots.map((name) => walk(path.join(root, name), name)))).flat().sort();
+const files = [];
+for (const relative of paths) {
+  const bytes = await fs.readFile(path.join(root, ...relative.split("/")));
+  files.push({ path: relative, size: bytes.byteLength, sha256: sha256(bytes) });
+}
+const count = files.length;
+const bytes = files.reduce((sum, file) => sum + file.size, 0);
+const digest = sha256(files.map((file) => `${file.sha256}  ${file.path}\n`).join(""));
+if (count !== expected.count || bytes !== expected.bytes || digest !== expected.digest) {
+  throw new Error(`canonical source invariant mismatch: count=${count} bytes=${bytes} digest=${digest}`);
+}
+for (const entry of legal) {
+  const actual = sha256(await fs.readFile(path.join(root, ...entry.path.split("/"))));
+  if (actual !== entry.sha256) throw new Error(`canonical legal mismatch: ${entry.path}`);
+}
+
+const manifest = {
+  schemaVersion: 1,
+  source: {
+    commit: "8ec16c5129df7b9778959e8367657d0e79c2c3bb",
+    tree: "9188410be0af35f2421ba300d91a0d7a7341caf0"
+  },
+  roots,
+  count,
+  bytes,
+  digest,
+  legal,
+  files
+};
+await fs.writeFile(path.join(root, "_canonical-corpus", "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+console.log(`canonical frontend manifest wrote ${count} files, ${bytes} bytes, ${digest}`);

package/tools/gen-managed-skill-manifest.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// Regenerates the canonicalFiles SHA-256 sets in skills/managed-skill-manifest.json from disk and
+// refuses agent-owned user skills if they intrude into the repository's shipped skill corpus.
+//
+// Two gates read that manifest as an EXACT file set: tools/check-pack-payload.mjs reports
+// "unexpected managed-skill payload" for any file it does not list, and
+// src/cli/native-skill-integrity.ts throws "has an altered file set". So adding or editing a managed
+// skill asset requires the manifest to move in the same change, and the manifest had no generator.
+//
+//   node tools/gen-managed-skill-manifest.mjs            rewrite canonicalFiles from disk
+//   node tools/gen-managed-skill-manifest.mjs --check     verify only; exit 1 on drift
+//
+// distributionFiles is a curated install list and is NEVER rewritten here — only read, so the files
+// it already covers are excluded from canonicalFiles.
+
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+const renamedSkillIds = JSON.parse(readFileSync(new URL("../skills/skill-rename-aliases.json", import.meta.url), "utf8"));
+
+const MANIFEST_PATH = "skills/managed-skill-manifest.json";
+
+function walk(base, rel = "") {
+  const out = [];
+  for (const entry of readdirSync(path.join(base, rel), { withFileTypes: true })) {
+    const next = rel ? `${rel}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) out.push(...walk(base, next));
+    else out.push(next);
+  }
+  return out;
+}
+
+function canonicalRoot(skillRoot, definition) {
+  if (definition.canonicalRoot !== undefined && typeof definition.canonicalRoot !== "string") {
+    throw new Error("managed-skill manifest canonicalRoot must be a string");
+  }
+  return path.resolve(skillRoot, definition.canonicalRoot ?? ".");
+}
+
+function refreshPinnedFiles(root, previous, label, discover = true) {
+  const wanted = (discover ? walk(root) : previous.map((asset) => asset.path)).sort();
+  const was = new Map(previous.map((asset) => [asset.path, asset.sha256]));
+  const next = wanted.map((rel) => ({
+    path: rel,
+    sha256: createHash("sha256").update(readFileSync(path.join(root, rel))).digest("hex"),
+  }));
+
+  for (const asset of next) {
+    const prior = was.get(asset.path);
+    if (prior === undefined) drift.push(`  unpinned  ${label}/${asset.path}`);
+    else if (prior !== asset.sha256) drift.push(`  changed   ${label}/${asset.path}`);
+  }
+  for (const rel of was.keys()) if (!wanted.includes(rel)) drift.push(`  missing   ${label}/${rel}`);
+  return next;
+}
+
+const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf8"));
+const drift = [];
+if (JSON.stringify(manifest.renamedSkills) !== JSON.stringify(renamedSkillIds)) {
+  drift.push("  changed   installer skill rename map");
+  manifest.renamedSkills = renamedSkillIds;
+}
+const intrusions = [];
+let pinned = 0;
+
+function hasAgentOwnedMarker(text) {
+  if (!text.startsWith("---\n")) return false;
+  const end = text.indexOf("\n---\n", 4);
+  if (end < 0) return false;
+  return /^\s{2}litopencodeAgentGenerated:\s*["']true["']\s*$/mu.test(text.slice(4, end));
+}
+
+for (const entry of readdirSync("skills", { withFileTypes: true })) {
+  if (!entry.isDirectory()) continue;
+  const skillPath = path.join("skills", entry.name, "SKILL.md");
+  try {
+    if (hasAgentOwnedMarker(readFileSync(skillPath, "utf8"))) {
+      intrusions.push(`  AGENT_OWNED_REPO_SKILL_FORBIDDEN ${skillPath}`);
+    }
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+  }
+}
+
+for (const [id, definition] of Object.entries(manifest.skills)) {
+  const skillRoot = path.join("skills", id);
+  const root = canonicalRoot(skillRoot, definition);
+  const distributed = new Set(definition.canonicalRoot === undefined ? definition.distributionFiles : []);
+  const wanted = walk(root)
+    .filter((rel) => !distributed.has(rel))
+    .sort();
+
+  const was = new Map(definition.canonicalFiles.map((asset) => [asset.path, asset.sha256]));
+  const next = wanted.map((rel) => ({
+    path: rel,
+    sha256: createHash("sha256").update(readFileSync(path.join(root, rel))).digest("hex"),
+  }));
+
+  for (const asset of next) {
+    const previous = was.get(asset.path);
+    if (previous === undefined) drift.push(`  unpinned  ${id}/${asset.path}`);
+    else if (previous !== asset.sha256) drift.push(`  changed   ${id}/${asset.path}`);
+  }
+  for (const rel of was.keys()) if (!wanted.includes(rel)) drift.push(`  missing   ${id}/${rel}`);
+
+  definition.canonicalFiles = next;
+  pinned += next.length;
+}
+
+if (manifest.vendorFiles !== undefined) {
+  if (!Array.isArray(manifest.vendorFiles)) throw new Error("managed-skill manifest vendorFiles must be an array");
+  manifest.vendorFiles = refreshPinnedFiles("vendor", manifest.vendorFiles, "vendor", false);
+  pinned += manifest.vendorFiles.length;
+}
+
+if (intrusions.length > 0) {
+  console.error(`managed-skill-manifest INTRUSION: ${intrusions.length} path(s)`);
+  console.error(intrusions.join("\n"));
+  process.exit(1);
+}
+
+if (drift.length === 0) {
+  console.log(`managed-skill-manifest OK: ${pinned} canonical asset(s)`);
+  process.exit(0);
+}
+
+if (process.argv.includes("--check")) {
+  console.error(`managed-skill-manifest DRIFT: ${drift.length} path(s)`);
+  console.error(drift.join("\n"));
+  console.error("run: npm run gen:managed-skill-manifest");
+  process.exit(1);
+}
+
+writeFileSync(MANIFEST_PATH, `${JSON.stringify(manifest, null, 2)}\n`);
+console.log(`managed-skill-manifest WROTE: ${pinned} canonical asset(s) -> ${MANIFEST_PATH}`);