@loomhelm/multi-task-flow 0.0.0-stage → 0.2.6

package/toolkit/skills/multi-task-flow/lib/service-maintenance.ts

@@ -0,0 +1,288 @@
+import { Runtime } from "../../bin/modules/core/runtime";
+import {
+  compatibilityReport,
+  requireReport,
+  type DowngradeApproval,
+} from "../lib/service-compatibility";
+import {
+  chmodSync,
+  existsSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { ContractError } from "../lib/errors";
+import { withExclusiveLockAsync } from "../../bin/modules/flow/storage";
+import {
+  PortRegistry,
+  defaultRegistryDir,
+  processAlive,
+} from "../../bin/modules/workspace/port_registry";
+import {
+  renameNoReplace,
+  readRegularNoFollow,
+  writeExclusiveNoFollow,
+} from "../../bin/modules/visual/secure_io";
+import { ensureDirectory, readRegular } from "../lib/store";
+import { ServiceState } from "../lib/service-state";
+import { ServiceAuth } from "../lib/service-auth";
+import { verifyRelease, requireSourceRelease } from "../lib/service-release";
+import { requireCondition } from "../lib/errors";
+import { type ReleaseManifest } from "../lib/service-contract";
+import { serviceStatus, SERVICE_STARTUP_TIMEOUT_MS, waitForServiceHealth } from "../lib/service-lifecycle";
+import {
+  unloadUserService,
+  writeLaunchdDefinition,
+  startUserService,
+} from "../lib/service-launchd";
+
+export function stageRelease(
+  state: ServiceState,
+  source: string,
+): ReleaseManifest {
+  const manifest = verifyRelease(source);
+  requireSourceRelease(manifest);
+  requireCondition(
+    manifest.platform === `${process.platform}-${process.arch}`,
+    "INCOMPATIBLE_PLATFORM",
+    "Release does not match this platform",
+  );
+  const target = join(state.paths.releases, manifest.build_id);
+  if (existsSync(target)) {
+    verifyRelease(target);
+    return manifest;
+  }
+  const staging = join(state.paths.releases, `.stage-${randomUUID()}`);
+  ensureDirectory(join(staging, "dist"));
+  for (const name of [...Object.keys(manifest.files), "manifest.json"]) {
+    ensureDirectory(dirname(join(staging,name)));
+    writeExclusiveNoFollow(
+      join(staging, name),
+      readRegularNoFollow(
+        join(source, name),
+        source,
+        undefined,
+        256 * 1024 * 1024,
+      ),
+      staging,
+    );
+  }
+  chmodSync(join(staging, "viewer"), 0o700);
+  verifyRelease(staging);
+  renameNoReplace(staging, target, state.paths.root);
+  return manifest;
+}
+export function checkDataCompatibility(
+  state: ServiceState,
+  manifest: ReleaseManifest,
+  approval?: DowngradeApproval,
+  strictTargetReadable = false,
+): void {
+  const report = compatibilityReport(state, manifest);
+  requireReport(report, approval);
+  if (strictTargetReadable && report.runs.some((run) => !run.target_readable))
+    throw new ContractError("INCOMPATIBLE_RELEASE", "Rollback target cannot read every retained run", 2);
+}
+
+function versionKey(value: string): number[] {
+  return value.replace(/^[^0-9]*/, "").split(/[.-]/).slice(0, 3).map((part) => Number(part) || 0);
+}
+
+export function discoverCandidate(state: ServiceState): ReleaseManifest | null {
+  if (!existsSync(state.paths.candidates)) return null;
+  const candidates = readdirSync(state.paths.candidates, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => join(state.paths.candidates, entry.name))
+    .map((path) => { try { return verifyRelease(path); } catch { return null; } })
+    .filter((manifest): manifest is ReleaseManifest => Boolean(manifest) && manifest!.schema_version === 2)
+    .filter((manifest) => manifest.platform === `${process.platform}-${process.arch}`)
+    .sort((left, right) => {
+      const a = versionKey(right.service_version);
+      const b = versionKey(left.service_version);
+      for (let index = 0; index < 3; index++) if (a[index] !== b[index]) return a[index] - b[index];
+      return right.build_id.localeCompare(left.build_id);
+    });
+  const current = state.config().current_build;
+  return candidates.find((manifest) => manifest.build_id !== current) ?? null;
+}
+
+export async function installRelease(
+  state: ServiceState,
+  source: string,
+  registryDir?: string,
+) {
+  state.initialize();
+  return withExclusiveLockAsync(
+    join(state.paths.state, "startup.lock"),
+    async () => {
+      requireCondition(
+        !existsSync(join(state.paths.config, "service.json")),
+        "ALREADY_INSTALLED",
+        "Use explicit upgrade for an existing installation",
+      );
+      const manifest = stageRelease(state, resolve(source));
+      checkDataCompatibility(state, manifest);
+      const directory = registryDir
+        ? resolve(registryDir)
+        : state.paths.isolated
+          ? join(state.paths.state, "port-registry")
+          : defaultRegistryDir();
+      const registry = new PortRegistry(directory);
+      const result = await registry.allocate({
+        scopeId: state.paths.scope,
+        service: "viewer",
+        project: "multi-task-flow",
+        repoRoot: "",
+        branch: "",
+        worktreePath: "",
+      });
+      const port = Number(result.port);
+      try {
+        state.saveConfig({
+          schema_version: 1,
+          port,
+          registry_dir: directory,
+          current_build: manifest.build_id,
+          previous_build: null,
+          agent_ttl_ms: 3_600_000,
+        });
+        new ServiceAuth(state).initialize();
+        writeLaunchdDefinition(state);
+        return {
+          build_id: manifest.build_id,
+          port,
+          root: state.paths.root,
+          started: false,
+        };
+      } finally {
+        await registry.releaseService(state.paths.scope, "viewer");
+      }
+    },
+  );
+}
+export const nativeServiceControl = {
+  unload: unloadUserService,
+  start: startUserService,
+  status: serviceStatus,
+};
+export async function switchRelease(
+  state: ServiceState,
+  source: string,
+  rollback = false,
+  control: typeof nativeServiceControl & { startupTimeoutMs?: number } = nativeServiceControl,
+  approval?: DowngradeApproval,
+) {
+  state.initialize();
+  return withExclusiveLockAsync(join(state.paths.state, "startup.lock"), () =>
+    withExclusiveLockAsync(
+      join(state.paths.data, ".maintenance.lock"),
+      async () => {
+        const old = state.config();
+        const startupTimeoutMs = control.startupTimeoutMs ?? SERVICE_STARTUP_TIMEOUT_MS;
+        requireCondition(Number.isFinite(startupTimeoutMs) && startupTimeoutMs > 0, "INVALID_TIMEOUT", "Startup timeout must be finite and positive");
+        const selected = rollback ? old.previous_build : null;
+        requireCondition(
+          !rollback || selected,
+          "NO_PREVIOUS_BUILD",
+          "No previous build is available",
+        );
+        const manifest = rollback
+          ? verifyRelease(join(state.paths.releases, selected!))
+          : stageRelease(state, resolve(source));
+        requireSourceRelease(manifest);
+        checkDataCompatibility(state, manifest, approval, rollback);
+        if (manifest.build_id === old.current_build)
+          return { build_id: manifest.build_id, changed: false };
+        const runtime = state.runtime();
+        const wasRunning = runtime.pid !== null && processAlive(runtime.pid);
+        if (wasRunning) await control.status(state);
+        control.unload(state);
+        const waitStopped = async () => {
+          for (let index = 0; index < 100; index++) {
+            const active = state.runtime();
+            if (active.pid === null || !processAlive(active.pid)) return;
+            await Runtime.sleep(100);
+          }
+          throw new Error("Viewer did not stop; refusing build switch");
+        };
+        await waitStopped();
+        try {
+          state.saveConfig({
+            ...old,
+            current_build: manifest.build_id,
+            previous_build: old.current_build,
+          });
+          writeLaunchdDefinition(state);
+          // Health-check even an initially idle service, using one bounded
+          // maintenance lease so installation never becomes permanent startup.
+          state.transaction((active) => {
+            active.phase = "stopped";
+            active.pid = null;
+          });
+          state.renew(
+            { id: "maintenance", kind: "agent", thread_id: null, run_id: null },
+            startupTimeoutMs + 30_000,
+          );
+          control.start(state);
+          // Native launchctl calls have their own bounded runtime. Refresh the
+          // temporary lease so readiness receives its complete health window.
+          state.renew(
+            { id: "maintenance", kind: "agent", thread_id: null, run_id: null },
+            startupTimeoutMs + 30_000,
+          );
+          try {
+            await waitForServiceHealth(() => control.status(state), startupTimeoutMs);
+          } catch {
+            throw new Error("New build did not become healthy");
+          }
+          return { build_id: manifest.build_id, changed: true };
+        } catch (error) {
+          control.unload(state);
+          await waitStopped();
+          state.saveConfig(old);
+          writeLaunchdDefinition(state);
+          state.transaction((active) => {
+            active.phase = "stopped";
+            active.pid = null;
+            active.leases = active.leases.filter(
+              (lease) => lease.id !== "maintenance",
+            );
+          });
+          // Recovery may restore old configuration, but cannot launch a legacy v1 package.
+          const restartPrevious = wasRunning && verifyRelease(join(state.paths.releases, old.current_build)).schema_version === 2;
+          if (restartPrevious) {
+            state.renew(
+              {
+                id: "maintenance",
+                kind: "agent",
+                thread_id: null,
+                run_id: null,
+              },
+              startupTimeoutMs + 30_000,
+            );
+            let recovered = false;
+            try {
+              control.start(state);
+              state.renew(
+                { id: "maintenance", kind: "agent", thread_id: null, run_id: null },
+                startupTimeoutMs + 30_000,
+              );
+              await waitForServiceHealth(() => control.status(state), startupTimeoutMs);
+              recovered = true;
+            } catch {}
+            requireCondition(
+              recovered,
+              "ROLLBACK_HEALTH_FAILED",
+              "Previous build restored but not healthy; inspect service doctor",
+            );
+          }
+          throw error;
+        } finally {
+          state.release("maintenance");
+        }
+      },
+    ),
+  );
+}

package/toolkit/skills/multi-task-flow/lib/service-pages.ts

@@ -0,0 +1,111 @@
+export function viewerPage(
+  title: string,
+  body: string,
+  script?: string,
+): string {
+  return `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title><style>:root{color-scheme:light dark;font:15px system-ui}body{max-width:1120px;margin:48px auto;padding:0 24px}header{border-bottom:1px solid #8886;padding-bottom:24px}h1{font-size:28px;font-weight:600}p{line-height:1.7}a{color:inherit}ul{list-style:none;padding:0}li{border-bottom:1px solid #8884;padding:20px 0;display:flex;gap:16px;flex-wrap:wrap}code,small{font-family:monospace}small{opacity:.7}#status{min-height:24px}button{padding:8px 16px}</style><header><small>MULTI TASK FLOW / SHARED VIEWER</small><h1>${title}</h1></header>${body}${script ? `<script src="${script}" defer></script>` : ""}</html>`;
+}
+
+const runPathPattern = /^\/runs\/[A-Za-z0-9][A-Za-z0-9_.-]{0,127}\/$/;
+const viewIdPattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
+const viewParamValidators: Record<string, (value: string) => boolean> = {
+  tab: (value) => /^(graph|atomic|planned|actual)$/.test(value),
+  graph: (value) => /^(aggregate|atomic)$/.test(value),
+  layout: (value) => /^(board|grid)$/.test(value),
+  q: (value) => value.length <= 200 && !/[\u0000-\u001f\u007f]/.test(value),
+  group: (value) => viewIdPattern.test(value),
+  state: (value) => viewIdPattern.test(value),
+  kind: (value) => viewIdPattern.test(value),
+  plan: (value) => viewIdPattern.test(value),
+  selected: (value) => /^(task|group|milestone):[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(value),
+  detail: (value) => value === "1" || value === "true",
+  zoom: (value) => {
+    const zoom = Number(value);
+    return Number.isFinite(zoom) && zoom >= 0.2 && zoom <= 2.5;
+  },
+  plannedStart: (value) => value.length <= 64 && !Number.isNaN(Date.parse(value)),
+  plannedEnd: (value) => value.length <= 64 && !Number.isNaN(Date.parse(value)),
+  actualStart: (value) => value.length <= 64 && !Number.isNaN(Date.parse(value)),
+  actualEnd: (value) => value.length <= 64 && !Number.isNaN(Date.parse(value)),
+};
+const maxTimelineSpanMs = 10_000 * 365.25 * 24 * 60 * 60 * 1000;
+
+export type ViewerTarget = { target: string; ticket: string | null };
+export function parseViewerTarget(
+  value: string | URL,
+  origin: string,
+  options: { allowHome?: boolean; allowTicket?: boolean } = {},
+): ViewerTarget | null {
+  const allowHome = options.allowHome ?? true;
+  const allowTicket = options.allowTicket ?? false;
+  try {
+    const rawPath = typeof value === "string" ? value.split(/[?#]/, 1)[0]! : null;
+    if (rawPath && (rawPath.includes("\\") || /(?:^|\/)(?:\.{1,2}|%2e(?:%2e)?)(?:\/|$)/i.test(rawPath))) return null;
+    const url = value instanceof URL ? new URL(value.href) : new URL(value, origin);
+    if (typeof value === "string" && value.trim() !== value) return null;
+    if (url.origin !== origin || url.username || url.password || url.hash) return null;
+    const home = url.pathname === "/";
+    if ((!home || !allowHome) && !runPathPattern.test(url.pathname)) return null;
+    const ticketValues = url.searchParams.getAll("ticket");
+    if (ticketValues.length > 1 || (ticketValues.length > 0 && !allowTicket)) return null;
+    const ticket = ticketValues[0] ?? null;
+    if (ticket !== null && (ticket.length > 100 || /[\u0000-\u001f\u007f]/.test(ticket))) return null;
+    let selected = false;
+    let detail = false;
+    for (const [key, parameter] of url.searchParams) {
+      if (key === "ticket") continue;
+      if (home || /[\u0000-\u001f\u007f]/.test(parameter) || !viewParamValidators[key] || url.searchParams.getAll(key).length !== 1 || !viewParamValidators[key]!(parameter)) return null;
+      if (key === "selected") selected = true;
+      if (key === "detail") detail = true;
+    }
+    if (detail && !selected) return null;
+    for (const [start, end] of [["plannedStart", "plannedEnd"], ["actualStart", "actualEnd"]] as const) {
+      const startValue = url.searchParams.get(start);
+      const endValue = url.searchParams.get(end);
+      if ((startValue === null) !== (endValue === null)) return null;
+      if (startValue && endValue && (Date.parse(startValue) >= Date.parse(endValue) || Date.parse(endValue) - Date.parse(startValue) > maxTimelineSpanMs)) return null;
+    }
+    url.searchParams.delete("ticket");
+    return { target: url.pathname + url.search, ticket };
+  } catch {
+    return null;
+  }
+}
+
+export const authFailedPage = viewerPage(
+  "登录入口失效",
+  '<p id="status" role="status">一次性登录入口已过期或已使用。</p><p>请重新运行 service login 获取新的入口，然后刷新此页面。</p>',
+);
+export const homePage = viewerPage(
+  "编排运行",
+  '<p id="status" role="status">正在读取运行。</p><ul id="runs"></ul><button id="more" hidden>加载更多</button><p><small id="build"></small></p>',
+  "/home.js",
+);
+export const homeScript = `let offset=0;const status=document.getElementById("status"),more=document.getElementById("more");async function renew(){try{const r=await fetch("/api/v1/lease",{method:"POST"});if(!r.ok)throw Error();}catch{status.textContent="服务已断开。若已退出，请先调用 service ensure；如登录过期，请重新获取登录入口。"}}async function load(){try{const r=await fetch("/api/v1/runs?offset="+offset);if(!r.ok)throw Error();const v=await r.json();for(const run of v.runs){const li=document.createElement("li"),a=document.createElement("a"),meta=document.createElement("small");a.textContent=run.id;a.href="/runs/"+encodeURIComponent(run.id)+"/";meta.textContent=run.error||("revision "+run.revision+" / "+run.owner_thread_id);li.append(a,meta);document.getElementById("runs").append(li)}offset+=v.runs.length;more.hidden=offset>=v.total;status.textContent=v.total?"共 "+v.total+" 个运行":"暂无编排运行";document.getElementById("build").textContent="build "+v.build_id;}catch{status.textContent="无法读取运行。请确认服务在线并通过 service login 登录。"}}more.onclick=load;load();renew();setInterval(renew,60000);document.addEventListener("visibilitychange",()=>{if(!document.hidden)renew()});`;
+
+export const runClientScript = `
+const brand=document.querySelector(".brand-mark");
+if(brand){
+  const home=document.createElement("a");
+  home.className=brand.className;home.href="/";
+  home.setAttribute("aria-label","全部编排运行");home.dataset.tooltip="全部编排运行";
+  home.append(...brand.childNodes);brand.replaceWith(home);
+}
+async function renew(){
+  try{
+    const r=await fetch("/api/v1/lease",{method:"POST"});
+    document.dispatchEvent(new CustomEvent("service-session",{detail:{expired:r.status===401}}));
+  }catch{/* The dashboard owns connection and snapshot feedback. */}
+}
+fetch("api/service").then(r=>r.ok?r.json():null).then(v=>{
+  if(!v)return;
+  const home=document.querySelector(".brand-mark");
+  if(home)home.dataset.tooltip="全部编排运行 · build "+v.build_id;
+  if(v.warning){
+    const anchor=document.getElementById("connection-notice");
+    if(anchor){const notice=document.createElement("div");notice.className="notice notice-warning";notice.setAttribute("role","status");notice.textContent=v.warning;anchor.after(notice)}
+  }
+}).catch(()=>{});
+renew();setInterval(renew,60000);
+document.addEventListener("visibilitychange",()=>{if(!document.hidden)renew()});
+`;

package/toolkit/skills/multi-task-flow/lib/service-paths.ts

@@ -0,0 +1,53 @@
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { requireCondition } from "../lib/errors";
+
+export function servicePaths(env: NodeJS.ProcessEnv = process.env) {
+  const production = join(homedir(), ".local", "share", "multi-task-flow");
+  const override = env.MULTI_TASK_FLOW_ROOT;
+  const isolated =
+    env.MULTI_TASK_FLOW_PROFILE === "test" ||
+    env.MULTI_TASK_FLOW_PROFILE === "development";
+  requireCondition(
+    !override ||
+      (isolated && isAbsolute(override) && resolve(override) !== production),
+    "INVALID_ROOT",
+    "A service root override requires an isolated test/development profile",
+  );
+  requireCondition(
+    !isolated || override,
+    "INVALID_ROOT",
+    "An isolated profile requires an explicit service root",
+  );
+  const root = override ? resolve(override) : production;
+  const suffix = isolated
+    ? "." + createHash("sha256").update(root).digest("hex").slice(0, 12)
+    : "";
+  return {
+    root,
+    isolated,
+    data: join(root, "data"),
+    config: join(root, "config"),
+    state: join(root, "state"),
+    releases: join(root, "releases"),
+    candidates: join(root, "candidates"),
+    logs: join(root, "logs"),
+    label: "cc.ivanli.loomhelm.multi-task-flow.viewer" + suffix,
+    scope: "multi-task-flow--user-" + String(process.getuid?.() ?? 0) + suffix,
+  };
+}
+
+export type ServicePaths = ReturnType<typeof servicePaths>;
+
+export function orchestrationRoot(
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  const explicit = env.TASK_ORCHESTRATION_DATA_ROOT;
+  requireCondition(
+    !explicit || isAbsolute(explicit),
+    "INVALID_ROOT",
+    "Data root must be absolute",
+  );
+  return explicit ? resolve(explicit) : servicePaths(env).data;
+}

package/toolkit/skills/multi-task-flow/lib/service-release.ts

@@ -0,0 +1,123 @@
+import { builtinModules } from "node:module";
+import { createHash } from "node:crypto";
+import { lstatSync, realpathSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { readRegular } from "../lib/store";
+import { requireCondition } from "../lib/errors";
+import { readRegularNoFollow } from "../../bin/modules/visual/secure_io";
+import {
+  releaseManifestSchema,
+  type ReleaseManifest,
+} from "../lib/service-contract";
+import { SKILL_ID, SKILL_VERSION } from "../lib/contract";
+
+export const releaseFiles = [
+  "viewer",
+  "skills/multi-task-flow/scripts/service.ts",
+  "skills/bin/plan_bunfig.toml",
+  "skills/multi-task-flow/dist/index.html",
+  "skills/multi-task-flow/dist/app.js",
+  "skills/multi-task-flow/dist/app.css",
+] as const;
+const legacyFiles = ["viewer", "dist/index.html", "dist/app.js", "dist/app.css"];
+export function requireSourceRelease(manifest: ReleaseManifest): void {
+  requireCondition(manifest.schema_version === 2, "SOURCE_RELEASE_REQUIRED", "Legacy viewer package is diagnostic-only; explicitly prepare a Bun source package");
+}
+export const digest = (value: Uint8Array | string) =>
+  createHash("sha256").update(value).digest("hex");
+function identityBody(
+  manifest: Omit<ReleaseManifest, "build_id">,
+  includeViewerContract: boolean,
+): Record<string, unknown> {
+  const body = { ...manifest } as Record<string, unknown>;
+  if (body.skill_id === SKILL_ID) delete body.skill_id;
+  if (body.skill_version === SKILL_VERSION) delete body.skill_version;
+  if (body.ledger_contract === 2) delete body.ledger_contract;
+  if (!includeViewerContract) delete body.viewer_contract;
+  // The launcher embeds this identity and therefore cannot be part of its own
+  // identity. The bootstrap verifier applies the same rule before checking
+  // the immutable resource inventory.
+  const files = { ...(body.files as Record<string, string>) };
+  delete files.viewer;
+  return {
+    ...body,
+    files: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b))),
+  };
+}
+export function buildId(manifest: Omit<ReleaseManifest, "build_id">): string {
+  return digest(JSON.stringify(identityBody(manifest, false)));
+}
+function versionedBuildId(manifest: Omit<ReleaseManifest, "build_id">): string {
+  return digest(JSON.stringify(identityBody(manifest, true)));
+}
+export function verifyRelease(root: string): ReleaseManifest {
+  requireCondition(
+    realpathSync(root) === resolve(root) && lstatSync(root).isDirectory(),
+    "UNSAFE_RELEASE",
+    "Release directory must be canonical",
+  );
+  const raw = JSON.parse(readRegular(join(root, "manifest.json")));
+  const manifest = releaseManifestSchema.parse(raw);
+  const { build_id, ...body } = manifest;
+  const { build_id: _rawBuildId, ...rawBody } = raw as Record<string, unknown>;
+  const identityMatches =
+    buildId(body) === build_id ||
+    versionedBuildId(body) === build_id ||
+    buildId(rawBody as Omit<ReleaseManifest, "build_id">) === build_id ||
+    versionedBuildId(rawBody as Omit<ReleaseManifest, "build_id">) === build_id;
+  requireCondition(
+    identityMatches,
+    "INVALID_RELEASE",
+    "Release identity mismatch",
+  );
+  const names = Object.keys(manifest.files);
+  const required = manifest.schema_version === 2 ? releaseFiles : legacyFiles;
+  requireCondition(required.every(file => names.includes(file)) && (manifest.schema_version === 2 || names.length === 4 || (names.length === 6 && names.includes("viewer.mjs") && names.includes("posix.node"))), "INVALID_RELEASE", "Release files are incomplete");
+  for (const file of names) {
+    requireCondition(!file.includes("\\") && !file.split("/").some(part => !part || part === "." || part === "..") && (manifest.schema_version === 2 ? file === "viewer" || file.startsWith("skills/") : [...legacyFiles,"viewer.mjs","posix.node"].includes(file)), "UNSAFE_RELEASE", "Release resource path is forbidden");
+    const path = join(root, file);
+    requireCondition(
+      realpathSync(path) === path &&
+        !lstatSync(path).isSymbolicLink() &&
+        lstatSync(path).isFile(),
+      "UNSAFE_RELEASE",
+      "Release file must be regular",
+    );
+    requireCondition(
+      digest(readRegularNoFollow(path, root, undefined, 256 * 1024 * 1024)) ===
+        manifest.files[file],
+      "INVALID_RELEASE",
+      "Release checksum mismatch",
+    );
+  }
+  if (manifest.schema_version === 2) {
+    const walk = (directory: string) => {
+      for (const entry of readdirSync(join(root,directory), {withFileTypes:true})) {
+        const path = directory ? directory + "/" + entry.name : entry.name;
+        requireCondition(!entry.isSymbolicLink(), "UNSAFE_RELEASE", "Release links are forbidden");
+        if (entry.isDirectory()) walk(path);
+        else requireCondition(path === "manifest.json" || names.includes(path), "INVALID_RELEASE", "Unlisted release resource: " + path);
+      }
+    };
+    walk("");
+    // Resolve the actual service import graph inside the verified resource set.
+    const pending = ["skills/multi-task-flow/scripts/service.ts"];
+    const visited = new Set<string>();
+    while (pending.length) {
+      const file = pending.pop()!;
+      if (visited.has(file)) continue;
+      visited.add(file);
+      const scan = new Bun.Transpiler({loader:file.endsWith(".ts") ? "ts" : "js"});
+      for (const item of scan.scanImports(readFileSync(join(root,file), "utf8"))) {
+        const specifier = item.path;
+        if (specifier.startsWith("node:") || specifier.startsWith("bun:") || builtinModules.includes(specifier)) continue;
+        let target: string;
+        try { target = Bun.resolveSync(specifier, resolve(root,file,"..")); }
+        catch { throw new Error("Source dependency is missing: " + file + " -> " + specifier); }
+        requireCondition(target.startsWith(root + "/") && names.includes(target.slice(root.length+1)), "INVALID_RELEASE", "Source dependency is outside resource inventory: " + file + " -> " + specifier);
+        if (/\.(?:ts|mjs|js|cjs)$/.test(target)) pending.push(target.slice(root.length+1));
+      }
+    }
+  }
+  return manifest;
+}