@marcusrbrown/infra 0.25.1 → 0.25.2

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.25.1",
+  version: "0.25.2",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -8390,6 +8390,13 @@ function registerSetupCommand(cli, commandLabel) {
 import { log as log3 } from "@clack/prompts";
 import { z as z6 } from "zod";
 
+// src/commands/agent/key-layout.ts
+var KEY_LAYOUT_VERSION = "fro-bot-agent-s3-layout/1";
+var LEGACY_KEY_LAYOUT_LABELS = new Set(["fro-bot/agent@v0.118.2", "fro-bot/agent@v0.119.2"]);
+function isKnownKeyLayoutVersion(label) {
+  return label === KEY_LAYOUT_VERSION || LEGACY_KEY_LAYOUT_LABELS.has(label);
+}
+
 // src/commands/agent/workflow-verify.ts
 var WORKFLOW_PATH = ".github/workflows/fro-bot.yaml";
 var STORAGE_ENVIRONMENT = "fro-bot-storage";
@@ -8405,9 +8412,6 @@ var CONTENT_EVENTS = new Set([
   "discussion",
   "discussion_comment"
 ]);
-var VERIFIED_ACTION_SHA_BY_LAYOUT = {
-  "fro-bot/agent@v0.119.2": "83ed683da24111bd1474eb4bda39715ed5799bc2"
-};
 var REQUIRED_S3_INPUTS = {
   "s3-backup": undefined,
   "s3-bucket": "FRO_BOT_S3_BUCKET",
@@ -8778,8 +8782,7 @@ function checkStorageAction(jobId, job, manifest, violations) {
     violations.push(`Storage job '${jobId}' must contain a fro-bot/agent action step.`);
     return;
   }
-  const verifiedSha = VERIFIED_ACTION_SHA_BY_LAYOUT[manifest.key_layout_version];
-  if (!verifiedSha) {
+  if (!isKnownKeyLayoutVersion(manifest.key_layout_version)) {
     violations.push(`Unknown key_layout_version '${manifest.key_layout_version}'; refusing to verify fro-bot/agent.`);
   }
   const firstAgentIndex = steps.findIndex((step) => typeof step.uses === "string" && step.uses.startsWith("fro-bot/agent@"));
@@ -8807,8 +8810,8 @@ function checkStorageAction(jobId, job, manifest, violations) {
   for (const [index, step] of agentSteps.entries()) {
     const uses = String(step.uses);
     const ref = uses.split("@").at(-1) ?? "";
-    if (verifiedSha && ref !== verifiedSha) {
-      violations.push(`Storage job '${jobId}' action ref '${ref}' is not the verified layout for '${manifest.key_layout_version}'; ` + `storage job must pin fro-bot/agent to the verified SHA for '${manifest.key_layout_version}', not a moveable tag.`);
+    if (!/^[0-9a-f]{40}$/i.test(ref)) {
+      violations.push(`Storage job '${jobId}' fro-bot/agent step ${index + 1} ref '${ref}' is not a full commit SHA; ` + "storage job must pin fro-bot/agent to a full 40-hex commit SHA, not a moveable tag or branch.");
     }
     if (!isMapping(step.with)) {
       violations.push(`Storage job '${jobId}' agent step ${index + 1} is missing its S3 inputs.`);
@@ -9138,7 +9141,6 @@ var STORAGE_VARIABLE_NAMES = {
   prefix: "FRO_BOT_S3_PREFIX",
   expectedBucketOwner: "FRO_BOT_S3_EXPECTED_BUCKET_OWNER"
 };
-var KNOWN_KEY_LAYOUT_VERSION = "fro-bot/agent@v0.119.2";
 var manifestSchema = z6.object({
   owner: z6.string().min(1),
   repo: z6.string().min(1),
@@ -9190,8 +9192,8 @@ function assertCanonicalPath(field, value, mustEndWithSlash) {
   }
 }
 function validateManifest(manifest) {
-  if (manifest.key_layout_version !== KNOWN_KEY_LAYOUT_VERSION) {
-    throw new Error(`Unknown handoff manifest key_layout_version '${manifest.key_layout_version}'; expected ${KNOWN_KEY_LAYOUT_VERSION}.`);
+  if (!isKnownKeyLayoutVersion(manifest.key_layout_version)) {
+    throw new Error(`Unknown handoff manifest key_layout_version '${manifest.key_layout_version}'; expected ${KEY_LAYOUT_VERSION}.`);
   }
   assertRepoFormat(`${manifest.owner}/${manifest.repo}`);
   assertCanonicalPath("s3_prefix", manifest.s3_prefix, false);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.25.1",
+  "version": "0.25.2",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",