@milpa/comal 0.1.0 → 0.1.2

package/src/workflows/chrome-task.mjs

@@ -53,9 +53,18 @@ export async function prepareChromeTask({ cwd, house, store, sessionId, executor
   if (await realpath(directory) !== directory || path.relative(cwd, directory).split(path.sep).includes('..')) throw failure('Task directory must be a real directory inside the workspace.');
   const catalogue = ['Deploy','Deployment','Open','Targets','Assert','Contexts', ...(brief.tests ? ['Interact'] : [])].map(name => prefix+name);
   if (catalogue.some(name => !house.registry.get(name))) throw failure('chrome-lab no está activo. Usa npm run lab:chrome -- --chrome-task ARCHIVO.json.');
-  const corpus = JSON.parse(await readFile(new URL('../../governance/chrome-task-v1.json', import.meta.url), 'utf8'));
-  const plan = compileGovernance(corpus, ['runtime:chrome-task.scope','runtime:chrome-task.close']);
-  if (saved && saved.governance_plan_hash !== plan.plan_hash) throw failure('La política de esta tarea cambió; no se reactiva silenciosamente.');
+  const mechanisms = ['runtime:chrome-task.scope','runtime:chrome-task.close','runtime:chrome-task.artifact-hash'];
+  const compile = async version => compileGovernance(JSON.parse(await readFile(new URL(`../../governance/chrome-task-v${version}.json`, import.meta.url), 'utf8')), mechanisms);
+  const currentPlan = await compile(2), legacyPlan = saved ? await compile(1) : null;
+  const legacy = Boolean(saved && saved.governance_plan_hash === legacyPlan.plan_hash);
+  const plan = legacy ? legacyPlan : currentPlan;
+  if (saved && saved.governance_plan_hash !== plan.plan_hash) throw failure('The accepted workflow policy changed; it cannot be reactivated silently.');
+  // A new acceptance explicitly adopts v2. Historical v1 approvals retain native
+  // text Read and never gain FileInfo access just by resuming on a newer client.
+  const artifactOperation = legacy ? 'Read' : 'FileInfo';
+  const hashOperation = house.registry.get('FileInfo');
+  const nativeHash = hashOperation?.contract;
+  if (!legacy && (!nativeHash || nativeHash.origin !== null || nativeHash.permission !== 'FileInfo' || nativeHash.steps || nativeHash.effects?.workspace !== 'read' || ['external','process','authority'].some(key => nativeHash.effects[key] !== 'none'))) throw failure('Native FileInfo artifact hashing is unavailable.');
   const work = workProjection(loaded);
   if (!saved && work) throw failure('La sesión ya tiene trabajo. Inicia una sesión nueva para adoptar el flujo Chrome.');
   const declaredTask = { id: 'chrome-task', title: 'Implement and verify accepted extension',
@@ -186,9 +195,9 @@ export async function prepareChromeTask({ cwd, house, store, sessionId, executor
       return { status: 'done', scope: 'declared_work_checks', asked: 'unjudged' };
     }, 'read')
   ]);
-  registerWorkOperations({ store, house });
+  registerWorkOperations({ store, house, artifactObservation: { sessionId, operation: artifactOperation } });
   if (!saved) {
-    await store.append(sessionId, { type: 'chrome_task_accepted', source: 'workflow_host', acceptance: source, task: brief, task_digest: taskDigest, governance_plan_hash: plan.plan_hash });
+    await store.append(sessionId, { type: 'chrome_task_accepted', source: 'workflow_host', acceptance: source, task: brief, task_digest: taskDigest, governance_plan_hash: plan.plan_hash, governance_profile: plan.profile, artifact_observation: { operation: artifactOperation, hash: true, paths: declaredTask.artifacts } });
     await store.append(sessionId, { type: 'intent', text: `Accepted Chrome task: ${brief.project}, directory ${brief.directory}, popup ${brief.popup}, ${brief.selector} equals ${JSON.stringify(brief.equals)}. Publish, correct and verify only this own extension; no extra permissions.` });
   }
   const scope = async view => {
@@ -199,6 +208,7 @@ export async function prepareChromeTask({ cwd, house, store, sessionId, executor
       const relative = path.relative(directory, path.resolve(cwd, view.input.file_path));
       return { allowed: Boolean(relative) && !path.isAbsolute(relative) && !relative.split(path.sep).some(part => part === '..' || ['.git','.comal','.harness','.ssh','node_modules'].includes(part) || /^\.env(?:\.|$)/i.test(part)), reason: 'Only files of the accepted extension.' };
     }
+    if (!legacy && view.operation === 'FileInfo') return { allowed: true, reason: 'Subject to the separately enforced artifact-hash capability.' };
     if (OWN.includes(view.operation)) return true;
     if (INTERNAL.has(view.operation)) return { allowed: ['ChromeFinish','WorkTaskUpdate'].includes(view.parent_operation), reason: 'Work administration belongs to the coordinator.' };
     if (view.operation.startsWith(prefix)) {
@@ -213,6 +223,12 @@ export async function prepareChromeTask({ cwd, house, store, sessionId, executor
     }
     return { allowed: false, reason: 'Operation outside this accepted workflow surface.' };
   };
+  const artifactHash = view => ({
+    allowed: !policy.denied.has(view.operation) && view.contract_digest === hashOperation?.digest &&
+      ['WorkStepRun','WorkTaskUpdate'].includes(view.parent_operation) &&
+      digest(view.input) === digest({ file_path: declaredTask.artifacts[0], hash: true }),
+    reason: 'Only native full-file hashing of the exact accepted artifact by the host work coordinator.'
+  });
   const close = async view => {
     if (view.input.status !== 'done') return true;
     const value = await state();
@@ -224,8 +240,9 @@ export async function prepareChromeTask({ cwd, house, store, sessionId, executor
   const initial = workProjection(await store.load(sessionId));
   if (initial.current?.status === 'pending') await executor.execute('WorkTaskUpdate', { task_id: 'chrome-task', plan_version: initial.plan.version, status: 'in_progress' });
   await house.activateGovernance({ sessionId, plan, bindings: {
-    'runtime:chrome-task.scope': { revision: 'chrome-scope-v3', operations: ['*'], configuration_digest: taskDigest, check: scope },
-    'runtime:chrome-task.close': { revision: 'chrome-close-v1', operations: ['WorkTaskUpdate'], configuration_digest: taskDigest, check: close }
+    'runtime:chrome-task.scope': { revision: legacy ? 'chrome-scope-v3' : 'chrome-scope-v4', operations: ['*'], configuration_digest: taskDigest, check: scope },
+    'runtime:chrome-task.close': { revision: 'chrome-close-v1', operations: ['WorkTaskUpdate'], configuration_digest: taskDigest, check: close },
+    ...(!legacy ? { 'runtime:chrome-task.artifact-hash': { revision: 'chrome-artifact-hash-v1', operations: ['FileInfo'], configuration_digest: digest({ taskDigest, artifacts: declaredTask.artifacts, contract_digest: hashOperation.digest }), check: artifactHash } } : {})
   } });
   const project = snapshot => {
     const definitions = snapshot.definitions().filter(tool => PUBLIC.has(tool.name));