@muggleai/works 5.12.0-staging.73 → 5.12.0-staging.75

package/dist/{chunk-FCDHJD6I.js → chunk-DJ6W5PZA.js}

@@ -69,12 +69,14 @@ __export(src_exports, {
   getElectronAppChecksums: () => getElectronAppChecksums,
   getElectronAppDir: () => getElectronAppDir,
   getElectronAppReleaseTagPrefix: () => getElectronAppReleaseTagPrefix,
+  getElectronAppSignedFromVersion: () => getElectronAppSignedFromVersion,
   getElectronAppVersion: () => getElectronAppVersion,
   getElectronAppVersionSource: () => getElectronAppVersionSource,
   getLocalQaTools: () => getLocalQaTools,
   getLogger: () => getLogger,
   getPlatformKey: () => getPlatformKey,
   getQaTools: () => getQaTools,
+  getReleaseSignerIdentityUri: () => getReleaseSignerIdentityUri,
   getValidApiKeyData: () => getValidApiKeyData,
   getValidCredentials: () => getValidCredentials,
   hasApiKey: () => hasApiKey,
@@ -271,6 +273,7 @@ function readReleaseManifest() {
 // packages/mcps/src/shared/config.ts
 var ELECTRON_APP_DIR = "electron-app";
 var API_KEY_FILE = "api-key.json";
+var OAUTH_SESSION_FILE = "oauth-session.json";
 var configInstance = null;
 var muggleConfigCache = null;
 function getPackageRoot2() {
@@ -359,6 +362,12 @@ function buildElectronAppDirName(params) {
   }
   return `${params.version}-${params.releaseStream}`;
 }
+function buildOAuthSessionFileName(params) {
+  if (params.runtimeTarget === "production" /* Production */) {
+    return OAUTH_SESSION_FILE;
+  }
+  return `oauth-session-${params.runtimeTarget}.json`;
+}
 function getDownloadedElectronAppPath() {
   const platformName = os4.platform();
   const version = getElectronAppVersion();
@@ -479,7 +488,10 @@ function buildLocalQaConfig() {
     projectsDir: path11.join(dataDir, "projects"),
     tempDir: path11.join(dataDir, "temp"),
     apiKeyFilePath: path11.join(dataDir, API_KEY_FILE),
-    oauthSessionFilePath: path11.join(dataDir, "oauth-session.json"),
+    oauthSessionFilePath: path11.join(
+      dataDir,
+      buildOAuthSessionFileName({ runtimeTarget: getActiveRuntimeTarget() })
+    ),
     webServicePath: resolveWebServicePath(),
     webServicePidFile: path11.join(dataDir, "web-service.pid"),
     auth0: {
@@ -569,6 +581,12 @@ function buildElectronAppChecksumsUrl(version) {
 function getElectronAppChecksums() {
   return getMuggleConfig().checksumsByStream?.[getActiveElectronAppReleaseStream()];
 }
+function getElectronAppSignedFromVersion() {
+  return getMuggleConfig().electronAppSignedFromVersion ?? "";
+}
+function getReleaseSignerIdentityUri() {
+  return getMuggleConfig().signerIdentityUri ?? "";
+}
 function isElectronAppInstalled() {
   return getDownloadedElectronAppPath() !== null;
 }
@@ -933,6 +951,14 @@ var TestResultStatus = /* @__PURE__ */ ((TestResultStatus2) => {
   return TestResultStatus2;
 })(TestResultStatus || {});
 
+// packages/mcps/src/mcp/local/services/stored-auth-target.ts
+function isStoredAuthForRuntimeTarget(params) {
+  if (!params.storedRuntimeTarget) {
+    return params.activeRuntimeTarget === "production" /* Production */;
+  }
+  return params.storedRuntimeTarget === params.activeRuntimeTarget;
+}
+
 // packages/mcps/src/mcp/local/services/auth-service.ts
 var DEFAULT_LOGIN_WAIT_TIMEOUT_MS = 12e4;
 var AuthService = class {
@@ -1267,7 +1293,8 @@ var AuthService = class {
       refreshToken: tokenResponse.refreshToken,
       expiresAt,
       email,
-      userId
+      userId,
+      runtimeTarget: getActiveRuntimeTarget()
     };
     const dir = path11.dirname(this.oauthSessionFilePath);
     if (!fs6.existsSync(dir)) {
@@ -1280,7 +1307,8 @@ var AuthService = class {
     logger6.info("Auth stored successfully", { email, expiresAt });
   }
   /**
-   * Load stored authentication.
+   * Load stored authentication for the active runtime target.
+   * @returns Stored auth, or null when it is absent, unreadable, or was issued for another target.
    */
   loadStoredAuth() {
     const logger6 = getLogger();
@@ -1289,7 +1317,19 @@ var AuthService = class {
     }
     try {
       const content = fs6.readFileSync(this.oauthSessionFilePath, "utf-8");
-      return JSON.parse(content);
+      const storedAuth = JSON.parse(content);
+      const activeRuntimeTarget = getActiveRuntimeTarget();
+      if (!isStoredAuthForRuntimeTarget({
+        storedRuntimeTarget: storedAuth.runtimeTarget,
+        activeRuntimeTarget
+      })) {
+        logger6.warn("Ignoring stored auth issued for a different runtime target", {
+          storedRuntimeTarget: storedAuth.runtimeTarget ?? "unrecorded",
+          activeRuntimeTarget
+        });
+        return null;
+      }
+      return storedAuth;
     } catch (error) {
       logger6.error("Failed to load stored auth", {
         error: error instanceof Error ? error.message : String(error)
@@ -1370,7 +1410,8 @@ var AuthService = class {
         refreshToken: tokenData.refresh_token ?? storedAuth.refreshToken,
         expiresAt: newExpiresAt,
         email: storedAuth.email,
-        userId: storedAuth.userId
+        userId: storedAuth.userId,
+        runtimeTarget: storedAuth.runtimeTarget ?? getActiveRuntimeTarget()
       };
       const dir = path11.dirname(this.oauthSessionFilePath);
       if (!fs6.existsSync(dir)) {
@@ -7727,4 +7768,4 @@ var WATCHER_LIFETIME_SECONDS = {
   ["never" /* Never */]: WATCHER_LIFETIME_UNBOUNDED_SECONDS
 };
 
-export { DEFAULT_PREFERENCES, ElectronAppReleaseStream, EventName, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RuntimeTarget, ServiceName, Surface, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, __export, __require, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports2 as e2e_exports, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir2 as getDataDir, getDisclosureCopy, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getValidApiKeyData, getValidCredentials, hasApiKey, hasShownDisclosure, initTelemetry, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports2 as local_exports, markDisclosureShown, mcp_exports, openBrowserUrl, performLogin, performLogout, pollDeviceCode, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveElectronAppPathOrNull, resolvePreferences, resolveRuntimeTarget, saveApiKey, saveApiKeyData, saveCredentials, src_exports, startDeviceCodeFlow, toolRequiresAuth, track, validatePreference, verifyFileChecksum, writePreferences2 as writePreferences };
+export { DEFAULT_PREFERENCES, ElectronAppReleaseStream, EventName, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RuntimeTarget, ServiceName, Surface, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, __export, __require, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports2 as e2e_exports, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir2 as getDataDir, getDisclosureCopy, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppSignedFromVersion, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getReleaseSignerIdentityUri, getValidApiKeyData, getValidCredentials, hasApiKey, hasShownDisclosure, initTelemetry, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports2 as local_exports, markDisclosureShown, mcp_exports, openBrowserUrl, performLogin, performLogout, pollDeviceCode, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveElectronAppPathOrNull, resolvePreferences, resolveRuntimeTarget, saveApiKey, saveApiKeyData, saveCredentials, src_exports, startDeviceCodeFlow, toolRequiresAuth, track, validatePreference, verifyFileChecksum, writePreferences2 as writePreferences };

package/dist/{chunk-O7LFABOC.js → chunk-VTSS6TGQ.js}

@@ -1,4 +1,4 @@
-import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assertDeviceCodeClientProvisioned, performLogin, toolRequiresAuth, getCallerCredentials, hasShownDisclosure, getDisclosureCopy, markDisclosureShown, getBundledElectronAppVersion, getElectronAppVersionSource, getCredentialsFilePath, buildElectronAppChecksumsUrl, __require } from './chunk-FCDHJD6I.js';
+import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assertDeviceCodeClientProvisioned, performLogin, toolRequiresAuth, getCallerCredentials, hasShownDisclosure, getDisclosureCopy, markDisclosureShown, getBundledElectronAppVersion, getElectronAppVersionSource, getCredentialsFilePath, buildElectronAppChecksumsUrl, __require } from './chunk-DJ6W5PZA.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { v4 } from 'uuid';
@@ -14,6 +14,8 @@ import axios from 'axios';
 import { platform, homedir, arch } from 'os';
 import { execFile } from 'child_process';
 import { pipeline } from 'stream/promises';
+import { readFile } from 'fs/promises';
+import { verify } from 'sigstore';
 
 var registeredTools = [];
 function registerTools(tools) {
@@ -751,7 +753,7 @@ async function resolveGsScreenshotUrls(report, opts) {
     if (gsUrls.length === 0) {
       return report;
     }
-    const mcps = await import('./src-TFNPZD5X.js');
+    const mcps = await import('./src-FRYBTZ6J.js');
     const credentials = await mcps.getCallerCredentialsAsync();
     if (!credentials.bearerToken && !credentials.apiKey) {
       stderrWrite(
@@ -1731,6 +1733,79 @@ async function serveCommand(options) {
     process.exit(1);
   }
 }
+
+// scripts/release-integrity/constants.mjs
+var SIGNATURE_BUNDLE_SUFFIX = ".sigstore.json";
+var SIGNER_CERTIFICATE_ISSUER = "https://token.actions.githubusercontent.com";
+var SIGNATURE_FETCH_TIMEOUT_MS = 3e4;
+
+// scripts/release-integrity/compareVersions.mjs
+function compareVersions2(a, b) {
+  const partsA = a.split(".").map(Number);
+  const partsB = b.split(".").map(Number);
+  for (let index = 0; index < 3; index++) {
+    const partA = partsA[index] || 0;
+    const partB = partsB[index] || 0;
+    if (partA > partB) {
+      return 1;
+    }
+    if (partA < partB) {
+      return -1;
+    }
+  }
+  return 0;
+}
+
+// scripts/release-integrity/resolveIntegrityPolicy.mjs
+function resolveIntegrityPolicy({ version, signedFromVersion, expectedChecksum }) {
+  const requiresSignature = Boolean(signedFromVersion) && compareVersions2(version, signedFromVersion) >= 0;
+  const hasChecksum = Boolean(expectedChecksum && expectedChecksum.trim());
+  if (!requiresSignature && !hasChecksum) {
+    return {
+      requiresSignature: false,
+      requiresChecksum: false,
+      unverifiableReason: `no integrity evidence is available for v${version}: it predates release signing (first signed version: ${signedFromVersion || "none configured"}) and no checksum is configured for this release stream`
+    };
+  }
+  return {
+    requiresSignature,
+    requiresChecksum: !requiresSignature,
+    unverifiableReason: ""
+  };
+}
+async function verifyReleaseSignature({ artifactPath, bundleUrl, signerIdentityUri }) {
+  if (!signerIdentityUri) {
+    return { valid: false, reason: "no signer identity is configured to verify against" };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), SIGNATURE_FETCH_TIMEOUT_MS);
+  let bundle;
+  try {
+    const response = await fetch(bundleUrl, { signal: controller.signal });
+    if (!response.ok) {
+      return {
+        valid: false,
+        reason: `signature bundle unavailable (HTTP ${response.status}) at ${bundleUrl}`
+      };
+    }
+    bundle = await response.json();
+  } catch (error) {
+    return { valid: false, reason: `could not fetch signature bundle: ${error.message}` };
+  } finally {
+    clearTimeout(timer);
+  }
+  try {
+    await verify(bundle, await readFile(artifactPath), {
+      certificateIssuer: SIGNER_CERTIFICATE_ISSUER,
+      certificateIdentityURI: signerIdentityUri
+    });
+    return { valid: true, reason: "" };
+  } catch (error) {
+    return { valid: false, reason: error.message };
+  }
+}
+
+// src/cli/setup.ts
 var logger6 = getLogger();
 var MAX_RETRY_ATTEMPTS = 3;
 var RETRY_BASE_DELAY_MS = 2e3;
@@ -1922,9 +1997,30 @@ async function setupCommand(options) {
     mkdirSync(versionDir, { recursive: true });
     const tempFile = path.join(versionDir, binaryName);
     await downloadWithRetry(downloadUrl, tempFile);
-    console.log("Download complete, verifying checksum...");
+    console.log("Download complete, verifying integrity...");
     const checksums = getElectronAppChecksums();
     const expectedChecksum = getChecksumForPlatform(checksums);
+    const integrityPolicy = resolveIntegrityPolicy({
+      version,
+      signedFromVersion: getElectronAppSignedFromVersion(),
+      expectedChecksum: expectedChecksum ?? ""
+    });
+    if (integrityPolicy.unverifiableReason) {
+      cleanupFailedInstall(versionDir);
+      throw new Error("Refusing to install an unverifiable download: " + integrityPolicy.unverifiableReason);
+    }
+    if (integrityPolicy.requiresSignature) {
+      const signatureResult = await verifyReleaseSignature({
+        artifactPath: tempFile,
+        bundleUrl: downloadUrl + SIGNATURE_BUNDLE_SUFFIX,
+        signerIdentityUri: getReleaseSignerIdentityUri()
+      });
+      if (!signatureResult.valid) {
+        cleanupFailedInstall(versionDir);
+        throw new Error("Signature verification failed, refusing to install: " + signatureResult.reason);
+      }
+      console.log("Signature verified successfully.");
+    }
     const checksumResult = await verifyFileChecksum(tempFile, expectedChecksum);
     if (!checksumResult.valid && expectedChecksum) {
       cleanupFailedInstall(versionDir);
@@ -1937,8 +2033,6 @@ The downloaded file may be corrupted or tampered with.`
     }
     if (expectedChecksum) {
       console.log("Checksum verified successfully.");
-    } else {
-      console.log("Warning: No checksum configured, skipping verification.");
     }
     console.log("Extracting...");
     if (binaryName.endsWith(".zip")) {
@@ -2067,21 +2161,6 @@ async function checkForUpdates() {
     throw new Error(`Failed to check for updates: ${errorMessage}`, { cause: error });
   }
 }
-function compareVersions2(a, b) {
-  const partsA = a.split(".").map(Number);
-  const partsB = b.split(".").map(Number);
-  for (let i = 0; i < 3; i++) {
-    const partA = partsA[i] || 0;
-    const partB = partsB[i] || 0;
-    if (partA > partB) {
-      return 1;
-    }
-    if (partA < partB) {
-      return -1;
-    }
-  }
-  return 0;
-}
 function getExpectedExecutablePath3(versionDir) {
   const os = platform();
   switch (os) {
@@ -2208,11 +2287,32 @@ async function downloadAndInstall(version, downloadUrl, checksum) {
     throw new Error("No response body");
   }
   await pipeline(response.body, fileStream);
-  console.log("Download complete, verifying checksum...");
+  console.log("Download complete, verifying integrity...");
   let expectedChecksum = checksum;
   if (!expectedChecksum) {
     expectedChecksum = await fetchChecksumFromRelease(version);
   }
+  const integrityPolicy = resolveIntegrityPolicy({
+    version,
+    signedFromVersion: getElectronAppSignedFromVersion(),
+    expectedChecksum: expectedChecksum ?? ""
+  });
+  if (integrityPolicy.unverifiableReason) {
+    rmSync(versionDir, { recursive: true, force: true });
+    throw new Error("Refusing to install an unverifiable download: " + integrityPolicy.unverifiableReason);
+  }
+  if (integrityPolicy.requiresSignature) {
+    const signatureResult = await verifyReleaseSignature({
+      artifactPath: tempFile,
+      bundleUrl: downloadUrl + SIGNATURE_BUNDLE_SUFFIX,
+      signerIdentityUri: getReleaseSignerIdentityUri()
+    });
+    if (!signatureResult.valid) {
+      rmSync(versionDir, { recursive: true, force: true });
+      throw new Error("Signature verification failed, refusing to install: " + signatureResult.reason);
+    }
+    console.log("Signature verified successfully.");
+  }
   const checksumResult = await verifyFileChecksum(tempFile, expectedChecksum || "");
   if (!checksumResult.valid && expectedChecksum) {
     rmSync(versionDir, { recursive: true, force: true });
@@ -2225,8 +2325,6 @@ The downloaded file may be corrupted or tampered with.`
   }
   if (expectedChecksum) {
     console.log("Checksum verified successfully.");
-  } else {
-    console.log("Warning: No checksum available, skipping verification.");
   }
   console.log("Extracting...");
   if (binaryName.endsWith(".zip")) {

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runCli } from './chunk-O7LFABOC.js';
-import './chunk-FCDHJD6I.js';
+import { runCli } from './chunk-VTSS6TGQ.js';
+import './chunk-DJ6W5PZA.js';
 
 // src/cli/main.ts
 runCli().catch((error) => {

package/dist/index.js

@@ -1,2 +1,2 @@
-export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-O7LFABOC.js';
-export { createChildLogger, e2e_exports as e2e, getConfig, getLocalQaTools, getLogger, getQaTools, local_exports as localQa, mcp_exports as mcp, e2e_exports as qa, src_exports as shared } from './chunk-FCDHJD6I.js';
+export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-VTSS6TGQ.js';
+export { createChildLogger, e2e_exports as e2e, getConfig, getLocalQaTools, getLogger, getQaTools, local_exports as localQa, mcp_exports as mcp, e2e_exports as qa, src_exports as shared } from './chunk-DJ6W5PZA.js';

package/dist/plugin/hooks/README.md

@@ -24,6 +24,8 @@ Enforcement is reserved for the handoffs that were being skipped: the E2E accept
 
 ## Mechanism
 
+A recorder that *clears* an obligation — a walkthrough posted, a failure diagnosed, a test case classified — records only when the call did not visibly fail (`callOutcome.ts`). Recording from the request alone let a rejected `gh pr comment` mark the walkthrough posted, so the gate went quiet on a PR that never received it.
+
 Each guardrail is a thin bash wrapper in `../scripts/` registered in `hooks.json`. The wrapper pipes the event payload (stdin JSON) to the bundled `../scripts/guardrails.mjs <subcommand>`, which holds the decision logic (built from `src/guardrails/`, vitest-covered). Per-session state in `~/.muggle-ai/guardrails/<session_id>.json` tracks what fired. Any *failure* degrades to `{}` (allow) — a gate blocks only by an explicit, tested decision, never by accident.
 
 Each wrapper short-circuits in shell first, so the common case never pays Node cold-start. A gate that has spent its block budget stamps a `<gate>Released` flag, which its wrapper then pre-filters on — without it a released gate keeps cold-starting Node on every remaining turn end to answer `{}`, and the walkthrough gate keeps making provider calls to do it. That pre-filter is a second, looser copy of what `guardrails.mjs` matches, and it is the one place a guardrail can fail *silently*: a payload it drops — a skip marker, a reopen line, a comment edit — reaches no recorder, and the gate keeps demanding an action the user already took. Over-matching is free; under-matching is a dead escape hatch. `src/test/guardrails/hook-prefilter.test.ts` pins every payload each subcommand acts on against the wrapper guarding it, and derives the skip-marker tokens from source so a new marker is covered the moment it exists.

package/dist/plugin/scripts/guardrails.mjs

@@ -40,6 +40,14 @@ var MAX_REPLY_BLOCKS = 3;
 var CAPABILITY_CLAIM_TRANSCRIPT_TAIL_BYTES = 64e3;
 var SESSION_STATE_LOCK_WAIT_MS = 250;
 var LOCK_POLL_INTERVAL_MS = 10;
+var CALL_FAILURE_SIGNALS = [
+  /\bgh:\s/,
+  /\bglab:\s/,
+  /\bHTTP\s(?:4|5)\d\d\b/,
+  /"status"\s*:\s*"?(?:4|5)\d\d/,
+  /"isError"\s*:\s*true/
+];
+var FORGE_TERMINAL_CMD = /\b(?:gh\s+pr\s+(?:merge|close|reopen)|glab\s+mr\s+(?:merge|close|reopen))\b/;
 
 // src/guardrails/store/fileLock.ts
 function isProcessAlive(pid) {
@@ -159,15 +167,21 @@ ${input2.tool_response?.output ?? ""}`;
 }
 
 // src/guardrails/prTerminal.ts
+function terminalProvenance(input2) {
+  const command = input2.tool_input?.command;
+  if (command === void 0) return { acceptsForgeLine: true };
+  return { acceptsForgeLine: FORGE_TERMINAL_CMD.test(command) };
+}
 function detectPrTerminal(input2) {
   if (input2.tool_name !== "Bash" && input2.tool_name !== "Monitor") return null;
   const response = input2.tool_response;
+  const provenance = terminalProvenance(input2);
   const haystack = [response?.stdout, response?.stderr, response?.output, response?.content].filter((part) => typeof part === "string").join("\n");
-  const mergedMatch = haystack.match(GH_PR_MERGED_LINE);
+  const mergedMatch = provenance.acceptsForgeLine ? haystack.match(GH_PR_MERGED_LINE) : null;
   if (mergedMatch) {
     return { prNumber: Number(mergedMatch[1]), verdict: "merged" /* Merged */ };
   }
-  const closedMatch = haystack.match(GH_PR_CLOSED_LINE);
+  const closedMatch = provenance.acceptsForgeLine ? haystack.match(GH_PR_CLOSED_LINE) : null;
   if (closedMatch) {
     return { prNumber: Number(closedMatch[1]), verdict: "closed" /* Closed */ };
   }
@@ -182,6 +196,7 @@ function detectPrTerminal(input2) {
 }
 function detectPrReopened(input2) {
   if (input2.tool_name !== "Bash") return null;
+  if (!terminalProvenance(input2).acceptsForgeLine) return null;
   const response = input2.tool_response;
   const haystack = [response?.stdout, response?.stderr, response?.output, response?.content].filter((part) => typeof part === "string").join("\n");
   const reopenedMatch = haystack.match(GH_PR_REOPENED_LINE);
@@ -362,11 +377,28 @@ function stageGateDecision(state, unreadStagePaths, maxBlocks = MAX_STAGE_BLOCKS
   return { action: "block" /* Block */, blockCount: blockCount + 1, unread: unreadStagePaths };
 }
 
+// src/guardrails/callOutcome.ts
+function renderedResponse(toolResponse) {
+  const rendered = [];
+  const collect = (value) => {
+    if (typeof value === "string") rendered.push(value);
+    else if (Array.isArray(value)) value.forEach(collect);
+    else if (value && typeof value === "object") Object.values(value).forEach(collect);
+  };
+  collect(toolResponse);
+  return rendered.join("\n");
+}
+function callFailed(input2) {
+  const rendered = renderedResponse(input2.tool_response);
+  return CALL_FAILURE_SIGNALS.some((signal) => signal.test(rendered));
+}
+
 // src/guardrails/preExecutionClassification.ts
 var CLASSIFICATION_SKIP_MARKER = /^\s*echo\s+["']?MUGGLE_CLASSIFY_SKIP\b/;
 function detectClassifiedTestCaseId(input2) {
   if (!MUGGLE_EVENT_EMIT_TOOL.test(input2.tool_name ?? "")) return void 0;
   if (input2.tool_input?.eventType !== PRE_EXECUTION_CLASSIFICATION_EVENT) return void 0;
+  if (callFailed(input2)) return void 0;
   return input2.tool_input?.testCaseId ?? ANY_TEST_CASE;
 }
 function applyClassifiedTestCase(state, testCaseId) {
@@ -423,6 +455,7 @@ function detectDebugEvidenceRunIds(input2, owedRunIds) {
   const toolName = input2.tool_name ?? "";
   const isDiagnosisEmit = MUGGLE_EVENT_EMIT_TOOL.test(toolName) && FAILURE_DIAGNOSIS_EVENT.test(input2.tool_input?.eventType ?? "");
   if (!isDiagnosisEmit && !MUGGLE_FEEDBACK_CREATE_TOOL.test(toolName)) return [];
+  if (callFailed(input2)) return [];
   const payload = serialize(input2);
   return owedRunIds.filter((runId) => payload.includes(runId));
 }
@@ -598,6 +631,7 @@ function detectWalkthroughPost(input2, read = defaultFileReader) {
   if (input2.tool_name !== "Bash") return false;
   const cmd = input2.tool_input?.command ?? "";
   if (!isPrReportPostCommand(cmd)) return false;
+  if (callFailed(input2)) return false;
   return collectPrPostText(cmd, input2.cwd, read).includes(REPORT_SENTINEL);
 }
 function applyWalkthroughPosted(state, posted) {

package/dist/release-manifest.json

@@ -1,7 +1,7 @@
 {
   "release": "5.11.0",
-  "buildId": "run-73-1",
-  "commitSha": "a43a1c2c9880b35b0442c511e65ffa8613ac3eb6",
-  "buildTime": "2026-08-26T17:58:32Z",
+  "buildId": "run-75-1",
+  "commitSha": "d2d28543763361dcae7b5bef1c31ca4ae75df64c",
+  "buildTime": "2026-08-26T20:14:09Z",
   "serviceName": "muggle-ai-works-mcp"
 }

package/dist/{src-TFNPZD5X.js → src-FRYBTZ6J.js}

@@ -1 +1 @@
-export { DEFAULT_PREFERENCES, ElectronAppReleaseStream, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RuntimeTarget, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports as e2e, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getValidApiKeyData, getValidCredentials, hasApiKey, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports as localQa, mcp_exports as mcp, openBrowserUrl, performLogin, performLogout, pollDeviceCode, e2e_exports as qa, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveElectronAppPathOrNull, resolvePreferences, resolveRuntimeTarget, saveApiKey, saveApiKeyData, saveCredentials, startDeviceCodeFlow, toolRequiresAuth, validatePreference, verifyFileChecksum, writePreferences } from './chunk-FCDHJD6I.js';
+export { DEFAULT_PREFERENCES, ElectronAppReleaseStream, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RuntimeTarget, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports as e2e, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppSignedFromVersion, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getReleaseSignerIdentityUri, getValidApiKeyData, getValidCredentials, hasApiKey, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports as localQa, mcp_exports as mcp, openBrowserUrl, performLogin, performLogout, pollDeviceCode, e2e_exports as qa, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveElectronAppPathOrNull, resolvePreferences, resolveRuntimeTarget, saveApiKey, saveApiKeyData, saveCredentials, startDeviceCodeFlow, toolRequiresAuth, validatePreference, verifyFileChecksum, writePreferences } from './chunk-DJ6W5PZA.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@muggleai/works",
   "mcpName": "io.github.multiplex-ai/muggle",
-  "version": "5.12.0-staging.73",
+  "version": "5.12.0-staging.75",
   "description": "Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.",
   "type": "module",
   "main": "dist/index.js",
@@ -13,6 +13,7 @@
     "plugin",
     "bin/muggle.js",
     "scripts/postinstall.mjs",
+    "scripts/release-integrity",
     "config/runtime-targets.json"
   ],
   "scripts": {
@@ -65,7 +66,9 @@
         "linux-x64": "929396f628a05f001782d48524cd9f76fdbb59216658982a5a3909dfe413cbea",
         "win32-x64": "a8b5b46b97ed788030be84982a3e8d463abbfa7f3e8bc795692ccbffc82bfa92"
       }
-    }
+    },
+    "electronAppSignedFromVersion": "1.10.0",
+    "signerIdentityUri": "https://github.com/multiplex-ai/muggle-ai-teaching-service/.github/workflows/release-electron-app-reusable.yml@refs/heads/master"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.25.3",
@@ -73,6 +76,7 @@
     "axios": "^1.7.9",
     "commander": "^14.0.3",
     "open": "^11.0.0",
+    "sigstore": "^5.0.0",
     "ulid": "^3.0.2",
     "uuid": "^14.0.0",
     "winston": "^3.17.0",

package/plugin/hooks/README.md

@@ -24,6 +24,8 @@ Enforcement is reserved for the handoffs that were being skipped: the E2E accept
 
 ## Mechanism
 
+A recorder that *clears* an obligation — a walkthrough posted, a failure diagnosed, a test case classified — records only when the call did not visibly fail (`callOutcome.ts`). Recording from the request alone let a rejected `gh pr comment` mark the walkthrough posted, so the gate went quiet on a PR that never received it.
+
 Each guardrail is a thin bash wrapper in `../scripts/` registered in `hooks.json`. The wrapper pipes the event payload (stdin JSON) to the bundled `../scripts/guardrails.mjs <subcommand>`, which holds the decision logic (built from `src/guardrails/`, vitest-covered). Per-session state in `~/.muggle-ai/guardrails/<session_id>.json` tracks what fired. Any *failure* degrades to `{}` (allow) — a gate blocks only by an explicit, tested decision, never by accident.
 
 Each wrapper short-circuits in shell first, so the common case never pays Node cold-start. A gate that has spent its block budget stamps a `<gate>Released` flag, which its wrapper then pre-filters on — without it a released gate keeps cold-starting Node on every remaining turn end to answer `{}`, and the walkthrough gate keeps making provider calls to do it. That pre-filter is a second, looser copy of what `guardrails.mjs` matches, and it is the one place a guardrail can fail *silently*: a payload it drops — a skip marker, a reopen line, a comment edit — reaches no recorder, and the gate keeps demanding an action the user already took. Over-matching is free; under-matching is a dead escape hatch. `src/test/guardrails/hook-prefilter.test.ts` pins every payload each subcommand acts on against the wrapper guarding it, and derives the skip-marker tokens from source so a new marker is covered the moment it exists.

package/plugin/scripts/guardrails.mjs

@@ -40,6 +40,14 @@ var MAX_REPLY_BLOCKS = 3;
 var CAPABILITY_CLAIM_TRANSCRIPT_TAIL_BYTES = 64e3;
 var SESSION_STATE_LOCK_WAIT_MS = 250;
 var LOCK_POLL_INTERVAL_MS = 10;
+var CALL_FAILURE_SIGNALS = [
+  /\bgh:\s/,
+  /\bglab:\s/,
+  /\bHTTP\s(?:4|5)\d\d\b/,
+  /"status"\s*:\s*"?(?:4|5)\d\d/,
+  /"isError"\s*:\s*true/
+];
+var FORGE_TERMINAL_CMD = /\b(?:gh\s+pr\s+(?:merge|close|reopen)|glab\s+mr\s+(?:merge|close|reopen))\b/;
 
 // src/guardrails/store/fileLock.ts
 function isProcessAlive(pid) {
@@ -159,15 +167,21 @@ ${input2.tool_response?.output ?? ""}`;
 }
 
 // src/guardrails/prTerminal.ts
+function terminalProvenance(input2) {
+  const command = input2.tool_input?.command;
+  if (command === void 0) return { acceptsForgeLine: true };
+  return { acceptsForgeLine: FORGE_TERMINAL_CMD.test(command) };
+}
 function detectPrTerminal(input2) {
   if (input2.tool_name !== "Bash" && input2.tool_name !== "Monitor") return null;
   const response = input2.tool_response;
+  const provenance = terminalProvenance(input2);
   const haystack = [response?.stdout, response?.stderr, response?.output, response?.content].filter((part) => typeof part === "string").join("\n");
-  const mergedMatch = haystack.match(GH_PR_MERGED_LINE);
+  const mergedMatch = provenance.acceptsForgeLine ? haystack.match(GH_PR_MERGED_LINE) : null;
   if (mergedMatch) {
     return { prNumber: Number(mergedMatch[1]), verdict: "merged" /* Merged */ };
   }
-  const closedMatch = haystack.match(GH_PR_CLOSED_LINE);
+  const closedMatch = provenance.acceptsForgeLine ? haystack.match(GH_PR_CLOSED_LINE) : null;
   if (closedMatch) {
     return { prNumber: Number(closedMatch[1]), verdict: "closed" /* Closed */ };
   }
@@ -182,6 +196,7 @@ function detectPrTerminal(input2) {
 }
 function detectPrReopened(input2) {
   if (input2.tool_name !== "Bash") return null;
+  if (!terminalProvenance(input2).acceptsForgeLine) return null;
   const response = input2.tool_response;
   const haystack = [response?.stdout, response?.stderr, response?.output, response?.content].filter((part) => typeof part === "string").join("\n");
   const reopenedMatch = haystack.match(GH_PR_REOPENED_LINE);
@@ -362,11 +377,28 @@ function stageGateDecision(state, unreadStagePaths, maxBlocks = MAX_STAGE_BLOCKS
   return { action: "block" /* Block */, blockCount: blockCount + 1, unread: unreadStagePaths };
 }
 
+// src/guardrails/callOutcome.ts
+function renderedResponse(toolResponse) {
+  const rendered = [];
+  const collect = (value) => {
+    if (typeof value === "string") rendered.push(value);
+    else if (Array.isArray(value)) value.forEach(collect);
+    else if (value && typeof value === "object") Object.values(value).forEach(collect);
+  };
+  collect(toolResponse);
+  return rendered.join("\n");
+}
+function callFailed(input2) {
+  const rendered = renderedResponse(input2.tool_response);
+  return CALL_FAILURE_SIGNALS.some((signal) => signal.test(rendered));
+}
+
 // src/guardrails/preExecutionClassification.ts
 var CLASSIFICATION_SKIP_MARKER = /^\s*echo\s+["']?MUGGLE_CLASSIFY_SKIP\b/;
 function detectClassifiedTestCaseId(input2) {
   if (!MUGGLE_EVENT_EMIT_TOOL.test(input2.tool_name ?? "")) return void 0;
   if (input2.tool_input?.eventType !== PRE_EXECUTION_CLASSIFICATION_EVENT) return void 0;
+  if (callFailed(input2)) return void 0;
   return input2.tool_input?.testCaseId ?? ANY_TEST_CASE;
 }
 function applyClassifiedTestCase(state, testCaseId) {
@@ -423,6 +455,7 @@ function detectDebugEvidenceRunIds(input2, owedRunIds) {
   const toolName = input2.tool_name ?? "";
   const isDiagnosisEmit = MUGGLE_EVENT_EMIT_TOOL.test(toolName) && FAILURE_DIAGNOSIS_EVENT.test(input2.tool_input?.eventType ?? "");
   if (!isDiagnosisEmit && !MUGGLE_FEEDBACK_CREATE_TOOL.test(toolName)) return [];
+  if (callFailed(input2)) return [];
   const payload = serialize(input2);
   return owedRunIds.filter((runId) => payload.includes(runId));
 }
@@ -598,6 +631,7 @@ function detectWalkthroughPost(input2, read = defaultFileReader) {
   if (input2.tool_name !== "Bash") return false;
   const cmd = input2.tool_input?.command ?? "";
   if (!isPrReportPostCommand(cmd)) return false;
+  if (callFailed(input2)) return false;
   return collectPrPostText(cmd, input2.cwd, read).includes(REPORT_SENTINEL);
 }
 function applyWalkthroughPosted(state, posted) {

package/scripts/postinstall.mjs

@@ -25,6 +25,11 @@ import { dirname, join } from "path";
 import { pipeline } from "stream/promises";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
+import {
+    SIGNATURE_BUNDLE_SUFFIX,
+    resolveIntegrityPolicy,
+    verifyReleaseSignature,
+} from "./release-integrity/index.mjs";
 
 const require = createRequire(import.meta.url);
 const VERSION_DIRECTORY_NAME_PATTERN = /^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/;
@@ -728,7 +733,35 @@ async function downloadElectronApp() {
             clearTimeout(streamTimer);
         }
 
-        log("Download complete, verifying checksum...");
+        log("Download complete, verifying integrity...");
+
+        const integrityPolicy = resolveIntegrityPolicy({
+            version: version,
+            signedFromVersion: config.electronAppSignedFromVersion || "",
+            expectedChecksum: expectedChecksum,
+        });
+
+        if (integrityPolicy.unverifiableReason) {
+            rmSync(versionDir, { recursive: true, force: true });
+            throw new Error("Refusing to install an unverifiable download: " + integrityPolicy.unverifiableReason);
+        }
+
+        if (integrityPolicy.requiresSignature) {
+            const signatureResult = await verifyReleaseSignature({
+                artifactPath: tempFile,
+                bundleUrl: downloadUrl + SIGNATURE_BUNDLE_SUFFIX,
+                signerIdentityUri: config.signerIdentityUri || "",
+            });
+
+            if (!signatureResult.valid) {
+                rmSync(versionDir, { recursive: true, force: true });
+                throw new Error(
+                    "Signature verification failed, refusing to install: " + signatureResult.reason,
+                );
+            }
+
+            log("Signature verified successfully.");
+        }
 
         // Verify checksum
         const checksumResult = await verifyFileChecksum(tempFile, expectedChecksum);
@@ -743,9 +776,7 @@ async function downloadElectronApp() {
             );
         }
 
-        if (checksumResult.skipped) {
-            log("Warning: No checksum configured, skipping verification.");
-        } else {
+        if (!checksumResult.skipped) {
             log("Checksum verified successfully.");
         }
 

package/scripts/release-integrity/compareVersions.mjs

@@ -0,0 +1,24 @@
+/**
+ * Compare two semver versions.
+ * @param {string} a - First version.
+ * @param {string} b - Second version.
+ * @returns {number} 1 if a > b, -1 if a < b, 0 if equal.
+ */
+export function compareVersions(a, b) {
+    const partsA = a.split(".").map(Number);
+    const partsB = b.split(".").map(Number);
+
+    for (let index = 0; index < 3; index++) {
+        const partA = partsA[index] || 0;
+        const partB = partsB[index] || 0;
+
+        if (partA > partB) {
+            return 1;
+        }
+        if (partA < partB) {
+            return -1;
+        }
+    }
+
+    return 0;
+}

package/scripts/release-integrity/constants.mjs

@@ -0,0 +1,8 @@
+/** Suffix appended to a release asset's name to locate its Sigstore bundle. */
+export const SIGNATURE_BUNDLE_SUFFIX = ".sigstore.json";
+
+/** OIDC issuer that must have issued the signing certificate. */
+export const SIGNER_CERTIFICATE_ISSUER = "https://token.actions.githubusercontent.com";
+
+/** Abort budget for fetching a signature bundle. */
+export const SIGNATURE_FETCH_TIMEOUT_MS = 30_000;

package/scripts/release-integrity/index.d.mts

@@ -0,0 +1,21 @@
+export declare const SIGNATURE_BUNDLE_SUFFIX: string;
+export declare const SIGNATURE_FETCH_TIMEOUT_MS: number;
+export declare const SIGNER_CERTIFICATE_ISSUER: string;
+
+export declare function compareVersions(a: string, b: string): number;
+
+export declare function resolveIntegrityPolicy(params: {
+    version: string;
+    signedFromVersion: string;
+    expectedChecksum: string;
+}): {
+    requiresSignature: boolean;
+    requiresChecksum: boolean;
+    unverifiableReason: string;
+};
+
+export declare function verifyReleaseSignature(params: {
+    artifactPath: string;
+    bundleUrl: string;
+    signerIdentityUri: string;
+}): Promise<{ valid: boolean; reason: string }>;

package/scripts/release-integrity/index.mjs

@@ -0,0 +1,4 @@
+export { SIGNATURE_BUNDLE_SUFFIX, SIGNATURE_FETCH_TIMEOUT_MS, SIGNER_CERTIFICATE_ISSUER } from "./constants.mjs";
+export { compareVersions } from "./compareVersions.mjs";
+export { resolveIntegrityPolicy } from "./resolveIntegrityPolicy.mjs";
+export { verifyReleaseSignature } from "./verifyReleaseSignature.mjs";

package/scripts/release-integrity/resolveIntegrityPolicy.mjs

@@ -0,0 +1,37 @@
+import { compareVersions } from "./compareVersions.mjs";
+
+/**
+ * Decide which integrity evidence a download must produce before it is trusted.
+ *
+ * Releases cut before signing existed carry only a checksum, so the signature
+ * requirement is pinned to the first version that ships one. Below that pin the
+ * checksum is mandatory rather than advisory: a download with neither signature
+ * nor checksum is refused instead of being installed behind a warning.
+ *
+ * @param {object} params - Policy inputs.
+ * @param {string} params.version - Electron app version being installed.
+ * @param {string} params.signedFromVersion - First version published with a signature.
+ * @param {string} params.expectedChecksum - Configured SHA256, empty when none.
+ * @returns {{requiresSignature: boolean, requiresChecksum: boolean, unverifiableReason: string}} Which checks apply, and why none can.
+ */
+export function resolveIntegrityPolicy({ version, signedFromVersion, expectedChecksum }) {
+    const requiresSignature = Boolean(signedFromVersion) && compareVersions(version, signedFromVersion) >= 0;
+    const hasChecksum = Boolean(expectedChecksum && expectedChecksum.trim());
+
+    if (!requiresSignature && !hasChecksum) {
+        return {
+            requiresSignature: false,
+            requiresChecksum: false,
+            unverifiableReason:
+                `no integrity evidence is available for v${version}: it predates release signing ` +
+                `(first signed version: ${signedFromVersion || "none configured"}) ` +
+                `and no checksum is configured for this release stream`,
+        };
+    }
+
+    return {
+        requiresSignature: requiresSignature,
+        requiresChecksum: !requiresSignature,
+        unverifiableReason: "",
+    };
+}

package/scripts/release-integrity/verifyReleaseSignature.mjs

@@ -0,0 +1,51 @@
+/* global AbortController */
+import { readFile } from "node:fs/promises";
+import { verify } from "sigstore";
+import { SIGNATURE_FETCH_TIMEOUT_MS, SIGNER_CERTIFICATE_ISSUER } from "./constants.mjs";
+
+/**
+ * Verify a downloaded release asset against the Sigstore bundle published beside it.
+ *
+ * The bundle proves the asset was produced by a specific workflow in the studio
+ * source repository, so the signer identity is pinned exactly: a bundle that is
+ * otherwise valid but was issued to any other workflow is rejected.
+ *
+ * @param {object} params - Verification parameters.
+ * @param {string} params.artifactPath - Path to the downloaded asset.
+ * @param {string} params.bundleUrl - URL of the asset's Sigstore bundle.
+ * @param {string} params.signerIdentityUri - Certificate subject the signer must carry.
+ * @returns {Promise<{valid: boolean, reason: string}>} Verification outcome, with the rejection cause when invalid.
+ */
+export async function verifyReleaseSignature({ artifactPath, bundleUrl, signerIdentityUri }) {
+    if (!signerIdentityUri) {
+        return { valid: false, reason: "no signer identity is configured to verify against" };
+    }
+
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), SIGNATURE_FETCH_TIMEOUT_MS);
+    let bundle;
+    try {
+        const response = await fetch(bundleUrl, { signal: controller.signal });
+        if (!response.ok) {
+            return {
+                valid: false,
+                reason: `signature bundle unavailable (HTTP ${response.status}) at ${bundleUrl}`,
+            };
+        }
+        bundle = await response.json();
+    } catch (error) {
+        return { valid: false, reason: `could not fetch signature bundle: ${error.message}` };
+    } finally {
+        clearTimeout(timer);
+    }
+
+    try {
+        await verify(bundle, await readFile(artifactPath), {
+            certificateIssuer: SIGNER_CERTIFICATE_ISSUER,
+            certificateIdentityURI: signerIdentityUri,
+        });
+        return { valid: true, reason: "" };
+    } catch (error) {
+        return { valid: false, reason: error.message };
+    }
+}