@notis_ai/cli 0.2.18 → 0.2.20

package/src/runtime/auth-recovery.js

@@ -49,6 +49,23 @@ export function getAuthRecovery(runtime = {}, { mode = 'expired' } = {}) {
   return { hints };
 }
 
+/**
+ * How to recover when renewing a sign-in failed but the sign-in itself is
+ * kept: try again. Never point at login, which would replace a working grant.
+ */
+export function getRetryRecovery(runtime = {}) {
+  const CLI_NPX = cliNpx(runtime);
+  const suffix = profileSuffix(runtime.profileName);
+  return {
+    hints: [
+      {
+        command: `${CLI_NPX} doctor${suffix}`,
+        reason: 'Check that Notis is reachable from this computer, then run the same command again',
+      },
+    ],
+  };
+}
+
 export function createExpiredAuthError(runtime) {
   const CLI_NPX = cliNpx(runtime || {});
   if (runtime?.credentialKind === 'worktree') {

package/src/runtime/base-skills.d.ts

@@ -1,5 +1,7 @@
 export interface BaseSkillReconcileResult {
   installed: number;
+  /** Skills left as installed because that copy is newer than this one. */
+  kept: number;
   linked: number;
   unchanged: number;
   backups: string[];
@@ -7,6 +9,15 @@ export interface BaseSkillReconcileResult {
 }
 
 export const BASE_SKILL_NAMES: readonly string[];
+export const RETIRED_BASE_SKILL_NAMES: readonly string[];
+
+export function isBaseSkillLink(linkPath: string, name: string, options?: {
+  home?: string;
+}): boolean;
+
+export const BASE_SKILL_STAMP_FILE: string;
+
+export function readBaseSkillStamp(skillDir: string): number | null;
 
 export function resolveBundledBaseSkillsRoot(options?: {
   resourcesPath?: string;

package/src/runtime/base-skills.js

@@ -1,22 +1,35 @@
+import { createHash } from 'node:crypto';
 import {
   cpSync,
   existsSync,
   lstatSync,
   mkdirSync,
+  readdirSync,
+  readFileSync,
   readlinkSync,
   renameSync,
   rmSync,
   symlinkSync,
+  unlinkSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const BASE_SKILL_NAMES = Object.freeze([
-  'notis-apps',
+  'notis-spaces',
   'notis-query',
   'notis-cli',
 ]);
+// Earlier CLIs linked these names. Only links this installer created are retired.
+export const RETIRED_BASE_SKILL_NAMES = Object.freeze(['notis-apps', 'notis-reports']);
+
+/**
+ * The npm package and Desktop build write this file into each skill folder
+ * they ship: `stamp` is the commit time (Unix seconds) of the newest commit
+ * that changed the skill. A source checkout has none.
+ */
+export const BASE_SKILL_STAMP_FILE = '.notis-base-skill.json';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -65,6 +78,11 @@ function sameLinkTarget(linkPath, expectedTarget) {
   }
 }
 
+/** True only for a link into this installer's base copy of `name`. */
+export function isBaseSkillLink(linkPath, name, { home = homedir() } = {}) {
+  return sameLinkTarget(linkPath, join(getBaseSkillPaths({ home }).baseRoot, name));
+}
+
 function backupConflict(linkPath, backupRoot, targetLabel, skillName, now) {
   const backupPath = join(backupRoot, String(now), targetLabel, skillName);
   mkdirSync(dirname(backupPath), { recursive: true, mode: 0o700 });
@@ -72,6 +90,60 @@ function backupConflict(linkPath, backupRoot, targetLabel, skillName, now) {
   return backupPath;
 }
 
+/** The version stamp of one skill folder, or null when it has none. */
+export function readBaseSkillStamp(skillDir) {
+  try {
+    const { stamp } = JSON.parse(readFileSync(join(skillDir, BASE_SKILL_STAMP_FILE), 'utf8'));
+    return Number.isSafeInteger(stamp) && stamp > 0 ? stamp : null;
+  } catch {
+    return null;
+  }
+}
+
+function byName(left, right) {
+  if (left.name === right.name) return 0;
+  return left.name < right.name ? -1 : 1;
+}
+
+/** Digest of a skill folder's files, leaving out its version stamp. */
+function contentDigest(root) {
+  const hash = createHash('sha256');
+  const walk = (directory, prefix) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true }).sort(byName)) {
+      const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+      const full = join(directory, entry.name);
+      if (path === BASE_SKILL_STAMP_FILE) continue;
+      if (entry.isDirectory()) {
+        hash.update(`dir\0${path}\0`);
+        walk(full, path);
+      } else if (entry.isSymbolicLink()) {
+        hash.update(`link\0${path}\0${readlinkSync(full)}\0`);
+      } else {
+        const bytes = readFileSync(full);
+        hash.update(`file\0${path}\0${bytes.length}\0`);
+        hash.update(bytes);
+      }
+    }
+  };
+  walk(root, '');
+  return hash.digest('hex');
+}
+
+/**
+ * Newest wins. Desktop and the CLI both run this with the copy they ship, so
+ * a copy replaces the installed one only when it is newer, or when both are
+ * the same version and the installed files changed since. A source checkout
+ * has no stamp and replaces the installed copy whenever their files differ.
+ */
+function baseSkillAction(source, destination) {
+  if (!existsSync(join(destination, 'SKILL.md'))) return 'install';
+  const bundled = readBaseSkillStamp(source);
+  const installed = readBaseSkillStamp(destination);
+  if (bundled !== null && installed !== null && installed > bundled) return 'keep';
+  if (bundled !== null && (installed === null || installed < bundled)) return 'install';
+  return contentDigest(source) === contentDigest(destination) ? 'current' : 'install';
+}
+
 function replaceDirectory(source, destination) {
   mkdirSync(dirname(destination), { recursive: true, mode: 0o700 });
   const temporary = `${destination}.tmp-${process.pid}-${Date.now()}`;
@@ -109,6 +181,7 @@ export function reconcileBaseSkills({
   const paths = getBaseSkillPaths({ home, userId });
   const result = {
     installed: 0,
+    kept: 0,
     linked: 0,
     unchanged: 0,
     backups: [],
@@ -120,13 +193,31 @@ export function reconcileBaseSkills({
     if (!existsSync(join(source, 'SKILL.md'))) {
       throw new Error(`Bundled base skill is missing: ${name}`);
     }
-    replaceDirectory(source, join(paths.baseRoot, name));
-    result.installed += 1;
+    const destination = join(paths.baseRoot, name);
+    let action;
+    try {
+      action = baseSkillAction(source, destination);
+    } catch {
+      // An unreadable installed copy is repaired, as before stamps existed.
+      action = 'install';
+    }
+    if (action === 'install') {
+      replaceDirectory(source, destination);
+      result.installed += 1;
+    } else if (action === 'keep') {
+      result.kept += 1;
+    }
   }
 
   for (const targetRoot of paths.targetRoots) {
     mkdirSync(targetRoot, { recursive: true, mode: 0o700 });
     const targetLabel = relative(home, targetRoot).replaceAll('/', '_') || 'home';
+    // Retire only links this installer owns. A personal skill with an old
+    // product name remains untouched; name alone is never deletion authority.
+    for (const retired of RETIRED_BASE_SKILL_NAMES) {
+      const oldLink = join(targetRoot, retired);
+      if (sameLinkTarget(oldLink, join(paths.baseRoot, retired))) unlinkSync(oldLink);
+    }
     for (const name of BASE_SKILL_NAMES) {
       const skillTarget = join(paths.baseRoot, name);
       const linkPath = join(targetRoot, name);
@@ -152,6 +243,12 @@ export function reconcileBaseSkills({
     }
   }
 
+  // Keep the old managed bytes recoverable, outside every agent's skill scan.
+  for (const retired of RETIRED_BASE_SKILL_NAMES) {
+    const oldRoot = join(paths.baseRoot, retired);
+    if (existsSync(oldRoot)) result.backups.push(backupConflict(oldRoot, paths.backupRoot, 'base', retired, now));
+  }
+
   return result;
 }
 

package/src/runtime/computer-identity.d.ts

@@ -0,0 +1,30 @@
+export interface ComputerIdentity {
+  /** Stable UUID v4 for this computer, shared by every account on it. */
+  computerId: string;
+  /** The name the user chose, or null to use the computer's own name. */
+  name: string | null;
+  /** The computer's own name (macOS Computer Name, else the host name). */
+  defaultName: string;
+  /** `name ?? defaultName`, what the server and the user see. */
+  displayName: string;
+}
+
+export interface ComputerIdentityOptions {
+  /** The CLI config file computer.json sits next to. Defaults to NOTIS_CLI_CONFIG_FILE or ~/.notis/config.json. */
+  configFile?: string;
+  platform?: NodeJS.Platform;
+  hostname?: () => string;
+  readMacComputerName?: () => string | null;
+}
+
+export const COMPUTER_IDENTITY_VERSION: number;
+export const COMPUTER_NAME_MAX_LENGTH: number;
+
+export function computerIdentityFile(configFile?: string): string;
+export function normalizeComputerName(value: unknown): string | null;
+export function defaultComputerName(options?: ComputerIdentityOptions): string;
+export function readComputerIdentity(options?: ComputerIdentityOptions): ComputerIdentity;
+export function setComputerName(
+  name: string | null,
+  options?: ComputerIdentityOptions,
+): ComputerIdentity;

package/src/runtime/computer-identity.js

@@ -0,0 +1,151 @@
+import { randomUUID } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { hostname as osHostname } from 'node:os';
+import { dirname, join } from 'node:path';
+import { resolveCliConfigFile, withConfigFileWriteLock } from './config-lock.js';
+
+// This computer's identity, shared by the CLI and Desktop: one stable id per
+// computer (the server keeps one CLI sign-in and one local shell connection per
+// computer) and the name the user sees for it. It lives next to the CLI config
+// file, so NOTIS_CLI_CONFIG_FILE moves it too, and is written under the same
+// lock as the config.
+export const COMPUTER_IDENTITY_VERSION = 1;
+export const COMPUTER_NAME_MAX_LENGTH = 64;
+const COMPUTER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const FALLBACK_COMPUTER_NAME = 'Computer';
+
+export function computerIdentityFile(configFile = resolveCliConfigFile()) {
+  return join(dirname(configFile), 'computer.json');
+}
+
+/**
+ * Trim, collapse whitespace and cap at 64 characters. Returns null for a name
+ * that is empty after cleanup, which means "use the computer's own name".
+ */
+export function normalizeComputerName(value) {
+  if (typeof value !== 'string') return null;
+  const collapsed = value.replace(/\s+/gu, ' ').trim();
+  if (!collapsed) return null;
+  // Count code points so a cut never splits a character in two.
+  const characters = Array.from(collapsed);
+  if (characters.length <= COMPUTER_NAME_MAX_LENGTH) return collapsed;
+  return characters.slice(0, COMPUTER_NAME_MAX_LENGTH).join('').trim();
+}
+
+function readMacComputerName() {
+  try {
+    return execFileSync('/usr/sbin/scutil', ['--get', 'ComputerName'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2_000,
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The computer's own name: the macOS Computer Name, else the host name without
+ * a trailing `.local`.
+ */
+export function defaultComputerName(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform === 'darwin') {
+    const macName = normalizeComputerName((options.readMacComputerName ?? readMacComputerName)());
+    if (macName) return macName;
+  }
+  let host = '';
+  try {
+    host = String((options.hostname ?? osHostname)() || '');
+  } catch {
+    host = '';
+  }
+  return normalizeComputerName(host.replace(/\.local\.?$/iu, '')) || FALLBACK_COMPUTER_NAME;
+}
+
+function parseIdentityFile(file) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  return raw;
+}
+
+function validStored(raw) {
+  if (!raw || raw.version !== COMPUTER_IDENTITY_VERSION) return null;
+  if (typeof raw.computer_id !== 'string' || !COMPUTER_ID_PATTERN.test(raw.computer_id)) return null;
+  return {
+    computerId: raw.computer_id.toLowerCase(),
+    name: normalizeComputerName(raw.name),
+  };
+}
+
+function writeIdentityFile(file, stored) {
+  mkdirSync(dirname(file), { recursive: true });
+  const contents = {
+    version: COMPUTER_IDENTITY_VERSION,
+    computer_id: stored.computerId,
+    ...(stored.name ? { name: stored.name } : {}),
+  };
+  const temporaryFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporaryFile, `${JSON.stringify(contents, null, 2)}\n`, { mode: 0o600 });
+  renameSync(temporaryFile, file);
+}
+
+function withIdentity(stored, options) {
+  const defaultName = defaultComputerName(options);
+  return {
+    computerId: stored.computerId,
+    name: stored.name,
+    defaultName,
+    displayName: stored.name ?? defaultName,
+  };
+}
+
+// Under the config lock: re-read so two first reads agree on one id, then
+// create (or repair) the file only when it holds no valid identity.
+function readOrCreateLocked(configFile, file) {
+  const raw = parseIdentityFile(file);
+  const existing = validStored(raw);
+  if (existing) return existing;
+  const created = {
+    computerId: randomUUID(),
+    // A file with a broken id keeps the name the user chose.
+    name: normalizeComputerName(raw?.name),
+  };
+  writeIdentityFile(file, created);
+  return created;
+}
+
+/**
+ * Read this computer's identity, creating `computer.json` on first read.
+ */
+export function readComputerIdentity(options = {}) {
+  const configFile = options.configFile ?? resolveCliConfigFile();
+  const file = computerIdentityFile(configFile);
+  const stored = validStored(parseIdentityFile(file))
+    ?? withConfigFileWriteLock(configFile, () => readOrCreateLocked(configFile, file));
+  return withIdentity(stored, options);
+}
+
+/**
+ * Rename this computer for every account on it. An empty name goes back to the
+ * computer's own name.
+ */
+export function setComputerName(name, options = {}) {
+  const configFile = options.configFile ?? resolveCliConfigFile();
+  const file = computerIdentityFile(configFile);
+  const stored = withConfigFileWriteLock(configFile, () => {
+    const current = readOrCreateLocked(configFile, file);
+    const next = { computerId: current.computerId, name: normalizeComputerName(name) };
+    if (next.name !== current.name) {
+      writeIdentityFile(file, next);
+    }
+    return next;
+  });
+  return withIdentity(stored, options);
+}

package/src/runtime/config-lock.js

@@ -0,0 +1,135 @@
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+
+// Cross-process write lock over ~/.notis/config.json. Independent `notis`
+// processes (a `login` in one terminal and a `tools exec` in another) and
+// Desktop all rewrite the files in this directory, so the lock directory name
+// and these three timings are the whole coordination protocol. Desktop keeps a
+// TypeScript copy in electron/src/notis-config-file.ts. Guarded by the
+// concurrency test in packages/cli/test/runtime-auth.test.js.
+const CONFIG_WRITE_LOCK_TIMEOUT_MS = 5_000;
+const CONFIG_WRITE_LOCK_STALE_MS = 2_000;
+const CONFIG_WRITE_LOCK_POLL_MS = 10;
+
+/**
+ * The shared CLI config file. NOTIS_CLI_CONFIG_FILE moves it (and every file
+ * kept next to it, such as computer.json) for tests and isolated runtimes.
+ */
+export function resolveCliConfigFile() {
+  const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
+  if (envConfigFile) {
+    return resolve(envConfigFile);
+  }
+  return join(homedir(), '.notis', 'config.json');
+}
+
+// The lock records who holds it and when they took it. Reclaiming a stale lock
+// by mtime alone is not safe: the reclaimer cannot tell an abandoned lock from
+// one it is about to steal from a live writer, and the victim's own release
+// would then delete the thief's lock and admit a third writer. Both sides are
+// on the same host, so the stored timestamp and Date.now() share a clock.
+function readLockOwner(lockDirectory) {
+  try {
+    return JSON.parse(readFileSync(join(lockDirectory, 'owner'), 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function lockDirectoryMtime(lockDirectory) {
+  try {
+    return statSync(lockDirectory).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+function publishConfigWriteLock(lockDirectory, ownerId) {
+  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
+  try {
+    mkdirSync(candidateDirectory);
+    writeFileSync(
+      join(candidateDirectory, 'owner'),
+      JSON.stringify({ id: ownerId, at: Date.now() }),
+      { mode: 0o600 },
+    );
+    try {
+      renameSync(candidateDirectory, lockDirectory);
+      return true;
+    } catch (error) {
+      if (!existsSync(lockDirectory)) throw error;
+      return false;
+    }
+  } finally {
+    rmSync(candidateDirectory, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Run `callback(configFile)` while holding `<configFile>.write-lock`.
+ */
+export function withConfigFileWriteLock(configFile, callback) {
+  const lockDirectory = `${configFile}.write-lock`;
+  const ownerId = `${process.pid}.${randomUUID()}`;
+  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
+  mkdirSync(dirname(configFile), { recursive: true });
+  for (;;) {
+    if (!existsSync(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
+      break;
+    }
+
+    const owner = readLockOwner(lockDirectory);
+    const observedMtime = lockDirectoryMtime(lockDirectory);
+    const ownerIsStale =
+      owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
+    const ownerlessIsStale =
+      !owner
+      && observedMtime !== null
+      && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
+    if (ownerIsStale || ownerlessIsStale) {
+      try {
+        const currentOwner = readLockOwner(lockDirectory);
+        const ownerUnchanged = owner?.id
+          ? currentOwner?.id === owner.id
+          : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
+        if (ownerUnchanged) {
+          rmSync(lockDirectory, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        // Losing the reclaim race is normal; fall through and keep waiting.
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting to update ${configFile}`);
+    }
+    Atomics.wait(
+      new Int32Array(new SharedArrayBuffer(4)),
+      0,
+      0,
+      CONFIG_WRITE_LOCK_POLL_MS,
+    );
+  }
+  try {
+    return callback(configFile);
+  } finally {
+    try {
+      // Never release a lock that was reclaimed from us while we worked.
+      if (readLockOwner(lockDirectory)?.id === ownerId) {
+        rmSync(lockDirectory, { recursive: true, force: true });
+      }
+    } catch {
+      // The lock may already have been removed after an interrupted write.
+    }
+  }
+}

package/src/runtime/confined-space-build.js

@@ -0,0 +1,74 @@
+/**
+ * Pinned first build of one Space for a confined local effect
+ * (server/lib/confined_effects/space_build.py).
+ *
+ *   node confined-space-build.js <build-request.json>
+ *
+ * The backend starts this file from a hashed, read-only toolchain under the macOS
+ * sandbox (no network). It reuses the canonical selected-source freeze, manifest,
+ * V4 checks and build receipt (buildSpaceArtifact) and replaces only the build
+ * runner: the canonical Vite command runs with this same node executable and a
+ * rebuilt environment, never PATH npm, a package script or the caller's
+ * environment. It never refreshes the SDK or installs anything.
+ */
+import { spawn } from 'node:child_process';
+import { readFileSync, realpathSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { buildSpaceArtifact } from './space-platform.js';
+
+const CANONICAL_BUILD_SCRIPTS = new Set(['vite build', 'vite build --configLoader runner']);
+const OUTPUT_LIMIT = 32 * 1024;
+
+export function pinnedBuildEnvironment(environment = process.env) {
+  return { PATH: [dirname(process.execPath), '/usr/bin', '/bin'].join(':'), HOME: environment.HOME || '',
+    TMPDIR: environment.TMPDIR || '', LANG: 'C', LC_ALL: 'C', NODE_ENV: 'production' };
+}
+
+export function pinnedViteCommand(projectDir, executable = process.execPath) {
+  const pkg = JSON.parse(readFileSync(join(projectDir, 'package.json'), 'utf8'));
+  const script = String(pkg.scripts?.build || '').trim();
+  if (!CANONICAL_BUILD_SCRIPTS.has(script)) throw new Error('Only the canonical vite build script can run in a confined build.');
+  const vite = realpathSync(join(projectDir, 'node_modules', 'vite', 'bin', 'vite.js'));
+  return [executable, vite, 'build', '--configLoader', 'runner'];
+}
+
+/** buildArtifact runBuild seam: the canonical build, pinned, with bounded captured output. */
+export function runPinnedVite({ projectDir }) {
+  const [command, ...args] = pinnedViteCommand(projectDir);
+  return new Promise((resolvePromise, rejectPromise) => {
+    const child = spawn(command, args, { cwd: projectDir, env: pinnedBuildEnvironment(), stdio: ['ignore', 'pipe', 'pipe'] });
+    let output = '';
+    for (const stream of [child.stdout, child.stderr]) {
+      stream.on('data', chunk => { if (output.length < OUTPUT_LIMIT) output += chunk.toString().slice(0, OUTPUT_LIMIT - output.length); });
+    }
+    child.on('error', rejectPromise);
+    child.on('exit', (code, signal) => {
+      if (code === 0) resolvePromise();
+      else rejectPromise(new Error(`vite build failed (${signal || code})${output.trim() ? `:\n${output.trim()}` : ''}`));
+    });
+  });
+}
+
+export async function runConfinedBuild(request) {
+  if (!request || typeof request.projectDir !== 'string' || typeof request.key !== 'string') {
+    throw new Error('The build request names one workspace and one Space key.');
+  }
+  const result = await buildSpaceArtifact(request.projectDir, request.key, { stdio: 'pipe', refreshSdk: false, runBuild: runPinnedVite });
+  // A summary only: the backend grades the saved build receipt bytes, not this line.
+  const { local_key, kind, name, spec_version } = result.manifest || {};
+  return { status: 'built', key: request.key, receipt_path: result.receiptPath, source_hash: result.sourceHash,
+    manifest: { local_key, kind, name, spec_version } };
+}
+
+async function main(argv) {
+  const request = JSON.parse(readFileSync(argv[2], 'utf8'));
+  try {
+    process.stdout.write(JSON.stringify(await runConfinedBuild(request)) + '\n');
+  } catch (error) {
+    process.stdout.write(JSON.stringify({ status: 'failed', error: String(error?.message || error).slice(0, OUTPUT_LIMIT) }) + '\n');
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) await main(process.argv);

package/src/runtime/confined-space-verify.js

@@ -0,0 +1,49 @@
+/**
+ * Credential-free canonical verification of one accepted confined build
+ * (server/lib/confined_effects/space_build.py).
+ *
+ *   node confined-space-verify.js <verify-request.json>
+ *
+ * Runs outside the build sandbox so Chromium keeps its own sandbox
+ * (chromiumSandbox: true in the shared renderer pool). The request carries the
+ * capabilities returned by backend source verification and the accepted build's
+ * exact source and artifact digests; anything else refuses before rendering.
+ * Rendering uses only the declared offline fixtures at 390 and 1440 (no live
+ * data, no deployment, no Store publication).
+ */
+import { readFileSync, realpathSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { appFilesDigest } from './app-platform.js';
+import { prepareSpaceRelease } from './space-platform.js';
+import { verifySpaceRelease } from './space-verification.js';
+
+export async function runConfinedVerification(request, { verify = verifySpaceRelease } = {}) {
+  if (!request || typeof request.projectDir !== 'string' || typeof request.key !== 'string'
+    || typeof request.sourceDigest !== 'string' || typeof request.artifactDigest !== 'string'
+    || !request.capabilities || typeof request.capabilities !== 'object') {
+    throw new Error('The verification request names one accepted build and its capabilities.');
+  }
+  const release = await prepareSpaceRelease(request.projectDir, request.key);
+  try {
+    const sourceDigest = appFilesDigest(release.sourceFiles), artifactDigest = appFilesDigest(release.files);
+    if (sourceDigest !== request.sourceDigest || artifactDigest !== request.artifactDigest) {
+      return { status: 'failed', error: 'build_changed', source_digest: sourceDigest, artifact_digest: artifactDigest };
+    }
+    const diagnostic = await verify(release, { capabilities: request.capabilities, timeoutMs: 45_000 });
+    return { status: diagnostic.status === 'passed' ? 'verified' : 'failed', diagnostic };
+  } finally { release.close(); }
+}
+
+async function main(argv) {
+  const request = JSON.parse(readFileSync(argv[2], 'utf8'));
+  try {
+    const result = await runConfinedVerification(request);
+    process.stdout.write(JSON.stringify(result) + '\n');
+    process.exitCode = result.status === 'verified' ? 0 : 3;
+  } catch (error) {
+    process.stdout.write(JSON.stringify({ status: 'failed', error: String(error?.message || error).slice(0, 32 * 1024) }) + '\n');
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) await main(process.argv);