@nurix/nustack 0.23.12 → 0.23.14

package/dist/commands/review.js

@@ -2,6 +2,7 @@ import { ensureAccessToken } from "../lib/auth_grant.js";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { makeReviewClient, ReviewUnreachableError } from "../lib/review/client.js";
 import { printJsonSuccess } from "../lib/json_output.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 const EXIT_FOR = {
     signed: 0,
     refused: 1,
@@ -56,7 +57,7 @@ export async function runReviewCheck(options, globals) {
         process.exitCode = EXIT_FOR[state];
     };
     const baseUrl = resolveNuStackUrl(globals);
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return report("unreachable");
     try {
@@ -124,7 +125,7 @@ export async function runReviewMirror(options, globals) {
     if (!sessionId)
         return mirrorReport(json, "skipped", null, "--session is required");
     const baseUrl = resolveNuStackUrl(globals);
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return mirrorReport(json, "skipped", null, "signed out");
     const client = makeReviewClient(baseUrl, deviceAuth.accessToken);

package/dist/commands/sessions.js

@@ -5,17 +5,20 @@ import { ensureAccessToken } from "../lib/auth_grant.js";
 import { isInteractive } from "../lib/interactive.js";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { makeSessionsClient, sessionsClientFromEnv } from "../lib/sessions/client.js";
+import { mountProjectHarness } from "../lib/harness/mount.js";
 import { recordOutsideSessions, } from "../lib/sessions/outsideSessions.js";
 import { inspectSession, readOrphanedWorktrees, reclaimSession, } from "../lib/session-engine/prune.js";
 import { readSessionRegistry, sessionRegistryPath } from "../lib/session-engine/registry.js";
 import { SessionSupervisor } from "../lib/session-engine/supervisor.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 export async function runSessionsServe(engineVersion) {
     const supervisor = new SessionSupervisor({
         input: process.stdin,
         output: process.stdout,
         engineVersion,
         sessions: sessionsClientFromEnv(process.env),
+        mountHarness: mountProjectHarness,
     });
     await supervisor.run();
     process.exit(0);
@@ -69,7 +72,7 @@ export async function runSessionsRecord(options, globals) {
     const transcripts = readTranscripts(payload?.sessions);
     if (transcripts.length === 0)
         return report("sessions record", EMPTY, json, "nothing to record");
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return report("sessions record", EMPTY, json, "signed out");
     const summary = await recordOutsideSessions(makeSessionsClient(baseUrl, deviceAuth.accessToken), {

package/dist/commands/sync.js

@@ -6,6 +6,7 @@ import { ensureAccessToken, signedOutCopy } from "../lib/auth_grant.js";
 import { resolveProjectId } from "../lib/project_context.js";
 import { readManagedValues, writeManagedValues } from "../lib/env_file.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 const COMMAND = "sync";
 const signedOut = () => signedOutCopy();
 export async function runSync(options) {
@@ -14,7 +15,7 @@ export async function runSync(options) {
     const json = options.json === true;
     if (!json)
         p.intro("nustack sync");
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return failSync(json, "SIGNED_OUT", signedOut(), "The managed block was not touched.");
     const accessToken = deviceAuth.accessToken;

package/dist/index.js

@@ -5,6 +5,10 @@ if (command === "gate" && subcommand !== undefined && HOOK_SUBCOMMANDS.includes(
     const { runGateHook } = await import("./lib/gate/hook.js");
     await runGateHook(subcommand);
 }
+else if (command === "check" && process.argv.includes("--hook")) {
+    const { runHookMode } = await import("./lib/harness/hookEntry.js");
+    await runHookMode(process.argv[process.argv.indexOf("--hook") + 1] ?? "", process.argv.includes("--protection"));
+}
 else {
     await import("./program.js");
 }

package/dist/lib/agent/claudeHooks.js

@@ -9,6 +9,9 @@ function managedEntry(matcher, command, options) {
         hook.timeout = options.timeout;
     return { matcher, hooks: [hook] };
 }
+function isManagedCommand(command) {
+    return command.trimEnd().endsWith(`# ${MANAGED_MARKER}`);
+}
 function carriesMarker(entry) {
     if (entry === null || typeof entry !== "object")
         return false;
@@ -18,7 +21,7 @@ function carriesMarker(entry) {
     return hooks.some((hook) => hook !== null &&
         typeof hook === "object" &&
         typeof hook.command === "string" &&
-        hook.command.includes(MANAGED_MARKER));
+        isManagedCommand(hook.command));
 }
 function isManagedEntry(entry, matcher) {
     if (!carriesMarker(entry))

package/dist/lib/agent/desktopDoor.js

@@ -0,0 +1,55 @@
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+const PROBE_TIMEOUT_MS = 1500;
+export function desktopConfigDir() {
+    return (process.env.NUSTACK_DESKTOP_CONFIG_DIR ||
+        path.join(os.homedir(), "Library", "Application Support", "co.nurix.nustack"));
+}
+export async function readServerRecord() {
+    const recordPath = path.join(desktopConfigDir(), "server.json");
+    try {
+        const parsed = JSON.parse(await readFile(recordPath, "utf8"));
+        if (typeof parsed.port !== "number" ||
+            typeof parsed.token !== "string" ||
+            typeof parsed.pid !== "number" ||
+            typeof parsed.startedAt !== "string") {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+export function isRosterProject(value) {
+    return (value !== null &&
+        typeof value === "object" &&
+        typeof value.path === "string" &&
+        typeof value.label === "string");
+}
+export async function probeProjects(record) {
+    try {
+        const response = await fetch(`http://127.0.0.1:${record.port}/api/projects`, {
+            headers: { Authorization: `Bearer ${record.token}` },
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return null;
+        const body = (await response.json());
+        const projects = body.data?.projects;
+        return Array.isArray(projects) ? projects.filter(isRosterProject) : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/lib/auth_grant.js

@@ -3,6 +3,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { getOrCreateDeviceId } from "./device_identity.js";
 import { deleteDeviceCredential, readCredentialFailure, readDeviceCredential, writeDeviceCredential } from "./device_keychain.js";
 import { openLoopbackListener } from "./loopback.js";
+import { originMismatchError, refusedContractOrigin } from "./origin_guard.js";
 const REQUEST_TIMEOUT_MS = 10_000;
 const BOOTSTRAP_TIMEOUT_MS = 25_000;
 const LOOPBACK_TIMEOUT_MS = 10 * 60_000;
@@ -160,11 +161,14 @@ export async function readStoredCredential() {
         credential: { deviceToken: credential.device_token, studioBaseUrl: credential.studio_base_url, deviceId, userEmail: credential.user_email },
     };
 }
-export async function resolveAccessToken() {
+export async function resolveAccessToken(origin) {
     const fromEnv = envToken();
     if (fromEnv) {
         if (fromEnv.kind === "malformed")
             return { kind: "malformed_token", message: fromEnv.message };
+        const refused = refusedContractOrigin(null, origin);
+        if (refused)
+            return { kind: "origin_mismatch", error: originMismatchError(refused, null, "pat") };
         const deviceId = resolvedDeviceId ?? (await getOrCreateDeviceId());
         resolvedDeviceId = deviceId;
         return { kind: "ok", session: { accessToken: fromEnv.token, userEmail: "", deviceId } };
@@ -173,12 +177,20 @@ export async function resolveAccessToken() {
     if (!credential) {
         if (failure)
             lastDeadReason = failure;
+        const refused = refusedContractOrigin(null, origin);
+        if (refused)
+            return { kind: "origin_mismatch", error: originMismatchError(refused, null, "none") };
         return { kind: "none", reason: failure };
     }
+    const refused = refusedContractOrigin(credential.studioBaseUrl, origin);
+    if (refused)
+        return { kind: "origin_mismatch", error: originMismatchError(refused, credential.studioBaseUrl, "device") };
     return { kind: "ok", session: { accessToken: credential.deviceToken, userEmail: credential.userEmail, deviceId } };
 }
-export async function ensureAccessToken() {
-    const outcome = await resolveAccessToken();
+export async function ensureAccessToken(origin) {
+    const outcome = await resolveAccessToken(origin);
+    if (outcome.kind === "origin_mismatch")
+        throw outcome.error;
     return outcome.kind === "ok" ? { accessToken: outcome.session.accessToken, userEmail: outcome.session.userEmail } : null;
 }
 export async function forgetRefusedToken(staleToken) {

package/dist/lib/auth_recovery.js

@@ -2,6 +2,7 @@ import * as p from "@clack/prompts";
 import { deadCredentialCopy, ensureAccessToken, resolveAccessToken } from "./auth_grant.js";
 import { performDeviceLogin } from "../commands/login.js";
 import { isInteractive } from "./interactive.js";
+import { originMismatchError, refusedContractOrigin } from "./origin_guard.js";
 let lastFailure = { code: "SIGNED_OUT", message: deadCredentialCopy(null), retryable: false };
 export function lastAuthFailure() {
     return lastFailure;
@@ -12,6 +13,8 @@ function describeFailure(outcome) {
     }
     if (outcome.kind === "malformed_token")
         return { code: "TOKEN_MALFORMED", message: outcome.message, retryable: false };
+    if (outcome.kind === "origin_mismatch")
+        return { code: "ORIGIN_MISMATCH", message: outcome.error.message, retryable: false };
     return { code: "SIGNED_OUT", message: deadCredentialCopy(outcome.reason), retryable: false };
 }
 function reconnectingCopy(outcome) {
@@ -24,7 +27,7 @@ function reconnectingCopy(outcome) {
 export async function ensureAuthWithRecovery(baseUrl, json) {
     let outcome;
     try {
-        outcome = await resolveAccessToken();
+        outcome = await resolveAccessToken(baseUrl);
     }
     catch {
         lastFailure = describeFailure("unreachable");
@@ -33,13 +36,17 @@ export async function ensureAuthWithRecovery(baseUrl, json) {
     if (outcome.kind === "ok")
         return { accessToken: outcome.session.accessToken, userEmail: outcome.session.userEmail };
     lastFailure = describeFailure(outcome);
-    if (json || !isInteractive() || outcome.kind === "malformed_token")
+    if (json || !isInteractive() || outcome.kind === "malformed_token" || outcome.kind === "origin_mismatch")
         return null;
+    if (refusedContractOrigin(null, baseUrl)) {
+        lastFailure = describeFailure({ kind: "origin_mismatch", error: originMismatchError(baseUrl, null, "none") });
+        return null;
+    }
     p.log.warn(reconnectingCopy(outcome));
     const didLogin = await performDeviceLogin(baseUrl, process.cwd(), { reauthorize: true });
     if (!didLogin)
         return null;
-    return ensureAccessToken().catch(() => {
+    return ensureAccessToken(baseUrl).catch(() => {
         lastFailure = describeFailure("unreachable");
         return null;
     });

package/dist/lib/etna/manager.js

@@ -2,7 +2,17 @@ import { detectPackageManager, installPackage } from "../package_manager.js";
 import { assertSafePackageName } from "../guards.js";
 import { updateBindingEtnaProfile } from "../local_store/bindings.js";
 import { serializeProfileForBinding } from "./profile.js";
-import { mountHarness } from "../harness/mount.js";
+import { mountProjectHarness } from "../harness/mount.js";
+export function profileNamesHarness(profile) {
+    return Boolean(profile.harnessDigest || profile.versionManifestPath || profile.manifestUrl);
+}
+export function mountReportOf(outcome) {
+    return { status: outcome.status, source: outcome.source, version: outcome.version, digest: outcome.digest };
+}
+export function mountFailureReport(error) {
+    const code = error?.code;
+    return { status: "failed", code: typeof code === "string" ? code : "HARNESS_MOUNT_FAILED", message: error instanceof Error ? error.message : String(error) };
+}
 export function toolkitPackageName(profile) {
     if (!profile.name.startsWith("@"))
         return null;
@@ -16,14 +26,22 @@ export function toolkitPackageName(profile) {
 export async function installToolkit(store, bindingId, profile, cwd, deps = {}) {
     const packageName = toolkitPackageName(profile);
     let result;
-    const manifestUrl = deps.manifestUrl ?? profile.manifestUrl ?? null;
-    if (manifestUrl) {
+    if (deps.skipMount) {
+        result = { ok: true, installed: false, skipped: true, reason: "skipped_etna_mount", mount: { status: "skipped_etna_mount" } };
+    }
+    else if (profileNamesHarness(profile)) {
         try {
-            await (deps.mount ?? mountHarness)(cwd, manifestUrl);
-            result = { ok: true, installed: true, skipped: false, reason: "mounted" };
+            const outcome = await (deps.mount ?? mountProjectHarness)(cwd, {
+                projectId: deps.projectId,
+                globals: deps.globals,
+                writeContract: deps.writeContract ?? "never",
+                runtime: "claude-code",
+            });
+            result = { ok: true, installed: true, skipped: false, reason: "mounted", mount: mountReportOf(outcome) };
         }
         catch (error) {
-            result = { ok: false, installed: false, skipped: false, reason: error instanceof Error ? error.message : String(error) };
+            const mount = mountFailureReport(error);
+            result = { ok: false, installed: false, skipped: false, reason: mount.message, mount };
         }
     }
     else if (!packageName) {

package/dist/lib/etna/profile.js

@@ -1,4 +1,5 @@
 import { getProject } from "../nustack_client.js";
+import { contractFieldsFromSummary } from "../project_contract.js";
 export class ToolkitProfileUnavailableError extends Error {
     projectId;
     constructor(projectId) {
@@ -21,6 +22,11 @@ export async function fetchToolkitProfile(baseUrl, accessToken, projectId) {
         catalogVersionId: null,
         harnessVersion: project.harness?.version ?? null,
         manifestUrl: project.harness?.manifestUrl ?? null,
+        harnessTrack: project.harness?.track ?? null,
+        harnessDigest: project.harness?.digest ?? null,
+        versionManifestPath: project.harness?.versionManifestPath ?? null,
+        branchPolicy: project.branchPolicy === "trunk" || project.branchPolicy === "branch" ? project.branchPolicy : null,
+        contractFields: contractFieldsFromSummary(project),
     };
 }
 export function toolkitProfileFromManifest(manifest) {

package/dist/lib/etna/reconcile.js

@@ -22,6 +22,12 @@ export function parseRecordedToolkit(binding) {
 export function toolkitCompatibility(mounted, cloud) {
     if (!mounted || !cloud)
         return { compatible: true, blocksWrites: false, reason: null };
+    if (mounted.digest && cloud.harnessDigest) {
+        if (mounted.digest !== cloud.harnessDigest) {
+            return { compatible: false, blocksWrites: true, reason: `mounted harness digest ${mounted.digest.slice(0, 12)} differs from the expected ${cloud.harnessDigest.slice(0, 12)}` };
+        }
+        return { compatible: true, blocksWrites: false, reason: null };
+    }
     const pinned = cloud.harnessVersion ?? cloud.version;
     if (mounted.version !== pinned) {
         return { compatible: false, blocksWrites: true, reason: `mounted harness ${mounted.version} differs from the cloud pin ${pinned}` };