@oneie/claude 0.8.0 → 0.10.0

package/scripts/agent-actor-parity.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+# agent-actor-parity.sh — the Proof line for text/agent-actor-plan.md.
+#
+# THREE GUARDS over the three stores that claim to know which agents are live.
+# All reads are read-only (D1 SELECT, R2 ListObjectsV2, one HTTP GET). Nothing
+# is written, nothing is published.
+#
+#   G1 IDENTITY   every distinct follows.actor_id is a mintable actor id
+#                 ^[a-z0-9][a-z0-9-]{0,62}$ — no trailing dot, no domain
+#   G2 GROUNDING  every distinct follows.actor_id has a live persona in R2
+#                 at <ws>/agents/<id>.md
+#   G3 SUBSTRATE  count(R2 live personas) == count(actor with actor-status "live")
+#
+# EXIT CODES ARE THE VERDICT
+#   0  all three pass
+#   1  a guard FAILED (real mismatch)
+#   3  no guard failed but one is UNRUN — an unrun gate is not a pass
+#   4  could not read a store (credentials / network) — UNRUN, never green
+#
+# Usage:  bash .claude/scripts/agent-actor-parity.sh [workspace]      (default: one)
+#         bash .claude/scripts/agent-actor-parity.sh --self-test      (red + green proof)
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WS="${1:-one}"
+
+# ── the guard logic, isolated so --self-test can drive it with fixtures ──────
+guards() { # $1=actor_ids file  $2=r2 live names file  $3=substrate live count ("" = unrun)
+  python3 - "$1" "$2" "${3:-}" <<'PY'
+import re,sys
+ids=[l.strip() for l in open(sys.argv[1]) if l.strip()]
+r2=set(l.strip() for l in open(sys.argv[2]) if l.strip())
+sub=sys.argv[3]
+ID=re.compile(r'^[a-z0-9][a-z0-9-]{0,62}$')
+bad=[i for i in ids if not ID.match(i)]
+ung=[i for i in ids if i not in r2]
+rc=0
+print(f"G1 IDENTITY   {'pass' if not bad else 'FAIL'}  {len(ids)-len(bad)}/{len(ids)} mintable" + (f"  -> {' '.join(sorted(bad))}" if bad else ""))
+print(f"G2 GROUNDING  {'pass' if not ung else 'FAIL'}  {len(ids)-len(ung)}/{len(ids)} have an R2 persona" + (f"  -> {len(ung)} ungrounded" if ung else ""))
+if bad or ung: rc=1
+if sub=="":
+    print(f"G3 SUBSTRATE  unrun  R2 live={len(r2)}  actor-status live=UNREADABLE (no door)")
+    rc = rc if rc else 3
+else:
+    ok = int(sub)==len(r2) and len(r2)>0
+    print(f"G3 SUBSTRATE  {'pass' if ok else 'FAIL'}  R2 live={len(r2)}  actor-status live={sub}")
+    if not ok: rc=1
+sys.exit(rc)
+PY
+}
+
+# ── --self-test: prove the checker can go BOTH ways ─────────────────────────
+if [ "${1:-}" = "--self-test" ]; then
+  T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
+  printf 'ceo\ncmo.\n'      > "$T/red_ids";   printf 'ceo\n'        > "$T/red_r2"
+  printf 'ceo\ncto\n'       > "$T/green_ids"; printf 'ceo\ncto\n'   > "$T/green_r2"
+  guards "$T/red_ids" "$T/red_r2" 0 >/dev/null 2>&1; r=$?
+  guards "$T/green_ids" "$T/green_r2" 2 >/dev/null 2>&1; g=$?
+  guards "$T/green_ids" "$T/green_r2" "" >/dev/null 2>&1; u=$?
+  echo "self-test: red=$r (want 1)  green=$g (want 0)  unrun=$u (want 3)"
+  [ "$r" = 1 ] && [ "$g" = 0 ] && [ "$u" = 3 ] && { echo "SELF-TEST PASS"; exit 0; }
+  echo "SELF-TEST FAIL"; exit 1
+fi
+
+WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+
+# ── store 1: D1 follows ─────────────────────────────────────────────────────
+( cd "$ROOT/one.ie/web" && npx wrangler d1 execute one-owners --remote --json \
+    --command "SELECT DISTINCT actor_id FROM follows WHERE workspace='$WS' ORDER BY actor_id" 2>/dev/null ) \
+  | python3 -c "import json,sys;d=json.load(sys.stdin);print('\n'.join(r['actor_id'] for r in d[0]['results']))" \
+  > "$WORK/ids" || { echo "UNRUN: D1 follows unreadable"; exit 4; }
+[ -s "$WORK/ids" ] || { echo "UNRUN: D1 follows returned no rows for workspace=$WS"; exit 4; }
+
+# ── store 2: R2 one-content, ListObjectsV2 (SigV4, stdlib only) ─────────────
+python3 - "$ROOT/one.ie/web/.dev.vars" "one-content" "$WS/agents/" > "$WORK/r2" <<'PY' || { echo "UNRUN: R2 unreadable"; exit 4; }
+import sys,hmac,hashlib,datetime,urllib.request,urllib.parse
+import xml.etree.ElementTree as ET
+env={}
+for line in open(sys.argv[1],encoding='utf-8',errors='ignore'):
+    line=line.strip()
+    if line and not line.startswith('#') and '=' in line:
+        k,v=line.split('=',1); env[k.strip()]=v.strip().strip('"').strip("'")
+AK=env['CLOUDFLARE_R2_S3_ACCESS_KEY_ID']; SK=env['CLOUDFLARE_R2_S3_SECRET_KEY']
+host=f"{env['CLOUDFLARE_ACCOUNT_ID']}.r2.cloudflarestorage.com"
+bucket,prefix=sys.argv[2],sys.argv[3]
+sign=lambda k,m: hmac.new(k,m.encode(),hashlib.sha256).digest()
+def page(tok):
+    q={'list-type':'2','prefix':prefix,'max-keys':'1000'}
+    if tok: q['continuation-token']=tok
+    qs='&'.join(f"{urllib.parse.quote(k,safe='')}={urllib.parse.quote(v,safe='')}" for k,v in sorted(q.items()))
+    t=datetime.datetime.now(datetime.timezone.utc)
+    ad,ds=t.strftime('%Y%m%dT%H%M%SZ'),t.strftime('%Y%m%d')
+    ph=hashlib.sha256(b'').hexdigest()
+    cr=f"GET\n/{bucket}\n{qs}\nhost:{host}\nx-amz-content-sha256:{ph}\nx-amz-date:{ad}\n\nhost;x-amz-content-sha256;x-amz-date\n{ph}"
+    sc=f"{ds}/auto/s3/aws4_request"
+    sts=f"AWS4-HMAC-SHA256\n{ad}\n{sc}\n{hashlib.sha256(cr.encode()).hexdigest()}"
+    k=sign(('AWS4'+SK).encode(),ds);k=sign(k,'auto');k=sign(k,'s3');k=sign(k,'aws4_request')
+    sig=hmac.new(k,sts.encode(),hashlib.sha256).hexdigest()
+    r=urllib.request.Request(f"https://{host}/{bucket}?{qs}",headers={'Host':host,'x-amz-date':ad,
+        'x-amz-content-sha256':ph,'Authorization':f"AWS4-HMAC-SHA256 Credential={AK}/{sc}, "
+        f"SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature={sig}"})
+    return urllib.request.urlopen(r,timeout=60).read()
+ns='{http://s3.amazonaws.com/doc/2006-03-01/}';keys=[];tok=None
+while True:
+    root=ET.fromstring(page(tok))
+    keys += [c.find(ns+'Key').text for c in root.findall(ns+'Contents')]
+    tr=root.find(ns+'IsTruncated')
+    if tr is not None and tr.text=='true': tok=root.find(ns+'NextContinuationToken').text
+    else: break
+for k in sorted(keys):
+    rel=k[len(prefix):]
+    if rel.endswith('.md') and '/' not in rel: print(rel[:-3])
+PY
+
+# ── store 3: the substrate. actor-status "live" has no read door today. ─────
+SUB=""
+CODE=$(curl -s -o "$WORK/sub" -w '%{http_code}' --max-time 25 \
+        "https://one.ie/api/export/actors?workspace=$WS&status=live" 2>/dev/null || echo 000)
+if [ "$CODE" = "200" ]; then
+  SUB=$(python3 -c "
+import json,sys
+try:
+  d=json.load(open('$WORK/sub'))
+  rows=d if isinstance(d,list) else d.get('actors',d.get('results',[]))
+  print(sum(1 for r in rows if str(r.get('actorStatus',r.get('actor-status',''))) == 'live'))
+except Exception: print('')" 2>/dev/null)
+fi
+
+echo "workspace=$WS  follows_actors=$(wc -l < "$WORK/ids" | tr -d ' ')  r2_live_personas=$(wc -l < "$WORK/r2" | tr -d ' ')  export_actors_http=$CODE"
+guards "$WORK/ids" "$WORK/r2" "$SUB"

package/scripts/blocks-manifest-cached.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# blocks-manifest-cached.sh — run `blocks-manifest.mjs --check`, or skip it when
+# nothing that feeds the manifest has moved.
+#
+# manifest: needs-env
+#
+# WHY. C2 wired `--check` into verify-fast.sh as Step 0 on 2026-09-09, which was
+# right -- three committed artifacts were generated from one registry and gated by
+# nothing. But it runs on EVERY fast-lane pass, and measured on this box, warm,
+# twice in a row: 8.19s and 6.98s. The fast lane exists to be run on every edit;
+# a fixed ~7s toll on a doc edit, a script edit or a test-only cycle is most of
+# what the lane was built to avoid. Only ~1.0-1.3s of that is the `bunx tsx`
+# resolution leg (measured: `bunx tsx --version` 1.33s then 1.03s) -- the rest is
+# the real work, importing a 7,800-line config through tsx and walking 243 blocks.
+# So vendoring tsx does not fix this. A memo does.
+#
+# WHY NARROWING IS SOUND HERE, AND IS NOT THE test-cached.sh MISTAKE. CLAUDE.md
+# warns: do not narrow test-cached.sh's key, because those tests readFileSync
+# across pay/, channels/, schema/, .claude/ and text/ at runtime, so an import
+# graph is NOT a superset of what a test reads. blocks-manifest.mjs is the
+# opposite shape. Its inputs are DECLARED at :33-38 -- config.tsx, families.ts,
+# block-usage.json -- and the runner it generates does nothing but import
+# config.tsx and walk puckConfig.components. Its inputs ARE its import graph, by
+# construction. Read that precedent before reaching for it here; it is about a
+# different failure.
+#
+# THE KEY IS A SUPERSET ON PURPOSE. Everything the check reads AND all three
+# artifacts it compares against live under one.ie/web/src, so the fingerprint
+# covers that whole tree rather than a hand-listed set of paths. A block
+# component living somewhere the list did not anticipate is exactly how a memo
+# goes unsound, and a drifted manifest reading as cached is far worse than 7s.
+# The cost of the superset is that any src edit misses -- which is correct, and
+# still skips every doc-only, script-only and test-only cycle.
+#
+# SAFETY, the direction that matters: a LOST stamp costs a run, never a skip.
+# The stamp lives in GOVERN_DIR (machine-wide tmp, evaporates), so a fresh box, a
+# cleared tmp or a new worktree all MISS. There is no path where a missing stamp
+# reads as cached. Staged-but-uncommitted edits move the key too, because
+# `ls-files -s` shows the INDEX while `diff` shows the working tree -- one leg
+# alone would miss half of them (the scar sdk-build-cached.sh records).
+#
+# BLOCKS_MANIFEST_FORCE=1 always runs. --self-test drives the red half.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GOVERN_DIR="${GOVERN_DIR:-${TMPDIR:-/tmp}/one-govern}"
+mkdir -p "$GOVERN_DIR"
+
+_fp() {
+  { git -C "$ROOT" ls-files -s one.ie/web/src 2>/dev/null
+    git -C "$ROOT" diff -- one.ie/web/src 2>/dev/null
+    git -C "$ROOT" ls-files --others --exclude-standard one.ie/web/src 2>/dev/null \
+      | while IFS= read -r u; do shasum -a 256 "$ROOT/$u" 2>/dev/null; done
+  } | shasum -a 256 | cut -d' ' -f1
+}
+
+_run_check() {
+  local out rc
+  out="$(mktemp)"
+  set +e
+  node "$ROOT/.claude/scripts/blocks-manifest.mjs" --check > "$out" 2>&1
+  rc=$?
+  set -e
+  cat "$out"; rm -f "$out"
+  return $rc
+}
+
+if [ "${1:-}" = "--self-test" ]; then
+  fails=0
+  probe="$ROOT/one.ie/web/src/lib/puck/.memo-probe.ts"
+  BLOCKS_MANIFEST_FORCE=1 bash "$0" >/dev/null 2>&1 || true
+  a="$(bash "$0" 2>&1)"
+  case "$a" in *cached*) echo "ok: second run on an unchanged tree is CACHED";;
+    *) echo "FAIL: unchanged tree re-ran: $a"; fails=$((fails+1));; esac
+  # RED HALF: a memo that cannot be shown to MISS is an unrun gate in a
+  # performance costume -- the exact class Step 0 was added to close.
+  printf 'export const __memoProbe = 1\n' > "$probe"
+  b="$(bash "$0" 2>&1)"
+  rm -f "$probe"
+  case "$b" in *cached*) echo "FAIL: a new file under src did NOT invalidate the memo"; fails=$((fails+1));;
+    *) echo "ok: a new file under src MISSES (red half proven)";; esac
+  c="$(bash "$0" 2>&1)"
+  case "$c" in *cached*) echo "ok: removing the probe returns to the earlier key";;
+    *) echo "note: post-probe run re-ran (fine — a miss is never wrong)";; esac
+  [ "$fails" -eq 0 ] && echo "blocks-manifest-cached --self-test: PASS" || { echo "blocks-manifest-cached --self-test: $fails FAIL"; exit 1; }
+  exit 0
+fi
+
+want="$(_fp)"
+STAMP="$GOVERN_DIR/blocks-manifest.$want"
+
+if [ "${BLOCKS_MANIFEST_FORCE:-0}" != "1" ] && [ -f "$STAMP" ]; then
+  echo "blocks-manifest --check: cached (one.ie/web/src unchanged since the last pass)"
+  exit 0
+fi
+
+_run_check || exit $?
+# Only a PASS is memoised. A drift result is never stamped: the next run must
+# see it again, and `test-cached.sh` records the same rule for the same reason.
+rm -f "$GOVERN_DIR"/blocks-manifest.* 2>/dev/null || true
+printf '%s' "$want" > "$STAMP"

package/scripts/chat-context-check.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# manifest: monorepo-only
+#
+# chat-context-check.sh — the deep chat context reaches the prompt, and the
+# checker that says so can go RED.
+#
+# WHAT IT GUARDS. Two fields carry the operator's ask: `contextPack.page.body`
+# (the page read in full, not just its headings) and `contextPack.panel` (the
+# tab open in the rail beside the chat, and its rows). Both cross four files —
+# the sender (Chat.tsx), web's edge sanitizer (/api/chat), channels'
+# sanitizer, and channels' renderer — and a field that any one of them does not
+# name is DEAD while every other test stays green. That has happened four times
+# on this exact path (`workflowId` twice, `focusBlockId`, `page`).
+#
+# WHY A SCRIPT AND NOT JUST THE SUITE. The suite proves the field arrives. This
+# proves the SUITE would notice if it stopped: it cuts the copy line out of
+# `sanitizeContextPack`, re-runs, and requires a failure. A green run against a
+# gutted sanitizer would mean the assertions were reading something else.
+#
+#   bash .claude/scripts/chat-context-check.sh              # green half
+#   bash .claude/scripts/chat-context-check.sh --self-test  # both halves
+#
+# Exit codes: 0 ok · 1 the suite is red on an untouched tree · 2 the RED PROOF
+# failed (the suite stayed green with the wire cut) · 3 setup (dirty target).
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+CTX="$ROOT/channels/src/context.ts"
+SUITES=(test/context-pack-deep.test.ts test/context-pack-parity.test.ts)
+
+run_suite() {
+  ( cd "$ROOT/channels" && bash "$ROOT/.claude/scripts/gate-run.sh" chat-ctx-check -- bunx vitest run "${SUITES[@]}" ) >"$1" 2>&1
+}
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+echo "[chat-context] green half — the suite on an untouched tree"
+if ! run_suite "$TMP/green.log"; then
+  echo "[chat-context] RED on an untouched tree — this is a real failure, not a proof:"
+  tail -30 "$TMP/green.log"
+  exit 1
+fi
+grep -E 'Tests +[0-9]+ passed' "$TMP/green.log" || true
+
+if [ "${1:-}" != "--self-test" ]; then
+  echo "[chat-context] ok — pass --self-test for the red proof"
+  exit 0
+fi
+
+# ── RED PROOF ───────────────────────────────────────────────────────────────
+# Cut the two copy lines out of channels' sanitizer, one at a time, and require
+# the suite to notice. The file is restored on every exit path, including a
+# SIGINT — a checker that can leave the tree mutated is worse than no checker.
+if ! git -C "$ROOT" diff --quiet -- channels/src/context.ts; then
+  echo "[chat-context] refusing: channels/src/context.ts already has uncommitted edits."
+  echo "               The red proof rewrites it and restores from THIS copy; it will not"
+  echo "               step on work in progress."
+  exit 3
+fi
+cp "$CTX" "$TMP/context.ts.orig"
+restore() { cp "$TMP/context.ts.orig" "$CTX"; }
+trap 'restore; rm -rf "$TMP"' EXIT INT TERM
+
+fail=0
+cut_and_check() {
+  local label="$1" pattern="$2"
+  restore
+  if ! grep -q "$pattern" "$CTX"; then
+    echo "[chat-context] RED PROOF SETUP FAILED — no line matching: $pattern"
+    echo "               The wire moved. Update this checker or it is guarding nothing."
+    fail=1
+    return
+  fi
+  grep -v "$pattern" "$TMP/context.ts.orig" > "$CTX"
+  if run_suite "$TMP/red-$label.log"; then
+    echo "[chat-context] RED PROOF FAILED ($label) — the suite stayed GREEN with the wire cut."
+    fail=1
+  else
+    echo "[chat-context] red proof ok: cutting $label turns the suite red"
+  fi
+}
+
+cut_and_check "page.body"  "page.body = rawBody.slice"
+cut_and_check "panel.tab"  "pack.panel = panel"
+restore
+
+[ "$fail" -eq 0 ] || exit 2
+echo "[chat-context] ok — the field arrives, and the checker can go red"

package/scripts/chrome.mjs

@@ -30,6 +30,9 @@
  *   --header <k: v>        extra HTTP header (repeatable)
  *   --ua <string>          user agent
  *   --viewport <WxH>       viewport (default 1280x800)
+ *   --reduced-motion       emulate `prefers-reduced-motion: reduce` for the run, so a
+ *                          reduced-motion rule can be CHECKED instead of believed:
+ *                          drive the same route twice and diff the computed styles
  *   --headed               use full Chromium with a visible window instead of the shell
  *   --max <n>              truncation ceiling for text/html/eval (default 4000)
  *
@@ -184,8 +187,23 @@ const statePath = typeof val('state') === 'string' ? val('state') : null
 const stateLoaded = Boolean(statePath && existsSync(statePath))
 
 const [vw, vh] = String(val('viewport', '1280x800')).split('x').map(Number)
+// THE FLAG text/ehc-motion.md ASKED FOR, and what it buys.
+//
+// That page could not write an `accept:` for its own central rule — "reduced
+// motion must reach the same final frame" — because this harness had no way to
+// ask for the flag, so every reduced-motion block in the repo was believed
+// rather than checked, and one of them (`Layout.astro:599`) had already been
+// correct, reviewed, and DEAD because its sheet was not on the page. An
+// animation is the one kind of code whose failure looks exactly like success.
+//
+// Playwright emulates it per context (CDP `Emulation.setEmulatedMedia`), so the
+// same route can be driven twice and the two `getComputedStyle` readings
+// compared. `--reduced-motion` asks for `reduce`; the default stays `no-preference`
+// so every existing caller reads exactly what it read before.
+const reducedMotion = flag('reduced-motion') ? 'reduce' : 'no-preference'
 const context = await browser.newContext({
   viewport: { width: vw || 1280, height: vh || 800 },
+  reducedMotion,
   ...(stateLoaded ? { storageState: statePath } : {}),
   ...(typeof val('ua') === 'string' ? { userAgent: val('ua') } : {}),
   ...(all('header').length