@open-agent-toolkit/cli 0.2.72 → 0.2.74

package/assets/skills/explainer-kit/schemas/visual-review-evidence.v1.schema.json

@@ -1,66 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "explainer-kit.visual-review-evidence/v1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schemaVersion",
-    "requestHash",
-    "attempt",
-    "disposition",
-    "reasons"
-  ],
-  "properties": {
-    "schemaVersion": {
-      "const": "explainer-kit.visual-review-evidence/v1"
-    },
-    "requestHash": { "$ref": "#/$defs/hash" },
-    "attempt": { "enum": [1, 2] },
-    "disposition": { "enum": ["pass", "correct", "failed"] },
-    "reasons": {
-      "type": "array",
-      "minItems": 0,
-      "maxItems": 50,
-      "items": { "$ref": "#/$defs/reason" }
-    }
-  },
-  "$defs": {
-    "hash": {
-      "type": "string",
-      "pattern": "^sha256:[a-f0-9]{64}$"
-    },
-    "reason": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["stage", "kind", "count"],
-      "properties": {
-        "stage": {
-          "enum": [
-            "planning",
-            "authoring",
-            "rendering",
-            "link-validation",
-            "browser-review",
-            "visual-review",
-            "durability",
-            "finalization"
-          ]
-        },
-        "kind": {
-          "enum": [
-            "finding",
-            "provider-failure",
-            "pipeline-failure",
-            "superseded"
-          ]
-        },
-        "artifactId": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 2000
-        },
-        "count": { "type": "integer", "minimum": 1, "maximum": 50 }
-      }
-    }
-  }
-}

package/assets/skills/explainer-kit/schemas/visual-review-request.v1.schema.json

@@ -1,117 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "explainer-kit.visual-review-request/v1",
-  "title": "VisualReviewRequestV1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schemaVersion",
-    "requestId",
-    "requestHash",
-    "browserRuntime",
-    "captureIdentity",
-    "plan",
-    "renderedArtifacts"
-  ],
-  "properties": {
-    "schemaVersion": {
-      "const": "explainer-kit.visual-review-request/v1"
-    },
-    "requestId": { "$ref": "#/$defs/safeId" },
-    "requestHash": { "$ref": "#/$defs/hash" },
-    "browserRuntime": { "$ref": "#/$defs/browserRuntime" },
-    "captureIdentity": { "$ref": "#/$defs/hash" },
-    "plan": { "$ref": "explainer-kit.set-plan/v1" },
-    "renderedArtifacts": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/renderedArtifact" },
-      "minItems": 1,
-      "uniqueItems": true
-    }
-  },
-  "$defs": {
-    "safeRelativePath": {
-      "type": "string",
-      "minLength": 1,
-      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
-    },
-    "safeId": {
-      "type": "string",
-      "pattern": "^[a-z0-9]+(?:[._-][a-z0-9]+)*$"
-    },
-    "hash": {
-      "type": "string",
-      "pattern": "^sha256:[a-f0-9]{64}$"
-    },
-    "browserRuntime": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["kind", "name", "version"],
-      "properties": {
-        "kind": { "enum": ["launched", "fixture"] },
-        "name": { "const": "chromium" },
-        "version": { "type": "string", "minLength": 1 }
-      }
-    },
-    "renderedArtifact": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["artifactId", "renderedPath", "renderedHash", "evidence"],
-      "properties": {
-        "artifactId": {
-          "type": "string",
-          "pattern": "^[a-z0-9]+(?:[._-][a-z0-9]+)*$"
-        },
-        "renderedPath": { "$ref": "#/$defs/safeRelativePath" },
-        "renderedHash": { "$ref": "#/$defs/hash" },
-        "cohesionObservations": {
-          "type": "array",
-          "items": { "$ref": "#/$defs/cohesionObservation" },
-          "uniqueItems": true
-        },
-        "evidence": {
-          "type": "array",
-          "items": { "$ref": "#/$defs/evidence" },
-          "minItems": 1,
-          "uniqueItems": true
-        }
-      }
-    },
-    "cohesionObservation": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["artifactId", "contentHash", "group", "claim", "value"],
-      "properties": {
-        "artifactId": { "$ref": "#/$defs/safeId" },
-        "contentHash": { "$ref": "#/$defs/hash" },
-        "group": {
-          "enum": ["terminology", "statuses", "numericClaims"]
-        },
-        "claim": { "type": "string", "minLength": 1 },
-        "value": {
-          "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "number" }]
-        }
-      }
-    },
-    "evidence": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "viewport",
-        "screenshotPath",
-        "screenshotHash",
-        "metricsPath",
-        "metricsHash",
-        "captureIdentity"
-      ],
-      "properties": {
-        "viewport": { "enum": ["desktop", "tablet", "mobile"] },
-        "screenshotPath": { "$ref": "#/$defs/safeRelativePath" },
-        "screenshotHash": { "$ref": "#/$defs/hash" },
-        "metricsPath": { "$ref": "#/$defs/safeRelativePath" },
-        "metricsHash": { "$ref": "#/$defs/hash" },
-        "captureIdentity": { "$ref": "#/$defs/hash" }
-      }
-    }
-  }
-}

package/assets/skills/explainer-kit/schemas/visual-review-result.v1.schema.json

@@ -1,80 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "explainer-kit.visual-review-result/v1",
-  "title": "VisualReviewResultV1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schemaVersion",
-    "reviewId",
-    "requestId",
-    "requestHash",
-    "reviewedAt",
-    "disposition",
-    "artifactIds",
-    "findings"
-  ],
-  "properties": {
-    "schemaVersion": {
-      "const": "explainer-kit.visual-review-result/v1"
-    },
-    "reviewId": { "$ref": "#/$defs/safeId" },
-    "requestId": { "$ref": "#/$defs/safeId" },
-    "requestHash": { "$ref": "#/$defs/hash" },
-    "reviewedAt": { "type": "string", "format": "date-time" },
-    "disposition": { "enum": ["pass", "correct", "fail"] },
-    "artifactIds": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/safeId" },
-      "minItems": 1,
-      "uniqueItems": true
-    },
-    "findings": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/finding" },
-      "uniqueItems": true
-    }
-  },
-  "$defs": {
-    "safeId": {
-      "type": "string",
-      "pattern": "^[a-z0-9]+(?:[._-][a-z0-9]+)*$"
-    },
-    "hash": {
-      "type": "string",
-      "pattern": "^sha256:[a-f0-9]{64}$"
-    },
-    "finding": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "artifactId",
-        "rubric",
-        "severity",
-        "evidence",
-        "correction"
-      ],
-      "properties": {
-        "artifactId": { "$ref": "#/$defs/safeId" },
-        "rubric": {
-          "enum": [
-            "first-viewport",
-            "hierarchy",
-            "representation",
-            "legibility",
-            "medium-fit",
-            "cohesion",
-            "coverage",
-            "redundancy",
-            "interaction"
-          ]
-        },
-        "severity": {
-          "enum": ["critical", "important", "medium", "minor"]
-        },
-        "evidence": { "type": "string", "minLength": 1 },
-        "correction": { "type": "string", "minLength": 1 }
-      }
-    }
-  }
-}

package/assets/skills/explainer-kit/scripts/lib/catalog.mjs

@@ -1,349 +0,0 @@
-import { canonicalStringify, validateContract } from './contracts.mjs';
-
-/**
- * Bumped to v2 when the root `publicVerification` marker was added below.
- *
- * The catalog is serialized, hashed, and recorded as an auxiliary artifact in
- * the publish receipt, so adding a root key changes the bytes. Released
- * `0.2.30` emits the v1 shape, which has no such key: leaving both shapes under
- * one version string would put two different wire formats behind one identifier
- * for anyone parsing `catalog.json` by declared version.
- *
- * There is deliberately no v1 read path. Unlike `publish-request/v1` and
- * `publish-receipt/v1`, which are retained because a v1 record can still be
- * replayed, the catalog is regenerate-only and never reconstructed from a v1
- * receipt: every rebuild site short-circuits on a non-v2 receipt
- * (`durability.mjs` verifyPublishEvidence, `run.mjs` publicationValidationContext,
- * and the normative `private-wrapper.mjs` example), and `0.2.30` emits
- * `publish-receipt/v1` only. Accepting v1 here would be unreachable code. If a
- * future reader ever does replay a v1-era catalog, it must reconstruct that
- * shape explicitly rather than relaxing this constant.
- */
-const CATALOG_SCHEMA_VERSION = 'explainer-kit.initiative-catalog/v2';
-
-export const PUBLIC_VERIFICATION_REQUIRED = 'required';
-export const PUBLIC_VERIFICATION_SKIPPED_BY_POLICY = 'skipped-by-policy';
-
-/**
- * Single source of truth for public-verification state.
- *
- * The catalog is built, serialized and hashed *before* the first upload and long
- * before any per-artifact public verification runs, so it can never carry a
- * verification *outcome*: writing one would either require re-uploading the
- * catalog or invalidate the hash the receipt records for it. It therefore
- * carries verification *policy* only, and the authoritative outcome stays in the
- * run's publish receipt, which the catalog's `runId` identifies.
- *
- * Both the catalog marker and the receipt's skipped status are derived from this
- * one result so the two cannot drift apart.
- */
-export function resolvePublicVerificationPolicy(publicAccess) {
-  return publicAccess === 'protected'
-    ? {
-        publicAccess: 'protected',
-        catalogMarker: PUBLIC_VERIFICATION_SKIPPED_BY_POLICY,
-        verifyPublicly: false,
-        receiptSkipStatus: 'skipped-protected',
-      }
-    : {
-        publicAccess: 'public',
-        catalogMarker: PUBLIC_VERIFICATION_REQUIRED,
-        verifyPublicly: true,
-        receiptSkipStatus: 'skipped-protected',
-      };
-}
-
-/**
- * The public-access policy must be stated explicitly, never defaulted.
- *
- * It selects the catalog's `publicVerification` marker, which is part of the
- * serialized bytes and therefore of the catalog hash the receipt records. An
- * options bag that silently defaulted to the permissive `public` branch is what
- * let four call sites omit it and still produce a plausible-looking catalog:
- * the connector published `skipped-by-policy` for a `protected` run while the
- * durability verifier rebuilt `required`, so the hashes diverged and no
- * `protected` publication could ever be recorded durable.
- *
- * Passing `{ publicAccess: undefined }` is allowed and means `public` — that is
- * the correct reading for `publish-request/v1` and `publish-receipt/v1`, which
- * have no such field. Omitting the key entirely is a programming error.
- */
-function requiredPublicAccess(options, caller) {
-  if (
-    options === null ||
-    typeof options !== 'object' ||
-    !('publicAccess' in options)
-  ) {
-    throw new TypeError(
-      `${caller} requires an explicit { publicAccess } policy: it selects the catalog's publicVerification marker and therefore its hash. Pass { publicAccess: undefined } for v1 records, which are public by definition.`,
-    );
-  }
-  return options.publicAccess;
-}
-
-export function initiativeCatalogPath(slug) {
-  if (typeof slug !== 'string' || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) {
-    throw new TypeError('Initiative catalog requires a safe initiative slug.');
-  }
-  return `site/initiatives/${slug}/catalog.json`;
-}
-
-export function catalogFromManifest(manifest, publicBaseUrl, options) {
-  const publicAccess = requiredPublicAccess(options, 'catalogFromManifest');
-  const validation = validateContract('manifest', manifest);
-  if (!validation.valid) {
-    throw new TypeError(
-      `Initiative catalog requires a valid finalized manifest: ${validation.errors[0].message}`,
-    );
-  }
-  const baseUrl = normalizePublicBaseUrl(publicBaseUrl);
-  const artifacts = manifest.artifacts.map((artifact) => {
-    if (
-      artifact.status !== 'built' ||
-      typeof artifact.renderedPath !== 'string' ||
-      !artifact.renderedPath.startsWith('site/') ||
-      typeof artifact.hash !== 'string'
-    ) {
-      throw new TypeError(
-        `Initiative catalog cannot publish non-built artifact ${artifact.id}.`,
-      );
-    }
-    return {
-      id: artifact.id,
-      type: artifact.type,
-      status: artifact.status,
-      renderedPath: artifact.renderedPath,
-      ...(artifact.mediaType && { mediaType: artifact.mediaType }),
-      hash: artifact.hash,
-      url: absoluteArtifactUrl(baseUrl, artifact.renderedPath),
-    };
-  });
-
-  return {
-    schemaVersion: CATALOG_SCHEMA_VERSION,
-    runId: manifest.runId,
-    slug: manifest.slug,
-    recipe: structuredClone(manifest.recipe),
-    createdAt: manifest.createdAt,
-    // Policy, never outcome. See resolvePublicVerificationPolicy.
-    publicVerification:
-      resolvePublicVerificationPolicy(publicAccess).catalogMarker,
-    artifacts,
-    sourceBacklinks: structuredClone(manifest.source.backlinks ?? []),
-  };
-}
-
-export function validateInitiativeCatalog(
-  catalog,
-  manifest,
-  publicBaseUrl,
-  options,
-) {
-  const publicAccess = requiredPublicAccess(
-    options,
-    'validateInitiativeCatalog',
-  );
-  const errors = [];
-  let normalizedPublicBaseUrl;
-  try {
-    normalizedPublicBaseUrl = normalizePublicBaseUrl(publicBaseUrl);
-  } catch (error) {
-    add(
-      errors,
-      '$.artifacts',
-      'catalog-public-root',
-      error instanceof Error
-        ? error.message
-        : 'Initiative catalog requires an HTTPS public base URL.',
-    );
-  }
-  if (!catalog || typeof catalog !== 'object' || Array.isArray(catalog)) {
-    return {
-      valid: false,
-      errors: [
-        {
-          path: '$',
-          code: 'catalog-shape',
-          message: 'Initiative catalog must be an object.',
-        },
-      ],
-    };
-  }
-  const expectedRootKeys = new Set([
-    'schemaVersion',
-    'runId',
-    'slug',
-    'recipe',
-    'createdAt',
-    'publicVerification',
-    'artifacts',
-    'sourceBacklinks',
-  ]);
-  if (Object.keys(catalog).some((key) => !expectedRootKeys.has(key))) {
-    add(
-      errors,
-      '$',
-      'catalog-shape',
-      'Initiative catalog contains an unknown property.',
-    );
-  }
-
-  for (const [field, expected] of [
-    ['schemaVersion', CATALOG_SCHEMA_VERSION],
-    ['runId', manifest?.runId],
-    ['slug', manifest?.slug],
-    ['createdAt', manifest?.createdAt],
-  ]) {
-    if (catalog[field] !== expected) {
-      add(
-        errors,
-        `$.${field}`,
-        'catalog-manifest-mismatch',
-        `Catalog ${field} does not match the finalized manifest.`,
-      );
-    }
-  }
-  // Derived from the same resolver the receipt status comes from, so a catalog
-  // that disagrees with the run's resolved verification policy is rejected.
-  const expectedPublicVerification =
-    resolvePublicVerificationPolicy(publicAccess).catalogMarker;
-  if (catalog.publicVerification !== expectedPublicVerification) {
-    add(
-      errors,
-      '$.publicVerification',
-      'catalog-verification-policy',
-      `Catalog publicVerification must be ${expectedPublicVerification} for this run's public access policy.`,
-    );
-  }
-
-  if (
-    canonicalStringify(catalog.recipe) !== canonicalStringify(manifest?.recipe)
-  ) {
-    add(
-      errors,
-      '$.recipe',
-      'catalog-manifest-mismatch',
-      'Catalog recipe does not match the finalized manifest.',
-    );
-  }
-
-  const catalogArtifacts = Array.isArray(catalog.artifacts)
-    ? catalog.artifacts
-    : [];
-  const manifestArtifacts = Array.isArray(manifest?.artifacts)
-    ? manifest.artifacts
-    : [];
-  if (
-    !Array.isArray(catalog.artifacts) ||
-    catalogArtifacts.length !== manifestArtifacts.length
-  ) {
-    add(
-      errors,
-      '$.artifacts',
-      'catalog-artifact-parity',
-      'Catalog artifacts must exactly cover the finalized manifest artifacts.',
-    );
-  }
-  for (const [index, artifact] of manifestArtifacts.entries()) {
-    const entry = catalogArtifacts[index];
-    const expected = {
-      id: artifact.id,
-      type: artifact.type,
-      status: artifact.status,
-      renderedPath: artifact.renderedPath,
-      ...(artifact.mediaType && { mediaType: artifact.mediaType }),
-      hash: artifact.hash,
-      url:
-        normalizedPublicBaseUrl === undefined
-          ? undefined
-          : absoluteArtifactUrl(normalizedPublicBaseUrl, artifact.renderedPath),
-    };
-    const actual = entry && typeof entry === 'object' ? entry : undefined;
-    if (canonicalStringify(actual) !== canonicalStringify(expected)) {
-      add(
-        errors,
-        `$.artifacts[${index}]`,
-        'catalog-artifact-mismatch',
-        `Catalog artifact ${artifact.id} is stale or does not match the finalized manifest.`,
-      );
-    }
-  }
-
-  if (
-    canonicalStringify(catalog.sourceBacklinks) !==
-    canonicalStringify(manifest?.source?.backlinks ?? [])
-  ) {
-    add(
-      errors,
-      '$.sourceBacklinks',
-      'catalog-source-mismatch',
-      'Catalog source backlinks do not match the finalized manifest.',
-    );
-  }
-  for (const [index, backlink] of (Array.isArray(catalog.sourceBacklinks)
-    ? catalog.sourceBacklinks
-    : []
-  ).entries()) {
-    if (
-      typeof backlink?.sourceId !== 'string' ||
-      !isImmutableGithubUrl(backlink?.url)
-    ) {
-      add(
-        errors,
-        `$.sourceBacklinks[${index}]`,
-        'catalog-source-url',
-        'Catalog source backlinks must be immutable absolute GitHub URLs.',
-      );
-    }
-  }
-
-  return { valid: errors.length === 0, errors };
-}
-
-export function serializeInitiativeCatalog(catalog) {
-  return `${JSON.stringify(catalog, null, 2)}\n`;
-}
-
-function normalizePublicBaseUrl(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new TypeError(
-      'Initiative catalog requires an HTTPS public base URL.',
-    );
-  }
-  if (
-    url.protocol !== 'https:' ||
-    url.username ||
-    url.password ||
-    url.search ||
-    url.hash
-  ) {
-    throw new TypeError(
-      'Initiative catalog requires credential-free HTTPS without query or fragment.',
-    );
-  }
-  return url.href.replace(/\/+$/, '');
-}
-
-function absoluteArtifactUrl(baseUrl, renderedPath) {
-  return `${baseUrl}/${renderedPath
-    .slice('site/'.length)
-    .split('/')
-    .map((part) => encodeURIComponent(part))
-    .join('/')}`;
-}
-
-function isImmutableGithubUrl(value) {
-  return (
-    typeof value === 'string' &&
-    /^https:\/\/github\.com\/[^/]+\/[^/]+\/blob\/[a-f0-9]{40}\/.+#L[1-9][0-9]*(?:-L[1-9][0-9]*)?$/.test(
-      value,
-    )
-  );
-}
-
-function add(errors, path, code, message) {
-  errors.push({ path, code, message });
-}