@openrig/cli 0.6.5 → 0.6.7

package/daemon/dist/domain/bundle-archive.js

@@ -42,6 +42,55 @@ export async function pack(stagingDir, outputPath) {
     fs.writeFileSync(`${outputPath}.sha256`, archiveHash, "utf-8");
     return archiveHash;
 }
+/**
+ * Normalize a tar entry path for safety checks: Windows backslashes to
+ * forward slashes so a `..\\escape` or `C:\\…` entry cannot slip past a
+ * POSIX-only check.
+ */
+export function normalizeArchiveEntryPath(entryPath) {
+    return entryPath.replace(/\\/g, "/");
+}
+/**
+ * The single unsafe-entry verdict shared by bundle extraction and inspection.
+ * Returns a human-readable reason when the entry must be refused, or `null`
+ * when the entry is safe. Rejects symlinks/hardlinks, POSIX-absolute and
+ * Windows drive-absolute paths, and dot-dot traversal (POSIX or backslash).
+ *
+ * One source of truth: `unpack()` and the `/api/bundles/inspect` route both
+ * call this so a bundle cannot be refused by one and reported safe by the
+ * other. The labels (`SymbolicLink:`, `absolute path:`, `path traversal:`)
+ * are part of the refusal contract.
+ */
+export function unsafeArchiveEntryReason(entryPath, entryType) {
+    if (entryType === "SymbolicLink" || entryType === "Link") {
+        return `${entryType}: ${entryPath}`;
+    }
+    const normalizedPath = normalizeArchiveEntryPath(entryPath);
+    if (normalizedPath.startsWith("/") || /^[a-zA-Z]:/.test(normalizedPath)) {
+        return `absolute path: ${entryPath}`;
+    }
+    if (normalizedPath.split("/").some((segment) => segment === "..")) {
+        return `path traversal: ${entryPath}`;
+    }
+    return null;
+}
+/**
+ * Pre-scan an archive and return every unsafe entry reason (empty when clean).
+ * Shared by `unpack()` and the `/api/bundles/inspect` route so both apply the
+ * same boundary before any extraction happens.
+ */
+export async function collectUnsafeArchiveEntries(archivePath) {
+    const unsafeEntries = [];
+    await tar.list({
+        file: archivePath,
+        onReadEntry: (entry) => {
+            const reason = unsafeArchiveEntryReason(entry.path, entry.type);
+            if (reason)
+                unsafeEntries.push(reason);
+        },
+    });
+    return unsafeEntries;
+}
 /**
  * Unpack a .rigbundle archive to a directory.
  * Requires sibling .sha256 digest file. Verifies archive integrity before extraction.
@@ -55,25 +104,7 @@ export async function unpack(archivePath, outputDir) {
         throw new Error(`Archive integrity check failed: expected ${digestResult.expected}, got ${digestResult.actual}`);
     }
     // Step 2: Pre-scan archive for unsafe entries BEFORE extraction
-    const unsafeEntries = [];
-    await tar.list({
-        file: archivePath,
-        onReadEntry: (entry) => {
-            const entryPath = entry.path;
-            const entryType = entry.type;
-            if (entryType === "SymbolicLink" || entryType === "Link") {
-                unsafeEntries.push(`${entryType}: ${entryPath}`);
-            }
-            const normalizedPath = entryPath.replace(/\\/g, "/");
-            if (normalizedPath.startsWith("/") || /^[a-zA-Z]:/.test(normalizedPath)) {
-                unsafeEntries.push(`absolute path: ${entryPath}`);
-            }
-            const segments = normalizedPath.split("/");
-            if (segments.some((s) => s === "..")) {
-                unsafeEntries.push(`path traversal: ${entryPath}`);
-            }
-        },
-    });
+    const unsafeEntries = await collectUnsafeArchiveEntries(archivePath);
     if (unsafeEntries.length > 0) {
         throw new Error(`Unsafe archive entries rejected: ${unsafeEntries.join("; ")}`);
     }
@@ -85,14 +116,8 @@ export async function unpack(archivePath, outputDir) {
         filter: (p, entry) => {
             if ("isSymbolicLink" in entry && typeof entry.isSymbolicLink === "function" && entry.isSymbolicLink())
                 return false;
-            if ("type" in entry && (entry.type === "SymbolicLink" || entry.type === "Link"))
-                return false;
-            const normalized = p.replace(/\\/g, "/");
-            if (normalized.startsWith("/") || /^[a-zA-Z]:/.test(normalized))
-                return false;
-            if (normalized.split("/").some((s) => s === ".."))
-                return false;
-            return true;
+            const type = "type" in entry ? entry.type : undefined;
+            return unsafeArchiveEntryReason(p, type) === null;
         },
     });
     // Step 3: Verify content integrity

package/daemon/dist/domain/bundle-archive.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-archive.js","sourceRoot":"","sources":["../../src/domain/bundle-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,mDAAmD;AACnD,OAAO,EAAE,yBAAyB,IAAI,mBAAmB,EAAE,6BAA6B,IAAI,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE/I;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,UAAkB,EAAE,UAAkB;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,mCAAmC;IACnC,MAAM,GAAG,CAAC,MAAM,CACd;QACE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAClB,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,IAAI,EAAE,wCAAwC;QACxD,KAAK,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,8BAA8B;KACxE,EACD,QAAQ,CACT,CAAC;IAEF,yBAAyB;IACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,GAAG,UAAU,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,SAAiB;IACjE,sCAAsC;IACtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,QAAQ,SAAS,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,GAAG,CAAC,IAAI,CAAC;QACb,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACrB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YAC7B,IAAI,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzD,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxE,aAAa,CAAC,IAAI,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7C,aAAa,CAAC,IAAI,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,gEAAgE;IAChE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;YACnB,IAAI,gBAAgB,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,OAAO,KAAK,CAAC;YACpH,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9F,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9E,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAA4B,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAW,CAAC;IACtD,IAAI,SAA2E,CAAC;IAEhF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,sDAAsD;QACtD,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAA4B,CAAC;YAC1D,SAAS,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAW,EAAE,KAAK,EAAG,KAAK,CAAC,OAAO,CAA4B,IAAI,EAAE,EAAE,CAAC;QACnH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,CAAC;QACC,MAAM,KAAK,GAAmB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;YAC5C,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YACpD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;SACvC,CAAC;QAEF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,SAAS,EAAsD,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG;gBACd,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,GAAG,MAAM,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,UAAU,GAAG,GAAG,WAAW,SAAS,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,OAAO,EAAE,KAAK,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,IAAI,CAAC,CAAS,EAAE,MAAc;QACrC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACd,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"bundle-archive.js","sourceRoot":"","sources":["../../src/domain/bundle-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,mDAAmD;AACnD,OAAO,EAAE,yBAAyB,IAAI,mBAAmB,EAAE,6BAA6B,IAAI,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE/I;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,UAAkB,EAAE,UAAkB;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,mCAAmC;IACnC,MAAM,GAAG,CAAC,MAAM,CACd;QACE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QAClB,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,IAAI,EAAE,wCAAwC;QACxD,KAAK,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,8BAA8B;KACxE,EACD,QAAQ,CACT,CAAC;IAEF,yBAAyB;IACzB,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,GAAG,UAAU,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,SAAkB;IAC5E,IAAI,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzD,OAAO,GAAG,SAAS,KAAK,SAAS,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACxE,OAAO,kBAAkB,SAAS,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,OAAO,mBAAmB,SAAS,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,GAAG,CAAC,IAAI,CAAC;QACb,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,MAAM;gBAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;KACF,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,SAAiB;IACjE,sCAAsC;IACtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,CAAC,QAAQ,SAAS,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,gEAAgE;IAChE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;YACnB,IAAI,gBAAgB,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,OAAO,KAAK,CAAC;YACpH,MAAM,IAAI,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAE,KAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,OAAO,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAA4B,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAW,CAAC;IACtD,IAAI,SAA2E,CAAC;IAEhF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,sDAAsD;QACtD,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAA4B,CAAC;YAC1D,SAAS,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,CAAW,EAAE,KAAK,EAAG,KAAK,CAAC,OAAO,CAA4B,IAAI,EAAE,EAAE,CAAC;QACnH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,CAAC;QACC,MAAM,KAAK,GAAmB;YAC5B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;YAC5C,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;YACpD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;SACvC,CAAC;QAEF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,EAAE,SAAS,EAAsD,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG;gBACd,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,GAAG,MAAM,CAAC,MAAM;aACjB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,UAAU,GAAG,GAAG,WAAW,SAAS,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,OAAO,EAAE,KAAK,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,IAAI,CAAC,CAAS,EAAE,MAAc;QACrC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACd,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/daemon/dist/domain/bundle-audit.d.ts

@@ -35,6 +35,11 @@ export interface BundleAuditRecord {
     cliVersion?: string;
     /** Install outcome — keep honest (partial = some stages ok, some not). */
     outcome: "success" | "failed" | "partial";
+    /** Declared bundle contents that failed to route; the install itself still ran. */
+    routingFailures?: Array<{
+        kind: string;
+        error: string;
+    }>;
 }
 /** Filesystem injection point — real impl wraps node:fs. Tests substitute in-memory. */
 export interface BundleAuditFsOps {

package/daemon/dist/domain/bundle-audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-audit.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC3C;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;CAKxC;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;;OAKG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,iBAAiB,EAAE;CAiBxD"}
+{"version":3,"file":"bundle-audit.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC1C,mFAAmF;IACnF,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;CAKxC;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,IAAI,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE;IAKpE;;;;;OAKG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,iBAAiB,EAAE;CAiBxD"}

package/daemon/dist/domain/bundle-audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-audit.js","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,QAAQ,MAAM,WAAW,CAAC;AAsCjC,2DAA2D;AAC3D,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAyB;QAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;CACF;AAUD,sDAAsD;AACtD,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,OAA4B;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,OAAO,CAAC,IAAI,CAAC,MAA2B,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED,gEAAgE;AAChE,SAAS,YAAY,CAAC,OAA4B,EAAE,OAA4B;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"bundle-audit.js","sourceRoot":"","sources":["../../src/domain/bundle-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,QAAQ,MAAM,WAAW,CAAC;AAwCjC,2DAA2D;AAC3D,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAyB;QAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;CACF;AAUD,sDAAsD;AACtD,MAAM,OAAO,iBAAiB;IACpB,IAAI,CAAkB;IACtB,EAAE,CAAmB;IAE7B,YAAY,IAAwD;QAClE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,OAA4B;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,OAAO,CAAC,IAAI,CAAC,MAA2B,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED,gEAAgE;AAChE,SAAS,YAAY,CAAC,OAA4B,EAAE,OAA4B;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/daemon/dist/domain/bundle-behaviour-inspect.d.ts

@@ -0,0 +1,4 @@
+import { type BundleBehaviour, type DescribeBundleInput } from "./bundle-behaviour.js";
+/** Called only for the private directory produced by the existing archive inspection. */
+export declare function inspectBundleBehaviour(archiveRoot: string, input: Omit<DescribeBundleInput, "files" | "omittedFiles">): BundleBehaviour;
+//# sourceMappingURL=bundle-behaviour-inspect.d.ts.map

package/daemon/dist/domain/bundle-behaviour-inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-behaviour-inspect.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-behaviour-inspect.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEhH,yFAAyF;AACzF,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,cAAc,CAAC,GACzD,eAAe,CA4BjB"}

package/daemon/dist/domain/bundle-behaviour-inspect.js

@@ -0,0 +1,56 @@
+import fs from "node:fs";
+import path from "node:path";
+import { describeBundleBehaviour } from "./bundle-behaviour.js";
+/** Called only for the private directory produced by the existing archive inspection. */
+export function inspectBundleBehaviour(archiveRoot, input) {
+    const files = new Map();
+    const omittedFiles = [];
+    // Description is diagnostic, so oversized/binary files are unknown, not a new install refusal.
+    let remainingBytes = 8 * 1024 * 1024;
+    const walk = (directory, prefix) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
+            const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const absolute = path.join(directory, entry.name);
+            if (entry.isDirectory()) {
+                walk(absolute, relative);
+                continue;
+            }
+            if (!entry.isFile()) {
+                omittedFiles.push(relative);
+                continue;
+            }
+            let fd;
+            try {
+                fd = fs.openSync(absolute, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+                const stat = fs.fstatSync(fd);
+                if (!stat.isFile() || stat.size > 1024 * 1024 || stat.size > remainingBytes) {
+                    omittedFiles.push(relative);
+                    continue;
+                }
+                const bytes = fs.readFileSync(fd);
+                if (bytes.includes(0)) {
+                    omittedFiles.push(relative);
+                    continue;
+                }
+                const content = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+                remainingBytes -= bytes.byteLength;
+                files.set(relative, content);
+            }
+            catch {
+                omittedFiles.push(relative);
+            }
+            finally {
+                if (fd !== undefined)
+                    fs.closeSync(fd);
+            }
+        }
+    };
+    try {
+        walk(archiveRoot, "");
+    }
+    catch {
+        omittedFiles.push("<unread archive members>");
+    }
+    return describeBundleBehaviour({ ...input, files, omittedFiles });
+}
+//# sourceMappingURL=bundle-behaviour-inspect.js.map

package/daemon/dist/domain/bundle-behaviour-inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-behaviour-inspect.js","sourceRoot":"","sources":["../../src/domain/bundle-behaviour-inspect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAkD,MAAM,uBAAuB,CAAC;AAEhH,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,KAA0D;IAE1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,+FAA+F;IAC/F,IAAI,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE;QACjD,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtI,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC/D,IAAI,EAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnF,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;oBAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACvH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACjE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;oBAChC,CAAC;gBAAC,IAAI,EAAE,KAAK,SAAS;oBAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC;QAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAC9B,MAAM,CAAC;QAAC,YAAY,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/daemon/dist/domain/bundle-behaviour.d.ts

@@ -0,0 +1,118 @@
+import { type PackageDigest } from "./bundle-identity.js";
+type ObjectValue = Record<string, unknown>;
+type SourceRef = {
+    path: string;
+    field?: string;
+};
+type Resolution = "archive" | "host_at_launch" | "unresolved";
+type Assembler = {
+    openrigVersion: string;
+    commit?: string;
+};
+export interface BehaviourIdentity {
+    source: ObjectValue | null;
+    configurationId: string | null;
+    packageDigest: PackageDigest | null;
+    assembler: Assembler | null;
+    generator: Assembler;
+    compatibility?: ObjectValue;
+    statedProvenance?: ObjectValue;
+    integrity: {
+        digestValid: boolean;
+        filesVerified: boolean;
+    };
+}
+interface FileFact {
+    seat?: string;
+    kind: string;
+    pathOrRef: string;
+    resolution: Resolution;
+    sourceRefs: SourceRef[];
+    delivery?: string;
+    trigger?: string;
+}
+interface WriteFact {
+    seat?: string;
+    kind: string;
+    destinationBase: string;
+    path: string;
+    operation: string;
+    phase: string;
+    condition?: string;
+    sourceRefs: SourceRef[];
+}
+interface GeneratedBehaviour {
+    schema: "openrig.bundle-behaviour/v1";
+    state: "generated";
+    identity: BehaviourIdentity;
+    team: Array<{
+        seat: string;
+        pod: string;
+        member: string;
+        agentRef: string;
+        profile: string;
+        runtime: string;
+        model?: string;
+        cwd: string;
+    }>;
+    posture: Array<{
+        seat: string;
+        shellAccess: string;
+        selection: string;
+        basis: "explicit" | "product_default" | "unresolved";
+        permissionPrompts?: "off" | "on" | "default";
+        firstRunWarnings?: {
+            claudeBypass: "harness_asks_once";
+        };
+        nonInterruptive?: "available";
+        nonInterruptiveDefault?: boolean;
+        nativeEffect: "unknown";
+        sourceRefs: SourceRef[];
+    }>;
+    toldFiles: FileFact[];
+    alsoRuns: FileFact[];
+    writes: WriteFact[];
+    outsideAddresses: Array<{
+        domain: string;
+        sourceRefs: SourceRef[];
+    }>;
+    needs: Array<{
+        seat?: string;
+        kind: string;
+        name: string;
+        commands?: string[];
+        versionConstraint?: string;
+        status: "not_checked";
+        sourceRefs: SourceRef[];
+    }>;
+    unknownBeforeLaunch: Array<{
+        seat?: string;
+        subject: string;
+        reason: string;
+        sourceRefs: SourceRef[];
+    }>;
+}
+export type BundleBehaviour = GeneratedBehaviour | {
+    schema: "openrig.bundle-behaviour/v1";
+    state: "not_generated";
+    identity: BehaviourIdentity;
+    reason: string;
+    localInspectCommand: string;
+};
+export interface DescribeBundleInput {
+    /** Only regular members of the inspected archive. No host filesystem reader. */
+    files: ReadonlyMap<string, string>;
+    manifest: ObjectValue;
+    generator: Assembler;
+    digestValid: boolean;
+    filesVerified: boolean;
+    /** Binary, oversized or unreadable members omitted by the inspection wrapper. */
+    omittedFiles?: string[];
+    source?: ObjectValue | null;
+    configurationId?: string | null;
+    assembler?: Assembler | null;
+}
+/** Read archive declarations only. This function has no process, filesystem, network or database dependency. */
+export declare function describeBundleBehaviour(input: DescribeBundleInput): BundleBehaviour;
+export {};
+//# sourceMappingURL=bundle-behaviour.d.ts.map

package/daemon/dist/domain/bundle-behaviour.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-behaviour.d.ts","sourceRoot":"","sources":["../../src/domain/bundle-behaviour.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAOzE,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3C,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAClD,KAAK,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,YAAY,CAAC;AAC9D,KAAK,SAAS,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC7D,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,SAAS,EAAE;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7D;AACD,UAAU,QAAQ;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AACD,UAAU,kBAAkB;IAC1B,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5I,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,GAAG,YAAY,CAAC;QAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC;QAAC,gBAAgB,CAAC,EAAE;YAAE,YAAY,EAAE,mBAAmB,CAAA;SAAE,CAAC;QAAC,eAAe,CAAC,EAAE,WAAW,CAAC;QAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,SAAS,CAAC;QAAC,UAAU,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC,CAAC;IAC1V,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,gBAAgB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC,CAAC;IACrE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC;QAAC,UAAU,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7J,mBAAmB,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC,CAAC;CACzG;AACD,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG;IACjD,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AACF,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAC9B;AAaD,gHAAgH;AAChH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,eAAe,CAuRnF"}