@pieai/pro-gov 0.3.6 → 0.3.7

package/assets/docs/reference/adoption/adoption-playbook.md

@@ -129,6 +129,12 @@ The plan file is the safety gate. Review it before applying. It creates managed
 symlinks and `.pro-gov/assets.lock.json`; it should not overwrite unmanaged
 project files.
 
+Managed symlinks are relative by default. A target project's normal
+`assets check` validates the local lock and linked content without requiring the
+public package to know a maintainer's private registry. Maintainers can add
+`--strict-registry`, or run `pro-gov portfolio assets-check --config
+/path/to/portfolio.json`, when they need central private-registry validation.
+
 When a maintainer promotes a private asset into `public-agent-assets/`, the
 public registry must record the private-source hash and the public-copy hash.
 Run this in the upstream checkout before publishing:

package/dist/cli.js

@@ -422,6 +422,7 @@ function listFiles3(absolutePath) {
   if (stats.isFile()) return [absolutePath];
   const files = [];
   for (const entry of readdirSync4(absolutePath, { withFileTypes: true })) {
+    if (shouldIgnoreAssetHashEntry(entry.name)) continue;
     const entryPath = join5(absolutePath, entry.name);
     if (entry.isDirectory()) {
       files.push(...listFiles3(entryPath));
@@ -431,6 +432,9 @@ function listFiles3(absolutePath) {
   }
   return files.sort();
 }
+function shouldIgnoreAssetHashEntry(name) {
+  return name === "__pycache__" || name === ".DS_Store" || name === "Thumbs.db" || name === "node_modules" || name.endsWith(".pyc") || name.endsWith(".pyo");
+}
 function toUnixPath3(path) {
   return path.replaceAll("\\", "/");
 }
@@ -532,8 +536,8 @@ function resolveSafePath(root, sourcePath) {
 }
 
 // src/asset-targets/apply.ts
-import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync2, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname as dirname3, join as join7, resolve } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync2, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname as dirname3, join as join7, relative as relative4, resolve } from "node:path";
 function applyAssetInstallPlan(plan) {
   const appliedActions = [];
   for (const action of plan.actions) {
@@ -555,15 +559,16 @@ function applyAction(targetDir, action) {
   }
   mkdirSync2(dirname3(targetAbsolutePath), { recursive: true });
   const sourceAbsolutePath = resolve(action.sourcePath);
+  const symlinkTarget = relative4(realpathSync(dirname3(targetAbsolutePath)), realpathSync(sourceAbsolutePath)) || ".";
   if (action.type === "symlink") {
     if (pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
       throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
     }
-    symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+    symlinkSync(symlinkTarget, targetAbsolutePath);
     return;
   }
   if (!pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
-    symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+    symlinkSync(symlinkTarget, targetAbsolutePath);
     return;
   }
   const stats = lstatSync2(targetAbsolutePath);
@@ -571,7 +576,7 @@ function applyAction(targetDir, action) {
     throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
   }
   unlinkSync(targetAbsolutePath);
-  symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+  symlinkSync(symlinkTarget, targetAbsolutePath);
 }
 function pathExistsEvenIfDanglingSymlink2(path) {
   try {
@@ -601,20 +606,19 @@ function checkInstalledAssets(options) {
   const registryById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
   const lockfile = JSON.parse(readFileSync4(lockfilePath, "utf8"));
   const issues = [];
+  const strictRegistry = options.strictRegistry ?? false;
   for (const entry of lockfile.assets ?? []) {
     const asset = registryById.get(entry.id);
     const targetAbsolutePath = join8(options.targetDir, entry.targetPath);
-    const sourceAbsolutePath = join8(options.agentAssetsDir, entry.sourcePath);
-    if (!asset) {
+    if (!asset && strictRegistry) {
       issues.push({
         type: "unknown-asset",
         id: entry.id,
         targetPath: entry.targetPath,
         message: `Lockfile references unknown asset: ${entry.id}`
       });
-      continue;
     }
-    if (asset.kind === "skill" && asset.defaultScope === "user") {
+    if (asset?.kind === "skill" && asset.defaultScope === "user") {
       issues.push({
         type: "user-scoped-asset-in-project-lock",
         id: entry.id,
@@ -622,13 +626,15 @@ function checkInstalledAssets(options) {
         message: `User-scoped skill is still locked into this project; move it to the user skill roots: ${entry.id}`
       });
     }
-    const hostFolderIssue = checkHostFolder(lockfile.host, asset.kind, entry.targetPath, entry.id);
-    if (hostFolderIssue) {
-      issues.push(hostFolderIssue);
-    }
-    const placementDriftIssue = checkRegistryPlacement(lockfile, asset, entry.targetPath);
-    if (placementDriftIssue) {
-      issues.push(placementDriftIssue);
+    if (asset) {
+      const hostFolderIssue = checkHostFolder(lockfile.host, asset.kind, entry.targetPath, entry.id);
+      if (hostFolderIssue) {
+        issues.push(hostFolderIssue);
+      }
+      const placementDriftIssue = checkRegistryPlacement(lockfile, asset, entry.targetPath);
+      if (placementDriftIssue) {
+        issues.push(placementDriftIssue);
+      }
     }
     if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       issues.push({
@@ -658,6 +664,18 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
+    const currentTargetHash = hashAssetPathContent(targetAbsolutePath);
+    const targetHashMatchesLock = currentTargetHash === entry.contentHash;
+    if (!targetHashMatchesLock) {
+      issues.push({
+        type: "hash-drift",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `Managed asset hash drifted: ${entry.id}`
+      });
+    }
+    if (!asset || !strictRegistry) continue;
+    const sourceAbsolutePath = join8(options.agentAssetsDir, asset.sourcePath);
     if (!existsSync8(sourceAbsolutePath)) {
       issues.push({
         type: "missing-source",
@@ -667,8 +685,8 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    const currentHash = hashAgentAssetContent(asset, options.agentAssetsDir);
-    if (currentHash !== entry.contentHash) {
+    const currentSourceHash = hashAgentAssetContent(asset, options.agentAssetsDir);
+    if (targetHashMatchesLock && currentSourceHash !== entry.contentHash) {
       issues.push({
         type: "hash-drift",
         id: entry.id,
@@ -1145,7 +1163,8 @@ function runAssetsCheck(args) {
   const result = checkInstalledAssets({
     targetDir: options.value.targetDir,
     agentAssetsDir: loaded.agentAssetsDir,
-    registry: loaded.registry
+    registry: loaded.registry,
+    strictRegistry: options.value.strictRegistry
   });
   if (options.value.json) {
     console.log(JSON.stringify(result, null, 2));
@@ -1300,6 +1319,8 @@ function parseTargetJsonOptions(args) {
       if (!targetDir) return { ok: false, error: "Expected --target <path>" };
       options.targetDir = targetDir;
       index += 1;
+    } else if (arg === "--strict-registry") {
+      options.strictRegistry = true;
     } else if (arg === "--json") {
       options.json = true;
     } else {
@@ -1717,7 +1738,7 @@ function bulletList(values) {
 // src/lens/scan.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
-import { join as join13, relative as relative4 } from "node:path";
+import { join as join13, relative as relative5 } from "node:path";
 var ignoredDirectories = /* @__PURE__ */ new Set([
   ".git",
   ".next",
@@ -1792,7 +1813,7 @@ function collectFiles2(rootDir, currentDir, files) {
       if (ignoredDirectories.has(entry.name)) continue;
       collectFiles2(rootDir, join13(currentDir, entry.name), files);
     } else if (entry.isFile()) {
-      files.push(toUnixPath4(relative4(rootDir, join13(currentDir, entry.name))));
+      files.push(toUnixPath4(relative5(rootDir, join13(currentDir, entry.name))));
     }
   }
 }
@@ -1886,6 +1907,10 @@ function printUsage2() {
   console.error("Usage: pro-gov lens report --target <path> --out <path>");
 }
 
+// src/commands/portfolio.ts
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join14 } from "node:path";
+
 // src/portfolio/manifest.ts
 import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
 function loadPortfolioManifest(configPath) {
@@ -1935,6 +1960,7 @@ function validatePortfolioManifest(value) {
       message: "Portfolio manifest portfolioId must be a non-empty string."
     });
   }
+  validateAllowedFields(value, "root", ["schemaVersion", "portfolioId", "controlPlane", "executionEngine", "targets"], issues);
   validateEndpoint(value.controlPlane, "controlPlane", issues);
   validateEndpoint(value.executionEngine, "executionEngine", issues);
   if (!Array.isArray(value.targets)) {
@@ -1956,6 +1982,7 @@ function validatePortfolioManifest(value) {
       continue;
     }
     validateEndpoint(target, "targets", issues);
+    validateAllowedFields(target, "target", ["id", "path", "profile", "assetBundles"], issues);
     if (typeof target.id === "string") {
       if (seenTargetIds.has(target.id)) {
         issues.push({
@@ -1966,14 +1993,41 @@ function validatePortfolioManifest(value) {
       }
       seenTargetIds.add(target.id);
     }
+    if (target.profile !== void 0 && (typeof target.profile !== "string" || !isValidProfile(target.profile))) {
+      issues.push({
+        type: "invalid-field",
+        id: typeof target.id === "string" ? target.id : void 0,
+        field: "profile",
+        message: "Portfolio target profile must be engineering-runtime or doc-only."
+      });
+    }
     validateOptionalStringArray(target.assetBundles, target.id, "assetBundles", issues);
-    validateOptionalStringArray(target.sharedRules, target.id, "sharedRules", issues);
+    if ("sharedRules" in target) {
+      issues.push({
+        type: "invalid-field",
+        id: typeof target.id === "string" ? target.id : void 0,
+        field: "sharedRules",
+        message: "Portfolio target sharedRules is not managed yet; remove it until plan/check supports it."
+      });
+    }
   }
   return issues;
 }
 function getDefaultPortfolioTargets(manifest) {
   return manifest?.targets ?? [];
 }
+function validateAllowedFields(value, location, allowedFields, issues) {
+  const allowed = new Set(allowedFields);
+  for (const field of Object.keys(value)) {
+    if (allowed.has(field)) continue;
+    issues.push({
+      type: "invalid-field",
+      id: typeof value.id === "string" ? value.id : void 0,
+      field,
+      message: `Unknown portfolio ${location} field: ${field}`
+    });
+  }
+}
 function validateEndpoint(value, field, issues) {
   if (value === void 0) return;
   if (!isRecord(value)) {
@@ -2029,6 +2083,7 @@ function runPortfolio(args) {
   const [subcommand2, ...rest] = args;
   if (subcommand2 === "check") return runPortfolioCheck(rest);
   if (subcommand2 === "plan") return runPortfolioPlan(rest);
+  if (subcommand2 === "assets-check") return runPortfolioAssetsCheck(rest);
   printUsage3();
   return 1;
 }
@@ -2085,7 +2140,9 @@ function runPortfolioPlan(args) {
     console.error(`Unknown portfolio target: ${options.value.targetId}`);
     return 1;
   }
-  const loadedAssets = loadAgentAssetRegistry();
+  const loadedAssets = loadAgentAssetRegistry({
+    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+  });
   if (loadedAssets.issues.length > 0) {
     for (const issue of loadedAssets.issues) {
       console.error(`${issue.type}: ${issue.message}`);
@@ -2136,6 +2193,106 @@ function runPortfolioPlan(args) {
     return 1;
   }
 }
+function runPortfolioAssetsCheck(args) {
+  const options = parsePortfolioOptions(args);
+  if (!options.ok) {
+    console.error(options.error);
+    printUsage3();
+    return 1;
+  }
+  const loaded = loadPortfolioManifest(options.value.configPath);
+  if (loaded.issues.length > 0 || !loaded.manifest) {
+    if (options.value.json) {
+      console.log(
+        JSON.stringify(
+          {
+            ok: false,
+            configPath: loaded.configPath,
+            issues: loaded.issues,
+            targets: []
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      for (const issue of loaded.issues) {
+        console.error(`${issue.type}: ${issue.message}`);
+      }
+    }
+    return 1;
+  }
+  const targets = getDefaultPortfolioTargets(loaded.manifest).filter(
+    (target) => !options.value.targetId || options.value.targetId === "all" || target.id === options.value.targetId
+  );
+  if (targets.length === 0) {
+    console.error(`Unknown portfolio target: ${options.value.targetId}`);
+    return 1;
+  }
+  const loadedAssets = loadAgentAssetRegistry({
+    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+  });
+  if (loadedAssets.issues.length > 0) {
+    if (options.value.json) {
+      console.log(
+        JSON.stringify(
+          {
+            ok: false,
+            configPath: loaded.configPath,
+            portfolioId: loaded.manifest.portfolioId,
+            registryIssues: loadedAssets.issues,
+            targets: []
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      for (const issue of loadedAssets.issues) {
+        console.error(`${issue.type}: ${issue.message}`);
+      }
+    }
+    return 1;
+  }
+  const targetResults = targets.map((target) => {
+    const result = checkInstalledAssets({
+      targetDir: target.path,
+      agentAssetsDir: loadedAssets.agentAssetsDir,
+      registry: loadedAssets.registry,
+      strictRegistry: true
+    });
+    return {
+      id: target.id,
+      path: target.path,
+      issues: result.issues
+    };
+  });
+  const ok = targetResults.every((target) => target.issues.length === 0);
+  if (options.value.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok,
+          configPath: loaded.configPath,
+          portfolioId: loaded.manifest.portfolioId,
+          agentAssetsDir: loadedAssets.agentAssetsDir,
+          targets: targetResults
+        },
+        null,
+        2
+      )
+    );
+  } else if (ok) {
+    console.log(`portfolio assets check passed (${targetResults.length} targets)`);
+  } else {
+    for (const target of targetResults) {
+      for (const issue of target.issues) {
+        console.log(`${target.id}	${issue.type}: ${issue.message}`);
+      }
+    }
+  }
+  return ok ? 0 : 1;
+}
 function parsePortfolioOptions(args) {
   const options = {
     configPath: "",
@@ -2171,15 +2328,20 @@ function parsePortfolioOptions(args) {
 function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
+function findPortfolioAgentAssetsDir(manifest) {
+  const agentAssetsDir = manifest?.executionEngine?.path ? join14(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync15(join14(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+}
 function printUsage3() {
   console.error("Usage:");
   console.error("  pro-gov portfolio check --config <path> [--json]");
   console.error("  pro-gov portfolio plan --config <path> [--target <id|all>] [--host codex|claude-code|gemini-cli|antigravity] [--json]");
+  console.error("  pro-gov portfolio assets-check --config <path> [--target <id|all>] [--json]");
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync15, readFileSync as readFileSync10 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 function runSync(args) {
   if (!args.includes("--check")) {
     console.error("pro-gov sync requires --check in this first read-only release.");
@@ -2188,8 +2350,8 @@ function runSync(args) {
   let differences = 0;
   console.log("pro-gov sync check");
   for (const file of planStarterFiles()) {
-    const targetPath = join14(process.cwd(), file.targetPath);
-    if (!existsSync15(targetPath)) {
+    const targetPath = join15(process.cwd(), file.targetPath);
+    if (!existsSync16(targetPath)) {
       console.log(`missing: ${file.targetPath}`);
       differences += 1;
       continue;
@@ -2216,11 +2378,12 @@ var COMMANDS = [
   "assets recommend [--target <path>] [--json]",
   "assets plan --bundle <bundle-id> [--target <path>] [--json]",
   "assets apply --plan <path>",
-  "assets check [--target <path>] [--json]",
+  "assets check [--target <path>] [--strict-registry] [--json]",
   "assets public-check [--public-root <path>] [--private-root <path>] [--json]",
   "assets npx add|update ... --plan",
   "portfolio check --config <path> [--json]",
   "portfolio plan --config <path> [--target <id|all>] [--json]",
+  "portfolio assets-check --config <path> [--target <id|all>] [--json]",
   "lens scan [--target <path>] [--json]",
   "lens inspect [--target <path>] [--format text|json]",
   "lens report --target <path> --out <path>",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pieai/pro-gov",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Project-level distribution kit for Project Governance System.",
   "keywords": [
     "ai-agents",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pieai/doc-gov": "^0.3.6"
+    "@pieai/doc-gov": "^0.3.7"
   },
   "devDependencies": {
     "@types/node": "24.13.2",