@riddledc/riddle-proof 0.8.32 → 0.8.33

package/dist/advanced/index.d.cts

@@ -1,5 +1,5 @@
 export { b as runner } from '../runner-4LJ5z0D-.cjs';
 export { l as engineHarness } from '../engine-harness-LBfqbFSe.cjs';
 export { p as proofRunCore } from '../proof-run-core-B1GeqkR8.cjs';
-export { p as proofRunEngine } from '../proof-run-engine-DeHxtGnW.cjs';
+export { p as proofRunEngine } from '../proof-run-engine-4dM37pEx.cjs';
 import '../types.cjs';

package/dist/advanced/index.d.ts

@@ -1,5 +1,5 @@
 export { b as runner } from '../runner-BdQpOkZD.js';
 export { l as engineHarness } from '../engine-harness-CMACHP6A.js';
 export { p as proofRunCore } from '../proof-run-core-B1GeqkR8.js';
-export { p as proofRunEngine } from '../proof-run-engine-DYfmd8d7.js';
+export { p as proofRunEngine } from '../proof-run-engine-BqaeqAze.js';
 import '../types.js';

package/dist/advanced/proof-run-engine.d.cts

@@ -1,2 +1,2 @@
-export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-DeHxtGnW.cjs';
+export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-4dM37pEx.cjs';
 import '../proof-run-core-B1GeqkR8.cjs';

package/dist/advanced/proof-run-engine.d.ts

@@ -1,2 +1,2 @@
-export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-DYfmd8d7.js';
+export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from '../proof-run-engine-BqaeqAze.js';
 import '../proof-run-core-B1GeqkR8.js';

package/dist/{proof-run-engine-DeHxtGnW.d.cts → proof-run-engine-4dM37pEx.d.cts}

@@ -292,7 +292,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     blocking?: boolean;
     details?: Record<string, unknown>;
     ok: boolean;
-    action: "recon" | "author" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     summary: string;
@@ -382,7 +382,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     continueWithStage?: WorkflowStage | null;
     blocking?: boolean;
     details?: Record<string, unknown>;
-    action: "recon" | "author" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     checkpoint: string;
@@ -659,7 +659,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     error?: undefined;
 } | {
     ok: boolean;
-    action: "recon" | "author" | "ship" | "implement" | "verify" | "setup";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup";
     state_path: string;
     stage: any;
     summary: string;

package/dist/{proof-run-engine-DYfmd8d7.d.ts → proof-run-engine-BqaeqAze.d.ts}

@@ -292,7 +292,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     blocking?: boolean;
     details?: Record<string, unknown>;
     ok: boolean;
-    action: "recon" | "author" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     summary: string;
@@ -382,7 +382,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     continueWithStage?: WorkflowStage | null;
     blocking?: boolean;
     details?: Record<string, unknown>;
-    action: "recon" | "author" | "ship" | "implement" | "verify" | "setup" | "run";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup" | "run";
     state_path: string;
     stage: any;
     checkpoint: string;
@@ -659,7 +659,7 @@ declare function executeWorkflow(params: WorkflowParams, pluginConfig: any, reso
     error?: undefined;
 } | {
     ok: boolean;
-    action: "recon" | "author" | "ship" | "implement" | "verify" | "setup";
+    action: "author" | "recon" | "ship" | "implement" | "verify" | "setup";
     state_path: string;
     stage: any;
     summary: string;

package/dist/proof-run-engine.d.cts

@@ -1,2 +1,2 @@
 import './proof-run-core-B1GeqkR8.cjs';
-export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from './proof-run-engine-DeHxtGnW.cjs';
+export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from './proof-run-engine-4dM37pEx.cjs';

package/dist/proof-run-engine.d.ts

@@ -1,2 +1,2 @@
 import './proof-run-core-B1GeqkR8.js';
-export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from './proof-run-engine-DYfmd8d7.js';
+export { R as RiddleProofEngine, c as createRiddleProofEngine, e as executeWorkflow } from './proof-run-engine-BqaeqAze.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.8.32",
+  "version": "0.8.33",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",

package/runtime/lib/ship.py

@@ -362,6 +362,11 @@ def resolve_github_repo_name(repo_dir):
     return ''
 
 
+def github_file_url(repo_name, ref, path_value, mode='blob'):
+    safe_path = urllib.parse.quote(str(path_value or '').lstrip('/'), safe='/._-')
+    return 'https://github.com/' + repo_name + '/' + mode + '/' + ref + '/' + safe_path
+
+
 def write_artifact_readme(path_value, state, artifacts):
     lines = [
         '# Riddle Proof Artifacts',
@@ -467,16 +472,16 @@ def publish_local_proof_artifacts_to_github(state, repo_dir, pr_num):
         for artifact in published:
             if artifact.get('published'):
                 published_path = artifact.get('published_path')
-                artifact['raw_url'] = 'https://raw.githubusercontent.com/' + repo_name + '/' + commit + '/' + published_path
-                artifact['html_url'] = 'https://github.com/' + repo_name + '/blob/' + commit + '/' + published_path
+                artifact['raw_url'] = github_file_url(repo_name, commit, published_path, 'raw')
+                artifact['html_url'] = github_file_url(repo_name, commit, published_path, 'blob')
         publication = {
             'ok': True,
             'branch': artifact_branch,
             'commit': commit,
             'repo': repo_name,
-            'html_url': 'https://github.com/' + repo_name + '/tree/' + commit + '/' + artifact_dir_name,
-            'manifest_url': 'https://github.com/' + repo_name + '/blob/' + commit + '/' + artifact_dir_name + '/proof-artifacts.json',
-            'readme_url': 'https://github.com/' + repo_name + '/blob/' + commit + '/' + artifact_dir_name + '/README.md',
+            'html_url': github_file_url(repo_name, commit, artifact_dir_name, 'tree'),
+            'manifest_url': github_file_url(repo_name, commit, artifact_dir_name + '/proof-artifacts.json', 'blob'),
+            'readme_url': github_file_url(repo_name, commit, artifact_dir_name + '/README.md', 'blob'),
             'source_fingerprint': source_fingerprint,
             'artifacts': published,
         }

package/runtime/tests/ship_artifact_publication.py

@@ -163,13 +163,16 @@ def main():
         assert publication.get("ok") is True, "proof artifact publication should be recorded"
         assert publication.get("artifacts"), "published artifact list should be recorded"
         assert updated.get("ship_report", {}).get("after_artifact_url", "").startswith(
-            "https://raw.githubusercontent.com/example/test-repo/"
-        ), "ship report should expose a public after artifact URL"
+            "https://github.com/example/test-repo/raw/"
+        ), "ship report should expose a GitHub-hosted after artifact URL"
 
         comment = comment_body_path.read_text(encoding="utf-8")
         assert "file://" not in comment, "PR proof comment must not expose local file URLs"
-        assert "![after](https://raw.githubusercontent.com/example/test-repo/" in comment, (
-            "PR proof comment should embed the GitHub-hosted after screenshot"
+        assert "raw.githubusercontent.com" not in comment, (
+            "PR proof comment must not depend on unauthenticated raw GitHub URLs"
+        )
+        assert "![after](https://github.com/example/test-repo/raw/" in comment, (
+            "PR proof comment should embed the GitHub-hosted after screenshot using a private-repo-safe URL"
         )
         assert "[proof.json](https://github.com/example/test-repo/blob/" in comment, (
             "PR proof comment should link the structured proof JSON"