@rulemetric/hooks 0.15.1 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/hooks",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "publishConfig": {
     "access": "public"
   },

package/scripts/scoped-live.mjs

@@ -2,11 +2,11 @@ import { createHash } from 'node:crypto';
 import { readFileSync, lstatSync, realpathSync } from 'node:fs';
 import { resolve, join, dirname } from 'node:path';
 import { homedir } from 'node:os';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 
 const hash = bytes => createHash('sha256').update(bytes).digest('hex');
-export function readArtifact(root, path) {
+export function readArtifact(root, path, maxBytes = 200_000) {
   if (!path || path.startsWith('/') || path.includes('\\') || path.split('/').some(s => !s || s === '.' || s === '..')) throw new Error('Unsafe artifact path');
   let current = resolve(root);
   for (const segment of path.split('/')) {
@@ -15,10 +15,30 @@ export function readArtifact(root, path) {
     catch (error) { if (error.code === 'ENOENT') return null; throw error; }
   }
   const stat = lstatSync(current);
-  if (!stat.isFile() || stat.size > 200_000) throw new Error('Artifact is not a bounded regular file');
+  if (!stat.isFile() || stat.size > maxBytes) throw new Error('Artifact is not a bounded regular file');
   return readFileSync(current, 'utf8');
 }
 
+/** Execute only the prospectively frozen check, never an actor's success claim. */
+export function runRepositoryCheck(root, check) {
+  const definitionHash = hash(JSON.stringify({ name: check.name, path: check.path, kind: check.kind, expected: check.expected, primary: check.primary, command: check.command, timeoutMs: check.timeoutMs, fileHashes: Object.fromEntries(Object.entries(check.fileHashes).sort(([a], [b]) => a.localeCompare(b))) }));
+  const result = { name: check.name, definitionHash, exitCode: null, outputHash: null, error: null };
+  const unchanged = () => Object.entries(check.fileHashes).every(([path, expected]) => {
+    const content = readArtifact(root, path, 2_000_000);
+    return content !== null && hash(content) === expected;
+  });
+  try {
+    if (!unchanged()) return { ...result, error: 'Verifier files changed' };
+    const child = spawnSync(check.command[0], check.command.slice(1), {
+      cwd: root, timeout: check.timeoutMs, maxBuffer: 200_000, encoding: 'utf8',
+      env: { PATH: process.env.PATH, HOME: process.env.HOME, TMPDIR: process.env.TMPDIR, CI: '1' },
+    });
+    if (!unchanged()) return { ...result, error: 'Verifier files changed' };
+    return { ...result, exitCode: child.status, outputHash: hash((child.stdout ?? '') + (child.stderr ?? '')),
+      error: child.error ? child.error.message : child.signal ? `Verifier terminated: ${child.signal}` : null };
+  } catch (error) { return { ...result, error: error.message }; }
+}
+
 export function observeEnvironment(root) {
   const contextHashes = {};
   const context = path => {
@@ -68,6 +88,17 @@ export function transcriptEvidence(path, sessionId) {
 
 export function transcriptModels(path, sessionId) { return transcriptEvidence(path, sessionId).observedModels; }
 
+export function collectScopedOutcome(protocol, taskId, sessionId, root, transcriptPath) {
+    const environment = observeEnvironment(root);
+    const task = protocol.verification.tasks.find(task => task.taskId === taskId);
+    if (!task) throw new Error('Unknown task');
+    const artifacts = [...new Set(task.checks.map(check => check.path))].map(path => {
+      try { return { path, content: readArtifact(root, path) }; }
+      catch (error) { return { path, content: null, error: error.message }; }
+    });
+    return { externalSessionId: sessionId, projectPath: root, environment, ...transcriptEvidence(transcriptPath, sessionId), artifacts, commands: task.checks.filter(check => check.kind === 'command_exit').map(check => runRepositoryCheck(root, check)) };
+}
+
 export async function runScopedHook(mode, sessionId, root, model, transcriptPath) {
   const id = process.env.RULEMETRIC_SCOPED_CONFIRMATION_ID;
   const taskId = process.env.RULEMETRIC_SCOPED_TASK_ID;
@@ -86,21 +117,15 @@ export async function runScopedHook(mode, sessionId, root, model, transcriptPath
   const protocol = confirmation.protocol;
   const environment = protocol.verification ? observeEnvironment(root) : undefined;
   if (mode === 'start') {
-    const configurationHash = environment ? hash(JSON.stringify(environment)) : process.env.RULEMETRIC_SCOPED_CONFIGURATION_HASH;
-    const rendered = await request(`/scoped-live-confirmations/${id}/hook-render`, { taskId, externalSessionId: sessionId, model, projectPath: root, configurationHash, environment });
+    const configurationHash = environment ? hash(JSON.stringify(protocol.research?.enrollment === 'prospective-launches' ? { ...environment, repositoryRevision: protocol.verification.environment.repositoryRevision } : environment)) : process.env.RULEMETRIC_SCOPED_CONFIGURATION_HASH;
+    const rendered = await request(`/scoped-live-confirmations/${id}/hook-render`, { taskId, externalSessionId: sessionId, model, projectPath: root, configurationHash, environment, collectorVersion: 2 });
     const content = Buffer.from(rendered.contentBase64, 'base64');
     if (hash(content) !== rendered.deliveryHash) throw new Error('Scoped delivery hash mismatch');
     // No unhashed headings or wrappers are added to the treatment.
     await new Promise((resolve, reject) => process.stdout.write(content, error => error ? reject(error) : resolve()));
     await request(`/scoped-live-confirmations/${id}/assignments/${rendered.assignment.id}/delivery`, { deliveryHash: rendered.deliveryHash });
   } else if (mode === 'end' && protocol.verification) {
-    const task = protocol.verification.tasks.find(task => task.taskId === taskId);
-    if (!task) throw new Error('Unknown task');
-    const artifacts = [...new Set(task.checks.map(check => check.path))].map(path => {
-      try { return { path, content: readArtifact(root, path) }; }
-      catch (error) { return { path, content: null, error: error.message }; }
-    });
-    await request(`/scoped-live-confirmations/${id}/verify`, { externalSessionId: sessionId, projectPath: root, environment, ...transcriptEvidence(transcriptPath, sessionId), artifacts });
+    await request(`/scoped-live-confirmations/${id}/verify`, collectScopedOutcome(protocol, taskId, sessionId, root, transcriptPath));
     // A non-final task legitimately returns 409; its receipt is already durable.
     await request(`/scoped-live-confirmations/${id}/decide`, {}).catch(() => {});
   }