@the-open-engine/zeroshot 6.38.0 → 6.39.0

package/src/omp-blob-root.ts

@@ -0,0 +1,116 @@
+// Resolution of OMP's *shared* content-addressed blob store root, mirrored from the tagged
+// v17.2.1 source (`packages/utils/src/dirs.ts`: `getBlobsDir()` / `DirResolver`) rather than
+// invented by Zeroshot.
+//
+// Why this exists: OMP externalizes large payloads (images, provider data URLs) out of the session
+// JSONL into `<blobsDir>/<sha256-hex>` and leaves a nested `blob:sha256:<hex>` reference string
+// inside the JSONL record (`packages/coding-agent/src/session/blob-store.ts`). The store is shared
+// by every session on the machine and lives at `~/.omp/agent/blobs` by default — nowhere near
+// Zeroshot's per-task session partition. A resumed partition whose referenced blobs are missing is
+// an invalid continuation, so verification has to resolve them at this real root; and because the
+// root is shared, Zeroshot cleanup must never delete anything under it.
+//
+// Resolution order, exactly as `DirResolver`'s constructor computes it:
+//   profile      = normalize(OMP_PROFILE ?? PI_PROFILE)         // OMP_PROFILE wins; '' selects default
+//   configRoot   = ~/${PI_CONFIG_DIR || '.omp'}[/profiles/<profile>]
+//   defaultAgent = <configRoot>/agent
+//   agentDir     = profile ? defaultAgent : (resolve(PI_CODING_AGENT_DIR) || defaultAgent)
+//   dataBase     = (linux|darwin) && agentDir === defaultAgent && $XDG_DATA_HOME/omp[/profiles/<p>]
+//                  exists ? that : agentDir                      // XDG flattens the agent/ prefix
+//   blobsDir     = <dataBase>/blobs
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+
+type Environment = Readonly<Record<string, string | undefined>>;
+
+interface OmpBlobsDirOptions {
+  readonly env?: Environment;
+  readonly homedir?: string;
+  readonly platform?: NodeJS.Platform;
+}
+
+const APP_NAME = 'omp';
+const CONFIG_DIR_NAME = '.omp';
+// dirs.ts PROFILE_NAME_RE / WINDOWS_RESERVED_BASENAME_RE.
+const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+const WINDOWS_RESERVED_BASENAME_PATTERN = /^(?:CON|PRN|AUX|NUL|COM[0-9]|LPT[0-9])(?:\..*)?$/iu;
+
+/** dirs.ts normalizeProfileName, but total: an invalid name resolves to the default profile here
+ * instead of throwing. A resume against a profile OMP itself would reject cannot succeed anyway —
+ * the verifier will simply not find the referenced blobs and fail the continuation closed. */
+function normalizeProfileName(profile: unknown): string | undefined {
+  const normalized = typeof profile === 'string' ? profile.trim() : '';
+  if (!normalized || normalized === 'default') return undefined;
+  if (
+    normalized === '.' ||
+    normalized === '..' ||
+    normalized.endsWith('.') ||
+    !PROFILE_NAME_PATTERN.test(normalized) ||
+    WINDOWS_RESERVED_BASENAME_PATTERN.test(normalized)
+  ) {
+    return undefined;
+  }
+  return normalized;
+}
+
+function activeProfile(env: Environment): string | undefined {
+  return normalizeProfileName(env.OMP_PROFILE !== undefined ? env.OMP_PROFILE : env.PI_PROFILE);
+}
+
+function directoryExists(candidate: string): boolean {
+  try {
+    return fs.statSync(candidate).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Absolute path of the shared OMP blob store for the current environment.
+ * `env`/`homedir`/`platform` are injectable for tests only; production callers pass nothing.
+ */
+function resolveOmpBlobsDir({
+  env = process.env,
+  homedir = os.homedir(),
+  platform = process.platform,
+}: OmpBlobsDirOptions = {}): string {
+  const profile = activeProfile(env);
+  const configDirName = env.PI_CONFIG_DIR || CONFIG_DIR_NAME;
+  const baseConfigRoot = path.join(homedir, configDirName);
+  const configRoot = profile ? path.join(baseConfigRoot, 'profiles', profile) : baseConfigRoot;
+
+  const defaultAgentDir = path.join(configRoot, 'agent');
+  // A named profile pins the agent dir to the profile root; PI_CODING_AGENT_DIR applies only in
+  // default mode (dirs.ts: `const agentDirOverride = profile ? undefined : options.agentDirOverride`).
+  const agentDirOverride = profile ? undefined : env.PI_CODING_AGENT_DIR;
+  const agentDir = agentDirOverride ? path.resolve(agentDirOverride) : defaultAgentDir;
+
+  let dataBase = agentDir;
+  if ((platform === 'linux' || platform === 'darwin') && agentDir === defaultAgentDir) {
+    const xdgDataHome = env.XDG_DATA_HOME;
+    if (xdgDataHome) {
+      const appRoot = path.join(xdgDataHome, APP_NAME);
+      const candidate = profile ? path.join(appRoot, 'profiles', profile) : appRoot;
+      if (directoryExists(candidate)) dataBase = candidate;
+    }
+  }
+
+  return path.join(dataBase, 'blobs');
+}
+
+/** True when `candidate` is the shared blob root or anything inside it. Cleanup uses this as a
+ * hard stop: a Zeroshot partition must never resolve into OMP's shared, cross-session CAS. */
+function isInsideOmpBlobsDir(candidate: string, options: OmpBlobsDirOptions = {}): boolean {
+  const blobsDir = resolveOmpBlobsDir(options);
+  const resolved = path.resolve(candidate);
+  return resolved === blobsDir || resolved.startsWith(blobsDir + path.sep);
+}
+
+export = {
+  APP_NAME,
+  CONFIG_DIR_NAME,
+  isInsideOmpBlobsDir,
+  normalizeProfileName,
+  resolveOmpBlobsDir,
+};

package/src/omp-config-overlay.js

@@ -1,13 +1,44 @@
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { createHash, randomUUID } = require('crypto');
-
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const OVERLAY_PREFIX = 'zeroshot-omp-config-';
 const OMP_CONFIG_OVERLAY_DIR_PATTERN = /^zeroshot-omp-config-[A-Za-z0-9_-]+$/u;
-const OMP_CONFIG_OVERLAY_FILE_PATTERN =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.yml$/u;
-
+const OMP_CONFIG_OVERLAY_FILE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.yml$/u;
 // Verified against tagged v17.2.1 source: packages/coding-agent/src/config/settings-schema.ts
 // (key types/defaults) and packages/coding-agent/src/main.ts (HOST_DEFAULTED_SETTING_PATHS /
 // RPC_BACKGROUND_DEFAULTED_SETTING_PATHS). RPC mode (docs/rpc.md) only re-applies its own
@@ -61,44 +92,40 @@ bash:
     enabled: false
     thresholdMs: 60000
 `;
-
 // Identity of the overlay *content*, not of any one temp file. A resumed session was produced
 // under whatever workflow-altering defaults this body pinned; if the body changes (a Zeroshot
 // upgrade retunes task.*/memory/advisor/async behaviour), continuing an old transcript under the
 // new rules is execution drift, so this digest is part of the OMP execution fingerprint recorded
-// with every resumable session (src/omp-execution-fingerprint.js).
-const OMP_CONFIG_OVERLAY_DIGEST = `sha256:${createHash('sha256').update(OVERLAY_BODY, 'utf8').digest('hex')}`;
-
+// with every resumable session (src/omp-execution-fingerprint.ts).
+const OMP_CONFIG_OVERLAY_DIGEST = `sha256:${(0, crypto_1.createHash)('sha256').update(OVERLAY_BODY, 'utf8').digest('hex')}`;
 function createOmpConfigOverlay() {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX), { mode: 0o700 });
-  try {
-    const file = path.join(dir, `${randomUUID()}.yml`);
-    fs.writeFileSync(file, OVERLAY_BODY, { flag: 'wx', mode: 0o600 });
-    if (process.platform !== 'win32') {
-      fs.chmodSync(dir, 0o700);
-      fs.chmodSync(file, 0o600);
+    const directoryOptions = { mode: 0o700 };
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX), directoryOptions);
+    try {
+        const file = path.join(dir, `${(0, crypto_1.randomUUID)()}.yml`);
+        fs.writeFileSync(file, OVERLAY_BODY, { flag: 'wx', mode: 0o600 });
+        if (process.platform !== 'win32') {
+            fs.chmodSync(dir, 0o700);
+            fs.chmodSync(file, 0o600);
+        }
+        return { dir, file };
+    }
+    catch (error) {
+        fs.rmSync(dir, { recursive: true, force: true });
+        throw error;
     }
-    return { dir, file };
-  } catch (error) {
-    fs.rmSync(dir, { recursive: true, force: true });
-    throw error;
-  }
 }
-
 function isCanonicalOmpConfigOverlayDirectory(overlayDir) {
-  if (typeof overlayDir !== 'string' || !overlayDir || path.resolve(overlayDir) !== overlayDir) {
-    return false;
-  }
-  return (
-    path.dirname(overlayDir) === path.resolve(os.tmpdir()) &&
-    OMP_CONFIG_OVERLAY_DIR_PATTERN.test(path.basename(overlayDir))
-  );
+    if (typeof overlayDir !== 'string' || !overlayDir || path.resolve(overlayDir) !== overlayDir) {
+        return false;
+    }
+    return (path.dirname(overlayDir) === path.resolve(os.tmpdir()) &&
+        OMP_CONFIG_OVERLAY_DIR_PATTERN.test(path.basename(overlayDir)));
 }
-
 module.exports = {
-  OMP_CONFIG_OVERLAY_DIGEST,
-  OMP_CONFIG_OVERLAY_DIR_PATTERN,
-  OMP_CONFIG_OVERLAY_FILE_PATTERN,
-  createOmpConfigOverlay,
-  isCanonicalOmpConfigOverlayDirectory,
+    OMP_CONFIG_OVERLAY_DIGEST,
+    OMP_CONFIG_OVERLAY_DIR_PATTERN,
+    OMP_CONFIG_OVERLAY_FILE_PATTERN,
+    createOmpConfigOverlay,
+    isCanonicalOmpConfigOverlayDirectory,
 };

package/src/omp-config-overlay.ts

@@ -0,0 +1,110 @@
+import { createHash, randomUUID } from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+
+interface OmpConfigOverlay {
+  readonly dir: string;
+  readonly file: string;
+}
+
+const OVERLAY_PREFIX = 'zeroshot-omp-config-';
+const OMP_CONFIG_OVERLAY_DIR_PATTERN = /^zeroshot-omp-config-[A-Za-z0-9_-]+$/u;
+const OMP_CONFIG_OVERLAY_FILE_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.yml$/u;
+
+// Verified against tagged v17.2.1 source: packages/coding-agent/src/config/settings-schema.ts
+// (key types/defaults) and packages/coding-agent/src/main.ts (HOST_DEFAULTED_SETTING_PATHS /
+// RPC_BACKGROUND_DEFAULTED_SETTING_PATHS). RPC mode (docs/rpc.md) only re-applies its own
+// neutral defaults for task.*/memory.backend/memories.enabled/advisor.*/tier.advisor/
+// async.*/bash.autoBackground.* when a path is completely unconfigured at every settings
+// layer; `todo.*` is explicitly caller-controlled and never host-defaulted in RPC mode
+// (main.ts: "embedders need project-level opt-outs for reminder/prelude prompt injection").
+// A host's ~/.omp/agent/config.yml or project .omp/config.yml can therefore change one of
+// these workflow-altering namespaces out from under an unattended RPC worker. This overlay
+// pins every one of them to its schema built-in default plus marketplace.autoUpdate off, so
+// Zeroshot's worker behavior never depends on the host machine's OMP config. It deliberately
+// never sets context/skills/rules/extensions/mcp keys, which keep flowing from native
+// project/user config underneath this overlay.
+const OVERLAY_BODY = `# Zeroshot-owned OMP safety overlay — do not add model/profile settings.
+marketplace:
+  autoUpdate: "off"
+todo:
+  enabled: true
+  reminders: true
+  remindersMax: 3
+  eager: "default"
+task:
+  isolation:
+    mode: "none"
+    apply: true
+    merge: "patch"
+    commits: "generic"
+  eager: "default"
+  batch: true
+  maxConcurrency: 32
+  maxRecursionDepth: 2
+  disabledAgents: []
+  agentModelOverrides: {}
+  agentPrewalk: {}
+memory:
+  backend: "off"
+memories:
+  enabled: false
+advisor:
+  enabled: false
+  subagents: false
+  syncBacklog: "off"
+  immuneTurns: 3
+tier:
+  advisor: "none"
+async:
+  enabled: true
+  maxJobs: 100
+bash:
+  autoBackground:
+    enabled: false
+    thresholdMs: 60000
+`;
+
+// Identity of the overlay *content*, not of any one temp file. A resumed session was produced
+// under whatever workflow-altering defaults this body pinned; if the body changes (a Zeroshot
+// upgrade retunes task.*/memory/advisor/async behaviour), continuing an old transcript under the
+// new rules is execution drift, so this digest is part of the OMP execution fingerprint recorded
+// with every resumable session (src/omp-execution-fingerprint.ts).
+const OMP_CONFIG_OVERLAY_DIGEST = `sha256:${createHash('sha256').update(OVERLAY_BODY, 'utf8').digest('hex')}`;
+
+function createOmpConfigOverlay(): OmpConfigOverlay {
+  const directoryOptions: fs.EncodingOption & { readonly mode: number } = { mode: 0o700 };
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), OVERLAY_PREFIX), directoryOptions);
+  try {
+    const file = path.join(dir, `${randomUUID()}.yml`);
+    fs.writeFileSync(file, OVERLAY_BODY, { flag: 'wx', mode: 0o600 });
+    if (process.platform !== 'win32') {
+      fs.chmodSync(dir, 0o700);
+      fs.chmodSync(file, 0o600);
+    }
+    return { dir, file };
+  } catch (error) {
+    fs.rmSync(dir, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function isCanonicalOmpConfigOverlayDirectory(overlayDir: unknown): boolean {
+  if (typeof overlayDir !== 'string' || !overlayDir || path.resolve(overlayDir) !== overlayDir) {
+    return false;
+  }
+  return (
+    path.dirname(overlayDir) === path.resolve(os.tmpdir()) &&
+    OMP_CONFIG_OVERLAY_DIR_PATTERN.test(path.basename(overlayDir))
+  );
+}
+
+export = {
+  OMP_CONFIG_OVERLAY_DIGEST,
+  OMP_CONFIG_OVERLAY_DIR_PATTERN,
+  OMP_CONFIG_OVERLAY_FILE_PATTERN,
+  createOmpConfigOverlay,
+  isCanonicalOmpConfigOverlayDirectory,
+};

package/src/omp-execution-fingerprint.js

@@ -1,3 +1,4 @@
+"use strict";
 // The `executionFingerprint` recorded with every resumable OMP session (issue #866).
 //
 // A session transcript is only safely continuable under the same execution contract that produced
@@ -7,56 +8,50 @@
 // between the recording turn and a resume attempt — a Zeroshot upgrade that retunes the overlay, a
 // changed level mapping, an alias resolving to a different concrete model, a different thinking
 // level — makes the fingerprints differ, and the continuation is refused before the prompt.
-const { createHash } = require('crypto');
+const crypto_1 = require("crypto");
+// The generated CommonJS module resolves the maintained overlay at the matching runtime path.
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
 const { OMP_CONFIG_OVERLAY_DIGEST } = require('./omp-config-overlay');
-
 /** Value of `--flag <value>` in an argv array, or '' when the flag is absent. */
 function flagValue(args, flag) {
-  if (!Array.isArray(args)) return '';
-  const index = args.indexOf(flag);
-  if (index < 0 || index + 1 >= args.length) return '';
-  const value = args[index + 1];
-  return typeof value === 'string' ? value : '';
+    if (!Array.isArray(args))
+        return '';
+    const index = args.indexOf(flag);
+    if (index < 0 || index + 1 >= args.length)
+        return '';
+    const value = args[index + 1];
+    return typeof value === 'string' ? value : '';
 }
-
 /** The Zeroshot-requested half of the contract, readable from the command spec alone. */
 function requestedExecutionSelectors(commandSpec) {
-  const args = commandSpec?.args;
-  return {
-    modelSelector: flagValue(args, '--model'),
-    thinkingSelector: flagValue(args, '--thinking'),
-    approvalMode: flagValue(args, '--approval-mode'),
-  };
+    const args = commandSpec?.args;
+    return {
+        modelSelector: flagValue(args, '--model'),
+        thinkingSelector: flagValue(args, '--thinking'),
+        approvalMode: flagValue(args, '--approval-mode'),
+    };
 }
-
-/**
- * @param {object} params
- * @param {string} params.expectedVersion pinned OMP release (OMP_SUPPORTED_VERSION)
- * @param {object} params.commandSpec the spec OMP was actually spawned with
- * @param {object} params.evidence OMP's reported session evidence (selectedProvider/Model, thinkingLevel)
- * @param {string} [params.configOverlayDigest] injectable for tests only
- * @returns {string} `sha256:<64-lower-hex>`
- */
-function computeOmpExecutionFingerprint({
-  expectedVersion,
-  commandSpec,
-  evidence,
-  configOverlayDigest = OMP_CONFIG_OVERLAY_DIGEST,
-}) {
-  const fields = {
-    ompSupportedVersion: String(expectedVersion ?? ''),
-    configOverlayDigest: String(configOverlayDigest ?? ''),
-    ...requestedExecutionSelectors(commandSpec),
-    observedProvider: String(evidence?.selectedProvider ?? ''),
-    observedModel: String(evidence?.selectedModel ?? ''),
-    observedThinkingLevel: String(evidence?.thinkingLevel ?? ''),
-  };
-  const stable = {};
-  for (const key of Object.keys(fields).sort()) stable[key] = fields[key];
-  return `sha256:${createHash('sha256').update(JSON.stringify(stable), 'utf8').digest('hex')}`;
+/** Compute the deterministic digest for the requested and observed OMP execution contract. */
+function computeOmpExecutionFingerprint({ expectedVersion, commandSpec, evidence, configOverlayDigest = OMP_CONFIG_OVERLAY_DIGEST, }) {
+    const fields = {
+        ompSupportedVersion: String(expectedVersion ?? ''),
+        configOverlayDigest: String(configOverlayDigest ?? ''),
+        ...requestedExecutionSelectors(commandSpec),
+        observedProvider: String(evidence?.selectedProvider ?? ''),
+        observedModel: String(evidence?.selectedModel ?? ''),
+        observedThinkingLevel: String(evidence?.thinkingLevel ?? ''),
+    };
+    const stable = {};
+    // Fingerprints preserve ECMAScript's locale-independent UTF-16 code-unit ordering.
+    // eslint-disable-next-line sonarjs/no-alphabetical-sort
+    for (const key of Object.keys(fields).sort()) {
+        const value = fields[key];
+        if (value !== undefined)
+            stable[key] = value;
+    }
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(JSON.stringify(stable), 'utf8').digest('hex')}`;
 }
-
 module.exports = {
-  computeOmpExecutionFingerprint,
-  requestedExecutionSelectors,
+    computeOmpExecutionFingerprint,
+    requestedExecutionSelectors,
 };

package/src/omp-execution-fingerprint.ts

@@ -0,0 +1,92 @@
+// The `executionFingerprint` recorded with every resumable OMP session (issue #866).
+//
+// A session transcript is only safely continuable under the same execution contract that produced
+// it. This digest binds that contract: the pinned OMP release, the Zeroshot config overlay's
+// content, the requested Zeroshot selectors (`--model`, `--thinking`, `--approval-mode`), and the
+// concrete provider/model/thinking level OMP actually reported for the turn. Any of those drifting
+// between the recording turn and a resume attempt — a Zeroshot upgrade that retunes the overlay, a
+// changed level mapping, an alias resolving to a different concrete model, a different thinking
+// level — makes the fingerprints differ, and the continuation is refused before the prompt.
+import { createHash } from 'crypto';
+
+interface ConfigOverlayFacade {
+  readonly OMP_CONFIG_OVERLAY_DIGEST: string;
+}
+
+interface CommandSpec {
+  readonly args?: unknown;
+}
+
+interface OmpSessionEvidence {
+  readonly selectedProvider?: unknown;
+  readonly selectedModel?: unknown;
+  readonly thinkingLevel?: unknown;
+}
+
+interface FingerprintParams {
+  readonly expectedVersion: unknown;
+  readonly commandSpec: CommandSpec | null | undefined;
+  readonly evidence: OmpSessionEvidence | null | undefined;
+  readonly configOverlayDigest?: unknown;
+}
+
+interface RequestedExecutionSelectors {
+  readonly modelSelector: string;
+  readonly thinkingSelector: string;
+  readonly approvalMode: string;
+}
+
+// The generated CommonJS module resolves the maintained overlay at the matching runtime path.
+// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+const { OMP_CONFIG_OVERLAY_DIGEST }: ConfigOverlayFacade = require('./omp-config-overlay');
+
+/** Value of `--flag <value>` in an argv array, or '' when the flag is absent. */
+function flagValue(args: unknown, flag: string): string {
+  if (!Array.isArray(args)) return '';
+  const index = args.indexOf(flag);
+  if (index < 0 || index + 1 >= args.length) return '';
+  const value: unknown = args[index + 1];
+  return typeof value === 'string' ? value : '';
+}
+
+/** The Zeroshot-requested half of the contract, readable from the command spec alone. */
+function requestedExecutionSelectors(
+  commandSpec: CommandSpec | null | undefined
+): RequestedExecutionSelectors {
+  const args = commandSpec?.args;
+  return {
+    modelSelector: flagValue(args, '--model'),
+    thinkingSelector: flagValue(args, '--thinking'),
+    approvalMode: flagValue(args, '--approval-mode'),
+  };
+}
+
+/** Compute the deterministic digest for the requested and observed OMP execution contract. */
+function computeOmpExecutionFingerprint({
+  expectedVersion,
+  commandSpec,
+  evidence,
+  configOverlayDigest = OMP_CONFIG_OVERLAY_DIGEST,
+}: FingerprintParams): string {
+  const fields: Record<string, string> = {
+    ompSupportedVersion: String(expectedVersion ?? ''),
+    configOverlayDigest: String(configOverlayDigest ?? ''),
+    ...requestedExecutionSelectors(commandSpec),
+    observedProvider: String(evidence?.selectedProvider ?? ''),
+    observedModel: String(evidence?.selectedModel ?? ''),
+    observedThinkingLevel: String(evidence?.thinkingLevel ?? ''),
+  };
+  const stable: Record<string, string> = {};
+  // Fingerprints preserve ECMAScript's locale-independent UTF-16 code-unit ordering.
+  // eslint-disable-next-line sonarjs/no-alphabetical-sort
+  for (const key of Object.keys(fields).sort()) {
+    const value = fields[key];
+    if (value !== undefined) stable[key] = value;
+  }
+  return `sha256:${createHash('sha256').update(JSON.stringify(stable), 'utf8').digest('hex')}`;
+}
+
+export = {
+  computeOmpExecutionFingerprint,
+  requestedExecutionSelectors,
+};

package/src/omp-session-limits.js

@@ -1,19 +1,15 @@
-// Non-configurable bounds for OMP session partition verification (src/omp-session-verifier.js).
-// Every value is pinned exactly as specified by issue #866; do not derive these from settings or
-// environment — a configurable ceiling here would let a compromised/misbehaving OMP process (or a
-// hostile resumed partition) negotiate its own verification budget.
+"use strict";
 const OMP_SESSION_LIMITS = Object.freeze({
-  maxSessionBytes: 268435456,
-  maxSessionRecords: 1000000,
-  maxArtifactEntries: 4096,
-  maxArtifactDepth: 16,
-  maxRelativePathBytes: 4096,
-  maxArtifactFileBytes: 268435456,
-  maxArtifactAggregateBytes: 536870912,
-  maxBlobReferences: 4096,
-  maxReferencedBlobBytes: 67108864,
+    maxSessionBytes: 268435456,
+    maxSessionRecords: 1000000,
+    maxArtifactEntries: 4096,
+    maxArtifactDepth: 16,
+    maxRelativePathBytes: 4096,
+    maxArtifactFileBytes: 268435456,
+    maxArtifactAggregateBytes: 536870912,
+    maxBlobReferences: 4096,
+    maxReferencedBlobBytes: 67108864,
 });
-
 /**
  * The largest single JSONL record the verifier will buffer, DERIVED from the constants above
  * rather than chosen — it is `maxReferencedBlobBytes`, and it is not a new knob (there is nothing
@@ -37,5 +33,4 @@ const OMP_SESSION_LIMITS = Object.freeze({
  * verifier accumulates session, artifact, or blob bytes.
  */
 const MAX_SESSION_RECORD_BYTES = OMP_SESSION_LIMITS.maxReferencedBlobBytes;
-
 module.exports = { OMP_SESSION_LIMITS, MAX_SESSION_RECORD_BYTES };

package/src/omp-session-limits.ts

@@ -0,0 +1,53 @@
+// Non-configurable bounds for OMP session partition verification (src/omp-session-verifier.js).
+// Every value is pinned exactly as specified by issue #866; do not derive these from settings or
+// environment — a configurable ceiling here would let a compromised/misbehaving OMP process (or a
+// hostile resumed partition) negotiate its own verification budget.
+interface OmpSessionLimits {
+  readonly maxSessionBytes: number;
+  readonly maxSessionRecords: number;
+  readonly maxArtifactEntries: number;
+  readonly maxArtifactDepth: number;
+  readonly maxRelativePathBytes: number;
+  readonly maxArtifactFileBytes: number;
+  readonly maxArtifactAggregateBytes: number;
+  readonly maxBlobReferences: number;
+  readonly maxReferencedBlobBytes: number;
+}
+
+const OMP_SESSION_LIMITS: Readonly<OmpSessionLimits> = Object.freeze({
+  maxSessionBytes: 268435456,
+  maxSessionRecords: 1000000,
+  maxArtifactEntries: 4096,
+  maxArtifactDepth: 16,
+  maxRelativePathBytes: 4096,
+  maxArtifactFileBytes: 268435456,
+  maxArtifactAggregateBytes: 536870912,
+  maxBlobReferences: 4096,
+  maxReferencedBlobBytes: 67108864,
+});
+
+/**
+ * The largest single JSONL record the verifier will buffer, DERIVED from the constants above
+ * rather than chosen — it is `maxReferencedBlobBytes`, and it is not a new knob (there is nothing
+ * to configure and no caller may override it).
+ *
+ * Why a per-record bound is needed at all: `maxSessionBytes` bounds the *file*, not a line within
+ * it. A hostile 256 MiB session with no newline in it is one record, and buffering it would cost
+ * the raw bytes, a concatenated copy, a UTF-16 string for JSON.parse, and the parsed value — a
+ * multi-hundred-megabyte spike driven entirely by the attacker's choice of where to put newlines.
+ *
+ * Why this value: `maxReferencedBlobBytes` is the issue's own answer to "how large may one
+ * addressable unit of session content be". OMP externalizes anything bigger than a message to the
+ * shared CAS store (blob-store.ts) and leaves only a 76-byte `blob:sha256:<hex>` reference in the
+ * record, so a legitimate record is orders of magnitude smaller than this; the bound exists to cap
+ * the pathological case, not to constrain real transcripts.
+ *
+ * Remaining allocation, exactly: verification buffers at most MAX_SESSION_RECORD_BYTES of raw
+ * record bytes, and `JSON.parse` necessarily materializes that record as one UTF-16 string plus its
+ * parsed value. Peak per-record cost is therefore O(MAX_SESSION_RECORD_BYTES) and independent of
+ * `maxSessionBytes`, the record count, and the file's newline placement. Nothing else in the
+ * verifier accumulates session, artifact, or blob bytes.
+ */
+const MAX_SESSION_RECORD_BYTES = OMP_SESSION_LIMITS.maxReferencedBlobBytes;
+
+export = { OMP_SESSION_LIMITS, MAX_SESSION_RECORD_BYTES };

package/src/omp-session-partition.js

@@ -5,9 +5,9 @@ const { isInsideOmpBlobsDir } = require('./omp-blob-root');
 
 // Every OMP session partition lives under <storageRoot>/omp-sessions/<uuid>/. storageRoot is the
 // owning cluster's storageDir for cluster-agent tasks or the standalone TASKS_DIR otherwise (see
-// task-lib/omp-storage-root.js) — never derived from prompt text or cwd. The shared OMP CAS blob
+// task-lib/omp-storage-root.ts) — never derived from prompt text or cwd. The shared OMP CAS blob
 // store is *not* under here at all (it is machine-wide, at pi-utils::getBlobsDir(); see
-// src/omp-blob-root.js), which is what makes per-task partition deletion safe.
+// src/omp-blob-root.ts), which is what makes per-task partition deletion safe.
 const OMP_SESSIONS_SUBDIR = 'omp-sessions';
 const PARTITION_ID_PATTERN =
   /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;

package/src/omp-session-verifier.js

@@ -10,7 +10,7 @@
 // CAS blobs are NOT part of the partition. OMP externalizes large payloads to a *shared*,
 // machine-wide content-addressed store (`blob-store.ts`, rooted at `pi-utils::getBlobsDir()` —
 // `~/.omp/agent/blobs` modulo OMP's config-root/profile/XDG semantics, mirrored in
-// src/omp-blob-root.js) and leaves a *nested* `blob:sha256:<64-lower-hex>` reference string inside
+// src/omp-blob-root.ts) and leaves a *nested* `blob:sha256:<64-lower-hex>` reference string inside
 // the session JSONL records. So verification parses the JSONL, collects canonical nested refs, and
 // checks the referenced blobs at that real shared root. Nothing here ever writes to or deletes
 // from it (see src/omp-session-partition.js, which refuses any path resolving inside it).