@verax-ai/body 0.1.3 → 0.1.4

package/dist/cli.js

@@ -9,6 +9,7 @@ import { runHalt } from "./halt.js";
 import { main } from "./main.js";
 import { runOperator } from "./operator-cli.js";
 import { runReconcile } from "./reconcile-cli.js";
+import { runVerify } from "./verify-cli.js";
 import { runUnlock } from "./unlock.js";
 import { runWitness } from "./witness.js";
 const HELP = `verax - the body an agent asks before it acts, and the ledger it answers from.
@@ -20,6 +21,8 @@ Usage: verax <command> [options]
   approve <args>       approve a waiting request from this machine
   operator <args>      enrol an operator and manage their passkeys
   reconcile <args>     compare the ledger against a statement
+  verify <stateDir>    read a ledger back without a body: signatures, chain,
+                       effect binding, and which key answered
   witness <stateDir>   run the witness alongside a body
   halt <stateDir>      stop the body from allowing anything further
   unlock [--force] <stateDir>   clear a stale ledger lock
@@ -98,6 +101,9 @@ if (argv[0] === "doctor") {
 if (argv[0] === "reconcile") {
     process.exit(runReconcile(argv));
 }
+if (argv[0] === "verify") {
+    process.exit(await runVerify(argv.slice(1)));
+}
 if (argv[0] === "desktop") {
     process.exit(await desktopMain(argv));
 }

package/dist/downstream.js

@@ -6,6 +6,10 @@ const PREFIX_RE = /^[A-Za-z][A-Za-z0-9_-]{0,31}$/;
 const CHILD_TOOL_RE = /^[A-Za-z][A-Za-z0-9._-]{0,63}$/;
 /** Prefixed name a caller may put on extraTools: `prefix.childName`. */
 const EXTRA_NAME_RE = /^[A-Za-z][A-Za-z0-9_-]{0,31}\.[A-Za-z][A-Za-z0-9._-]{0,63}$/;
+// Sanity bound, not a capacity claim. A child that lists more than this is
+// hostile or broken; the body is not a registry for thousands of names.
+const MAX_CHILD_TOOLS = 256;
+const MAX_TOOL_BYTES = 64 * 1024;
 export class DownstreamCallError extends Error {
     prefix;
     tool;
@@ -196,9 +200,47 @@ function httpTransport(spec) {
     if (spec.url === undefined)
         throw new Error("downstream-url-invalid");
     return new StreamableHTTPClientTransport(new URL(spec.url), {
-        ...(spec.headers ? { requestInit: { headers: spec.headers } } : {}),
+        requestInit: {
+            // The child's address is the operator's document, not a place the
+            // child may name. Following a redirect would rewrite that document
+            // at run time. The egress list does not see it: egress is for hosts
+            // the brain picks.
+            redirect: "error",
+            ...(spec.headers ? { headers: spec.headers } : {}),
+        },
     });
 }
+/**
+ * `connect` does not take a timeout option. Race it, close the transport
+ * when the clock wins, and drop the timer so a settled attach cannot keep
+ * the process alive.
+ */
+async function connectWithDeadline(client, transport, timeoutMs, prefix) {
+    let timer;
+    try {
+        await new Promise((resolve, reject) => {
+            timer = setTimeout(() => {
+                void shut(client, transport);
+                reject(new Error(`downstream-attach-timeout:${prefix}`));
+            }, timeoutMs);
+            client.connect(transport).then(resolve, reject);
+        });
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+function attachTimeoutError(err, prefix) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.startsWith("downstream-attach-timeout:")) {
+        return err instanceof Error ? err : new Error(`downstream-attach-timeout:${prefix}`);
+    }
+    if (/timed?\s*out|timeout/i.test(msg)) {
+        return new Error(`downstream-attach-timeout:${prefix}`);
+    }
+    return err instanceof Error ? err : new Error(msg);
+}
 export async function openDownstream(spec) {
     if (!PREFIX_RE.test(spec.prefix)) {
         throw new Error("downstream-prefix-invalid");
@@ -214,12 +256,16 @@ export async function openDownstream(spec) {
     const client = new Client({ name: "verax-downstream", version: "0.0.0" });
     let listed;
     try {
-        await client.connect(transport);
-        listed = await client.listTools();
+        await connectWithDeadline(client, transport, timeoutMs, spec.prefix);
+        listed = await client.listTools(undefined, { timeout: timeoutMs });
     }
     catch (err) {
         await shut(client, transport);
-        throw err;
+        throw attachTimeoutError(err, spec.prefix);
+    }
+    if (listed.tools.length > MAX_CHILD_TOOLS) {
+        await shut(client, transport);
+        throw new Error(`downstream-too-many-tools:${spec.prefix}:${listed.tools.length}`);
     }
     const tools = [];
     const seen = new Set();
@@ -228,6 +274,15 @@ export async function openDownstream(spec) {
             await shut(client, transport);
             throw new Error(`downstream-child-name-invalid:${tool.name}`);
         }
+        const toolBytes = JSON.stringify({
+            name: tool.name,
+            description: tool.description,
+            inputSchema: tool.inputSchema,
+        }).length;
+        if (toolBytes > MAX_TOOL_BYTES) {
+            await shut(client, transport);
+            throw new Error(`downstream-tool-too-large:${spec.prefix}.${tool.name}:${toolBytes}`);
+        }
         const name = prefixedName(spec.prefix, tool.name);
         if (seen.has(name)) {
             await shut(client, transport);

package/dist/verify-cli.d.ts

@@ -0,0 +1,5 @@
+import { type VerifyResult } from "@verax-ai/proxy";
+export declare const EX_VERIFY_FAILED = 1;
+/** Lines a person reads. The trust line is never omitted. */
+export declare function renderVerify(r: VerifyResult): string;
+export declare function runVerify(argv: readonly string[], out?: (s: string) => void): Promise<number>;

package/dist/verify-cli.js

@@ -0,0 +1,91 @@
+/**
+ * `verax verify <stateDir>` — read a ledger back without a body.
+ *
+ * The command exists for the moment a customer stops being a customer. A
+ * ledger that only the vendor's running service can read is not evidence a
+ * buyer holds; it is evidence they rent. This reads the directory on its own,
+ * with nothing listening and nothing on the network, and says what still
+ * holds together.
+ *
+ * It refuses to flatten four separate questions into one word. Signatures,
+ * the chain, the binding between effects and decisions, and — the one worth
+ * the most — **which key** answered. Verifying against the key lying in the
+ * same directory proves the files agree with each other and nothing else;
+ * that line is printed every time, not buried in a flag.
+ */
+import { readFileSync } from "node:fs";
+import { verifyLedger } from "@verax-ai/proxy";
+export const EX_VERIFY_FAILED = 1;
+function usage() {
+    return [
+        "usage: verax verify <stateDir> [--key <public.pem>] [--json]",
+        "",
+        "  <stateDir>        the directory holding decisions.jsonl and effects.jsonl",
+        "  --key <file>      verify against a public key you hold, instead of the one",
+        "                    the records carry. This is the difference between",
+        "                    'these files agree with each other' and 'these files",
+        "                    were signed by the key I was given'.",
+        "  --json            machine-readable result on stdout",
+        "",
+        "Exit code is 0 when the ledger verifies and 1 when it does not.",
+    ].join("\n");
+}
+/** Lines a person reads. The trust line is never omitted. */
+export function renderVerify(r) {
+    const lines = [];
+    lines.push(`ledger        ${r.directory}`);
+    lines.push(`decisions     ${r.decisions}`);
+    lines.push(`effects       ${r.effects} (${r.effectsBound} bound to a decision, ${r.effectsOrphaned} with none)`);
+    lines.push(`signatures    ${r.signaturesValid} verify, ${r.signaturesInvalid} do not`);
+    lines.push(`chain         ${r.chainBreakAt === null ? "unbroken" : `breaks at record ${r.chainBreakAt}`}`);
+    lines.push(`verified with ${r.trust.source === "pinned"
+        ? "a key you supplied"
+        : r.trust.source === "in-ledger"
+            ? "the key carried in these files"
+            : "no key"}`);
+    lines.push(`              ${r.trust.note}`);
+    if (r.problems.length > 0) {
+        lines.push("");
+        lines.push("problems:");
+        for (const p of r.problems.slice(0, 50))
+            lines.push(`  - ${p}`);
+        if (r.problems.length > 50)
+            lines.push(`  … and ${r.problems.length - 50} more`);
+    }
+    lines.push("");
+    lines.push(r.ok ? "VERIFIED" : "NOT VERIFIED");
+    return lines.join("\n");
+}
+export async function runVerify(argv, out = (s) => process.stdout.write(`${s}\n`)) {
+    const args = [...argv];
+    if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
+        out(usage());
+        return args.length === 0 ? EX_VERIFY_FAILED : 0;
+    }
+    const json = args.includes("--json");
+    let publicKeyPem;
+    const keyAt = args.indexOf("--key");
+    if (keyAt !== -1) {
+        const path = args[keyAt + 1];
+        if (!path || path.startsWith("-")) {
+            out("verify: --key needs a file path");
+            return EX_VERIFY_FAILED;
+        }
+        try {
+            publicKeyPem = readFileSync(path, "utf8");
+        }
+        catch {
+            out(`verify: cannot read key file ${path}`);
+            return EX_VERIFY_FAILED;
+        }
+        args.splice(keyAt, 2);
+    }
+    const dir = args.find((a) => !a.startsWith("-"));
+    if (!dir) {
+        out(usage());
+        return EX_VERIFY_FAILED;
+    }
+    const result = await verifyLedger(dir, publicKeyPem ? { publicKeyPem } : {});
+    out(json ? JSON.stringify(result, null, 2) : renderVerify(result));
+    return result.ok ? 0 : EX_VERIFY_FAILED;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verax-ai/body",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {