@wildo-ai/wildo-module-client 1.1.4 → 1.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wildo-ai/wildo-module-client",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Module-registry runtime services consumed by wildo-cli and the dev companion (Phase 0.5 skeleton)",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Wildo AI",
@@ -30,7 +30,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@wildo-ai/platform-config-lib": "1.1.4"
+    "@wildo-ai/platform-config-lib": "1.1.5"
   },
   "devDependencies": {
     "@types/node": "^24.0.15",

package/src/__tests__/lockfile-repair.service.test.ts

@@ -1,5 +1,5 @@
 /**
- * Phase 2 tests for `LockfileRepairService`.
+ * Read-only inspector tests for `LockfileRepairService`.
  *
  * The service is read-only and produces a structured report.
  * Tests pin every finding kind:
@@ -7,7 +7,7 @@
  *   - malformed envelope → error finding.
  *   - malformed modules section → error finding.
  *   - lockfile entry pointing at a missing file → warn finding.
- *   - lockfile entry with non-sha256 digest → warn finding.
+ * Malformed-digest dispatch and healthy/structure controls are covered by the CLI repair-contract suite.
  */
 
 import { promises as fs } from 'node:fs';

package/src/services/lockfile-repair.service.ts

@@ -1,21 +1,12 @@
 /**
- * `LockfileRepairService` — Phase 2 read-only lockfile diagnostics.
+ * `LockfileRepairService` — read-only lockfile diagnostics.
  *
- * Backs `wildo registry repair-lockfile` (CLI command lands in a
- * later step). The service does NOT mutate the lockfile by
- * default — its job is to surface a structured diagnostic the
- * operator can act on:
- *   - validate the canonical envelope shape;
- *   - validate `sections.modules` against
- *     `RegistryModulesLockSectionSchema`;
- *   - report which `installed[*].files` are missing on disk
- *     (drift between the lockfile and the source tree);
- *   - report which `installed[*].artifactDigest` strings are not
- *     `Sha256DigestSchema`-shaped (residue from pre-tightening
- *     publishes).
- *
- * Mutating repair is a Phase 7 deliverable — surfacing the gaps is
- * what unblocks the operator now.
+ * Backs `wildo registry repair-lockfile`. Strict envelope and module-section
+ * validation runs before file inspection. Malformed records, including invalid
+ * artifact digests, require restoration from a trusted record; they are never
+ * admitted into the automatic repair path. Valid records can report missing
+ * source files, which the CLI can re-fetch at their recorded exact version.
+ * This inspector does not mutate files.
  *
  * `i18n` validation is intentionally NOT performed here (KD-15 +
  * Review-pass-2 / MEDIUM-5): repair is the wrong place to
@@ -30,7 +21,6 @@ import { z } from 'zod';
 import { formatZodIssuesAsSingleLine } from './_zod-issue-formatting';
 import {
   RegistryModulesLockSectionSchema,
-  Sha256DigestSchema,
   getWildoSaasLockPath,
   type RegistryModulesLockEntry,
   type RegistryModulesLockSection,
@@ -66,12 +56,6 @@ export type LockfileRepairFinding =
       kind: 'module-file-missing';
       moduleId: string;
       filePath: string;
-    }
-  | {
-      severity: 'warn';
-      kind: 'module-digest-not-sha256';
-      moduleId: string;
-      observedDigest: string;
     };
 
 export interface LockfileRepairReport {
@@ -163,7 +147,7 @@ export const LockfileRepairService = {
       findings.push({
         severity: 'error',
         kind: 'modules-section-malformed',
-        message: '`sections.modules` failed schema validation.',
+        message: '`sections.modules` failed schema validation. Restore the affected record from a trusted lockfile revision; automatic repair does not infer missing or invalid metadata.',
         detail: formatZodIssuesAsSingleLine(parsed.error),
       });
       return { lockfilePath, ok: false, findings };
@@ -179,8 +163,7 @@ export const LockfileRepairService = {
   },
 
   /**
-   * Per-entry diagnostic helper. Exposed so Phase 7 mutating-
-   * repair flows can reuse the same predicates.
+   * Missing-file diagnostics for an entry already validated by the strict section schema.
    */
   async collectEntryFindings(
     saasRoot: string,
@@ -188,14 +171,6 @@ export const LockfileRepairService = {
     entry: RegistryModulesLockEntry,
     findings: LockfileRepairFinding[],
   ): Promise<void> {
-    if (!Sha256DigestSchema.safeParse(entry.artifactDigest).success) {
-      findings.push({
-        severity: 'warn',
-        kind: 'module-digest-not-sha256',
-        moduleId,
-        observedDigest: entry.artifactDigest,
-      });
-    }
     for (const filePath of entry.files) {
       const abs = path.resolve(saasRoot, filePath);
       if (!(await fileExists(abs))) {

package/src/services/registry-companion-client.ts

@@ -13,6 +13,10 @@
  * `platform/factory/wildo-dev-companion/src/companion-api/controllers/`)
  * implements them with the actual ts-morph + filesystem work in
  * Phase 5+.
+ *
+ * The four mutations are GATED: the companion refuses any non-`GET` route that does not present the
+ * machine-local token, so they take `RegistryCompanionMutationOptions` and `ping` — a `GET` — does
+ * not. See that type for why the credential is required rather than optional.
  */
 
 import {
@@ -31,20 +35,50 @@ import { formatZodIssuesAsSingleLine } from './_zod-issue-formatting';
 
 const DIAGNOSTIC_LABEL = 'Companion registry';
 
+/**
+ * The header the companion's P-29b token floor reads on a mutating route.
+ *
+ * A wire contract between two processes that share no package, so it is named at both ends rather
+ * than at neither. Its server twin is `COMPANION_TOKEN_HEADER` in the companion's
+ * `core/auth/companion-auth-floor.companion.service.ts`; the CLI's is in
+ * `wildo-cli/src/services/companion/companion-local-token.utils.ts`. Move one, move all three.
+ */
+// semantic-literal-boundary: private companion HTTP protocol, translated only at this client edge.
+const COMPANION_TOKEN_HEADER = 'x-wildo-companion-token';
+
 export interface RegistryCompanionClientOptions {
   baseUrl: string;
   timeoutMs?: number;
 }
 
+/**
+ * What a MUTATING companion registry call needs, over and above an address.
+ *
+ * `companionToken` is REQUIRED, and that is the whole point of this second type. Every non-`GET`
+ * route under `/api/companion/**` is refused without it, and the four methods below have no caller
+ * yet (the routes answer a not-implemented envelope until Phase 5) — so making it required now costs
+ * nothing and means the caller Phase 5 writes cannot be written without the credential. An optional
+ * field would have been a rule to remember; a required one is a compile error.
+ *
+ * The value is the content of `<appRoot>/.wildo-saas/state/companion.token` (mode 0600), which the
+ * companion mints on every boot. This package has no notion of an application root, so reading it is
+ * deliberately the caller's job: `wildo-cli` already owns a hardened no-follow reader
+ * (`readCompanionTokenNoFollow`), and a second copy of a permission-checked read is precisely where
+ * the checks quietly diverge.
+ */
+export interface RegistryCompanionMutationOptions extends RegistryCompanionClientOptions {
+  companionToken: string;
+}
+
 async function postJson<R>(
-  options: RegistryCompanionClientOptions,
+  options: RegistryCompanionMutationOptions,
   routePath: string,
   body: unknown,
 ): Promise<R> {
   const url = joinUrl(options.baseUrl, routePath);
   const res = await fetchWithTimeout(url, {
     method: 'POST',
-    headers: { 'content-type': 'application/json' },
+    headers: { 'content-type': 'application/json', [COMPANION_TOKEN_HEADER]: options.companionToken },
     body: JSON.stringify(body),
     timeoutMs: options.timeoutMs,
     diagnosticLabel: DIAGNOSTIC_LABEL,
@@ -103,7 +137,7 @@ export const RegistryCompanionClient = {
    * `sections.modules`, run provider sync.
    */
   async install(
-    options: RegistryCompanionClientOptions,
+    options: RegistryCompanionMutationOptions,
     request: RegistryInstallRequest,
   ): Promise<RegistryRouteResult> {
     const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.install, request);
@@ -111,7 +145,7 @@ export const RegistryCompanionClient = {
   },
 
   async update(
-    options: RegistryCompanionClientOptions,
+    options: RegistryCompanionMutationOptions,
     request: RegistryUpdateRequest,
   ): Promise<RegistryRouteResult> {
     const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.update, request);
@@ -119,7 +153,7 @@ export const RegistryCompanionClient = {
   },
 
   async remove(
-    options: RegistryCompanionClientOptions,
+    options: RegistryCompanionMutationOptions,
     request: RegistryRemoveRequest,
   ): Promise<RegistryRouteResult> {
     const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.remove, request);
@@ -127,7 +161,7 @@ export const RegistryCompanionClient = {
   },
 
   async publish(
-    options: RegistryCompanionClientOptions,
+    options: RegistryCompanionMutationOptions,
     request: RegistryPublishRequest,
   ): Promise<RegistryRouteResult> {
     const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.publish, request);