blun-king-cli 9.1.457 → 9.1.458

package/bin/cognitive-action-checkpoint.cjs

@@ -316,7 +316,18 @@ function externalReportOriginFromRuntimeSource(input) {
   });
 }
 
-function resolveExternalReportOrigin(selectorInput, runtimeExternalReports) {
+function assertExternalReportChecksumClaims(report, claimText) {
+  const claims = extractChecksumClaims(claimText);
+  if (claims.length === 0) return;
+  const reportClaims = new Set(report.claimTokens ?? []);
+  for (const claim of claims) {
+    if (!reportClaims.has(claim)) {
+      throw new TypeError(`checksum claim ${claim} is absent from the selected external report`);
+    }
+  }
+}
+
+function resolveExternalReportOrigin(selectorInput, runtimeExternalReports, claimText) {
   const selector = normalizeExternalReportSelector(selectorInput);
   const reports = Array.isArray(runtimeExternalReports)
     ? runtimeExternalReports.map(normalizeRuntimeExternalReportSource)
@@ -327,6 +338,7 @@ function resolveExternalReportOrigin(selectorInput, runtimeExternalReports) {
   if (report === undefined) {
     throw new TypeError('externalReportSource does not match a trusted external report in the current turn');
   }
+  assertExternalReportChecksumClaims(report, claimText);
   return externalReportOriginFromRuntimeSource(report);
 }
 
@@ -911,7 +923,7 @@ function assertActionCheckpointEvidenceBasis(current, input, runtimeEvidence, ru
       throw new TypeError('external_report evidenceBasis cannot claim verified epistemicState');
     }
     if (runtimeExternalReports !== undefined) {
-      resolveExternalReportOrigin(input?.externalReportSource, runtimeExternalReports);
+      resolveExternalReportOrigin(input?.externalReportSource, runtimeExternalReports, input?.lastVerified);
     }
   } else if (input?.externalReportSource !== undefined) {
     throw new TypeError('externalReportSource requires external_report evidenceBasis');
@@ -972,6 +984,7 @@ function normalizeActionCheckpoint(input, options = {}) {
     checkpoint.externalReportOrigin = resolveExternalReportOrigin(
       input.externalReportSource,
       options.runtimeExternalReports,
+      input.lastVerified,
     );
   } else if (replay && input.externalReportOrigin !== undefined) {
     checkpoint.externalReportOrigin = normalizeExternalReportOrigin(input.externalReportOrigin);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.457",
+  "version": "9.1.458",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {