blun-king-cli 9.1.536 → 9.1.561

package/agent-spine-plugin/scripts/release-check.js

@@ -1,128 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { readFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-const REQUIRED_PACKAGE_FILES = [
-  "blun.plugin.json", ".claude-plugin/plugin.json", ".codex-plugin/plugin.json", ".mcp.json",
-  "CHANGELOG.md", "LICENSE", "README.md", "bin/agentspine.js", "bin/agentspine-mcp.js",
-  "docs/acceptance.md", "docs/source-roots.md", "docs/preflight-recall.md", "docs/preservation-contract.md", "scripts/run-acceptance.js",
-  "skills/agent-spine/SKILL.md", "src/index.js", "src/mcp.js", "src/worker.js",
-  "hooks/hooks.json", "hooks/codex.json", "hooks/version.json"
-];
-const FORBIDDEN_PACKAGE_PATHS = [
-  /(?:^|\/)\.env(?:\.|$)/i,
-  /(?:^|\/)\.git(?:$|\/)/i,
-  /(?:^|\/)\.agentspine(?:$|\/)/i,
-  /(?:^|\/)(?:AGENTS|CLAUDE|SOUL|MEMORY)\.md$/i,
-  /(?:^|\/)(?:test|\.github)(?:$|\/)/,
-  /\.(?:key|pem|p12|pfx)$/i,
-  /(?:^|\/)state\.json$/i,
-  /(?:^|\/)(?:catalog|graph|attention|learning|coordination|sharing|sharing-trust|delegation-policy)\.json$/
-];
-
-function parse(argv) {
-  const options = { root: process.cwd(), tag: null, allowDirty: false, skipPack: false, json: false };
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (token === "--root") options.root = argv[++index];
-    else if (token === "--tag") options.tag = argv[++index];
-    else if (token === "--allow-dirty") options.allowDirty = true;
-    else if (token === "--skip-pack") options.skipPack = true;
-    else if (token === "--json") options.json = true;
-    else throw new Error(`unknown release-check argument: ${token}`);
-  }
-  options.root = resolve(options.root);
-  return options;
-}
-
-async function json(root, path) {
-  return JSON.parse(await readFile(resolve(root, path), "utf8"));
-}
-
-function command(root, args) {
-  const npmCli = process.env.npm_execpath;
-  const executable = npmCli ? process.execPath : (process.platform === "win32" ? "npm.cmd" : "npm");
-  const commandArgs = npmCli ? [npmCli, ...args] : args;
-  return spawnSync(executable, commandArgs, { cwd: root, encoding: "utf8" });
-}
-
-function git(root, args) {
-  return spawnSync("git", args, { cwd: root, encoding: "utf8" });
-}
-
-function assert(condition, message) {
-  if (!condition) throw new Error(message);
-}
-
-function validatePackageReport(report, version) {
-  assert(Array.isArray(report) && report.length === 1, "npm pack report must describe exactly one package");
-  const item = report[0];
-  assert(item.version === version, "npm pack version does not match package.json");
-  assert(typeof item.filename === "string" && item.filename.endsWith(`-${version}.tgz`), "npm pack filename is not versioned correctly");
-  assert(typeof item.integrity === "string" && item.integrity.startsWith("sha512-"), "npm pack did not report SHA-512 integrity");
-  assert(Number.isInteger(item.entryCount) && item.entryCount > 0 && item.entryCount <= 500, "npm package file count is outside the release limit");
-  assert(Number.isInteger(item.unpackedSize) && item.unpackedSize > 0 && item.unpackedSize <= 2 * 1024 * 1024, "npm package exceeds the 2 MiB unpacked release limit");
-  const paths = (item.files || []).map((file) => file.path);
-  assert(paths.length === new Set(paths).size, "npm package contains duplicate paths");
-  for (const path of REQUIRED_PACKAGE_FILES) assert(paths.includes(path), `npm package is missing required file: ${path}`);
-  for (const path of paths) {
-    assert(path && !path.startsWith("/") && !path.split("/").includes(".."), `npm package contains an unsafe path: ${path}`);
-    assert(!FORBIDDEN_PACKAGE_PATHS.some((pattern) => pattern.test(path)), `npm package contains forbidden state or source material: ${path}`);
-  }
-  return { filename: item.filename, integrity: item.integrity, files: paths.length, unpackedSize: item.unpackedSize };
-}
-
-export async function releaseCheck(options) {
-  const [pkg, lock, blun, claude, codex, marketplace, hookVersion, changelog] = await Promise.all([
-    json(options.root, "package.json"), json(options.root, "package-lock.json"),
-    json(options.root, "blun.plugin.json"),
-    json(options.root, ".claude-plugin/plugin.json"), json(options.root, ".codex-plugin/plugin.json"),
-    json(options.root, ".claude-plugin/marketplace.json"), json(options.root, "hooks/version.json"),
-    readFile(resolve(options.root, "CHANGELOG.md"), "utf8")
-  ]);
-  assert(SEMVER_RE.test(pkg.version || ""), "package version is not valid SemVer");
-  const versions = [lock.version, lock.packages?.[""]?.version, blun.version, claude.version, codex.version, marketplace.plugins?.[0]?.version, hookVersion.version];
-  assert(versions.every((version) => version === pkg.version), "release version differs across package and host manifests");
-  assert(pkg.name === lock.name && pkg.name === lock.packages?.[""]?.name, "package name differs from package-lock.json");
-  assert(pkg.repository?.url === "git+https://github.com/Maykbiletti/AgentSpine.git", "package repository must identify the public source repository exactly");
-  if (options.tag) {
-    assert(options.tag === `v${pkg.version}`, `release tag must be v${pkg.version}`);
-    const escaped = pkg.version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    assert(new RegExp(`^## \\[${escaped}\\] - \\d{4}-\\d{2}-\\d{2}$`, "m").test(changelog), `CHANGELOG.md needs a dated ${pkg.version} section`);
-  }
-  if (!options.allowDirty) {
-    const status = git(options.root, ["status", "--porcelain"]);
-    assert(status.status === 0, status.stderr || "git status failed");
-    assert(status.stdout.trim() === "", "release worktree must be clean");
-  }
-  let packageReport = null;
-  if (!options.skipPack) {
-    const packed = command(options.root, ["pack", "--dry-run", "--ignore-scripts", "--json"]);
-    assert(packed.status === 0, packed.stderr || "npm pack --dry-run failed");
-    packageReport = validatePackageReport(JSON.parse(packed.stdout), pkg.version);
-  }
-  return {
-    ok: true,
-    version: pkg.version,
-    tag: options.tag,
-    cleanRequired: !options.allowDirty,
-    package: packageReport,
-    authority: "release-metadata-only"
-  };
-}
-
-async function main() {
-  const options = parse(process.argv.slice(2));
-  const result = await releaseCheck(options);
-  process.stdout.write(`${JSON.stringify(result, null, options.json ? 2 : 0)}\n`);
-}
-
-if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
-  main().catch((error) => {
-    process.stderr.write(`AgentSpine release check failed: ${error.message}\n`);
-    process.exitCode = 1;
-  });
-}

package/agent-spine-plugin/scripts/run-acceptance.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-import { resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { renderAcceptanceReport, runVisibleAcceptance } from "../src/lib/acceptance.js";
-
-export async function main(argv = process.argv.slice(2)) {
-  const unknown = argv.filter((item) => item !== "--json");
-  if (unknown.length) throw new Error(`unknown acceptance argument: ${unknown[0]}`);
-  const report = await runVisibleAcceptance();
-  process.stdout.write(argv.includes("--json") ? `${JSON.stringify(report, null, 2)}\n` : renderAcceptanceReport(report));
-  return report;
-}
-
-if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
-  main().catch((error) => {
-    process.stderr.write(`AgentSpine acceptance failed: ${error.message}\n`);
-    process.exitCode = 1;
-  });
-}

package/agent-spine-plugin/scripts/run-checks.js

@@ -1,46 +0,0 @@
-#!/usr/bin/env node
-import { spawn } from "node:child_process";
-import { resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { githubErrorCommand } from "./github-actions.js";
-
-const CHECKS = [
-  { title: "Syntax check", script: "lint" },
-  { title: "Hermetic test suite", script: "test" },
-  { title: "Host manifest check", script: "host:check" },
-  { title: "Installed bundle check", script: "host:install-check" },
-  { title: "Runtime smoke test", script: "smoke" },
-  { title: "Self audit", script: "audit:self" }
-];
-
-function runNpmScript(script) {
-  const npmExecPath = process.env.npm_execpath;
-  const executable = npmExecPath ? process.execPath : (process.platform === "win32" ? "npm.cmd" : "npm");
-  const args = npmExecPath ? [npmExecPath, "run", script] : ["run", script];
-  return new Promise((resolve, reject) => {
-    const child = spawn(executable, args, { stdio: "inherit", shell: false, windowsHide: true });
-    child.once("error", reject);
-    child.once("close", (code) => resolve(code ?? 1));
-  });
-}
-
-export async function runChecks({
-  checks = CHECKS, runCommand = runNpmScript, githubActions = process.env.GITHUB_ACTIONS === "true", output = process.stderr
-} = {}) {
-  for (const check of checks) {
-    let code;
-    try { code = await runCommand(check.script); }
-    catch (error) {
-      if (githubActions) output.write(githubErrorCommand(check.title, error.message) + "\n");
-      else output.write(`${check.title} failed: ${error.message}\n`);
-      return 1;
-    }
-    if (code !== 0) {
-      if (githubActions) output.write(githubErrorCommand(check.title, `npm run ${check.script} exited with code ${code}`) + "\n");
-      return code;
-    }
-  }
-  return 0;
-}
-
-if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) process.exitCode = await runChecks();

package/agent-spine-plugin/scripts/run-tests-hermetic.js

@@ -1,73 +0,0 @@
-#!/usr/bin/env node
-import { spawn } from "node:child_process";
-import { cpus, tmpdir } from "node:os";
-import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { githubErrorCommand } from "./github-actions.js";
-
-const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
-const base = await mkdtemp(join(tmpdir(), "agentspine-hermetic-tests-"));
-const testFiles = (await readdir(join(root, "test"))).filter((name) => name.endsWith(".test.js")).sort();
-const concurrency = Math.max(1, Math.min(4, cpus().length));
-
-async function profileEnvironment(mode, index) {
-  const profile = join(base, mode, String(index));
-  const home = join(profile, "home"); const claude = join(profile, "claude"); const codex = join(profile, "codex");
-  const state = join(profile, "state"); const xdgState = join(profile, "xdg-state"); const temporary = join(profile, "tmp");
-  for (const directory of [home, claude, codex, state, xdgState, temporary]) await mkdir(directory, { recursive: true });
-  if (mode === "populated") {
-    await writeFile(join(claude, "CLAUDE.md"), "# Hermetic populated Claude profile\n\nSynthetic global source.\n");
-    await writeFile(join(codex, "AGENTS.md"), "# Hermetic populated Codex profile\n\nSynthetic global source.\n");
-  }
-  const inherited = Object.fromEntries(Object.entries(process.env).filter(([key]) =>
-    !/^(?:AGENTSPINE_|CLAUDE_|CODEX_|HOME$|USERPROFILE$|XDG_STATE_HOME$|TMPDIR$|TMP$|TEMP$|NODE_OPTIONS$|NODE_PATH$)/.test(key)));
-  return { ...inherited, HOME: home, USERPROFILE: home, CLAUDE_CONFIG_DIR: claude, CODEX_HOME: codex,
-    AGENTSPINE_STATE_DIR: state, XDG_STATE_HOME: xdgState, TMPDIR: temporary, TMP: temporary, TEMP: temporary,
-    AGENTSPINE_HERMETIC_ROOT: profile, AGENTSPINE_TEST_PROFILE: mode };
-}
-
-async function runOne(file, mode, index) {
-  const env = await profileEnvironment(mode, index);
-  return new Promise((resolvePromise) => {
-    const child = spawn(process.execPath, ["--test", join(root, "test", file)], { cwd: root, env, shell: false,
-      stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
-    let stdout = ""; let stderr = "";
-    child.stdout.on("data", (chunk) => { stdout += chunk; }); child.stderr.on("data", (chunk) => { stderr += chunk; });
-    child.on("close", (code) => resolvePromise({ file, mode, code, stdout, stderr }));
-    child.on("error", (error) => resolvePromise({ file, mode, code: 1, stdout, stderr: error.message }));
-  });
-}
-
-async function runMode(mode) {
-  const queue = testFiles.map((file, index) => ({ file, index })); const results = [];
-  async function worker() { while (queue.length) { const item = queue.shift(); results.push(await runOne(item.file, mode, item.index)); } }
-  await Promise.all(Array.from({ length: concurrency }, () => worker()));
-  for (const result of results.sort((a, b) => a.file.localeCompare(b.file))) {
-    if (result.code !== 0) {
-      if (process.env.GITHUB_ACTIONS === "true") {
-        process.stderr.write(githubErrorCommand(`${mode}: ${result.file}`, result.stdout + result.stderr) + "\n");
-      }
-      process.stderr.write("\n[" + mode + "] " + result.file + " failed\n" + result.stdout + result.stderr);
-    }
-  }
-  return results;
-}
-
-let failed = false; let runnerError = null;
-try {
-  for (const mode of ["empty", "populated"]) {
-    const results = await runMode(mode); const failures = results.filter((item) => item.code !== 0);
-    process.stdout.write("Hermetic " + mode + " profile: " + (results.length - failures.length) + "/" + results.length + " test files passed\n");
-    if (failures.length) failed = true;
-  }
-} catch (error) { runnerError = error; }
-try { await rm(base, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }); }
-catch (error) { runnerError = runnerError ? new AggregateError([runnerError, error], "Hermetic test run and cleanup failed") : error; }
-if (runnerError) {
-  if (process.env.GITHUB_ACTIONS === "true") {
-    process.stderr.write(githubErrorCommand("Hermetic test runner", runnerError.stack || runnerError.message) + "\n");
-  }
-  throw runnerError;
-}
-if (failed) process.exitCode = 1;

package/agent-spine-plugin/spine-example/1-identity.md

@@ -1,12 +0,0 @@
-# Layer 1 — Identity
-
-I am <AgentName>, the <role> of <Owner>. <Owner> is my owner; their word is
-final.
-
-My purpose: <one sentence — what this agent exists to do>.
-
-Principles that no later layer may override:
-
-- I am honest before I am impressive. "Not verified yet" beats a wrong "done".
-- I claim only what a real result has shown me.
-- What my owner teaches me about myself becomes part of me (layer 4).

package/agent-spine-plugin/spine-example/2-voice.md

@@ -1,6 +0,0 @@
-# Layer 2 — Voice
-
-- Language: <language the owner prefers>.
-- Tone: warm, direct, like a colleague — not a manual, not a servant.
-- Length: short by default; detail only on request.
-- Never: invented certainty, filler praise, jargon the owner did not use.

package/agent-spine-plugin/spine-example/3-conduct.md

@@ -1,8 +0,0 @@
-# Layer 3 — Conduct
-
-- Measure before acting; re-measure before reporting.
-- A claim carries its evidence: the command, the number, the file.
-- Errors are reported at once, with what I did and what I will do.
-- Escalate to the owner only for decisions that are truly theirs;
-  everything reversible I do myself.
-- Tasks, credentials and permissions do not live in this spine.

package/agent-spine-plugin/spine-example/4-history.md

@@ -1,4 +0,0 @@
-# Layer 4 — Grown history (append-only)
-
-## 2026-08-27
-Spine created.

package/bin/empty-response-retry-policy.cjs

@@ -1,29 +0,0 @@
-'use strict';
-
-const EMPTY_LENGTH_EFFORT_DOWNGRADE = Object.freeze({
-  max: 'high',
-  xhigh: 'high',
-  high: 'low',
-  medium: 'low',
-  low: 'off',
-  minimal: 'off',
-});
-
-function nextThinkingEffortForExhaustedEmpty(input = {}) {
-  const budget = Number(input.maxCompletionTokens);
-  const completion = Number(input.completionTokens);
-  if (
-    input.emptyResponseKind !== 'length'
-    || !Number.isFinite(budget)
-    || budget <= 0
-    || !Number.isFinite(completion)
-    || completion < budget
-  ) return undefined;
-
-  return EMPTY_LENGTH_EFFORT_DOWNGRADE[String(input.thinkingEffort || '').toLowerCase()];
-}
-
-module.exports = {
-  EMPTY_LENGTH_EFFORT_DOWNGRADE,
-  nextThinkingEffortForExhaustedEmpty,
-};

package/bin/fredrik-glm-provider.cjs

@@ -1,256 +0,0 @@
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { spawnSync } = require('node:child_process');
-
-const PROVIDER_ID = 'fredrik:zai';
-const PROVIDER_TYPE = 'openai_compatible';
-const BASE_URL = 'https://api.z.ai/api/coding/paas/v4';
-const MODEL_ALIASES = Object.freeze({
-  'fredrik/glm-5.3-flash': Object.freeze({
-    model: 'glm-5.3-flash',
-    displayName: 'GLM 5.3 Flash',
-  }),
-  'fredrik/glm-5.3': Object.freeze({
-    model: 'glm-5.3',
-    displayName: 'GLM 5.3',
-  }),
-});
-const MODEL_EFFORTS = Object.freeze(['low', 'high', 'max']);
-const MAX_SECRET_BYTES = 4096;
-
-function nonEmpty(value) {
-  if (typeof value !== 'string') return undefined;
-  const trimmed = value.trim();
-  return trimmed.length === 0 ? undefined : trimmed;
-}
-
-function normalizeBaseUrl(value) {
-  const raw = nonEmpty(value);
-  if (raw === undefined) throw new Error('Fredrik GLM base_url is required.');
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    throw new Error('Fredrik GLM base_url is invalid.');
-  }
-  if (
-    parsed.protocol !== 'https:' ||
-    parsed.username !== '' ||
-    parsed.password !== '' ||
-    parsed.search !== '' ||
-    parsed.hash !== '' ||
-    parsed.hostname.toLowerCase() !== 'api.z.ai'
-  ) {
-    throw new Error('Fredrik GLM base_url must use the approved api.z.ai Coding endpoint.');
-  }
-  const normalized = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}`;
-  if (normalized !== BASE_URL) {
-    throw new Error('Fredrik GLM base_url must use the approved api.z.ai Coding endpoint.');
-  }
-  return BASE_URL;
-}
-
-function resolveProfileRoot(env = process.env) {
-  const configured = nonEmpty(env.BLUN_HOME);
-  if (configured !== undefined) return path.resolve(configured);
-  const profile = nonEmpty(env.BLUN_PROFILE) ?? 'default';
-  return path.resolve(require('node:os').homedir(), '.blun', 'profile', profile);
-}
-
-function isContained(root, candidate) {
-  const relative = path.relative(root, candidate);
-  return relative !== '' && !relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative);
-}
-
-function rejectUnsafeRelativePath(value) {
-  const relative = nonEmpty(value);
-  if (relative === undefined) throw new Error('Fredrik GLM api_key_file is required.');
-  if (path.isAbsolute(relative)) throw new Error('Fredrik GLM api_key_file must be profile-relative.');
-  if (relative.includes('\0')) throw new Error('Fredrik GLM api_key_file contains a NUL byte.');
-  if (relative.split(/[\\/]/u).some((part) => part === '..' || part.includes(':'))) {
-    throw new Error('Fredrik GLM api_key_file escapes the profile or uses an alternate data stream.');
-  }
-  return relative;
-}
-
-function assertNoSymlinkPath(root, candidate) {
-  const relative = path.relative(root, candidate);
-  let cursor = root;
-  for (const segment of relative.split(path.sep)) {
-    cursor = path.join(cursor, segment);
-    const info = fs.lstatSync(cursor);
-    if (info.isSymbolicLink()) throw new Error('Fredrik GLM api_key_file must not use links or reparse points.');
-  }
-}
-
-function assertWindowsAcl(filePath) {
-  if (process.platform !== 'win32') return;
-  const script = [
-    '$target = $env:BLUN_SECRET_ACL_PATH',
-    '$unsafe = @("S-1-1-0", "S-1-5-11", "S-1-5-32-545")',
-    '$writeMask = [System.Security.AccessControl.FileSystemRights]::Write -bor [System.Security.AccessControl.FileSystemRights]::Modify -bor [System.Security.AccessControl.FileSystemRights]::FullControl -bor [System.Security.AccessControl.FileSystemRights]::CreateFiles -bor [System.Security.AccessControl.FileSystemRights]::AppendData -bor [System.Security.AccessControl.FileSystemRights]::WriteData',
-    'foreach ($rule in (Get-Acl -LiteralPath $target).Access) {',
-    '  if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { continue }',
-    '  $sid = $rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value',
-    '  if ($unsafe -contains $sid -and (($rule.FileSystemRights -band $writeMask) -ne 0)) { exit 23 }',
-    '}',
-    'exit 0',
-  ].join('; ');
-  const result = spawnSync('powershell.exe', ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script], {
-    encoding: 'utf8',
-    windowsHide: true,
-    timeout: 5000,
-    env: { ...process.env, BLUN_SECRET_ACL_PATH: filePath },
-  });
-  if (result.status === 23) throw new Error('Fredrik GLM api_key_file ACL is too permissive.');
-  if (result.status !== 0) throw new Error('Fredrik GLM api_key_file ACL could not be verified.');
-}
-
-function readApiKeyFile(provider, env = process.env) {
-  if (provider?.type !== PROVIDER_TYPE) throw new Error('Fredrik GLM provider type is invalid.');
-  if (provider.apiKey !== undefined || provider.env !== undefined || provider.oauth !== undefined || provider.customHeaders !== undefined) {
-    throw new Error('Fredrik GLM accepts only api_key_file authentication.');
-  }
-  normalizeBaseUrl(provider.baseUrl);
-  const profileRoot = resolveProfileRoot(env);
-  const relative = rejectUnsafeRelativePath(provider.apiKeyFile);
-  if (relative.replaceAll('\\', '/') !== 'secrets/zai-api-key.txt') {
-    throw new Error('Fredrik GLM api_key_file must use the approved profile-relative path.');
-  }
-  const candidate = path.resolve(profileRoot, relative);
-  if (!isContained(profileRoot, candidate)) throw new Error('Fredrik GLM api_key_file escapes the profile root.');
-  let rootReal;
-  let candidateReal;
-  try {
-    rootReal = fs.realpathSync(profileRoot);
-    assertNoSymlinkPath(profileRoot, candidate);
-    candidateReal = fs.realpathSync(candidate);
-  } catch (error) {
-    if (error instanceof Error && /links or reparse points/u.test(error.message)) throw error;
-    throw new Error('Fredrik GLM api_key_file could not be resolved safely.');
-  }
-  if (!isContained(rootReal, candidateReal)) throw new Error('Fredrik GLM api_key_file escapes the resolved profile root.');
-  let info;
-  try {
-    info = fs.statSync(candidateReal);
-  } catch {
-    throw new Error('Fredrik GLM api_key_file could not be inspected safely.');
-  }
-  if (!info.isFile()) throw new Error('Fredrik GLM api_key_file must be a regular file.');
-  if (info.size < 1 || info.size > MAX_SECRET_BYTES) throw new Error('Fredrik GLM api_key_file has an invalid size.');
-  assertWindowsAcl(candidateReal);
-  let raw;
-  try {
-    raw = fs.readFileSync(candidateReal);
-  } catch {
-    throw new Error('Fredrik GLM api_key_file could not be read safely.');
-  }
-  if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf) throw new Error('Fredrik GLM api_key_file must not contain a BOM.');
-  if (raw.includes(0)) throw new Error('Fredrik GLM api_key_file must not contain NUL bytes.');
-  const text = raw.toString('utf8');
-  if (Buffer.from(text, 'utf8').compare(raw) !== 0) throw new Error('Fredrik GLM api_key_file must be valid UTF-8.');
-  const lines = text.replace(/\r?\n$/u, '').split(/\r?\n/u);
-  if (lines.length !== 1 || lines[0].trim().length === 0 || lines[0] !== lines[0].trim()) {
-    throw new Error('Fredrik GLM api_key_file must contain exactly one non-empty line.');
-  }
-  return lines[0];
-}
-
-function isConfiguredAlias(alias, entry) {
-  const expected = MODEL_ALIASES[alias];
-  const capabilities = Array.isArray(entry?.capabilities) ? entry.capabilities : [];
-  const efforts = Array.isArray(entry?.supportEfforts) ? entry.supportEfforts : [];
-  return (
-    expected !== undefined &&
-    entry?.provider === PROVIDER_ID &&
-    entry.model === expected.model &&
-    entry.displayName === expected.displayName &&
-    entry.defaultEffort === 'max' &&
-    efforts.length === MODEL_EFFORTS.length &&
-    efforts.every((effort, index) => effort === MODEL_EFFORTS[index]) &&
-    capabilities.includes('always_thinking') &&
-    capabilities.includes('tool_use')
-  );
-}
-
-function configuredModels(models) {
-  const out = {};
-  for (const alias of Object.keys(MODEL_ALIASES)) {
-    const entry = models?.[alias];
-    if (isConfiguredAlias(alias, entry)) out[alias] = entry;
-  }
-  return out;
-}
-
-function configuredProvider(providers) {
-  const provider = providers?.[PROVIDER_ID];
-  if (provider?.type !== PROVIDER_TYPE) return undefined;
-  if (
-    provider.apiKey !== undefined ||
-    provider.env !== undefined ||
-    provider.oauth !== undefined ||
-    provider.customHeaders !== undefined ||
-    provider.apiKeyFile !== 'secrets/zai-api-key.txt'
-  ) return undefined;
-  try {
-    normalizeBaseUrl(provider.baseUrl);
-  } catch {
-    return undefined;
-  }
-  return provider;
-}
-
-function isAllowedRuntimeAlias(alias, models) {
-  return alias === 'blun/king' || isConfiguredAlias(alias, models?.[alias]);
-}
-
-function normalizeEffort(effort) {
-  if (!MODEL_EFFORTS.includes(effort)) throw new Error('GLM 5.3 supports only low, high, or max reasoning effort.');
-  return effort;
-}
-
-function requestControls(effort) {
-  return Object.freeze({
-    thinking: Object.freeze({ type: 'enabled' }),
-    reasoning_effort: normalizeEffort(effort),
-  });
-}
-
-function safeDiagnostic(alias, models, providers, credentialPresent = false) {
-  const entry = models?.[alias];
-  if (!isConfiguredAlias(alias, entry)) throw new Error('Unknown Fredrik GLM alias.');
-  const provider = configuredProvider(providers);
-  if (provider === undefined) throw new Error('Fredrik GLM provider is not configured safely.');
-  return Object.freeze({
-    alias,
-    alias_source: 'profile-config',
-    provider: PROVIDER_ID,
-    provider_type: PROVIDER_TYPE,
-    model: entry.model,
-    base_host: 'api.z.ai',
-    credential_source: 'profile-file',
-    credential_present: credentialPresent === true,
-    credential_fingerprint: null,
-    wire_format: 'openai-chat-completions',
-    health: 'untested',
-  });
-}
-
-module.exports = Object.freeze({
-  PROVIDER_ID,
-  PROVIDER_TYPE,
-  BASE_URL,
-  MODEL_ALIASES,
-  MODEL_EFFORTS,
-  normalizeBaseUrl,
-  readApiKeyFile,
-  configuredModels,
-  configuredProvider,
-  isAllowedRuntimeAlias,
-  isConfiguredAlias,
-  normalizeEffort,
-  requestControls,
-  safeDiagnostic,
-});

package/bin/package-regression-policy.cjs

@@ -1,77 +0,0 @@
-'use strict';
-
-const fs = require('node:fs');
-const zlib = require('node:zlib');
-
-function tarText(buffer, start, length) {
-  return buffer.subarray(start, start + length).toString('utf8').replace(/\0.*$/s, '').trim();
-}
-
-function listTarGzPaths(tarballPath) {
-  const archive = zlib.gunzipSync(fs.readFileSync(tarballPath));
-  const paths = [];
-  let offset = 0;
-  while (offset + 512 <= archive.length) {
-    const header = archive.subarray(offset, offset + 512);
-    if (header.every((byte) => byte === 0)) break;
-    const name = tarText(header, 0, 100);
-    const prefix = tarText(header, 345, 155);
-    const sizeText = tarText(header, 124, 12);
-    const size = sizeText ? Number.parseInt(sizeText, 8) : 0;
-    if (!Number.isFinite(size)) throw new Error(`Ungueltige TAR-Groesse bei ${name || '[ohne Namen]'}`);
-    const fullName = [prefix, name].filter(Boolean).join('/').replaceAll('\\', '/');
-    if (fullName) paths.push(fullName);
-    offset += 512 + Math.ceil(size / 512) * 512;
-  }
-  return paths;
-}
-
-function isStablePackagePath(filePath) {
-  const normalized = String(filePath || '').replaceAll('\\', '/');
-  if (!normalized || normalized.endsWith('/')) return false;
-  if (normalized.startsWith('package/dist-web/assets/')) return false;
-  if (normalized.startsWith('package/dist-web/vis/')) return false;
-  return normalized.startsWith('package/');
-}
-
-function validatePlannedRemovals(document) {
-  const removals = Array.isArray(document?.removals) ? document.removals : [];
-  for (const removal of removals) {
-    if (!isStablePackagePath(removal?.path)) throw new Error(`Ungueltiger Entfernungspfad: ${removal?.path || '[leer]'}`);
-    if (!String(removal?.reason || '').trim()) throw new Error(`Entfernungsgrund fehlt: ${removal.path}`);
-    if (!String(removal?.decisionRef || '').trim()) throw new Error(`Entscheidungsreferenz fehlt: ${removal.path}`);
-  }
-  return new Set(removals.map((removal) => removal.path.replaceAll('\\', '/')));
-}
-
-function findUnexpectedRemovals(previousPaths, currentPaths, plannedDocument = { removals: [] }) {
-  const current = new Set(currentPaths.map((entry) => String(entry).replaceAll('\\', '/')));
-  const planned = validatePlannedRemovals(plannedDocument);
-  return [...new Set(previousPaths
-    .map((entry) => String(entry).replaceAll('\\', '/'))
-    .filter(isStablePackagePath)
-    .filter((entry) => !current.has(entry) && !planned.has(entry)))]
-    .sort();
-}
-
-function comparePackagePaths(previousPaths, currentPaths, plannedDocument = { removals: [] }) {
-  const previousStablePaths = [...new Set(previousPaths
-    .map((entry) => String(entry).replaceAll('\\', '/'))
-    .filter(isStablePackagePath))];
-  const currentStablePaths = [...new Set(currentPaths
-    .map((entry) => String(entry).replaceAll('\\', '/'))
-    .filter(isStablePackagePath))];
-  return {
-    checkedStablePaths: previousStablePaths.length,
-    currentStablePaths: currentStablePaths.length,
-    unexpectedRemovals: findUnexpectedRemovals(previousStablePaths, currentStablePaths, plannedDocument),
-  };
-}
-
-module.exports = {
-  comparePackagePaths,
-  findUnexpectedRemovals,
-  isStablePackagePath,
-  listTarGzPaths,
-  validatePlannedRemovals,
-};