blun-king-cli 9.1.563 → 9.1.565

package/standard-skills/translate-native/scripts/pre_output_guard.py

@@ -1,64 +1,64 @@
-#!/usr/bin/env python3
-"""Installed-skill hook that verifies an exact current V6 release receipt."""
-
-from __future__ import annotations
-
-import hashlib
-import importlib.util
-import json
-import os
-import sys
-from pathlib import Path
-
-
-QUALITY_PATH = Path(__file__).with_name("language_quality.py")
-SPEC = importlib.util.spec_from_file_location("blun_installed_hook_quality", QUALITY_PATH)
-assert SPEC and SPEC.loader
-QUALITY = importlib.util.module_from_spec(SPEC)
-SPEC.loader.exec_module(QUALITY)
-
-
-def load_verification_key(path: Path) -> bytes:
-    """Load an existing verifier key without creating or replacing trust state."""
-    environment_key = os.environ.get("BLUN_LANGUAGE_GUARD_KEY")
-    if environment_key:
-        return hashlib.sha256(environment_key.encode("utf-8")).digest()
-    try:
-        return QUALITY.load_existing_key(path)
-    except FileNotFoundError as error:
-        raise ValueError("signing key is missing; verification fails closed") from error
-    except OSError as error:
-        raise ValueError("signing key cannot be read") from error
-    except ValueError as error:
-        if "permissions" in str(error):
-            raise ValueError("signing key permissions are broader than owner-only") from error
-        raise ValueError("signing key is invalid") from error
-
-
-def main() -> int:
-    try:
-        request = json.loads(sys.stdin.read().lstrip("\ufeff"))
-        task_kind = request["task_kind"]
-        source = request.get("source_text", "")
-        if task_kind not in {"translation", "response"}:
-            raise ValueError("task_kind must be translation or response")
-        if task_kind == "translation" and not source.strip():
-            raise ValueError("translation receipts require source_text")
-        if task_kind == "response" and source.strip():
-            raise ValueError("response receipts cannot carry source_text")
-        key_path = Path(os.environ.get("BLUN_LANGUAGE_GUARD_KEY_FILE", Path.home() / ".config" / "blun-language-guard" / "signing.key"))
-        result = QUALITY.verify_receipt(
-            request["release_token"], source, request["target_text"],
-            request["language"], load_verification_key(key_path),
-            request.get("content_type", "prose"), request.get("short_text_reviewed") is True,
-            purpose=task_kind,
-        )
-    except (KeyError, ValueError, json.JSONDecodeError, OSError) as error:
-        print(json.dumps({"allow": False, "error": str(error)}))
-        return 1
-    print(json.dumps({"allow": result["valid"], "verification": result}))
-    return 0 if result["valid"] else 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
+#!/usr/bin/env python3
+"""Installed-skill hook that verifies an exact current V6 release receipt."""
+
+from __future__ import annotations
+
+import hashlib
+import importlib.util
+import json
+import os
+import sys
+from pathlib import Path
+
+
+QUALITY_PATH = Path(__file__).with_name("language_quality.py")
+SPEC = importlib.util.spec_from_file_location("blun_installed_hook_quality", QUALITY_PATH)
+assert SPEC and SPEC.loader
+QUALITY = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(QUALITY)
+
+
+def load_verification_key(path: Path) -> bytes:
+    """Load an existing verifier key without creating or replacing trust state."""
+    environment_key = os.environ.get("BLUN_LANGUAGE_GUARD_KEY")
+    if environment_key:
+        return hashlib.sha256(environment_key.encode("utf-8")).digest()
+    try:
+        return QUALITY.load_existing_key(path)
+    except FileNotFoundError as error:
+        raise ValueError("signing key is missing; verification fails closed") from error
+    except OSError as error:
+        raise ValueError("signing key cannot be read") from error
+    except ValueError as error:
+        if "permissions" in str(error):
+            raise ValueError("signing key permissions are broader than owner-only") from error
+        raise ValueError("signing key is invalid") from error
+
+
+def main() -> int:
+    try:
+        request = json.loads(sys.stdin.read().lstrip("\ufeff"))
+        task_kind = request["task_kind"]
+        source = request.get("source_text", "")
+        if task_kind not in {"translation", "response"}:
+            raise ValueError("task_kind must be translation or response")
+        if task_kind == "translation" and not source.strip():
+            raise ValueError("translation receipts require source_text")
+        if task_kind == "response" and source.strip():
+            raise ValueError("response receipts cannot carry source_text")
+        key_path = Path(os.environ.get("BLUN_LANGUAGE_GUARD_KEY_FILE", Path.home() / ".config" / "blun-language-guard" / "signing.key"))
+        result = QUALITY.verify_receipt(
+            request["release_token"], source, request["target_text"],
+            request["language"], load_verification_key(key_path),
+            request.get("content_type", "prose"), request.get("short_text_reviewed") is True,
+            purpose=task_kind,
+        )
+    except (KeyError, ValueError, json.JSONDecodeError, OSError) as error:
+        print(json.dumps({"allow": False, "error": str(error)}))
+        return 1
+    print(json.dumps({"allow": result["valid"], "verification": result}))
+    return 0 if result["valid"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())