blun-king-cli 9.1.586 → 9.1.588

package/bin/verify-agent-behavior.cjs

@@ -0,0 +1,122 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const vm = require('node:vm');
+const assert = require('node:assert/strict');
+
+function functionSource(source, name) {
+  const found = source.match(new RegExp('^function ' + name + '\\([\\s\\S]*?^\\}', 'm'))?.[0];
+  if (!found) throw new Error('Missing executable contract: ' + name);
+  return found;
+}
+
+function verifyAgentBehavior(packageRoot, reportParent) {
+  const parent = reportParent || path.join(os.homedir(), '.blun', 'diagnostics', 'package-contracts');
+  fs.mkdirSync(parent, { recursive: true });
+  const work = fs.mkdtempSync(path.join(parent, 'check-'));
+  const passed = [];
+  const notApplicable = [];
+  const write = (file, data) => {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, typeof data === 'string' ? data : JSON.stringify(data));
+  };
+  const read = file => JSON.parse(fs.readFileSync(file, 'utf8'));
+  const core = fs.readFileSync(path.join(packageRoot, 'blun.mjs'), 'utf8');
+  const plugin = require(path.join(packageRoot, 'bin/plugin-bootstrap.js'));
+  const selected = require(path.join(packageRoot, 'bin/managed-plugin-selection.cjs'));
+  const tools = require(path.join(packageRoot, 'bin/standard-tools-bootstrap.js'));
+  const profile = path.join(work, 'profile');
+  plugin.installManagedAgentSpinePlugin({ packageRoot, blunDir: profile });
+  plugin.installManagedTelegramPlugin({ packageRoot, blunDir: profile });
+  tools.seedStandardTools({ packageRoot, blunDir: profile, names: ['blun-language-guard'], env: {} });
+  const registryFile = path.join(profile, 'plugins/installed.json');
+  const registry = read(registryFile);
+  const spine = registry.plugins.find(item => item.id === 'agent-spine');
+  const telegram = registry.plugins.find(item => item.id === 'telegram');
+  assert(spine?.enabled && telegram?.enabled, 'native startup omitted a bundled plugin');
+  assert(fs.existsSync(path.join(spine.root, 'src/hook.js')));
+  const mcpFile = path.join(profile, 'mcp.json');
+  const mcp = read(mcpFile);
+  const guard = mcp.mcpServers['blun-language-guard'];
+  assert.equal(guard.enabled, true);
+  assert.equal(guard.args[0], path.join(packageRoot, 'standard-tools/language-guard/blun_language_guard.py'));
+  passed.push('bootstrap-components-register-spine-telegram-guard');
+
+  spine.managedSelection = selected.describeAgentSpineSelection({ blunDir: profile, pluginRoot: spine.root });
+  write(registryFile, registry);
+  const before = fs.readFileSync(registryFile);
+  plugin.installManagedAgentSpinePlugin({ packageRoot, blunDir: profile });
+  assert.deepEqual(fs.readFileSync(registryFile), before);
+  guard.enabled = false; write(mcpFile, mcp);
+  tools.seedStandardTools({ packageRoot, blunDir: profile, names: ['blun-language-guard'], env: {} });
+  assert.equal(read(mcpFile).mcpServers['blun-language-guard'].enabled, false);
+  guard.args = [path.join(work, 'custom/blun_language_guard.py'), 'serve'];
+  guard.env = { SYNTHETIC_CUSTOM_SETTING: 'retained' }; write(mcpFile, mcp);
+  const custom = fs.readFileSync(mcpFile);
+  tools.seedStandardTools({ packageRoot, blunDir: profile, names: ['blun-language-guard'], env: {} });
+  assert.deepEqual(fs.readFileSync(mcpFile), custom);
+  passed.push('repeat-start-preserves-selected-plugin-disabled-and-custom-guard');
+
+  const sharedHome = path.join(work, 'old-user-home');
+  const staleRoot = path.join(sharedHome, '.blun/plugins/managed/old-telegram');
+  write(path.join(staleRoot, '.mcp.json'), { mcpServers: {} });
+  write(path.join(staleRoot, 'dist/mcp-server.mjs'), '// Synthetic old installed entrypoint.\n');
+  write(path.join(sharedHome, '.blun/plugins/installed.json'), { plugins: [{ id: 'telegram', enabled: true, root: staleRoot }] });
+  const env = { BLUN_HOME: profile };
+  const resolveRoot = vm.runInNewContext(functionSource(core, 'managedTelegramPluginRoot') + '\nmanagedTelegramPluginRoot;', {
+    process: { env }, join: path.join, homedir: () => sharedHome,
+    existsSync: fs.existsSync, readFileSync: fs.readFileSync,
+  });
+  assert.equal(resolveRoot(), telegram.root, 'bridge selected the old shared registration');
+  telegram.enabled = false; write(registryFile, registry);
+  assert.equal(resolveRoot(), undefined, 'disabled plugin was selected');
+  telegram.enabled = true; write(registryFile, registry);
+  passed.push('packed-host-selects-active-profile-not-stale-shared-copy');
+
+  const bridge = fs.readFileSync(path.join(telegram.root, 'dist/bridge.mjs'), 'utf8');
+  const access = { dmPolicy: 'allowlist', allowFrom: ['operator'], pending: {},
+    groups: { '-1001': { requireMention: true, alwaysAllowFrom: ['operator'], allowFrom: [] } } };
+  const gateHelpers = ['matchesAny', 'isMentioned', 'gate',
+    ...(/^function connectionCode\(/m.test(bridge) ? ['connectionCode']
+      : ['isGermanGroupBroadcast', 'botLoopGuardAllows'])];
+  const gate = vm.runInNewContext(gateHelpers
+    .map(name => functionSource(bridge, name)).join('\n') + '\ngate;', {
+    readAccess: () => access, pruneExpired: () => false,
+    saveAccess: () => { throw new Error('unexpected access change'); },
+    BOT_COOLDOWN_MS: 15000, lastBotDelivery: new Map(),
+  });
+  const message = { chatId: '-1001', chatType: 'supergroup', text: 'Status for another participant', from: { id: 'operator' } };
+  assert.equal(gate(message, 'ExampleBot').action, 'drop');
+  assert.equal(gate({ ...message, from: { id: 'another-bot', isBot: true } }, 'ExampleBot').action, 'drop');
+  assert.equal(gate({ ...message, text: '@ExampleBot inspect', entities: [{ type: 'mention', offset: 0, length: 11 }] }, 'ExampleBot').action, 'deliver');
+  assert.equal(gate({ ...message, replyToUsername: 'ExampleBot' }, 'ExampleBot').action, 'deliver');
+  assert.equal(gate({ ...message, chatType: 'private', chatId: 'operator' }, 'ExampleBot').action, 'deliver');
+  passed.push('registered-bridge-drops-unmentioned-groups-preserves-mentions-replies-dms');
+
+  const thinkingFile = path.join(packageRoot, 'bin/thinking-only-guard.cjs');
+  if (fs.existsSync(thinkingFile)) {
+    const thinking = require(thinkingFile);
+    assert.equal(thinking.DEFAULT_THINKING_ONLY_LIMIT_MS, 120000);
+    const original = { messages: [{ role: 'user', content: 'synthetic inspection' }] };
+    assert.equal(thinking.forceAnswerParams(original).thinkingOnlyRecovery, true);
+    assert(core.includes('thinkingOnlyRecovery') && core.includes('withThinking("off")'), 'thinking recovery integration missing');
+    passed.push('bounded-thinking-recovery-retained-structural-only');
+  } else {
+    assert(fs.existsSync(path.join(packageRoot, 'bundled-agent-sources.json')), 'private thinking helper missing');
+    notApplicable.push({ check: 'private-thinking-helper', reason: 'The regular CLI does not ship this private test API; no recovery or host proof.' });
+  }
+  const routing = require(path.join(packageRoot, 'bin/turn-thinking-policy.cjs'));
+  for (const prompt of ['Which result file belongs to our task?', 'Quick status?', 'Do you remember our previous decision?']) {
+    assert.equal(routing.selectThinkingEffortForTurn(prompt, 'user', 'off'), undefined,
+      'continuity request lost its project context');
+  }
+  assert.equal(routing.selectThinkingEffortForTurn('Hi', 'user'), 'low');
+  passed.push('continuity-requests-retain-normal-context-routing');
+  const report = { verified: true, work, passed, notApplicable, launcherAutomaticRegistrationTested: false, modelApplicationTested: false,
+    hubCompletenessTested: false, realProfilesChanged: false };
+  write(path.join(work, 'report.json'), report);
+  return report;
+}
+
+module.exports = { verifyAgentBehavior, functionSource };

package/bin/verify-agent-components.cjs

@@ -0,0 +1,104 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+
+const RECEIPT = 'agent-components.json';
+const SCHEMA = 'blun.bundled-agent-components/v1';
+const REQUIRED = [
+  'blun.mjs',
+  'telegram-plugin/dist/bridge.mjs',
+  'bin/thinking-only-guard.cjs',
+  'bin/turn-thinking-policy.cjs',
+  'bin/context-performance-policy.cjs',
+  'bin/verify-agent-behavior.cjs',
+  'agent-spine-plugin/blun.plugin.json',
+  'agent-spine-plugin/src/hook.js',
+  'agent-spine-plugin/src/mcp.js',
+  'agent-spine-plugin/skills/agent-spine/SKILL.md',
+  'standard-skills/translate-native/SKILL.md',
+  'standard-tools/language-guard/blun_language_guard.py',
+  'standard-tools/language-guard/check_diacritics.py',
+  'standard-tools/language-guard/guard_service_client.py',
+  'standard-tools/language-guard/language_quality.py',
+  'standard-tools/language-guard/translation_guard.py',
+  'bin/plugin-bootstrap.js',
+  'bin/managed-plugin-selection.cjs',
+  'bin/standard-tools-bootstrap.js',
+  'bin/launcher-runtime.js',
+];
+const PREFIXES = ['agent-spine-plugin/', 'standard-skills/translate-native/', 'standard-tools/language-guard/'];
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+function inventory(root, prefix = '', excluded = []) {
+  const result = {};
+  for (const name of fs.readdirSync(root).sort()) {
+    const file = path.join(root, name);
+    const relative = prefix + name;
+    if (excluded.some(item => relative === item || relative.startsWith(item + '/'))) continue;
+    const stat = fs.lstatSync(file);
+    if (stat.isSymbolicLink()) throw new Error('Linked component path: ' + relative);
+    if (stat.isDirectory()) Object.assign(result, inventory(file, relative + '/', excluded));
+    else if (stat.isFile()) result[relative] = sha256(fs.readFileSync(file));
+    else throw new Error('Unsupported component path: ' + relative);
+  }
+  return result;
+}
+
+function safeFile(root, relative) {
+  if (typeof relative !== 'string' || relative.includes('\\') || relative.includes(':')
+    || relative.split('/').some(part => !part || part === '.' || part === '..')) {
+    throw new Error('Invalid component path');
+  }
+  let current = path.resolve(root);
+  for (const part of relative.split('/')) {
+    current = path.join(current, part);
+    if (fs.lstatSync(current).isSymbolicLink()) throw new Error('Linked component path: ' + relative);
+  }
+  return current;
+}
+
+function verifyAgentComponents(packageRoot) {
+  const receipt = JSON.parse(fs.readFileSync(path.join(packageRoot, RECEIPT), 'utf8'));
+  if (receipt.schema !== SCHEMA || !receipt.files || typeof receipt.files !== 'object'
+    || Array.isArray(receipt.files)) throw new Error('Invalid bundled component receipt');
+  for (const name of ['agentSpine', 'translateNative']) {
+    if (!/^[a-f0-9]{40}$/.test(receipt.sources?.[name]?.commit || '')) {
+      throw new Error('Missing bundled component source: ' + name);
+    }
+  }
+  for (const name of REQUIRED) {
+    if (!Object.hasOwn(receipt.files, name)) throw new Error('Missing bundled component: ' + name);
+  }
+  for (const [relative, expected] of Object.entries(receipt.files)) {
+    if (!/^[a-f0-9]{64}$/.test(expected) || sha256(fs.readFileSync(safeFile(packageRoot, relative))) !== expected) {
+      throw new Error('Bundled component digest mismatch: ' + relative);
+    }
+  }
+  for (const prefix of PREFIXES) {
+    const actual = Object.keys(inventory(safeFile(packageRoot, prefix.slice(0, -1)), prefix));
+    const expected = Object.keys(receipt.files).filter(file => file.startsWith(prefix)).sort();
+    if (JSON.stringify(actual.sort()) !== JSON.stringify(expected)) throw new Error('Unexpected bundled component files: ' + prefix);
+  }
+  const manifest = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+  if (manifest.scripts?.prepack !== 'node bin/verify-agent-components.cjs') {
+    throw new Error('Bundled component prepack check missing');
+  }
+  const launcher = fs.readFileSync(path.join(packageRoot, 'bin/launcher-runtime.js'), 'utf8');
+  if (!launcher.includes("require('./verify-agent-components.cjs').verifyAgentComponents(PKG);")) {
+    throw new Error('Bundled component startup check missing');
+  }
+  return { verified: true, files: Object.keys(receipt.files).length, sources: receipt.sources };
+}
+
+if (require.main === module) {
+  try {
+    const root = path.resolve(__dirname, '..');
+    console.log(JSON.stringify(verifyAgentComponents(root)));
+    console.log(JSON.stringify(require('./verify-agent-behavior.cjs').verifyAgentBehavior(root)));
+  }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+}
+
+module.exports = { inventory, sha256, verifyAgentComponents, SCHEMA, RECEIPT, REQUIRED, PREFIXES };

package/bin/verify-bundled-agent-sources.cjs

@@ -0,0 +1,57 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+const RECEIPT = 'bundled-agent-sources.json';
+const SCHEMA = 'blun.bundled-agent-sources/v1';
+const PREFIXES = ['agent-spine-plugin/', 'standard-skills/translate-native/', 'standard-tools/language-guard/'];
+const REQUIRED = [
+  'agent-spine-plugin/blun.plugin.json', 'agent-spine-plugin/src/hook.js',
+  'agent-spine-plugin/src/mcp.js', 'agent-spine-plugin/skills/agent-spine/SKILL.md',
+  'standard-skills/translate-native/SKILL.md', 'standard-tools/language-guard/blun_language_guard.py',
+  'standard-tools/language-guard/check_diacritics.py', 'standard-tools/language-guard/language_quality.py',
+  'standard-tools/language-guard/guard_service_client.py', 'standard-tools/language-guard/translation_guard.py',
+];
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+function payloadInventory(root, prefix = '') {
+  const files = {};
+  for (const name of fs.readdirSync(root).sort()) {
+    const target = path.join(root, name), relative = prefix + name;
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink()) throw new Error('Linked bundled component: ' + relative);
+    if (stat.isDirectory()) Object.assign(files, payloadInventory(target, relative + '/'));
+    else if (stat.isFile()) files[relative] = sha256(fs.readFileSync(target));
+    else throw new Error('Unsupported bundled component: ' + relative);
+  }
+  return files;
+}
+
+function verifyBundledAgentSources(root, pins) {
+  const receipt = JSON.parse(fs.readFileSync(path.join(root, RECEIPT), 'utf8'));
+  if (receipt.schema !== SCHEMA || !receipt.files || Array.isArray(receipt.files)) throw new Error('Invalid bundled source receipt');
+  for (const name of ['agentSpine', 'translateNative']) {
+    if (!/^[a-f0-9]{40}$/.test(receipt.sources?.[name]?.commit || '')) throw new Error('Missing bundled source commit: ' + name);
+    if (pins && JSON.stringify(receipt.sources[name]) !== JSON.stringify(pins[name])) throw new Error('Stale bundled source: ' + name);
+  }
+  for (const file of REQUIRED) if (!Object.hasOwn(receipt.files, file)) throw new Error('Missing required bundled source: ' + file);
+  const actual = {};
+  for (const prefix of PREFIXES) {
+    const target = path.join(root, prefix);
+    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Linked component directory');
+    Object.assign(actual, payloadInventory(target, prefix));
+  }
+  const expectedNames = Object.keys(receipt.files).sort();
+  if (JSON.stringify(Object.keys(actual).sort()) !== JSON.stringify(expectedNames)) throw new Error('Bundled source inventory mismatch');
+  for (const file of expectedNames) {
+    if (!/^[a-f0-9]{64}$/.test(receipt.files[file]) || actual[file] !== receipt.files[file]) throw new Error('Bundled source digest mismatch: ' + file);
+  }
+  return receipt;
+}
+
+if (require.main === module) {
+  try { const receipt = verifyBundledAgentSources(path.resolve(__dirname, '..'));
+    console.log(JSON.stringify({ verified: true, sources: receipt.sources, files: Object.keys(receipt.files).length }));
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
+}
+module.exports = { verifyBundledAgentSources, payloadInventory, sha256, RECEIPT, SCHEMA, PREFIXES, REQUIRED };