blun-king-cli 9.1.597 → 9.1.600

package/agent-spine-plugin/src/lib/source-roots.js

@@ -8,7 +8,7 @@ import { isFileLockContention, replaceFileWithRetry } from "./filesystem-retry.j
 import { purgeIndexedMemoryCache, resolveIndexedMemory } from "./indexed-memory.js";
 import { hookMemoryQuery, loadLessonRecallSelection, rememberLessonRecallSelection } from "./lesson-recall-session.js";
 import { catalogScanPolicy } from "./catalog.js";
-import { isKingHost, KING_SOURCE_MAX_BYTES } from "./host-instruction-budget.js";
+import { isKingHost, KING_SOURCE_BYTES } from "./host-instruction-budget.js";
 import {
   SOURCE_SCAN_INCOMPLETE, boundedMarkdownTree, existingDirectory, existingRegular, sourceScanError
 } from "./source-tree-scan.js";
@@ -25,6 +25,20 @@ const SOURCE_RESOLUTION_MS = 2000;
 const SAFE_NAME = /^[A-Za-z0-9._-]{1,128}$/;
 
 function digest(value) { return createHash("sha256").update(value).digest("hex"); }
+async function partitionSources(sources, env) {
+  if (!isKingHost(env)) return { sources, unverified: [] };
+  const loaded = [], unverified = []; let used = 0;
+  for (const source of sources) {
+    if (!source.id.startsWith("codex:")) { loaded.push(source); continue; }
+    const bytes = (await lstat(source.path)).size, limit = source.maxBytes || KING_SOURCE_BYTES;
+    const total = bytes <= limit && used + bytes > MAX_TOTAL_SOURCE_BYTES;
+    if (bytes <= limit && !total) { loaded.push(source); used += bytes; continue; }
+    const ceiling = total ? MAX_TOTAL_SOURCE_BYTES : limit;
+    const message = `King rule ${source.id} (${bytes} bytes) exceeds AgentSpine's ${ceiling}-byte ${total ? "total " : ""}reader budget; AgentSpine did not load or verify it. Native rules apply. Continue; no retry.`;
+    unverified.push({ id: source.id, path: source.path, bytes, message });
+  }
+  return { sources: loaded, unverified };
+}
 function registryPath(env = process.env) { return join(stateRoot(env), "source-roots.json"); }
 function emptyRegistry() { return { schema: SOURCE_REGISTRY_SCHEMA, revision: 0, bindings: [], history: [] }; }
 
@@ -354,7 +368,7 @@ export async function resolveHostSourceCatalog({ host, cwd = process.cwd(), inpu
   const { registry } = await readRegistry(env);
   let hostHome;
   let projectRoot;
-  let sources;
+  let sources, unverified;
   let skipped = [];
   let hostDetails = {};
   let rootResolution = "explicit-root";
@@ -362,7 +376,7 @@ export async function resolveHostSourceCatalog({ host, cwd = process.cwd(), inpu
     const codexHome = isKingHost(env) ? env.BLUN_HOME : env.CODEX_HOME || env.BLUN_HOME || join(homedir(), ".codex");
     hostHome = await existingDirectory(resolve(codexHome)) || resolve(codexHome);
     const config = await codexConfig(hostHome);
-    if (isKingHost(env)) config.maxBytes = KING_SOURCE_MAX_BYTES;
+    if (isKingHost(env)) config.maxBytes = KING_SOURCE_BYTES;
     if (env.AGENTSPINE_ROOT) projectRoot = await canonicalPath(env.AGENTSPINE_ROOT);
     else ({ root: projectRoot, resolution: rootResolution } = await findRoot(canonicalCwd, config.rootMarkers));
     sources = await codexSources({ cwd: canonicalCwd, projectRoot, codexHome: hostHome, config });
@@ -378,7 +392,6 @@ export async function resolveHostSourceCatalog({ host, cwd = process.cwd(), inpu
     hostDetails = { memoryRoot: result.memoryRoot, memoryProvenance: result.memoryProvenance,
       memoryDiagnostics: result.memoryDiagnostics };
   } else {
-    // Generic hosts get project sources, never another provider's profile.
     hostHome = await canonicalPath(homedir());
     if (env.AGENTSPINE_ROOT) projectRoot = await canonicalPath(env.AGENTSPINE_ROOT);
     else ({ root: projectRoot, resolution: rootResolution } = await findRoot(canonicalCwd, [".git"]));
@@ -394,6 +407,7 @@ export async function resolveHostSourceCatalog({ host, cwd = process.cwd(), inpu
   }
   sources = [...new Map(sources.map((item) => [item.path, item])).values()];
   if (sources.length > MAX_SOURCES) throw new Error(`host-native required source set exceeds ${MAX_SOURCES} files`);
+  ({ sources, unverified } = await partitionSources(sources, env));
   const nativeNames = new Set(host === "codex"
     ? ["AGENTS.override.md", "AGENTS.md", ...(hostDetails.fallbackNames || [])]
     : host === "claude" ? ["CLAUDE.md", "CLAUDE.local.md"] : ["AGENTS.md", "SOUL.md", "MEMORY.md"]);
@@ -410,10 +424,6 @@ export async function resolveHostSourceCatalog({ host, cwd = process.cwd(), inpu
   }
   sources = [...new Map(sources.map((item) => [item.path, item])).values()];
   if (sources.length > MAX_SOURCES) throw new Error(`host-native source set exceeds ${MAX_SOURCES} files`);
-  const projectScanIncomplete = skipped.some((item) => item.code === SOURCE_SCAN_INCOMPLETE);
-  if (Date.now() > deadline && !projectScanIncomplete) {
-    throw new Error(`host-native source resolution exceeded ${SOURCE_RESOLUTION_MS} ms`);
-  }
   let documents;
   try {
     documents = await indexExplicitDocuments(sources);
@@ -421,25 +431,25 @@ export async function resolveHostSourceCatalog({ host, cwd = process.cwd(), inpu
     if (typeof error?.code === "string" && (error.path || error.syscall)) throw sourceScanError(error);
     throw error;
   }
-  if (Date.now() > deadline && !projectScanIncomplete) {
-    throw new Error(`host-native source resolution exceeded ${SOURCE_RESOLUTION_MS} ms`);
-  }
   const totalBytes = documents.reduce((sum, document) => sum + document.bytes, 0);
   if (totalBytes > MAX_TOTAL_SOURCE_BYTES) throw new Error("host-native source set exceeds 8 MiB");
   const activeUserState = activeBinding(registry, host, hostHome, projectRoot, "state-user");
   const orderedSkipped = skipped.sort((a, b) => a.path.localeCompare(b.path) || a.operation.localeCompare(b.operation));
   const warnings = orderedSkipped.filter((item) => item.code === SOURCE_SCAN_INCOMPLETE);
+  const unverifiedWarning = unverified.length > 1
+    ? `${unverified.length} King rules exceed AgentSpine reader budgets; none were loaded or verified. Native rules apply. Continue; no retry.`
+    : unverified[0]?.message;
   const diagnostics = {
-    schema: SOURCE_REGISTRY_SCHEMA, host, status: documents.length ? "loaded" : "empty", projectRoot,
+    schema: SOURCE_REGISTRY_SCHEMA, host, status: unverified.length ? "incomplete" : documents.length ? "loaded" : "empty", projectRoot,
     hostHomeDigest: digest(hostHome).slice(0, 16), checked: ["host-profile", "project-chain", ...(host === "claude" ? ["project-memory"] : [])],
     scopes: Object.fromEntries(["user", "project", "project-memory"].map((scope) => [scope, documents.filter((item) => item.sourceScope === scope).length])),
-    reason: documents.length ? null : "No regular, non-symlink host-native Markdown source exists in the checked scope.",
+    reason: unverifiedWarning || (documents.length ? null : "No regular, non-symlink host-native Markdown source exists in the checked scope."),
     personalContinuityLoaded: documents.some((item) => item.sourceScope === "user") || Boolean(activeUserState),
     broadHomeScan: false, projectTreeScan: skippedFallbackHomeTree ? "skipped-unmarked-home"
       : skippedHomeTree ? "skipped-home-root" : skippedProfileTree ? "skipped-profile-root"
         : warnings.length ? "bounded-truncated" : "bounded",
-    incomplete: warnings.length > 0,
-    warning: warnings[0]?.message || null,
+    incomplete: Boolean(unverified.length || warnings.length),
+    warning: unverifiedWarning || warnings[0]?.message || null,
     warnings,
     skipped: orderedSkipped,
     rootResolution, registryRevision: registry.revision,
@@ -460,6 +470,6 @@ export async function resolveHostSourceCatalog({ host, cwd = process.cwd(), inpu
     summary: { total: documents.length, protected: documents.filter((item) => item.protected).length, conflicts: 0,
       byLayer: Object.fromEntries([...new Set(documents.map((item) => item.layer))].sort().map((layer) => [layer, documents.filter((item) => item.layer === layer).length])) }
   };
-  return { host, hostHome, projectRoot, cwd: canonicalCwd, catalog, diagnostics,
+  return { host, hostHome, projectRoot, cwd: canonicalCwd, catalog, diagnostics, unverified,
     userStateRoot: activeUserState?.sourceRoot || null, memoryRoot: hostDetails.memoryRoot || null };
 }

package/agent-spine-plugin/src/lib/timeline-user-feedback.js

@@ -69,7 +69,6 @@ function validateInterpretation(input, value) {
   return true;
 }
 
-// Provenance only.
 export function validateUserFeedback(input, value) {
   if (validateInterpretation(input, value)) return;
   if (input.evidenceKind !== KIND && value?.schema !== USER_FEEDBACK_SCHEMA) return;

package/bin/core-bootstrap.js

@@ -7,12 +7,16 @@ const { pathToFileURL } = require('node:url');
 const { acquireSharedRuntimeLease } = require('./update-lease');
 const { installWindowsNodeCrashDump } = require('./windows-node-crash-dump.cjs');
 const { recordRuntimeExit } = require('./runtime-exit-ledger.cjs');
+const { isStandaloneHelpRequest } = require('./launcher-mode');
 
 const CORE_LOADED_MESSAGE = 'blun-core-bootstrap-loaded';
 
 async function runCoreBootstrap() {
+  const informational = isStandaloneHelpRequest(process.argv.slice(2));
   let diagnostics;
-  try { diagnostics = installWindowsNodeCrashDump({ homeDir: process.env.BLUN_HOME }); } catch {}
+  if (!informational) {
+    try { diagnostics = installWindowsNodeCrashDump({ homeDir: process.env.BLUN_HOME }); } catch {}
+  }
   const packageRoot = path.resolve(__dirname, '..');
   const mainPath = path.join(packageRoot, 'blun.mjs');
   let leaseResult;
@@ -25,18 +29,22 @@ async function runCoreBootstrap() {
     await import(pathToFileURL(mainPath).href);
     leaseResult.lease.assertOwned();
   } catch (error) {
-    try {
-      if (diagnostics?.enabled) diagnostics.write(error, 'bootstrap-failure');
-      else recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
-        kind: 'bootstrap-failure', phase: 'startup', error });
-    } catch {}
+    if (!informational) {
+      try {
+        if (diagnostics?.enabled) diagnostics.write(error, 'bootstrap-failure');
+        else recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
+          kind: 'bootstrap-failure', phase: 'startup', error });
+      } catch {}
+    }
     try { diagnostics?.dispose(); } catch {}
     try { await leaseResult?.lease?.release(); }
     catch (leaseError) {
-      try {
-        recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
-          kind: 'lease-release-failure', phase: 'cleanup', error: leaseError });
-      } catch {}
+      if (!informational) {
+        try {
+          recordRuntimeExit({ homeDir: process.env.BLUN_HOME, source: 'bootstrap',
+            kind: 'lease-release-failure', phase: 'cleanup', error: leaseError });
+        } catch {}
+      }
     }
     throw error;
   }

package/bin/launcher-mode.js

@@ -75,6 +75,10 @@ function isNpmPackageUpdateRequest(args) {
   return command === 'update' || command === 'upgrade';
 }
 
+function isStandaloneHelpRequest(args) {
+  return Array.isArray(args) && args.length === 1 && (args[0] === '--help' || args[0] === '-h');
+}
+
 function launcherHelpText() {
   return LAUNCHER_HELP_TEXT;
 }
@@ -83,6 +87,7 @@ module.exports = {
   LAUNCHER_MODES,
   createLauncherEnvironment,
   isNpmPackageUpdateRequest,
+  isStandaloneHelpRequest,
   launcherHelpText,
   launcherModeFromArgv,
 };

package/bin/launcher-runtime.js

@@ -12,6 +12,7 @@ const {
   LAUNCHER_MODES,
   createLauncherEnvironment,
   isNpmPackageUpdateRequest,
+  isStandaloneHelpRequest,
   launcherHelpText,
   launcherModeFromArgv,
 } = require('./launcher-mode');
@@ -28,6 +29,7 @@ const {
 } = require('./launcher-restart-policy.cjs');
 const { recordRuntimeExit } = require('./runtime-exit-ledger.cjs');
 const { prepareManagedNodeRuntime } = require('./node-runtime');
+const { unsupportedNodeMessage } = require('./node-version');
 const { repairConfiguredNativeModules } = require('./native-module-repair');
 const { acquireSharedRuntimeLease, tryAcquireUpdateLease } = require('./update-lease');
 const { runExplicitUpdate, runUpdateNotice } = require('./update-notice');
@@ -160,6 +162,15 @@ function spawnProtectedCore(args, env, cwd) {
   return { child, completed, loaded };
 }
 
+async function runInformationalCore(args, env, cwd, releaseNotice) {
+  const core = spawnProtectedCore(args, env, cwd);
+  await core.loaded;
+  await releaseNotice();
+  const result = await core.completed;
+  if (result.error) throw result.error;
+  return Number.isInteger(result.code) ? result.code : exitCodeForChild(result, false);
+}
+
 async function superviseProtectedCore(args, env, cwd, releaseNotice) {
   let noticeReleased = false;
   for (;;) {
@@ -347,6 +358,22 @@ async function runLauncher(options = {}) {
       return;
     }
 
+    if (isStandaloneHelpRequest(ARGS)) {
+      const compatibilityError = unsupportedNodeMessage(process.versions.node, process.platform);
+      if (compatibilityError !== null) {
+        process.stderr.write(`${compatibilityError}\n`);
+        process.exitCode = 1;
+        return;
+      }
+      process.stdout.write(launcherHelpText());
+      const env = createLauncherEnvironment(process.env, mode, readPackageVersion());
+      const informationalEnv = { ...process.env };
+      delete informationalEnv.BLUN_HOME;
+      env.BLUN_HOME = resolveLauncherPrivatePaths({ env: informationalEnv }).blunHome;
+      process.exitCode = await runInformationalCore(ARGS, env, callerCwd, releaseNotice);
+      return;
+    }
+
     let privatePaths;
     const getPrivatePaths = () => {
       privatePaths ||= resolveLauncherPrivatePaths();

package/bin/verify-bundled-agent-sources.cjs

@@ -5,10 +5,20 @@ const { createHash } = require('node:crypto');
 const RECEIPT = 'bundled-agent-sources.json';
 const SCHEMA = 'blun.bundled-agent-sources/v1';
 const PREFIXES = ['agent-spine-plugin/', 'standard-skills/translate-native/', 'standard-tools/language-guard/'];
+const GUARD_RESPONSE_PROFILE = Object.freeze({
+  schema: 'blun.language-guard-response-profile/v1',
+  file: 'translate-native/scripts/blun_language_guard.py',
+  beforeSha256: '837361690535ded4251ca23fbab313f5c3a7005472c259aa8fc51ebf7ecb9cb9',
+  afterSha256: '1e21b570259de0145ace2abf55fb82bf8896c90aaae93839c97fff36a01731f2',
+});
+const GUARD_RESPONSE_PAYLOADS = Object.freeze([
+  'standard-skills/translate-native/scripts/blun_language_guard.py',
+  'standard-tools/language-guard/blun_language_guard.py',
+]);
 const REQUIRED = [
   'agent-spine-plugin/blun.plugin.json', 'agent-spine-plugin/src/hook.js',
   'agent-spine-plugin/src/mcp.js', 'agent-spine-plugin/skills/agent-spine/SKILL.md',
-  'standard-skills/translate-native/SKILL.md', 'standard-tools/language-guard/blun_language_guard.py',
+  'standard-skills/translate-native/SKILL.md', ...GUARD_RESPONSE_PAYLOADS,
   'standard-tools/language-guard/check_diacritics.py', 'standard-tools/language-guard/language_quality.py',
   'standard-tools/language-guard/guard_service_client.py', 'standard-tools/language-guard/translation_guard.py',
 ];
@@ -46,6 +56,21 @@ function verifyBundledAgentSources(root, pins) {
   for (const file of expectedNames) {
     if (!/^[a-f0-9]{64}$/.test(receipt.files[file]) || actual[file] !== receipt.files[file]) throw new Error('Bundled source digest mismatch: ' + file);
   }
+  // Bind the semantic repair independently of the self-reported file inventory.
+  const patch = receipt.localPatches?.guardResponseProfile;
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)
+    || Object.keys(patch).length !== Object.keys(GUARD_RESPONSE_PROFILE).length
+    || Object.entries(GUARD_RESPONSE_PROFILE).some(([key, value]) => patch[key] !== value)) {
+    throw new Error('Invalid language guard response profile repair receipt');
+  }
+  if (receipt.sourceDigests?.translateNative?.[GUARD_RESPONSE_PROFILE.file] !== GUARD_RESPONSE_PROFILE.beforeSha256) {
+    throw new Error('Invalid language guard response profile source digest');
+  }
+  for (const file of GUARD_RESPONSE_PAYLOADS) {
+    if (actual[file] !== GUARD_RESPONSE_PROFILE.afterSha256) {
+      throw new Error('Invalid language guard response profile payload: ' + file);
+    }
+  }
   return receipt;
 }
 
@@ -54,4 +79,5 @@ if (require.main === module) {
     console.log(JSON.stringify({ verified: true, sources: receipt.sources, files: Object.keys(receipt.files).length }));
   } catch (error) { console.error(error.message); process.exitCode = 1; }
 }
-module.exports = { verifyBundledAgentSources, payloadInventory, sha256, RECEIPT, SCHEMA, PREFIXES, REQUIRED };
+module.exports = { verifyBundledAgentSources, payloadInventory, sha256, RECEIPT, SCHEMA, PREFIXES, REQUIRED,
+  GUARD_RESPONSE_PROFILE, GUARD_RESPONSE_PAYLOADS };