blun-king-cli 9.1.602 → 9.1.604

package/bin/verify-bundled-agent-sources.cjs

@@ -1,83 +1,105 @@
-'use strict';
-const fs = require('node:fs');
-const path = require('node:path');
-const { createHash } = require('node:crypto');
-const RECEIPT = 'bundled-agent-sources.json';
-const SCHEMA = 'blun.bundled-agent-sources/v1';
-const PREFIXES = ['agent-spine-plugin/', 'standard-skills/translate-native/', 'standard-tools/language-guard/'];
-const GUARD_RESPONSE_PROFILE = Object.freeze({
-  schema: 'blun.language-guard-response-profile/v1',
-  file: 'translate-native/scripts/blun_language_guard.py',
-  beforeSha256: '837361690535ded4251ca23fbab313f5c3a7005472c259aa8fc51ebf7ecb9cb9',
-  afterSha256: '1e21b570259de0145ace2abf55fb82bf8896c90aaae93839c97fff36a01731f2',
-});
-const GUARD_RESPONSE_PAYLOADS = Object.freeze([
-  'standard-skills/translate-native/scripts/blun_language_guard.py',
-  'standard-tools/language-guard/blun_language_guard.py',
-]);
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+const RECEIPT = 'bundled-agent-sources.json';
+const SCHEMA = 'blun.bundled-agent-sources/v1';
+const PREFIXES = ['agent-spine-plugin/', 'standard-skills/translate-native/', 'standard-tools/language-guard/'];
+const GUARD_RESPONSE_PROFILE = Object.freeze({
+  schema: 'blun.language-guard-response-profile/v1',
+  file: 'translate-native/scripts/blun_language_guard.py',
+  beforeSha256: '837361690535ded4251ca23fbab313f5c3a7005472c259aa8fc51ebf7ecb9cb9',
+  afterSha256: '1e21b570259de0145ace2abf55fb82bf8896c90aaae93839c97fff36a01731f2',
+});
+const GUARD_RESPONSE_PAYLOADS = Object.freeze([
+  'standard-skills/translate-native/scripts/blun_language_guard.py',
+  'standard-tools/language-guard/blun_language_guard.py',
+]);
 const REQUIRED = [
-  'agent-spine-plugin/blun.plugin.json', 'agent-spine-plugin/src/hook.js',
-  'agent-spine-plugin/src/mcp.js', 'agent-spine-plugin/skills/agent-spine/SKILL.md',
-  'standard-skills/translate-native/SKILL.md', ...GUARD_RESPONSE_PAYLOADS,
-  'standard-tools/language-guard/check_diacritics.py', 'standard-tools/language-guard/language_quality.py',
-  'standard-tools/language-guard/guard_service_client.py', 'standard-tools/language-guard/translation_guard.py',
-];
-const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
-
-function payloadInventory(root, prefix = '') {
-  const files = {};
-  for (const name of fs.readdirSync(root).sort()) {
-    const target = path.join(root, name), relative = prefix + name;
-    const stat = fs.lstatSync(target);
-    if (stat.isSymbolicLink()) throw new Error('Linked bundled component: ' + relative);
-    if (stat.isDirectory()) Object.assign(files, payloadInventory(target, relative + '/'));
-    else if (stat.isFile()) files[relative] = sha256(fs.readFileSync(target));
-    else throw new Error('Unsupported bundled component: ' + relative);
-  }
-  return files;
-}
-
-function verifyBundledAgentSources(root, pins) {
-  const receipt = JSON.parse(fs.readFileSync(path.join(root, RECEIPT), 'utf8'));
-  if (receipt.schema !== SCHEMA || !receipt.files || Array.isArray(receipt.files)) throw new Error('Invalid bundled source receipt');
-  for (const name of ['agentSpine', 'translateNative']) {
-    if (!/^[a-f0-9]{40}$/.test(receipt.sources?.[name]?.commit || '')) throw new Error('Missing bundled source commit: ' + name);
-    if (pins && JSON.stringify(receipt.sources[name]) !== JSON.stringify(pins[name])) throw new Error('Stale bundled source: ' + name);
-  }
-  for (const file of REQUIRED) if (!Object.hasOwn(receipt.files, file)) throw new Error('Missing required bundled source: ' + file);
-  const actual = {};
-  for (const prefix of PREFIXES) {
-    const target = path.join(root, prefix);
-    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Linked component directory');
-    Object.assign(actual, payloadInventory(target, prefix));
-  }
-  const expectedNames = Object.keys(receipt.files).sort();
-  if (JSON.stringify(Object.keys(actual).sort()) !== JSON.stringify(expectedNames)) throw new Error('Bundled source inventory mismatch');
+  'agent-spine-plugin/package.json',
+  'standard-skills/translate-native/VERSION', 'standard-skills/translate-native/provenance.json',
+  'standard-tools/language-guard/VERSION', 'standard-tools/language-guard/provenance.json',
+  'agent-spine-plugin/blun.plugin.json', 'agent-spine-plugin/src/hook.js',
+  'agent-spine-plugin/src/mcp.js', 'agent-spine-plugin/skills/agent-spine/SKILL.md',
+  'standard-skills/translate-native/SKILL.md', ...GUARD_RESPONSE_PAYLOADS,
+  'standard-tools/language-guard/check_diacritics.py', 'standard-tools/language-guard/language_quality.py',
+  'standard-tools/language-guard/guard_service_client.py', 'standard-tools/language-guard/translation_guard.py',
+];
+const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+function payloadInventory(root, prefix = '') {
+  const files = {};
+  for (const name of fs.readdirSync(root).sort()) {
+    const target = path.join(root, name), relative = prefix + name;
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink()) throw new Error('Linked bundled component: ' + relative);
+    if (stat.isDirectory()) Object.assign(files, payloadInventory(target, relative + '/'));
+    else if (stat.isFile()) files[relative] = sha256(fs.readFileSync(target));
+    else throw new Error('Unsupported bundled component: ' + relative);
+  }
+  return files;
+}
+
+function verifyBundledAgentSources(root, pins) {
+  const receipt = JSON.parse(fs.readFileSync(path.join(root, RECEIPT), 'utf8'));
+  if (receipt.schema !== SCHEMA || !receipt.files || Array.isArray(receipt.files)) throw new Error('Invalid bundled source receipt');
+  for (const name of ['agentSpine', 'translateNative']) {
+    if (!/^[a-f0-9]{40}$/.test(receipt.sources?.[name]?.commit || '')) throw new Error('Missing bundled source commit: ' + name);
+    if (pins && JSON.stringify(receipt.sources[name]) !== JSON.stringify(pins[name])) throw new Error('Stale bundled source: ' + name);
+  }
+  for (const file of REQUIRED) if (!Object.hasOwn(receipt.files, file)) throw new Error('Missing required bundled source: ' + file);
+  const actual = {};
+  for (const prefix of PREFIXES) {
+    const target = path.join(root, prefix);
+    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Linked component directory');
+    Object.assign(actual, payloadInventory(target, prefix));
+  }
+  const expectedNames = Object.keys(receipt.files).sort();
+  if (JSON.stringify(Object.keys(actual).sort()) !== JSON.stringify(expectedNames)) throw new Error('Bundled source inventory mismatch');
   for (const file of expectedNames) {
     if (!/^[a-f0-9]{64}$/.test(receipt.files[file]) || actual[file] !== receipt.files[file]) throw new Error('Bundled source digest mismatch: ' + file);
   }
-  // Bind the semantic repair independently of the self-reported file inventory.
-  const patch = receipt.localPatches?.guardResponseProfile;
-  if (!patch || typeof patch !== 'object' || Array.isArray(patch)
-    || Object.keys(patch).length !== Object.keys(GUARD_RESPONSE_PROFILE).length
-    || Object.entries(GUARD_RESPONSE_PROFILE).some(([key, value]) => patch[key] !== value)) {
-    throw new Error('Invalid language guard response profile repair receipt');
-  }
-  if (receipt.sourceDigests?.translateNative?.[GUARD_RESPONSE_PROFILE.file] !== GUARD_RESPONSE_PROFILE.beforeSha256) {
-    throw new Error('Invalid language guard response profile source digest');
+  for (const name of ['agentSpine', 'translateNative']) {
+    const version = receipt.versions?.[name];
+    if (typeof version !== 'string' || !version || version.trim() !== version) {
+      throw new Error('Invalid bundled component version: ' + name);
+    }
   }
-  for (const file of GUARD_RESPONSE_PAYLOADS) {
-    if (actual[file] !== GUARD_RESPONSE_PROFILE.afterSha256) {
-      throw new Error('Invalid language guard response profile payload: ' + file);
+  const spine = JSON.parse(fs.readFileSync(path.join(root, 'agent-spine-plugin/package.json'), 'utf8'));
+  if (spine.version !== receipt.versions.agentSpine) throw new Error('Bundled component version mismatch: agentSpine');
+  for (const prefix of ['standard-skills/translate-native/', 'standard-tools/language-guard/']) {
+    if (fs.readFileSync(path.join(root, prefix, 'VERSION'), 'utf8').trim() !== receipt.versions.translateNative) {
+      throw new Error('Bundled component version mismatch: ' + prefix);
+    }
+    const provenance = JSON.parse(fs.readFileSync(path.join(root, prefix, 'provenance.json'), 'utf8'));
+    if (provenance?.name !== 'translate-native' || provenance.version !== receipt.versions.translateNative
+      || provenance.sourceCommit !== receipt.sources.translateNative.commit
+      || provenance.sourceRepository !== receipt.sources.translateNative.repository) {
+      throw new Error('Bundled component provenance mismatch: ' + prefix);
     }
   }
-  return receipt;
-}
-
-if (require.main === module) {
-  try { const receipt = verifyBundledAgentSources(path.resolve(__dirname, '..'));
-    console.log(JSON.stringify({ verified: true, sources: receipt.sources, files: Object.keys(receipt.files).length }));
-  } catch (error) { console.error(error.message); process.exitCode = 1; }
-}
-module.exports = { verifyBundledAgentSources, payloadInventory, sha256, RECEIPT, SCHEMA, PREFIXES, REQUIRED,
-  GUARD_RESPONSE_PROFILE, GUARD_RESPONSE_PAYLOADS };
+  // Bind the semantic repair independently of the self-reported file inventory.
+  const patch = receipt.localPatches?.guardResponseProfile;
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)
+    || Object.keys(patch).length !== Object.keys(GUARD_RESPONSE_PROFILE).length
+    || Object.entries(GUARD_RESPONSE_PROFILE).some(([key, value]) => patch[key] !== value)) {
+    throw new Error('Invalid language guard response profile repair receipt');
+  }
+  if (receipt.sourceDigests?.translateNative?.[GUARD_RESPONSE_PROFILE.file] !== GUARD_RESPONSE_PROFILE.beforeSha256) {
+    throw new Error('Invalid language guard response profile source digest');
+  }
+  for (const file of GUARD_RESPONSE_PAYLOADS) {
+    if (actual[file] !== GUARD_RESPONSE_PROFILE.afterSha256) {
+      throw new Error('Invalid language guard response profile payload: ' + file);
+    }
+  }
+  return receipt;
+}
+
+if (require.main === module) {
+  try { const receipt = verifyBundledAgentSources(path.resolve(__dirname, '..'));
+    console.log(JSON.stringify({ verified: true, sources: receipt.sources, files: Object.keys(receipt.files).length }));
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
+}
+module.exports = { verifyBundledAgentSources, payloadInventory, sha256, RECEIPT, SCHEMA, PREFIXES, REQUIRED,
+  GUARD_RESPONSE_PROFILE, GUARD_RESPONSE_PAYLOADS };