blun-king-cli 9.1.613 → 9.1.615

package/bundled-agent-sources.json

@@ -554,7 +554,7 @@
     "agent-spine-plugin/src/lib/delivery-shell-wrapper.js": "95e178bcf8e1d7ea0bca58aa6aa5ea594bd15cac31f242e0e19250994732cd13",
     "agent-spine-plugin/src/lib/delivery-target.js": "29109a53a1dc487e10a41315194c88c4d9d0b425a07420d3420166f9050aded6",
     "agent-spine-plugin/src/lib/delivery-verification.js": "b9e094ebccf22a15e35505181b6968644087e455ec6826ba2c67ea61a5f2f5cc",
-    "agent-spine-plugin/src/lib/documents.js": "b3d254241326d57c397bd65c11f3d13abe9bb0d347615b939277a11485f14680",
+    "agent-spine-plugin/src/lib/documents.js": "49043da206c9948f4400048443772e891ee3367bc6a94e15a48df20f36c22870",
     "agent-spine-plugin/src/lib/feed-transport.js": "5236f0a7010e6896dd1dc28eb56b7562d2c9037da171119bf2b3fe82b7055055",
     "agent-spine-plugin/src/lib/filesystem-retry.js": "eba6335a068b0f5226e7c6b001b2dbadb294ad572098a2b713a3c78449ad785a",
     "agent-spine-plugin/src/lib/gateway-common.js": "18b42c4e28963ecad64091f1b3416332aa829fe13d869efbe6b67c749e31992f",
@@ -580,7 +580,7 @@
     "agent-spine-plugin/src/lib/hook-artifact-guards.js": "9e05895e9353afec815127322baccaed619969c752f6b00154354731afc8fac4",
     "agent-spine-plugin/src/lib/hook-audit.js": "05dee25020febcf628f7474b48cb7cd94dab84dd0127394d6ac80a5a5c91312c",
     "agent-spine-plugin/src/lib/hook-briefing-use.js": "ca4aed816d27f027bcc42600e80fa09d886d975d134a596c003f15603a381ed1",
-    "agent-spine-plugin/src/lib/hook-context.js": "e9ad81e9c6ba38bb88547e82bc87322f53d51e0359913868d8b131f334d19493",
+    "agent-spine-plugin/src/lib/hook-context.js": "a2fe610207dbe8e5fb5455aa0d148df8f233fcbe025e8b1007379b875a1fc84a",
     "agent-spine-plugin/src/lib/hook-final-message.js": "364044bba68c211a4b0f0474e5d77b6b3eb9db22fb64faea9bce623e4f4a4c9f",
     "agent-spine-plugin/src/lib/hook-input.js": "61e7257a1b0e06072e6159cf47fad4c97c52d6d7261eafdf0a9ea7f839845891",
     "agent-spine-plugin/src/lib/hook-output.js": "38a05c10e612f8aa449cca3ad25705491825c229191365e114a4978a2b8d32e9",
@@ -589,7 +589,7 @@
     "agent-spine-plugin/src/lib/hook-protection.js": "9a42a3f86c92ae09a6b312faf3b9ea7bbe72e89dd227c3b3468d968cca36628f",
     "agent-spine-plugin/src/lib/hook-stop-verification.js": "f6b4636b2136c8244f4f5deb8cd3fee6fd646b7d6b495093ff0c675411226eb2",
     "agent-spine-plugin/src/lib/hook-timeline.js": "27fcdae15e3b35372f598ee30c1c6ae72afde377e684938fadf76b9fa7b8ee90",
-    "agent-spine-plugin/src/lib/host-instruction-budget.js": "1d2515e15455e4149ba2c60de3445f67afc586bfaaf233a1538027e838eb43ae",
+    "agent-spine-plugin/src/lib/host-instruction-budget.js": "214bafaa4dc54405bea73ad78aeb63f78dd27ccd34a27fb4c2245f6c9f578cd0",
     "agent-spine-plugin/src/lib/https-transport.js": "c3482f88851d6c04bffac160bfcc8fb447e8b188abf0e3a1ce5a4d25a3ce2307",
     "agent-spine-plugin/src/lib/identifier-analysis.js": "a925db33ea8efabd3ce0a5fac1e74418b8a95c36fac1fedb4eaf846d0b4bcc76",
     "agent-spine-plugin/src/lib/indexed-memory-offline.js": "0d4c14fcdabda4bbe35c20a5526c8511253839bb310c0c2bfb5dd1abc57e047c",
@@ -637,7 +637,7 @@
     "agent-spine-plugin/src/lib/persona-runtime.js": "1f4c2f44edacc80bf92fc6906c78410ead0e379f2aaf34fed4bda55d4effe393",
     "agent-spine-plugin/src/lib/pre-answer-timeline-recall.js": "50780f8f6ec1578fc06b82cf8f2902a203232964b6745d8155049f5284ff9221",
     "agent-spine-plugin/src/lib/preflight-delivery-id.js": "d1467ac8278de877a44253428c7503991a08cc64f61ec6409f0f153535c7a2a6",
-    "agent-spine-plugin/src/lib/preflight.js": "54b1f576e255df4a2824c9030cfa142c035cfd01b5855dd5668c5859ba624354",
+    "agent-spine-plugin/src/lib/preflight.js": "d3ef8476146c825c110335b38e8fa37ae95313845384251d801df208698dd0e2",
     "agent-spine-plugin/src/lib/project-portfolio.js": "9125715201d97b694827b400c8829cecfbbc142d01b19bd16f92915be08a904f",
     "agent-spine-plugin/src/lib/runtime.js": "e9cb158700de18038651bbb21ac8211fcad8d50b016c7276dd078146a21f5555",
     "agent-spine-plugin/src/lib/selfstarter-core.js": "428ab53db57163b53d6125df914fee14bfbdd555c761cf89993d273f4d92f5a9",
@@ -672,7 +672,7 @@
     "agent-spine-plugin/src/lib/session-timeline-windows-acl.js": "e76fe7834ea45758c38aba39ebe956336785a8978a9edc79bd2873def6657b75",
     "agent-spine-plugin/src/lib/session-timeline.js": "6f14664024b454c3186ecba0b1b4d3402b5fc1e491f7cf5a4787a7be22536c07",
     "agent-spine-plugin/src/lib/sharing.js": "dee040d25122a39d3b44e752d1a22f64331c14bdd800f7b85cb9edc3ca9728b6",
-    "agent-spine-plugin/src/lib/source-roots.js": "d41d8d6e22236fd3e536029f0de436f5144f0fbd05c6e15483dd914748a34b54",
+    "agent-spine-plugin/src/lib/source-roots.js": "3091993a184e4eccbc08faedca8524810d2589cb606d3b8128a13968a27fc069",
     "agent-spine-plugin/src/lib/source-tree-scan.js": "23bcac5c72aca9c43556fc606e5d37bde43c4ae8ee92017b02a8a5b7098fcbf3",
     "agent-spine-plugin/src/lib/sqlite-transport.js": "5a329d4428c69e67fd56280b7258654572a792c0f03fb11e1f6a95ba8e0cf68a",
     "agent-spine-plugin/src/lib/task-knowledge-context.js": "4163bde2cf3fdcc1b51b4981d4425e996a042a2295e123b5941f360da029e543",

package/codebase-index/codebase_index.py

@@ -7,7 +7,7 @@ Auflagen Dieter 43102:
   (Run-3-Befund: Liste trieb RAM-Spitze auf 10,5 GB).
 - Inkrementell: Content-Hash je Datei im Manifest, Delta statt Vollindex.
 - Query mit Frische-Auskunft + Selbstauskunft in JEDER Antwort.
-- Query-Fehlschlag-Log lokal (query-log.jsonl) — der Moat.
+- Lokales Query-Metadatenlog (query-log.jsonl), ohne Fragetext.
 
 Aufruf:
   python codebase_index.py build  <repo>
@@ -351,13 +351,29 @@ def cmd_update(repo: str) -> None:
     )
 
 
-def freshness(repo: str, man: dict) -> str:
-    current = git_head(repo)
-    same = "== HEAD" if current == man["head"] else f"Index {man['head']} != HEAD {current} — 'update' faellig"
-    return f"Index-Stand: {man['head']} ({man['built_at']}), {man['chunks']} Chunks | {same}"
-
-
-def cmd_query(repo: str, question: str, top: int, selector: str = "auto") -> int:
+def freshness(repo: str, man: dict) -> str:
+    current = git_head(repo)
+    same = "== HEAD" if current == man["head"] else f"Index {man['head']} != HEAD {current} — 'update' faellig"
+    return f"Index-Stand: {man['head']} ({man['built_at']}), {man['chunks']} Chunks | {same}"
+
+
+def append_query_metadata(dirpath: str, question: str, hits: list[tuple[str, float]],
+                          requested_top: int, latency_ms: float, man: dict) -> None:
+    record = {
+        "ts": datetime.now(timezone.utc).isoformat(),
+        "query_bytes": len(question.encode("utf-8")),
+        "requested_top": requested_top,
+        "result_count": len(hits),
+        "result_paths": list(dict.fromkeys(meta.rsplit("#", 1)[0] for meta, _ in hits)),
+        "query_ms": round(latency_ms, 1),
+        "index_head": man["head"],
+        "model": man["model"],
+    }
+    with open(os.path.join(dirpath, "query-log.jsonl"), "a", encoding="utf-8") as fh:
+        fh.write(json.dumps(record) + "\n")
+
+
+def cmd_query(repo: str, question: str, top: int, selector: str = "auto") -> int:
     dirpath, man = resolve_existing_index(repo, selector)
     activate_model(man["model"], man["dim"])
     mat = np.load(os.path.join(dirpath, "vectors.npy"))
@@ -380,15 +396,7 @@ def cmd_query(repo: str, question: str, top: int, selector: str = "auto") -> int
         print(f"  {s:.4f}  {m}")
     print(f"query_ms={latency_ms:.1f}")
 
-    log_path = os.path.join(dirpath, "query-log.jsonl")
-    with open(log_path, "a", encoding="utf-8") as fh:
-        fh.write(json.dumps({
-            "ts": datetime.now(timezone.utc).isoformat(),
-            "query": question,
-            "top": hits,
-            "query_ms": round(latency_ms, 1),
-            "index_head": man["head"],
-        }) + "\n")
+    append_query_metadata(dirpath, question, hits, top, latency_ms, man)
     return 0
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.613",
+  "version": "9.1.615",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {

package/telegram-plugin/dist/bridge.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { appendFileSync, chmodSync, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { Readable, Writable } from "node:stream";
@@ -67686,204 +67686,6 @@ var RequestError = class RequestError extends Error {
 	}
 };
 //#endregion
-//#region src/language-release.ts
-const EXACT_LANGUAGE_TAG = /^(?:[A-Za-z]{2,8}|x)(?:-[A-Za-z0-9]{1,8})*$/;
-const LETTER = /^\p{Letter}$/u;
-const LATIN = /^\p{Script=Latin}$/u;
-const CYRILLIC = /^\p{Script=Cyrillic}$/u;
-const GREEK = /^\p{Script=Greek}$/u;
-const ARABIC = /^\p{Script=Arabic}$/u;
-const HEBREW = /^\p{Script=Hebrew}$/u;
-const HAN = /^\p{Script=Han}$/u;
-const HIRAGANA = /^\p{Script=Hiragana}$/u;
-const KATAKANA = /^\p{Script=Katakana}$/u;
-const HANGUL = /^\p{Script=Hangul}$/u;
-const LATIN_LANGUAGES = new Set([
-	"af",
-	"bs",
-	"ca",
-	"cs",
-	"cy",
-	"da",
-	"de",
-	"en",
-	"es",
-	"et",
-	"eu",
-	"fi",
-	"fr",
-	"ga",
-	"gd",
-	"gl",
-	"hr",
-	"hu",
-	"id",
-	"is",
-	"it",
-	"la",
-	"lb",
-	"lt",
-	"lv",
-	"ms",
-	"mt",
-	"nl",
-	"no",
-	"pl",
-	"pt",
-	"ro",
-	"sk",
-	"sl",
-	"sq",
-	"sv",
-	"sw",
-	"tr",
-	"vi"
-]);
-function canonicalText(text) {
-	return text.replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n").normalize("NFC");
-}
-function canonicalHash(text) {
-	return createHash("sha256").update(canonicalText(text), "utf8").digest("hex");
-}
-function maskTechnicalText(text) {
-	const mask = (value) => " ".repeat(value.length);
-	return text.replace(/```[\s\S]*?```|~~~[\s\S]*?~~~/g, mask).replace(/`[^`\r\n]*`/g, mask);
-}
-function allowedScriptMatchers(locale) {
-	if (!EXACT_LANGUAGE_TAG.test(locale) || ["auto", "all"].includes(locale.toLowerCase())) throw new Error("language release blocked: exact output locale required");
-	const parts = locale.replaceAll("_", "-").split("-");
-	const base = parts[0]?.toLowerCase() ?? "";
-	const explicitScript = parts.find((part) => part.length === 4)?.toLowerCase();
-	if (explicitScript !== void 0) {
-		const explicit = {
-			latn: [LATIN],
-			cyrl: [CYRILLIC],
-			grek: [GREEK],
-			arab: [ARABIC],
-			hebr: [HEBREW],
-			hani: [HAN],
-			jpan: [
-				HAN,
-				HIRAGANA,
-				KATAKANA
-			],
-			hang: [HANGUL, HAN]
-		}[explicitScript];
-		if (explicit === void 0) throw new Error("language release blocked: unsupported output script");
-		return explicit;
-	}
-	if (LATIN_LANGUAGES.has(base)) return [LATIN];
-	if ([
-		"ru",
-		"uk",
-		"bg",
-		"mk"
-	].includes(base)) return [CYRILLIC];
-	if (base === "el") return [GREEK];
-	if ([
-		"ar",
-		"fa",
-		"ur"
-	].includes(base)) return [ARABIC];
-	if (base === "he") return [HEBREW];
-	if (base === "zh") return [HAN];
-	if (base === "ja") return [
-		HAN,
-		HIRAGANA,
-		KATAKANA
-	];
-	if (base === "ko") return [HANGUL, HAN];
-	throw new Error("language release blocked: output locale has no deterministic script policy");
-}
-function assertExpectedScript(text, locale) {
-	const allowed = allowedScriptMatchers(locale);
-	for (const character of maskTechnicalText(text)) {
-		if (!LETTER.test(character)) continue;
-		if (allowed.some((matcher) => matcher.test(character))) continue;
-		const point = character.codePointAt(0)?.toString(16).toUpperCase().padStart(4, "0") ?? "UNKNOWN";
-		throw new Error(`language release blocked: unexpected-script-contamination (U+${point})`);
-	}
-}
-function parseAndVerifySignature(token, key) {
-	if (key.length < 32) throw new Error("language release blocked: invalid verification key");
-	if (token.length > 16384) throw new Error("language release blocked: release token too large");
-	const parts = token.split(".");
-	if (parts.length !== 3 || parts[0] !== "blg6" || parts[1] === "" || parts[2] === "") throw new Error("language release blocked: malformed release token");
-	const encoded = parts[1];
-	let supplied;
-	let payload;
-	try {
-		supplied = Buffer.from(parts[2], "base64url");
-		payload = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-	} catch {
-		throw new Error("language release blocked: malformed release token");
-	}
-	const expected = createHmac("sha256", key).update(encoded).digest();
-	if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) throw new Error("language release blocked: invalid release token signature");
-	if (payload === null || typeof payload !== "object" || Array.isArray(payload)) throw new Error("language release blocked: malformed release payload");
-	return payload;
-}
-function assertEqual(actual, expected, field) {
-	if (actual !== expected) throw new Error(`language release blocked: ${field} mismatch`);
-}
-function verifyTelegramLanguageRelease(text, releaseToken, options) {
-	if (typeof releaseToken !== "string" || releaseToken.length === 0) throw new Error("language release blocked: release token required");
-	if (options.expectedVersion.trim().length === 0) throw new Error("language release blocked: expected guard version required");
-	assertExpectedScript(text, options.locale);
-	const payload = parseAndVerifySignature(releaseToken, options.key);
-	const now = Math.floor(options.now ?? Date.now() / 1e3);
-	if (!Number.isSafeInteger(payload.iat) || !Number.isSafeInteger(payload.exp)) throw new Error("language release blocked: invalid receipt lifetime");
-	const issuedAt = payload.iat;
-	const expiresAt = payload.exp;
-	if (expiresAt < now) throw new Error("language release blocked: release token expired");
-	if (issuedAt > now + 60 || expiresAt < issuedAt || expiresAt - issuedAt > 604800) throw new Error("language release blocked: invalid receipt lifetime");
-	if (typeof payload.nonce !== "string" || payload.nonce.length === 0) throw new Error("language release blocked: invalid receipt nonce");
-	assertEqual(payload.source_sha256, canonicalHash(""), "source");
-	assertEqual(payload.target_sha256, canonicalHash(text), "target");
-	if (payload.language !== options.locale) throw new Error(`language release blocked: language mismatch (expected ${options.locale})`);
-	assertEqual(payload.purpose, "response", "purpose");
-	assertEqual(payload.content_type, "prose", "content type");
-	assertEqual(payload.short_text_reviewed, false, "short text review");
-	assertEqual(payload.v, options.expectedVersion, "version");
-}
-function isLanguageReleaseRequired() {
-	return process.env["BLUN_TELEGRAM_LANGUAGE_GATE"]?.trim().toLowerCase() === "required";
-}
-function requiredSetting(name) {
-	const value = process.env[name]?.trim();
-	if (value === void 0 || value.length === 0) throw new Error(`language release blocked: host setting ${name} required`);
-	return value;
-}
-function telegramLanguageReleaseLocale() {
-	if (!isLanguageReleaseRequired()) return void 0;
-	const locale = requiredSetting("BLUN_TELEGRAM_OUTPUT_LOCALE");
-	allowedScriptMatchers(locale);
-	return locale;
-}
-function defaultKeyFile() {
-	const configuredHome = process.env["BLUN_HOME"]?.trim();
-	return join(configuredHome !== void 0 && configuredHome.length > 0 ? configuredHome : join(homedir(), ".blun"), "secrets", "blun-language-guard-signing.key");
-}
-function assertTelegramLanguageReleased(text, releaseToken, now) {
-	if (!isLanguageReleaseRequired()) return;
-	if (typeof releaseToken !== "string" || releaseToken.length === 0) throw new Error("language release blocked: release token required");
-	const locale = telegramLanguageReleaseLocale();
-	if (locale === void 0) throw new Error("language release blocked: exact output locale required");
-	const keyFile = process.env["BLUN_LANGUAGE_GUARD_KEY_FILE"]?.trim() || defaultKeyFile();
-	let key;
-	try {
-		key = readFileSync(keyFile);
-	} catch {
-		throw new Error("language release blocked: verification key unavailable");
-	}
-	verifyTelegramLanguageRelease(text, releaseToken, {
-		locale,
-		expectedVersion: requiredSetting("BLUN_LANGUAGE_GUARD_VERSION"),
-		key,
-		now
-	});
-}
-//#endregion
 //#region src/noise.ts
 /**
 * Conservative outbound guard for group acknowledgements and narrated silence.
@@ -68071,7 +67873,6 @@ async function sendReplyFallback(chatId, rawText, threadId) {
 	const text = scrubSecrets(rawText);
 	const body = text.length > TELEGRAM_TEXT_LIMIT ? `${text.slice(0, TELEGRAM_TEXT_LIMIT - 1)}…` : text;
 	try {
-		assertTelegramLanguageReleased(body, void 0);
 		const payload = await (await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },

package/telegram-plugin/dist/mcp-server.mjs

@@ -73449,6 +73449,10 @@ function assertTelegramLanguageReleased(text, releaseToken, now) {
 		now
 	});
 }
+function assertOptionalTelegramLanguageRelease(text, releaseToken, now) {
+	if (releaseToken === void 0) return;
+	assertTelegramLanguageReleased(text, releaseToken, now);
+}
 //#endregion
 //#region src/noise.ts
 /**
@@ -73528,7 +73532,7 @@ const TOOL_DEFINITIONS = [
 				text: { type: "string" },
 				release_token: {
 					type: "string",
-					description: "Language Guard receipt for this exact text. Required when the host enables the language release gate."
+					description: "Optional Language Guard receipt for released text. When provided, it must match this exact text."
 				},
 				reply_to: {
 					type: "string",
@@ -73592,7 +73596,7 @@ const TOOL_DEFINITIONS = [
 				text: { type: "string" },
 				release_token: {
 					type: "string",
-					description: "Language Guard receipt for this exact text. Required when the host enables the language release gate."
+					description: "Optional Language Guard receipt for released text. When provided, it must match this exact text."
 				},
 				format: {
 					type: "string",
@@ -73622,7 +73626,7 @@ async function runTool(api, token, name, args) {
 		case "edit_message": {
 			const chatId = resolveAllowedChatId(args["chat_id"]);
 			if (isSilentTurnMarker(args["text"])) throw new Error("silent marker cannot be used to edit a Telegram message");
-			assertTelegramLanguageReleased(args["text"], args["release_token"]);
+			assertOptionalTelegramLanguageRelease(args["text"], args["release_token"]);
 			const parseMode = args["format"] === "markdownv2" ? "MarkdownV2" : void 0;
 			const edited = await api.editMessageText(chatId, Number(args["message_id"]), args["text"], parseMode !== void 0 ? { parse_mode: parseMode } : void 0);
 			const id = typeof edited === "object" ? edited.message_id : args["message_id"];
@@ -73701,7 +73705,7 @@ async function runReply(api, args) {
 		});
 		return "already delivered: an identical message was sent to this chat moments ago — do NOT send it again";
 	}
-	assertTelegramLanguageReleased(text, args["release_token"]);
+	assertOptionalTelegramLanguageRelease(text, args["release_token"]);
 	for (const file of files) {
 		assertSendable(file);
 		const info = statSync(file);