blun-king-cli 9.1.614 → 9.1.615

package/codebase-index/codebase_index.py

@@ -7,7 +7,7 @@ Auflagen Dieter 43102:
   (Run-3-Befund: Liste trieb RAM-Spitze auf 10,5 GB).
 - Inkrementell: Content-Hash je Datei im Manifest, Delta statt Vollindex.
 - Query mit Frische-Auskunft + Selbstauskunft in JEDER Antwort.
-- Query-Fehlschlag-Log lokal (query-log.jsonl) — der Moat.
+- Lokales Query-Metadatenlog (query-log.jsonl), ohne Fragetext.
 
 Aufruf:
   python codebase_index.py build  <repo>
@@ -351,13 +351,29 @@ def cmd_update(repo: str) -> None:
     )
 
 
-def freshness(repo: str, man: dict) -> str:
-    current = git_head(repo)
-    same = "== HEAD" if current == man["head"] else f"Index {man['head']} != HEAD {current} — 'update' faellig"
-    return f"Index-Stand: {man['head']} ({man['built_at']}), {man['chunks']} Chunks | {same}"
-
-
-def cmd_query(repo: str, question: str, top: int, selector: str = "auto") -> int:
+def freshness(repo: str, man: dict) -> str:
+    current = git_head(repo)
+    same = "== HEAD" if current == man["head"] else f"Index {man['head']} != HEAD {current} — 'update' faellig"
+    return f"Index-Stand: {man['head']} ({man['built_at']}), {man['chunks']} Chunks | {same}"
+
+
+def append_query_metadata(dirpath: str, question: str, hits: list[tuple[str, float]],
+                          requested_top: int, latency_ms: float, man: dict) -> None:
+    record = {
+        "ts": datetime.now(timezone.utc).isoformat(),
+        "query_bytes": len(question.encode("utf-8")),
+        "requested_top": requested_top,
+        "result_count": len(hits),
+        "result_paths": list(dict.fromkeys(meta.rsplit("#", 1)[0] for meta, _ in hits)),
+        "query_ms": round(latency_ms, 1),
+        "index_head": man["head"],
+        "model": man["model"],
+    }
+    with open(os.path.join(dirpath, "query-log.jsonl"), "a", encoding="utf-8") as fh:
+        fh.write(json.dumps(record) + "\n")
+
+
+def cmd_query(repo: str, question: str, top: int, selector: str = "auto") -> int:
     dirpath, man = resolve_existing_index(repo, selector)
     activate_model(man["model"], man["dim"])
     mat = np.load(os.path.join(dirpath, "vectors.npy"))
@@ -380,15 +396,7 @@ def cmd_query(repo: str, question: str, top: int, selector: str = "auto") -> int
         print(f"  {s:.4f}  {m}")
     print(f"query_ms={latency_ms:.1f}")
 
-    log_path = os.path.join(dirpath, "query-log.jsonl")
-    with open(log_path, "a", encoding="utf-8") as fh:
-        fh.write(json.dumps({
-            "ts": datetime.now(timezone.utc).isoformat(),
-            "query": question,
-            "top": hits,
-            "query_ms": round(latency_ms, 1),
-            "index_head": man["head"],
-        }) + "\n")
+    append_query_metadata(dirpath, question, hits, top, latency_ms, man)
     return 0
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.614",
+  "version": "9.1.615",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {

package/telegram-plugin/dist/bridge.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { appendFileSync, chmodSync, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { Readable, Writable } from "node:stream";
@@ -67686,204 +67686,6 @@ var RequestError = class RequestError extends Error {
 	}
 };
 //#endregion
-//#region src/language-release.ts
-const EXACT_LANGUAGE_TAG = /^(?:[A-Za-z]{2,8}|x)(?:-[A-Za-z0-9]{1,8})*$/;
-const LETTER = /^\p{Letter}$/u;
-const LATIN = /^\p{Script=Latin}$/u;
-const CYRILLIC = /^\p{Script=Cyrillic}$/u;
-const GREEK = /^\p{Script=Greek}$/u;
-const ARABIC = /^\p{Script=Arabic}$/u;
-const HEBREW = /^\p{Script=Hebrew}$/u;
-const HAN = /^\p{Script=Han}$/u;
-const HIRAGANA = /^\p{Script=Hiragana}$/u;
-const KATAKANA = /^\p{Script=Katakana}$/u;
-const HANGUL = /^\p{Script=Hangul}$/u;
-const LATIN_LANGUAGES = new Set([
-	"af",
-	"bs",
-	"ca",
-	"cs",
-	"cy",
-	"da",
-	"de",
-	"en",
-	"es",
-	"et",
-	"eu",
-	"fi",
-	"fr",
-	"ga",
-	"gd",
-	"gl",
-	"hr",
-	"hu",
-	"id",
-	"is",
-	"it",
-	"la",
-	"lb",
-	"lt",
-	"lv",
-	"ms",
-	"mt",
-	"nl",
-	"no",
-	"pl",
-	"pt",
-	"ro",
-	"sk",
-	"sl",
-	"sq",
-	"sv",
-	"sw",
-	"tr",
-	"vi"
-]);
-function canonicalText(text) {
-	return text.replace(/^\uFEFF/, "").replace(/\r\n?/g, "\n").normalize("NFC");
-}
-function canonicalHash(text) {
-	return createHash("sha256").update(canonicalText(text), "utf8").digest("hex");
-}
-function maskTechnicalText(text) {
-	const mask = (value) => " ".repeat(value.length);
-	return text.replace(/```[\s\S]*?```|~~~[\s\S]*?~~~/g, mask).replace(/`[^`\r\n]*`/g, mask);
-}
-function allowedScriptMatchers(locale) {
-	if (!EXACT_LANGUAGE_TAG.test(locale) || ["auto", "all"].includes(locale.toLowerCase())) throw new Error("language release blocked: exact output locale required");
-	const parts = locale.replaceAll("_", "-").split("-");
-	const base = parts[0]?.toLowerCase() ?? "";
-	const explicitScript = parts.find((part) => part.length === 4)?.toLowerCase();
-	if (explicitScript !== void 0) {
-		const explicit = {
-			latn: [LATIN],
-			cyrl: [CYRILLIC],
-			grek: [GREEK],
-			arab: [ARABIC],
-			hebr: [HEBREW],
-			hani: [HAN],
-			jpan: [
-				HAN,
-				HIRAGANA,
-				KATAKANA
-			],
-			hang: [HANGUL, HAN]
-		}[explicitScript];
-		if (explicit === void 0) throw new Error("language release blocked: unsupported output script");
-		return explicit;
-	}
-	if (LATIN_LANGUAGES.has(base)) return [LATIN];
-	if ([
-		"ru",
-		"uk",
-		"bg",
-		"mk"
-	].includes(base)) return [CYRILLIC];
-	if (base === "el") return [GREEK];
-	if ([
-		"ar",
-		"fa",
-		"ur"
-	].includes(base)) return [ARABIC];
-	if (base === "he") return [HEBREW];
-	if (base === "zh") return [HAN];
-	if (base === "ja") return [
-		HAN,
-		HIRAGANA,
-		KATAKANA
-	];
-	if (base === "ko") return [HANGUL, HAN];
-	throw new Error("language release blocked: output locale has no deterministic script policy");
-}
-function assertExpectedScript(text, locale) {
-	const allowed = allowedScriptMatchers(locale);
-	for (const character of maskTechnicalText(text)) {
-		if (!LETTER.test(character)) continue;
-		if (allowed.some((matcher) => matcher.test(character))) continue;
-		const point = character.codePointAt(0)?.toString(16).toUpperCase().padStart(4, "0") ?? "UNKNOWN";
-		throw new Error(`language release blocked: unexpected-script-contamination (U+${point})`);
-	}
-}
-function parseAndVerifySignature(token, key) {
-	if (key.length < 32) throw new Error("language release blocked: invalid verification key");
-	if (token.length > 16384) throw new Error("language release blocked: release token too large");
-	const parts = token.split(".");
-	if (parts.length !== 3 || parts[0] !== "blg6" || parts[1] === "" || parts[2] === "") throw new Error("language release blocked: malformed release token");
-	const encoded = parts[1];
-	let supplied;
-	let payload;
-	try {
-		supplied = Buffer.from(parts[2], "base64url");
-		payload = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-	} catch {
-		throw new Error("language release blocked: malformed release token");
-	}
-	const expected = createHmac("sha256", key).update(encoded).digest();
-	if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) throw new Error("language release blocked: invalid release token signature");
-	if (payload === null || typeof payload !== "object" || Array.isArray(payload)) throw new Error("language release blocked: malformed release payload");
-	return payload;
-}
-function assertEqual(actual, expected, field) {
-	if (actual !== expected) throw new Error(`language release blocked: ${field} mismatch`);
-}
-function verifyTelegramLanguageRelease(text, releaseToken, options) {
-	if (typeof releaseToken !== "string" || releaseToken.length === 0) throw new Error("language release blocked: release token required");
-	if (options.expectedVersion.trim().length === 0) throw new Error("language release blocked: expected guard version required");
-	assertExpectedScript(text, options.locale);
-	const payload = parseAndVerifySignature(releaseToken, options.key);
-	const now = Math.floor(options.now ?? Date.now() / 1e3);
-	if (!Number.isSafeInteger(payload.iat) || !Number.isSafeInteger(payload.exp)) throw new Error("language release blocked: invalid receipt lifetime");
-	const issuedAt = payload.iat;
-	const expiresAt = payload.exp;
-	if (expiresAt < now) throw new Error("language release blocked: release token expired");
-	if (issuedAt > now + 60 || expiresAt < issuedAt || expiresAt - issuedAt > 604800) throw new Error("language release blocked: invalid receipt lifetime");
-	if (typeof payload.nonce !== "string" || payload.nonce.length === 0) throw new Error("language release blocked: invalid receipt nonce");
-	assertEqual(payload.source_sha256, canonicalHash(""), "source");
-	assertEqual(payload.target_sha256, canonicalHash(text), "target");
-	if (payload.language !== options.locale) throw new Error(`language release blocked: language mismatch (expected ${options.locale})`);
-	assertEqual(payload.purpose, "response", "purpose");
-	assertEqual(payload.content_type, "prose", "content type");
-	assertEqual(payload.short_text_reviewed, false, "short text review");
-	assertEqual(payload.v, options.expectedVersion, "version");
-}
-function isLanguageReleaseRequired() {
-	return process.env["BLUN_TELEGRAM_LANGUAGE_GATE"]?.trim().toLowerCase() === "required";
-}
-function requiredSetting(name) {
-	const value = process.env[name]?.trim();
-	if (value === void 0 || value.length === 0) throw new Error(`language release blocked: host setting ${name} required`);
-	return value;
-}
-function telegramLanguageReleaseLocale() {
-	if (!isLanguageReleaseRequired()) return void 0;
-	const locale = requiredSetting("BLUN_TELEGRAM_OUTPUT_LOCALE");
-	allowedScriptMatchers(locale);
-	return locale;
-}
-function defaultKeyFile() {
-	const configuredHome = process.env["BLUN_HOME"]?.trim();
-	return join(configuredHome !== void 0 && configuredHome.length > 0 ? configuredHome : join(homedir(), ".blun"), "secrets", "blun-language-guard-signing.key");
-}
-function assertTelegramLanguageReleased(text, releaseToken, now) {
-	if (!isLanguageReleaseRequired()) return;
-	if (typeof releaseToken !== "string" || releaseToken.length === 0) throw new Error("language release blocked: release token required");
-	const locale = telegramLanguageReleaseLocale();
-	if (locale === void 0) throw new Error("language release blocked: exact output locale required");
-	const keyFile = process.env["BLUN_LANGUAGE_GUARD_KEY_FILE"]?.trim() || defaultKeyFile();
-	let key;
-	try {
-		key = readFileSync(keyFile);
-	} catch {
-		throw new Error("language release blocked: verification key unavailable");
-	}
-	verifyTelegramLanguageRelease(text, releaseToken, {
-		locale,
-		expectedVersion: requiredSetting("BLUN_LANGUAGE_GUARD_VERSION"),
-		key,
-		now
-	});
-}
-//#endregion
 //#region src/noise.ts
 /**
 * Conservative outbound guard for group acknowledgements and narrated silence.
@@ -68071,7 +67873,6 @@ async function sendReplyFallback(chatId, rawText, threadId) {
 	const text = scrubSecrets(rawText);
 	const body = text.length > TELEGRAM_TEXT_LIMIT ? `${text.slice(0, TELEGRAM_TEXT_LIMIT - 1)}…` : text;
 	try {
-		assertTelegramLanguageReleased(body, void 0);
 		const payload = await (await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },

package/telegram-plugin/dist/mcp-server.mjs

@@ -73449,6 +73449,10 @@ function assertTelegramLanguageReleased(text, releaseToken, now) {
 		now
 	});
 }
+function assertOptionalTelegramLanguageRelease(text, releaseToken, now) {
+	if (releaseToken === void 0) return;
+	assertTelegramLanguageReleased(text, releaseToken, now);
+}
 //#endregion
 //#region src/noise.ts
 /**
@@ -73528,7 +73532,7 @@ const TOOL_DEFINITIONS = [
 				text: { type: "string" },
 				release_token: {
 					type: "string",
-					description: "Language Guard receipt for this exact text. Required when the host enables the language release gate."
+					description: "Optional Language Guard receipt for released text. When provided, it must match this exact text."
 				},
 				reply_to: {
 					type: "string",
@@ -73592,7 +73596,7 @@ const TOOL_DEFINITIONS = [
 				text: { type: "string" },
 				release_token: {
 					type: "string",
-					description: "Language Guard receipt for this exact text. Required when the host enables the language release gate."
+					description: "Optional Language Guard receipt for released text. When provided, it must match this exact text."
 				},
 				format: {
 					type: "string",
@@ -73622,7 +73626,7 @@ async function runTool(api, token, name, args) {
 		case "edit_message": {
 			const chatId = resolveAllowedChatId(args["chat_id"]);
 			if (isSilentTurnMarker(args["text"])) throw new Error("silent marker cannot be used to edit a Telegram message");
-			assertTelegramLanguageReleased(args["text"], args["release_token"]);
+			assertOptionalTelegramLanguageRelease(args["text"], args["release_token"]);
 			const parseMode = args["format"] === "markdownv2" ? "MarkdownV2" : void 0;
 			const edited = await api.editMessageText(chatId, Number(args["message_id"]), args["text"], parseMode !== void 0 ? { parse_mode: parseMode } : void 0);
 			const id = typeof edited === "object" ? edited.message_id : args["message_id"];
@@ -73701,7 +73705,7 @@ async function runReply(api, args) {
 		});
 		return "already delivered: an identical message was sent to this chat moments ago — do NOT send it again";
 	}
-	assertTelegramLanguageReleased(text, args["release_token"]);
+	assertOptionalTelegramLanguageRelease(text, args["release_token"]);
 	for (const file of files) {
 		assertSendable(file);
 		const info = statSync(file);