chati-dev 4.5.16 → 4.5.27

package/src/installer/package-artifact.js

@@ -0,0 +1,249 @@
+import { execFileSync } from 'node:child_process';
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import {
+  closeSync, constants, existsSync, fstatSync, lstatSync, openSync, readFileSync, readSync,
+} from 'node:fs';
+import { join, resolve } from 'node:path';
+
+// This verifier is the package's trust root, including while npm runs
+// postpack after it has removed bundled @chati dependencies. Keep the tiny
+// canonical JSON implementation local instead of making the trust check depend
+// on an optional, mutable package-resolution path. It intentionally matches
+// @chati/core's canonical JSON contract: sorted object keys, array order
+// retained, finite JSON-compatible values only.
+function canonicalize(value, path = '$') {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) throw new TypeError(`${path} must be finite`);
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((entry, index) => canonicalize(entry, `${path}[${index}]`));
+  if (typeof value === 'object') {
+    const output = {};
+    for (const key of Object.keys(value).sort()) {
+      if (value[key] === undefined) throw new TypeError(`${path}.${key} is undefined`);
+      output[key] = canonicalize(value[key], `${path}.${key}`);
+    }
+    return output;
+  }
+  throw new TypeError(`${path} is not JSON-compatible`);
+}
+
+function canonicalSerialize(value) {
+  return JSON.stringify(canonicalize(value));
+}
+
+export const PACKAGE_ARTIFACT_MANIFEST = 'package-artifact-manifest.json';
+export const PACKAGE_ARTIFACT_SIGNATURE = 'package-artifact-manifest.sig';
+const EXCLUDED_ARTIFACT_FILES = new Set([PACKAGE_ARTIFACT_MANIFEST, PACKAGE_ARTIFACT_SIGNATURE]);
+
+/** npm 10/11 emit an array, while npm 12 keys the report by package name. */
+export function parseNpmPackDryRunReport(output) {
+  const parsed = JSON.parse(output);
+  if (Array.isArray(parsed)) return parsed[0] ?? null;
+  if (!parsed || typeof parsed !== 'object') return null;
+  const reports = Object.values(parsed);
+  return reports.length === 1 ? reports[0] : null;
+}
+
+/**
+ * npm emits POSIX tar paths. Treat its report as untrusted input anyway: a
+ * malformed path must never escape the package root while an artifact is
+ * signed or verified.
+ */
+export function isCanonicalPackageArtifactPath(path) {
+  return typeof path === 'string'
+    && path.length > 0
+    && !path.startsWith('/')
+    && !path.includes(':')
+    && !path.includes('\0')
+    && !path.includes('\\')
+    && path.split('/').every((segment) => segment.length > 0 && segment !== '.' && segment !== '..');
+}
+
+function listPublishArtifactEntries(packageRoot) {
+  // This helper can run while npm is executing a workspace lifecycle script.
+  // Do not let that parent workspace selection redirect the independent,
+  // temporary package probe below.
+  // npm exposes every effective config option to lifecycle scripts as an
+  // npm_config_* environment variable. Clearing only the workspace-shaped
+  // options still leaves inherited userconfig, prefix, and future workspace
+  // aliases able to redirect this nested npm invocation. The probe supplies
+  // every configuration it requires explicitly below.
+  const npmEnvironment = Object.fromEntries(
+    Object.entries(process.env).filter(([key]) => !key.toLowerCase().startsWith('npm_config_')),
+  );
+  // Clearing environment variables is not sufficient: npm falls back to the
+  // user's on-disk .npmrc, which can re-enable a workspace selection. Point
+  // the user layer at the platform null device to make the temporary probe
+  // independent of the calling account and CI runner.
+  const emptyNpmConfigPath = process.platform === 'win32' ? 'NUL' : '/dev/null';
+  const output = execFileSync(
+    process.platform === 'win32' ? 'npm.cmd' : 'npm',
+    // Keep this an independent single-package probe. In particular, do not
+    // pair --no-workspaces with an inherited --workspace: npm rejects that
+    // combination instead of resolving the package root.
+    [
+      '--prefix', packageRoot,
+      '--userconfig', emptyNpmConfigPath,
+      'pack', '--dry-run', '--ignore-scripts', '--json',
+    ],
+    {
+      cwd: packageRoot,
+      encoding: 'utf8',
+      env: npmEnvironment,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    },
+  );
+  const report = parseNpmPackDryRunReport(output);
+  if (!Array.isArray(report?.files) || report.files.length === 0) {
+    throw new Error('npm pack dry-run returned no publishable files');
+  }
+  return Object.freeze(report.files
+    .filter(({ path }) => !EXCLUDED_ARTIFACT_FILES.has(path))
+    .map(({ path, mode }) => {
+      if (!isCanonicalPackageArtifactPath(path)) {
+        throw new Error(`npm pack dry-run returned an unsafe artifact path: ${String(path)}`);
+      }
+      if (!Number.isInteger(mode) || mode < 0 || mode > 0o777) {
+        throw new Error(`npm pack dry-run returned an invalid file mode: ${path}`);
+      }
+      return Object.freeze({ path, mode });
+    })
+    .sort((left, right) => left.path.localeCompare(right.path)));
+}
+
+export function listPublishArtifactFiles(packageRoot) {
+  return Object.freeze(listPublishArtifactEntries(packageRoot).map(({ path }) => path));
+}
+
+function sameFileSnapshot(left, right) {
+  return Boolean(left && right
+    && left.dev === right.dev
+    && left.ino === right.ino
+    && left.mode === right.mode
+    && left.uid === right.uid
+    && left.gid === right.gid
+    && left.nlink === right.nlink
+    && left.size === right.size
+    && left.mtimeMs === right.mtimeMs
+    && left.ctimeMs === right.ctimeMs);
+}
+
+function hashPinnedRegularFile(path, expected) {
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    const opened = fstatSync(descriptor);
+    if (!opened.isFile() || opened.nlink !== 1 || !sameFileSnapshot(expected, opened)) {
+      throw new Error('publish artifact entry changed before it could be hashed');
+    }
+    const hash = createHash('sha256');
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    for (;;) {
+      const bytes = readSync(descriptor, buffer, 0, buffer.length, null);
+      if (bytes === 0) break;
+      hash.update(buffer.subarray(0, bytes));
+    }
+    const finished = fstatSync(descriptor);
+    if (!sameFileSnapshot(opened, finished)) {
+      throw new Error('publish artifact entry changed while it was hashed');
+    }
+    return hash.digest('hex');
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+  }
+}
+
+export function buildPackageArtifactManifest(packageRoot, { createdAt = new Date().toISOString() } = {}) {
+  const root = resolve(packageRoot);
+  const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const files = {};
+  for (const { path: relativePath, mode } of listPublishArtifactEntries(root)) {
+    const absolute = join(root, relativePath);
+    const stat = lstatSync(absolute);
+    if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) {
+      throw new Error(`publish artifact entry must be a single-link regular file: ${relativePath}`);
+    }
+    files[relativePath] = Object.freeze({
+      // npm normalizes file modes in the tarball. Signing the on-disk source
+      // mode would reject a clean install when its umask differs, even though
+      // the exact packaged entry is unchanged. The npm report is the canonical
+      // publish mode while lstat above still rejects links and unsafe entries.
+      hash: hashPinnedRegularFile(absolute, stat), size: stat.size, mode,
+    });
+  }
+  return Object.freeze(canonicalize({
+    schema_version: 1,
+    artifact_type: 'chati-npm-publish-artifact',
+    package_name: packageJson.name,
+    version: packageJson.version,
+    created_at: createdAt,
+    files,
+  }));
+}
+
+export function serializePackageArtifactManifest(manifest) {
+  return canonicalSerialize(manifest);
+}
+
+export function contentOnlyPackageArtifactManifest(manifest) {
+  const content = { ...manifest };
+  delete content.created_at;
+  return content;
+}
+
+/**
+ * The package's embedded public key is the only default trust root. The
+ * signing private key must never influence runtime or publish verification.
+ */
+export function externalTrustedPublicKey(packageRoot) {
+  try {
+    return createPublicKey(readFileSync(join(resolve(packageRoot), 'src', 'installer', 'signing-public-key.pem'), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function verifyPackageArtifactManifest(manifest, signature, publicKey) {
+  if (!publicKey) return Object.freeze({ valid: false, reason: 'external-trust-root-required' });
+  try {
+    if (manifest?.schema_version !== 1
+      || manifest?.artifact_type !== 'chati-npm-publish-artifact'
+      || !manifest?.files || typeof manifest.files !== 'object' || Array.isArray(manifest.files)) {
+      return Object.freeze({ valid: false, reason: 'invalid-artifact-manifest' });
+    }
+    const valid = verify(
+      null,
+      Buffer.from(serializePackageArtifactManifest(manifest)),
+      publicKey,
+      Buffer.from(String(signature).trim(), 'base64'),
+    );
+    return Object.freeze({ valid, reason: valid ? null : 'invalid-signature' });
+  } catch (error) {
+    return Object.freeze({ valid: false, reason: error.message });
+  }
+}
+
+/** Verifies the installed package's exact publishable file set before use. */
+export function verifyCurrentPackageArtifact(packageRoot) {
+  const root = resolve(packageRoot);
+  const manifestPath = join(root, PACKAGE_ARTIFACT_MANIFEST);
+  const signaturePath = join(root, PACKAGE_ARTIFACT_SIGNATURE);
+  if (!existsSync(manifestPath) || !existsSync(signaturePath)) {
+    return Object.freeze({ valid: false, reason: 'artifact-manifest-or-signature-missing' });
+  }
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    const signature = readFileSync(signaturePath, 'utf8').trim();
+    const signatureResult = verifyPackageArtifactManifest(manifest, signature, externalTrustedPublicKey(root));
+    if (!signatureResult.valid) return signatureResult;
+    const current = buildPackageArtifactManifest(root, { createdAt: manifest.created_at });
+    if (serializePackageArtifactManifest(manifest.files) !== serializePackageArtifactManifest(current.files)) {
+      return Object.freeze({ valid: false, reason: 'artifact-manifest-stale' });
+    }
+    return Object.freeze({ valid: true, reason: 'ok', fileCount: Object.keys(current.files).length });
+  } catch (error) {
+    return Object.freeze({ valid: false, reason: error.message });
+  }
+}

package/src/installer/templates.js

@@ -191,7 +191,7 @@ export function generateProjectContext(config) {
 - **Language**: ${language}
 
 ## Chati.dev
-Provider and model routing is resolved per task from the signed installation
+Provider and model routing is resolved per task from the integrity-checked installation
 capability snapshot. No primary harness is configured.
 <!-- chati-context:end -->
 `;
@@ -253,8 +253,16 @@ Parse the JSON output before responding:
 - If \`ok\` is \`true\`, use \`session.language\` for every visible response,
   preface, progress message, question and error, starting with the first response.
 - Follow the returned \`action\` in the adapted orchestrator.
-- When the action includes \`pipeline.spawn_command\`, execute that exact command.
-  Never replace it with an inferred provider check or a manually constructed command.
+- Execute \`pipeline.spawn_command\` only when the returned action explicitly
+  dispatches work, such as \`spawn_routed_interactive\`. Never execute a command
+  merely because a command-shaped field is present.
+- For \`resume_pending_interaction\`, do not execute any provider command. Show
+  exactly \`pipeline.question\`, with no preface, summary or paraphrase. Only
+  after the user answers, write \`{"response":"<exact user response>"}\` to
+  \`pipeline.response_file\` using the native file-write tool, never a shell
+  command. Then execute \`pipeline.deferred_spawn_command\` exactly once and
+  unchanged. Never execute a command merely because a command-shaped field is
+  present.
 - A router-provided spawn command starts an external provider CLI. Execute it
   with the active harness's native process permissions, preserving the exact
   command and working directory. If the harness sandboxes OS credentials,
@@ -275,11 +283,11 @@ overrides any global setting.
 | Value | Language |
 |-------|----------|
 | \`en\`  | English |
-| \`pt\`  | Portugues |
-| \`es\`  | Espanol |
-| \`fr\`  | Francais |
+| \`pt\`  | Português |
+| \`es\`  | Español |
+| \`fr\`  | Français |
 
-If session.yaml does not exist or has no language field, default to English.
+If the router returns no session language, default to English.
 
 ## Load
 
@@ -291,7 +299,7 @@ Read and execute the full orchestrator at \`${orchPath}\`.
 **NEVER create or reference CLAUDE.md, CLAUDE.local.md, or .claude/ directories.**
 
 **Context to pass:**
-- \`.chati/session.yaml\` (session state, includes language)
+- the validated \`session\` object already returned by the router
 - \`AGENTS.md\` (project context)
 - \`artifacts/handoffs/\` (latest handoff)
 - \`.chati.dev/config.yaml\` (version info)
@@ -307,10 +315,14 @@ export function generateGeminiRouter(options = {}) {
   const orchPath = options.orchestratorPath || '.chati.dev/orchestrator/chati.md';
   return `description = "Activate Chati.dev orchestrator"
 prompt = """
-CRITICAL — Language Override:
-Read .chati/session.yaml field "language" BEFORE anything else.
-Every visible response, including the first response, MUST be in this language (en, pt, es, fr).
-If session.yaml does not exist or has no language field, default to English.
+STEP 0: Run the deterministic router before reading mutable state or responding:
+
+node .chati.dev/orchestrator/chati-router.js --harness gemini
+
+Parse its JSON output. It is the source of truth for validated session state,
+task routing and provider authentication. If ok is false, report the exact
+error and stop. If ok is true, use session.language for every visible response,
+including the first one. If the router returns no language, default to English.
 
 The orchestrator and all agent files are pre-configured for Gemini CLI.
 No translation needed; follow all instructions as written.
@@ -319,7 +331,7 @@ Read and execute the full orchestrator at ${orchPath}.
 NEVER create or reference CLAUDE.md, CLAUDE.local.md, or .claude/ directories.
 
 Context to load:
-- .chati/session.yaml (session state, includes language)
+- the validated session object already returned by the router
 - GEMINI.md (project context)
 - artifacts/handoffs/ (latest handoff)
 - .chati.dev/config.yaml (version info)
@@ -345,15 +357,28 @@ node .chati.dev/orchestrator/chati-router.js --harness grok
 \`\`\`
 
 Parse the JSON output. It is the source of truth for session state, task
-routing and provider authentication. Use the returned \`session.language\` for
-every visible response, preface, progress message, question and error,
-starting with the first response. If absent, default to English.
-
-The orchestrator and agent files are pre-configured for Grok CLI. Read and
-execute the full orchestrator at \`${orchPath}\`.
+routing and provider authentication.
+
+- If the top-level \`ok\` field is \`false\`, report the exact \`error\` and
+  relevant detail, then stop. Do not load the orchestrator, recover mutable
+  state or run another command.
+- Only if \`ok\` is \`true\`, use the returned \`session.language\` for every
+  visible response, preface, progress message, question and error, starting
+  with the first response. If absent, default to English.
+
+For \`resume_pending_interaction\`, do not execute any provider command. Show
+exactly \`pipeline.question\`, with no preface, summary or paraphrase. Only
+after the user answers, write \`{"response":"<exact user response>"}\` to
+\`pipeline.response_file\` using the native file-write tool, never a shell
+command. Then execute \`pipeline.deferred_spawn_command\` exactly once and
+unchanged. Never execute a command merely because a command-shaped field is
+present.
+
+Only if \`ok\` is \`true\`, read and execute the full pre-configured Grok CLI
+orchestrator at \`${orchPath}\`.
 
 Only after the router succeeds, load this context:
-- \`.chati/session.yaml\`
+- the validated \`session\` object already returned by the router
 - \`AGENTS.md\`
 - \`.grok/session-lock.md\`
 - \`artifacts/handoffs/\`
@@ -365,6 +390,26 @@ User input: $ARGUMENTS
 `;
 }
 
+/**
+ * Generate project-scoped Grok rules that keep the deterministic router as
+ * the only CHATI entry boundary. Grok loads .grok/rules as project rules.
+ */
+export function generateGrokGovernanceRules() {
+  return `# Chati.dev Grok Governance
+
+For every CHATI.DEV entry or continuation, run this boundary before reading
+mutable CHATI state or taking an action:
+
+\`node .chati.dev/orchestrator/chati-router.js --harness grok\`
+
+If the returned \`ok\` value is false, report the exact error and stop. Never
+bypass the license check, provider-integrity check, session authority, RAIL
+journal, review council, or human release authorization. Execute RAIL actions
+only through commands returned by the deterministic router. Treat \`AGENTS.md\`
+as the project instruction authority and never create or modify \`CLAUDE.md\`.
+`;
+}
+
 /**
  * Generate CLAUDE.local.md content (runtime state — auto-gitignored, never committed)
  */