cli-jaw 2.0.6 → 2.0.13

package/scripts/require-release-evidence.mjs

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..');
+
+const installerSensitivePaths = [
+  '.github/workflows/postinstall-platform.yml',
+  'README.md',
+  'README.ko.md',
+  'README.ja.md',
+  'README.zh-CN.md',
+  'bin/postinstall.ts',
+  'src/core/claude-install.ts',
+  'src/core/cli-detect.ts',
+  'src/core/runtime-path.ts',
+  'scripts/install-risk-gate.mjs',
+  'scripts/install.sh',
+  'scripts/install-wsl.sh',
+  'scripts/install-officecli.ps1',
+  'scripts/install-officecli.sh',
+  'scripts/fresh-install-smoke.ts',
+  'scripts/verify-fresh-install.sh',
+  'scripts/collect-fresh-install-evidence.sh',
+  'scripts/audit-fresh-install-evidence.mjs',
+  'scripts/verify-release-evidence.mjs',
+  'scripts/require-release-evidence.mjs',
+  'scripts/release.sh',
+  'scripts/release-preview.sh',
+  'tests/unit/cli-detect.test.ts',
+  'tests/unit/install-sh-exec.test.ts',
+  'tests/unit/fresh-evidence-audit.test.ts',
+  'tests/unit/safe-install.test.ts',
+  'tests/unit/service.test.ts',
+  'tests/unit/postinstall-strict-tools.test.ts',
+  'tests/unit/wsl-installer-doctor.test.ts',
+  'tests/unit/wsl-installer-exec.test.ts',
+  'package.json',
+  'package-lock.json',
+];
+
+function usage() {
+  console.log(`Usage: require-release-evidence.mjs [options]
+
+Options:
+  --base-ref REF    Compare installer-sensitive files against REF instead of the latest v* tag.
+  -h, --help        Show this help.
+
+If installer-sensitive files changed, this script requires:
+  CLI_JAW_MACOS_EVIDENCE_DIR=/path/to/macos-evidence
+  CLI_JAW_WSL_EVIDENCE_DIR=/path/to/wsl-evidence
+
+Then it runs scripts/verify-release-evidence.mjs before publish/release can continue.
+`);
+}
+
+let baseRef = '';
+const args = process.argv.slice(2);
+for (let i = 0; i < args.length; i += 1) {
+  const arg = args[i];
+  if (arg === '-h' || arg === '--help') {
+    usage();
+    process.exit(0);
+  }
+  if (arg === '--base-ref') {
+    baseRef = args[++i] || '';
+    if (!baseRef) throw new Error('missing value for --base-ref');
+    continue;
+  }
+  throw new Error(`unknown option: ${arg}`);
+}
+
+function git(args, options = {}) {
+  return spawnSync('git', args, {
+    cwd: repoRoot,
+    encoding: 'utf8',
+    stdio: options.stdio || 'pipe',
+    shell: false,
+  });
+}
+
+function requireGit(args, label) {
+  const result = git(args);
+  if (result.status !== 0) {
+    throw new Error(`${label} failed: ${(result.stderr || result.stdout || '').trim()}`);
+  }
+  return result.stdout.trim();
+}
+
+function isGitRepo() {
+  return git(['rev-parse', '--is-inside-work-tree']).status === 0;
+}
+
+function currentPackageVersionTag() {
+  const packageJson = workingTreeFile('package.json');
+  if (!packageJson) return '';
+  try {
+    const version = JSON.parse(packageJson).version;
+    return typeof version === 'string' && version ? `v${version}` : '';
+  } catch {
+    return '';
+  }
+}
+
+function latestVersionTag() {
+  const result = git(['tag', '--sort=-v:refname']);
+  if (result.status !== 0) return '';
+  const currentTag = currentPackageVersionTag();
+  const tags = result.stdout
+    .split(/\r?\n/)
+    .map((tag) => tag.trim())
+    .filter((tag) => /^v[0-9]+\.[0-9]+\.[0-9]+$/.test(tag));
+  return tags.find((tag) => tag !== currentTag) || '';
+}
+
+function gitFile(ref, relativePath) {
+  const result = git(['show', `${ref}:${relativePath}`]);
+  if (result.status !== 0) return null;
+  return result.stdout;
+}
+
+function workingTreeFile(relativePath) {
+  const fullPath = path.join(repoRoot, relativePath);
+  if (!fs.existsSync(fullPath) || !fs.statSync(fullPath).isFile()) return null;
+  return fs.readFileSync(fullPath, 'utf8');
+}
+
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(',')}]`;
+  }
+  if (value && typeof value === 'object') {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function normalizePackageJson(content) {
+  const parsed = JSON.parse(content);
+  delete parsed.version;
+  return stableStringify(parsed);
+}
+
+function normalizePackageLock(content) {
+  const parsed = JSON.parse(content);
+  delete parsed.version;
+  if (parsed.packages?.['']) {
+    delete parsed.packages[''].version;
+  }
+  return stableStringify(parsed);
+}
+
+function normalizeForEvidence(relativePath, content) {
+  if (content === null) return null;
+  if (relativePath === 'package.json') return normalizePackageJson(content);
+  if (relativePath === 'package-lock.json') return normalizePackageLock(content);
+  return content.replace(/\r\n/g, '\n');
+}
+
+function changedInstallerFiles(ref) {
+  const changed = [];
+  for (const relativePath of installerSensitivePaths) {
+    const before = normalizeForEvidence(relativePath, gitFile(ref, relativePath));
+    const after = normalizeForEvidence(relativePath, workingTreeFile(relativePath));
+    if (before !== after) {
+      changed.push(relativePath);
+    }
+  }
+  return changed;
+}
+
+function shortHash(files) {
+  return crypto.createHash('sha256').update(files.join('\n')).digest('hex').slice(0, 12);
+}
+
+if (!isGitRepo()) {
+  console.error('[release-evidence-required] FAIL');
+  console.error('- Cannot determine installer-sensitive changes outside a git checkout.');
+  console.error('- Publish from the release checkout, or run scripts/verify-release-evidence.mjs manually before packaging.');
+  process.exit(1);
+}
+
+const ref = baseRef || latestVersionTag();
+if (!ref) {
+  console.error('[release-evidence-required] no previous v* tag found; treating release as installer-sensitive');
+}
+if (ref) {
+  requireGit(['rev-parse', '--verify', `${ref}^{commit}`], `base ref ${ref}`);
+}
+
+const changed = ref ? changedInstallerFiles(ref) : installerSensitivePaths;
+if (!changed.length) {
+  console.log(`[release-evidence-required] SKIP no installer-sensitive changes since ${ref}`);
+  process.exit(0);
+}
+
+const macosEvidence = process.env.CLI_JAW_MACOS_EVIDENCE_DIR || process.env.MACOS_EVIDENCE_DIR || '';
+const wslEvidence = process.env.CLI_JAW_WSL_EVIDENCE_DIR || process.env.WSL_EVIDENCE_DIR || '';
+
+console.error(`[release-evidence-required] installer-sensitive changes detected since ${ref || '(initial release)'} (${changed.length}, ${shortHash(changed)})`);
+for (const file of changed.slice(0, 30)) {
+  console.error(`- ${file}`);
+}
+if (changed.length > 30) {
+  console.error(`- ... ${changed.length - 30} more`);
+}
+
+if (!macosEvidence || !wslEvidence) {
+  console.error('[release-evidence-required] FAIL');
+  console.error('Strict fresh-machine evidence is required before git push or npm publish.');
+  console.error('Set both variables and rerun:');
+  console.error('  CLI_JAW_MACOS_EVIDENCE_DIR=/path/to/macos-evidence');
+  console.error('  CLI_JAW_WSL_EVIDENCE_DIR=/path/to/wsl-evidence');
+  console.error('Then verify with:');
+  console.error('  node scripts/verify-release-evidence.mjs --macos "$CLI_JAW_MACOS_EVIDENCE_DIR" --wsl "$CLI_JAW_WSL_EVIDENCE_DIR"');
+  process.exit(1);
+}
+
+const gate = path.join(__dirname, 'verify-release-evidence.mjs');
+const result = spawnSync(process.execPath, [gate, '--macos', macosEvidence, '--wsl', wslEvidence], {
+  cwd: repoRoot,
+  env: process.env,
+  encoding: 'utf8',
+  stdio: 'inherit',
+  shell: false,
+});
+
+if (result.status !== 0) {
+  process.exit(result.status ?? 1);
+}
+
+console.log('[release-evidence-required] PASS strict fresh-machine release evidence');

package/scripts/verify-fresh-install.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Verify a completed CLI-JAW fresh install from a newly opened macOS/Linux shell.
+set -euo pipefail
+
+SKIP_DOCTOR=0
+for arg in "$@"; do
+  case "$arg" in
+    --skip-doctor) SKIP_DOCTOR=1 ;;
+    *) echo "Unknown option: $arg" >&2; exit 2 ;;
+  esac
+done
+
+fail() {
+  echo "✖ $*" >&2
+  exit 1
+}
+
+ok() {
+  echo "✔ $*"
+}
+
+run_version() {
+  local name="$1"
+  command -v "$name" >/dev/null 2>&1 || fail "$name is not on PATH"
+  "$name" --version >/dev/null 2>&1 || fail "$name is on PATH but '$name --version' failed"
+  ok "$name works: $(command -v "$name")"
+}
+
+run_optional_version() {
+  local name="$1"
+  if command -v "$name" >/dev/null 2>&1 && "$name" --version >/dev/null 2>&1; then
+    ok "$name works: $(command -v "$name")"
+    return 0
+  fi
+  if [ "${CLI_JAW_REQUIRE_OPTIONAL_RUNTIMES:-0}" = "1" ] || [ "${CLI_JAW_REQUIRE_OPTIONAL_RUNTIMES:-}" = "true" ]; then
+    fail "$name optional runtime is missing or not runnable"
+  fi
+  ok "$name optional runtime not available; continuing"
+}
+
+path_contains() {
+  local needle="$1"
+  case ":${PATH:-}:" in
+    *":$needle:"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+should_check_zsh() {
+  command -v zsh >/dev/null 2>&1 || return 1
+
+  case "$(uname -s 2>/dev/null || true)" in
+    Darwin) return 0 ;;
+  esac
+
+  case "${SHELL:-}" in
+    */zsh) return 0 ;;
+  esac
+
+  [ -f "$HOME/.zshrc" ] || [ -f "$HOME/.zprofile" ]
+}
+
+is_wsl() {
+  [ -n "${WSL_DISTRO_NAME:-}" ] && return 0
+  grep -qi microsoft /proc/version 2>/dev/null
+}
+
+echo "CLI-JAW fresh-install verification"
+echo "shell=${SHELL:-unknown}"
+echo "path=${PATH:-}"
+
+run_version node
+node -e 'process.exit(Number(process.versions.node.split(".")[0]) >= 22 ? 0 : 1)' >/dev/null 2>&1 \
+  || fail "node version is below 22: $(node --version 2>/dev/null || echo unknown)"
+ok "node version is >=22: $(node --version)"
+
+run_version npm
+run_version jaw
+run_optional_version ai-e
+run_optional_version claude-e
+
+if command -v npm >/dev/null 2>&1; then
+  npm_prefix="$(npm prefix -g 2>/dev/null || true)"
+  npm_bin="${npm_prefix%/}/bin"
+  if [ -n "$npm_prefix" ] && [ -d "$npm_bin" ]; then
+    path_contains "$npm_bin" || fail "npm global bin is not on PATH: $npm_bin"
+    ok "npm global bin is on PATH: $npm_bin"
+  fi
+fi
+
+if [ -x "$HOME/.local/bin/claude" ]; then
+  path_contains "$HOME/.local/bin" || fail "~/.local/bin contains claude but is not on PATH"
+  "$HOME/.local/bin/claude" --version >/dev/null 2>&1 || fail "native claude exists but failed --version"
+  ok "native claude path is usable"
+fi
+
+if should_check_zsh; then
+  zsh -ic 'command -v node >/dev/null && command -v npm >/dev/null && command -v jaw >/dev/null' >/dev/null 2>&1 \
+    || fail "interactive zsh cannot resolve node/npm/jaw"
+  ok "interactive zsh resolves node/npm/jaw"
+
+  zsh -lc 'command -v node >/dev/null && command -v npm >/dev/null && command -v jaw >/dev/null' >/dev/null 2>&1 \
+    || fail "login zsh cannot resolve node/npm/jaw"
+  ok "login zsh resolves node/npm/jaw"
+fi
+
+if is_wsl; then
+  bash -lc 'command -v node >/dev/null && node --version >/dev/null && command -v npm >/dev/null && npm --version >/dev/null && command -v jaw >/dev/null && jaw --version >/dev/null' >/dev/null 2>&1 \
+    || fail "WSL bash login shell cannot resolve node/npm/jaw"
+  ok "WSL bash login shell resolves node/npm/jaw"
+fi
+
+if [ "$SKIP_DOCTOR" != "1" ]; then
+  jaw doctor >/dev/null 2>&1 || fail "jaw doctor failed"
+  ok "jaw doctor completed"
+else
+  ok "jaw doctor skipped"
+fi
+
+echo "ALL PASS"

package/scripts/verify-release-evidence.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+function usage() {
+  console.log(`Usage: verify-release-evidence.mjs --macos DIR --wsl DIR [options]
+
+Options:
+  --macos DIR       Strict macOS fresh-machine evidence directory.
+  --wsl DIR         Strict Windows-via-WSL fresh-machine evidence directory.
+  --auditor FILE    Auditor script path. Defaults to sibling audit-fresh-install-evidence.mjs.
+  -h, --help        Show this help.
+
+This is the release gate. It intentionally does not pass any --allow-* local-smoke
+flags to the per-target auditor.
+`);
+}
+
+const args = process.argv.slice(2);
+let macosDir = '';
+let wslDir = '';
+let auditor = path.join(__dirname, 'audit-fresh-install-evidence.mjs');
+const currentScripts = {
+  collector: path.join(__dirname, 'collect-fresh-install-evidence.sh'),
+  verifier: path.join(__dirname, 'verify-fresh-install.sh'),
+  macosInstaller: path.join(__dirname, 'install.sh'),
+  wslInstaller: path.join(__dirname, 'install-wsl.sh'),
+};
+
+for (let i = 0; i < args.length; i += 1) {
+  const arg = args[i];
+  if (arg === '-h' || arg === '--help') {
+    usage();
+    process.exit(0);
+  }
+  if (arg === '--macos') {
+    macosDir = args[++i] || '';
+    continue;
+  }
+  if (arg === '--wsl') {
+    wslDir = args[++i] || '';
+    continue;
+  }
+  if (arg === '--auditor') {
+    auditor = args[++i] || '';
+    continue;
+  }
+  throw new Error(`unknown option: ${arg}`);
+}
+
+const failures = [];
+if (!macosDir) failures.push('missing --macos DIR');
+if (!wslDir) failures.push('missing --wsl DIR');
+if (macosDir && wslDir && path.resolve(macosDir) === path.resolve(wslDir)) {
+  failures.push('--macos and --wsl must point to different evidence directories');
+}
+if (!auditor) failures.push('missing --auditor FILE');
+
+function requireDirectory(label, dir) {
+  if (!dir) return;
+  if (!fs.existsSync(dir)) {
+    failures.push(`${label} evidence directory does not exist: ${dir}`);
+    return;
+  }
+  if (!fs.statSync(dir).isDirectory()) {
+    failures.push(`${label} evidence path is not a directory: ${dir}`);
+  }
+}
+
+function requireFile(label, file) {
+  if (!file) return;
+  if (!fs.existsSync(file)) {
+    failures.push(`${label} file does not exist: ${file}`);
+    return;
+  }
+  if (!fs.statSync(file).isFile()) {
+    failures.push(`${label} path is not a file: ${file}`);
+  }
+}
+
+requireDirectory('macOS', macosDir);
+requireDirectory('Windows-via-WSL', wslDir);
+requireFile('auditor', auditor);
+requireFile('current collector', currentScripts.collector);
+requireFile('current verifier', currentScripts.verifier);
+requireFile('current macOS installer', currentScripts.macosInstaller);
+requireFile('current WSL installer', currentScripts.wslInstaller);
+
+function sha256(file) {
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+function requireEvidenceScriptMatches(label, evidenceDir, evidenceFile, currentFile) {
+  if (!evidenceDir || !currentFile) return;
+
+  const archived = path.join(evidenceDir, evidenceFile);
+  if (!fs.existsSync(archived)) {
+    failures.push(`${label} archived script missing: ${archived}`);
+    return;
+  }
+  if (!fs.statSync(archived).isFile()) {
+    failures.push(`${label} archived script path is not a file: ${archived}`);
+    return;
+  }
+
+  const archivedHash = sha256(archived);
+  const currentHash = sha256(currentFile);
+  if (archivedHash !== currentHash) {
+    failures.push(`${label} archived ${evidenceFile} does not match current ${path.basename(currentFile)}: evidence=${archivedHash} current=${currentHash}`);
+  }
+}
+
+function runAudit(label, dir, target) {
+  console.log(`[release-evidence] RUN ${label}: ${dir}`);
+  const result = spawnSync(process.execPath, [auditor, dir, '--target', target], {
+    cwd: process.cwd(),
+    env: process.env,
+    encoding: 'utf8',
+    stdio: 'pipe',
+    shell: false,
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  if (result.status !== 0) {
+    failures.push(`${label} audit failed with exit ${result.status ?? 'signal'}`);
+    return;
+  }
+  console.log(`[release-evidence] PASS ${label}`);
+}
+
+if (!failures.length) {
+  runAudit('macOS', macosDir, 'macos');
+  runAudit('Windows-via-WSL', wslDir, 'wsl');
+}
+
+if (!failures.length) {
+  requireEvidenceScriptMatches('macOS', macosDir, '00-collector-script.sh', currentScripts.collector);
+  requireEvidenceScriptMatches('macOS', macosDir, '02-installer-script.sh', currentScripts.macosInstaller);
+  requireEvidenceScriptMatches('macOS', macosDir, '21-verifier-script.sh', currentScripts.verifier);
+  requireEvidenceScriptMatches('Windows-via-WSL', wslDir, '00-collector-script.sh', currentScripts.collector);
+  requireEvidenceScriptMatches('Windows-via-WSL', wslDir, '02-installer-script.sh', currentScripts.wslInstaller);
+  requireEvidenceScriptMatches('Windows-via-WSL', wslDir, '21-verifier-script.sh', currentScripts.verifier);
+}
+
+if (failures.length) {
+  console.error('[release-evidence] FAIL');
+  for (const failure of failures) {
+    console.error(`- ${failure}`);
+  }
+  process.exit(1);
+}
+
+console.log('[release-evidence] ALL PASS');

package/public/dist/assets/Permissions-DvUCB8wA.js

@@ -1 +0,0 @@
-import{a as e,i as t,n,o as r,r as i,t as a}from"./Permissions-BkADXjQ4.js";export{a as default,n as isAllowlistValid,i as isPermissionToken,t as isPermissionsAuto,e as parsePermissionsValue,r as seedAutoAllowlist};

package/public/dist/assets/agent-meta-Du8y6mSM.js

@@ -1 +0,0 @@
-var e=[`claude`,`codex`,`gemini`],t={"ai-e":{label:`AI-E`,defaultProvider:`claude`,providers:[`claude`,`codex`,`gemini`,`grok`,`copilot`],models:[`opus`,`sonnet`,`haiku`,`gpt-5.4`,`gpt-5.4-mini`,`gemini-3-flash-preview`,`grok-build`,`gpt-5-mini`],efforts:[`low`,`medium`,`high`,`xhigh`,`max`],modelsByProvider:{claude:[`opus`,`sonnet`,`haiku`],codex:[`gpt-5.4`,`gpt-5.4-mini`],gemini:[`gemini-3-flash-preview`],grok:[`grok-build`],copilot:[`gpt-5-mini`]},effortsByProvider:{claude:[`low`,`medium`,`high`,`xhigh`,`max`],codex:[`low`,`medium`,`high`,`xhigh`],gemini:[],grok:[],copilot:[`low`,`medium`,`high`]}},claude:{label:`Claude`,models:[`opus`,`sonnet`,`sonnet[1m]`,`haiku`,`claude-opus-4-7`,`claude-opus-4-7[1m]`,`claude-opus-4-6`,`claude-opus-4-6[1m]`,`claude-sonnet-4-6`,`claude-sonnet-4-6[1m]`,`claude-haiku-4-5`],efforts:[`low`,`medium`,`high`,`xhigh`,`max`]},"claude-e":{label:`Claude E`,models:[`opus`,`sonnet`,`haiku`,`claude-opus-4-7`,`claude-sonnet-4-6`,`claude-haiku-4-5`],efforts:[`low`,`medium`,`high`,`xhigh`,`max`]},codex:{label:`Codex`,models:[`gpt-5.5`,`gpt-5.4`,`gpt-5.4-mini`,`gpt-5.3-codex`],efforts:[`low`,`medium`,`high`,`xhigh`]},"codex-app":{label:`Codex App`,models:[`gpt-5.5`,`gpt-5.4`,`gpt-5.4-mini`,`gpt-5.3-codex`],efforts:[`low`,`medium`,`high`,`xhigh`]},gemini:{label:`Gemini`,models:[`gemini-3-pro-preview`,`gemini-2.5-pro`,`gemini-3-flash-preview`],efforts:[]},grok:{label:`Grok`,models:[`grok-build`],efforts:[],effortNote:`unsupported by grok-build; do not pass --effort`},opencode:{label:`OpenCode`,models:[`opencode-go/kimi-k2.6`,`opencode-go/glm-5.1`],efforts:[`minimal`,`low`,`high`,`max`]},copilot:{label:`Copilot`,models:[`gpt-5.5`,`claude-opus-4.7`,`claude-sonnet-4.6`,`gpt-5.4`],efforts:[`low`,`medium`,`high`]}};function n(e){return t[e]||{label:e,models:[],efforts:[]}}function r(e,t={},n={}){return n[e]?.model||t[e]?.model||``}function i(e,t={},n={}){return n[e]?.effort||t[e]?.effort||``}function a(e,t=``){let n=new Set;t&&n.add(t);for(let t of e)n.add(t);return Array.from(n).map(e=>({value:e,label:e}))}export{r as a,i,n,a as r,e as t};