create-principles-disciple 1.132.1 → 1.132.3

package/console/dist/server/routes/update.js

@@ -8,9 +8,10 @@ import { appendUpdateHistory } from './update-history.js';
 import { checkOpenClawGateway, stopOpenClawGateway, restartOpenClawGateway, } from '../utils/gateway.js';
 import { migrateLegacyExtensionBackups, reservePdBackupDestination, resolvePdBackupsRoot, } from '../utils/pd-backups.js';
 import { resolveExtensionsDir, resolveUpdateLayout, resolvePluginDir, readCurrentVersion, } from '../utils/installed-layout.js';
-import { ActivationCompatibilityReadModel } from '@principles/core/runtime-v2';
+import { ActivationCompatibilityReadModel, isFeatureEnabled } from '@principles/core/runtime-v2';
 import { collectFileDepLinkSpecs } from '../utils/update-links.js';
-import { updateMutationController, LEGACY_MUTATION_AUTHORITY, } from '../update/mutation-controller.js';
+import { updateMutationController, LEGACY_MUTATION_AUTHORITY, RELEASE_MANAGER_AUTHORITY, MUTATION_KINDS, } from '../update/mutation-controller.js';
+import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 /**
  * Legacy rule contract preflight (2026-08-19): refuse to swap the runtime
  * while an ACTIVE owner-approved rule still depends on a RuleHost contract
@@ -904,6 +905,11 @@ function ensureRuntimeResolutionLinks(layout, tempDir) {
         { manifestDir: path.join(tempDir, 'install-layout'), deployedDir: layout.installLayoutDir },
         { manifestDir: path.join(tempDir, 'core'), deployedDir: layout.coreDir },
         { manifestDir: path.join(tempDir, 'plugin'), deployedDir: layout.pluginDir },
+        // PRI-672: staged release-manager component (npm name
+        // create-principles-disciple). Its staged manifest carries the
+        // file:../install-layout ref, and the staged console's manifest carries
+        // file:../release-manager — both derive their resolution links here.
+        { manifestDir: path.join(tempDir, 'release-manager'), deployedDir: layout.releaseManagerDir },
     ];
     const readStagedDependencies = (manifestDir) => {
         try {
@@ -1152,6 +1158,18 @@ async function doInlineFullUpdate(workspaceDir) {
             if (fs.existsSync(path.join(installLayoutSrc, 'package.json')) && fs.existsSync(path.join(installLayoutSrc, 'dist'))) {
                 copyDirRecursive(installLayoutSrc, layout.installLayoutDir, SKIP_DIRS);
             }
+            // PRI-672: the release-manager component (npm name
+            // create-principles-disciple — the ReleaseManager authority module the
+            // updated console imports) must land BEFORE the swap and its resolution
+            // link, same PRI-561 ordering as host-runtime/install-layout. Conditioned
+            // on the staged component so updates from tarballs published before this
+            // component existed simply skip it (their console does not import it).
+            const releaseManagerSrc = path.join(tempDir, 'release-manager');
+            if (fs.existsSync(releaseManagerSrc) &&
+                fs.existsSync(path.join(releaseManagerSrc, 'package.json')) &&
+                fs.existsSync(path.join(releaseManagerSrc, 'dist'))) {
+                copyDirRecursive(releaseManagerSrc, layout.releaseManagerDir, SKIP_DIRS);
+            }
             const { error: linkError, quarantined } = ensureRuntimeResolutionLinks(layout, tempDir);
             reconciledQuarantine = quarantined;
             if (linkError) {
@@ -1321,6 +1339,33 @@ async function doInlineFullUpdate(workspaceDir) {
  * registers under `release-manager` for the same kinds and this route layer
  * needs no further change.
  */
+/**
+ * Compute the legacy update-check response body (PRI-659 handler body, split
+ * out in PRI-672 so the ReleaseManager-governed check can serve the exact
+ * same wire contract). Behavior is unchanged: degraded ERR-002 shape when the
+ * current version cannot be determined, network checks otherwise.
+ */
+async function computeLegacyUpdateCheck(pluginDir) {
+    // ERR-002 / Runtime Contract Rule 9: 当无法确定当前版本时（如插件未安装），
+    // 返回 degraded 状态 + reason，而非 500。前端 validateUpdateStatus 要求
+    // currentVersion/latestVersion 为 string，hasUpdate 为 boolean。
+    const currentVersion = readCurrentVersion(pluginDir);
+    const codexInstalled = detectCodexInstall();
+    if (!currentVersion) {
+        return {
+            currentVersion: undefined,
+            body: {
+                hasUpdate: false,
+                currentVersion: 'unknown',
+                latestVersion: '',
+                codexInstalled,
+                error: 'Could not determine current version (plugin not installed)',
+            },
+        };
+    }
+    const result = await doCheckForUpdates(currentVersion);
+    return { currentVersion, body: { ...result, codexInstalled } };
+}
 function legacyCheckMutation(req, res, ctx) {
     return (async () => {
         const pluginDir = resolvePluginDir(ctx.workspaceDir);
@@ -1329,23 +1374,8 @@ function legacyCheckMutation(req, res, ctx) {
             return;
         }
         try {
-            // ERR-002 / Runtime Contract Rule 9: 当无法确定当前版本时（如插件未安装），
-            // 返回 degraded 状态 + reason，而非 500。前端 validateUpdateStatus 要求
-            // currentVersion/latestVersion 为 string，hasUpdate 为 boolean。
-            const currentVersion = readCurrentVersion(pluginDir);
-            const codexInstalled = detectCodexInstall();
-            if (!currentVersion) {
-                sendSuccess(res, {
-                    hasUpdate: false,
-                    currentVersion: 'unknown',
-                    latestVersion: '',
-                    codexInstalled,
-                    error: 'Could not determine current version (plugin not installed)',
-                });
-                return;
-            }
-            const result = await doCheckForUpdates(currentVersion);
-            sendSuccess(res, { ...result, codexInstalled });
+            const { body } = await computeLegacyUpdateCheck(pluginDir);
+            sendSuccess(res, body);
         }
         catch (err) {
             sendError(res, 500, 'update_check_error', err instanceof Error ? err.message : 'Unknown error');
@@ -1473,6 +1503,140 @@ updateMutationController.register('check', { name: LEGACY_MUTATION_AUTHORITY, ha
 updateMutationController.register('apply', { name: LEGACY_MUTATION_AUTHORITY, handler: legacyApplyMutation });
 updateMutationController.register('apply-full', { name: LEGACY_MUTATION_AUTHORITY, handler: legacyApplyFullMutation });
 updateMutationController.register('rollback', { name: LEGACY_MUTATION_AUTHORITY, handler: legacyRollbackMutation });
+let releaseManagerModuleState = { state: 'unattempted' };
+function releaseManagerFlagEnabled(workspaceDir) {
+    const flags = computeFlagsFromLoadResult(loadPdConfig(workspaceDir));
+    return isFeatureEnabled(flags, 'release_manager_shadow');
+}
+function fallbackToLegacyForAllKinds(reason) {
+    for (const kind of MUTATION_KINDS) {
+        updateMutationController.unregister(kind, RELEASE_MANAGER_AUTHORITY);
+        updateMutationController.setFallbackReason(kind, reason);
+    }
+}
+/**
+ * Governed check dispatch (kind `check` only, flag on, readiness ready at
+ * registration time). Runs the ReleaseManager shadow check for governance and
+ * parity evidence, then serves the legacy-computed response body — byte-for-
+ * byte the legacy contract. On a ReleaseManager refusal the response headers
+ * are re-annotated to the explicit fallback and the legacy body is served
+ * anyway: check is read-only, so the fallback cannot leave partial state.
+ */
+async function runReleaseManagerCheckDispatch(mod, req, res, ctx) {
+    if (req.method !== 'GET') {
+        sendMethodNotAllowed(res);
+        return;
+    }
+    const pluginDir = resolvePluginDir(ctx.workspaceDir);
+    // One legacy computation feeds BOTH the shadow comparison (via legacyCheck)
+    // and the response body — a governed check never doubles network cost.
+    let legacyOnce = null;
+    const legacyComputed = () => {
+        legacyOnce ??= () => computeLegacyUpdateCheck(pluginDir);
+        return legacyOnce();
+    };
+    let decisionSource = null;
+    const authority = mod.createReleaseManagerAuthority({
+        pdHome: path.join(os.homedir(), '.pd'),
+        metadataBaseUrl: process.env.PD_RELEASE_METADATA_URL,
+        legacyCheck: async (currentVersion) => {
+            if (decisionSource === null)
+                return null;
+            return decisionSource(currentVersion);
+        },
+    });
+    decisionSource = async () => {
+        const computed = await legacyComputed();
+        if (computed.currentVersion === undefined)
+            return null;
+        const raw = computed.body;
+        return {
+            source: 'legacy-updater',
+            latestVersion: typeof raw.latestVersion === 'string' && raw.latestVersion.length > 0 ? raw.latestVersion : null,
+            updateAvailable: raw.hasUpdate === true,
+        };
+    };
+    if (authority.installStatus === null || !authority.kinds.check.ready) {
+        // Readiness flipped between registration sync and dispatch — explicit
+        // fallback, never a half-governed check.
+        const reasons = authority.installStatus === null
+            ? 'install_state_corrupt'
+            : authority.kinds.check.reasons.join(',');
+        res.setHeader('X-PD-Mutation-Authority', `${LEGACY_MUTATION_AUTHORITY} (preferred: ${RELEASE_MANAGER_AUTHORITY} unavailable)`);
+        res.setHeader('X-PD-Mutation-Fallback-Reason', `release_manager_unavailable:${reasons}`);
+        await legacyCheckMutation(req, res, ctx);
+        return;
+    }
+    try {
+        const check = await authority.manager.check(authority.installStatus.channel);
+        const comparison = check.shadowComparison;
+        const agrees = comparison.agrees === null ? 'unknown' : String(comparison.agrees);
+        console.log(`[release-manager] governed update check served (channel=${check.channel}, agrees=${agrees}${comparison.note ? `, note: ${comparison.note}` : ''})`);
+    }
+    catch (error) {
+        const mapped = mod.mapReleaseManagerErrorToFallback(error);
+        console.log(`[release-manager] governed update check refused (${mapped.reason}) — explicit fallback to ${LEGACY_MUTATION_AUTHORITY}`);
+        res.setHeader('X-PD-Mutation-Authority', `${LEGACY_MUTATION_AUTHORITY} (preferred: ${RELEASE_MANAGER_AUTHORITY} unavailable: ${mapped.reason})`);
+        res.setHeader('X-PD-Mutation-Fallback-Reason', `release_manager_unavailable:${mapped.reason}`);
+    }
+    try {
+        const { body } = await legacyComputed();
+        sendSuccess(res, body);
+    }
+    catch (err) {
+        sendError(res, 500, 'update_check_error', err instanceof Error ? err.message : 'Unknown error');
+    }
+}
+/**
+ * Bring the authority registration in line with current flag + readiness
+ * state, then dispatch happens through the controller as usual. Idempotent;
+ * the dynamic import is attempted once per server run.
+ */
+async function syncReleaseManagerAuthority(workspaceDir) {
+    if (!releaseManagerFlagEnabled(workspaceDir)) {
+        fallbackToLegacyForAllKinds('release_manager_shadow_disabled');
+        return;
+    }
+    if (releaseManagerModuleState.state === 'unattempted') {
+        try {
+            const module = await import('create-principles-disciple/dist/update/release-manager-authority.js');
+            releaseManagerModuleState = { state: 'loaded', module };
+        }
+        catch (error) {
+            releaseManagerModuleState = { state: 'missing', detail: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    if (releaseManagerModuleState.state === 'missing') {
+        fallbackToLegacyForAllKinds('installer_missing');
+        return;
+    }
+    const mod = releaseManagerModuleState.module;
+    let authority;
+    try {
+        authority = mod.createReleaseManagerAuthority({
+            pdHome: path.join(os.homedir(), '.pd'),
+            metadataBaseUrl: process.env.PD_RELEASE_METADATA_URL,
+        });
+    }
+    catch {
+        fallbackToLegacyForAllKinds('authority_module_unavailable');
+        return;
+    }
+    for (const rmKind of mod.RELEASE_MANAGER_AUTHORITY_KINDS) {
+        const readiness = authority.kinds[rmKind];
+        if (readiness.ready && rmKind === 'check') {
+            updateMutationController.register('check', {
+                name: RELEASE_MANAGER_AUTHORITY,
+                handler: (req, res, ctx) => runReleaseManagerCheckDispatch(mod, req, res, ctx),
+            });
+            updateMutationController.setFallbackReason('check', null);
+        }
+        else {
+            updateMutationController.unregister(rmKind, RELEASE_MANAGER_AUTHORITY);
+            updateMutationController.setFallbackReason(rmKind, `release_manager_unavailable:${readiness.reasons.join(',')}`);
+        }
+    }
+}
 const UPDATE_MUTATION_KINDS = new Map([
     ['/check', 'check'],
     ['/apply', 'apply'],
@@ -1485,5 +1649,9 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
         sendNotFound(res, `Update route not found: ${subPath}`);
         return;
     }
+    // PRI-672: align the authority registration with the current flag +
+    // readiness state before the controller resolves the authority. Pure
+    // routing/decision work — no runtime mutation happens here.
+    await syncReleaseManagerAuthority(workspaceDir);
     await updateMutationController.dispatch(req, res, { workspaceDir }, kind);
 }

package/console/dist/server/update/mutation-controller.d.ts

@@ -57,6 +57,13 @@ export interface MutationGovernanceInfo {
     readonly preferred: string;
     readonly fallback: boolean;
     readonly available: readonly string[];
+    /**
+     * PRI-672: why the fallback authority is serving (set by the wiring when the
+     * preferred authority is unregistered/unavailable). Omitted when the wiring
+     * has no reason to report — e.g. before any dispatch, or while the preferred
+     * authority serves.
+     */
+    readonly fallbackReason?: string;
 }
 export interface ResolvedAuthority {
     readonly authority: MutationAuthority;
@@ -64,6 +71,17 @@ export interface ResolvedAuthority {
 }
 export declare class MutationController {
     private readonly authorities;
+    /** PRI-672: per-kind reason the fallback is serving (machine-readable, rc-9). */
+    private readonly fallbackReasons;
+    /**
+     * Record why the fallback authority is currently serving `kind` (e.g.
+     * `release_manager_shadow_disabled` or `release_manager_unavailable:…`).
+     * Emitted as the `X-PD-Mutation-Fallback-Reason` header whenever a dispatch
+     * actually resolves to the fallback, and surfaced by describeGovernance().
+     * Pass null to clear.
+     */
+    setFallbackReason(kind: MutationKind, reason: string | null): void;
+    getFallbackReason(kind: MutationKind): string | undefined;
     register(kind: MutationKind, authority: MutationAuthority): void;
     unregister(kind: MutationKind, name: string): boolean;
     hasAuthority(kind: MutationKind, name: string): boolean;

package/console/dist/server/update/mutation-controller.js

@@ -13,6 +13,26 @@ export const PREFERRED_MUTATION_AUTHORITY = RELEASE_MANAGER_AUTHORITY;
 export const MUTATION_KINDS = ['check', 'apply', 'apply-full', 'rollback'];
 export class MutationController {
     authorities = new Map();
+    /** PRI-672: per-kind reason the fallback is serving (machine-readable, rc-9). */
+    fallbackReasons = new Map();
+    /**
+     * Record why the fallback authority is currently serving `kind` (e.g.
+     * `release_manager_shadow_disabled` or `release_manager_unavailable:…`).
+     * Emitted as the `X-PD-Mutation-Fallback-Reason` header whenever a dispatch
+     * actually resolves to the fallback, and surfaced by describeGovernance().
+     * Pass null to clear.
+     */
+    setFallbackReason(kind, reason) {
+        if (reason === null) {
+            this.fallbackReasons.delete(kind);
+        }
+        else {
+            this.fallbackReasons.set(kind, reason);
+        }
+    }
+    getFallbackReason(kind) {
+        return this.fallbackReasons.get(kind);
+    }
     register(kind, authority) {
         let table = this.authorities.get(kind);
         if (table === undefined) {
@@ -61,6 +81,10 @@ export class MutationController {
             ? `${authority.name} (preferred: ${PREFERRED_MUTATION_AUTHORITY} not yet available)`
             : authority.name;
         res.setHeader('X-PD-Mutation-Authority', headerValue);
+        const fallbackReason = fallback ? this.fallbackReasons.get(kind) : undefined;
+        if (fallbackReason !== undefined) {
+            res.setHeader('X-PD-Mutation-Fallback-Reason', fallbackReason);
+        }
         await authority.handler(req, res, ctx);
     }
     /** Governance snapshot for observability and migration tests. */
@@ -77,6 +101,11 @@ export class MutationController {
                 const { authority, fallback } = this.resolveAuthority(kind);
                 info = { active: authority.name, preferred: PREFERRED_MUTATION_AUTHORITY, fallback, available };
             }
+            if (info.fallback) {
+                const fallbackReason = this.fallbackReasons.get(kind);
+                if (fallbackReason !== undefined)
+                    info = { ...info, fallbackReason };
+            }
             snapshot[kind] = info;
         }
         return snapshot;

package/console/dist/server/utils/installed-layout.d.ts

@@ -7,6 +7,7 @@ export interface UpdateLayout {
     hostRuntimeDir: string;
     pdCliDir: string;
     installLayoutDir: string;
+    releaseManagerDir: string;
     hosts: InstallHost[];
 }
 export declare function resolveUpdateLayout(): UpdateLayout | undefined;

package/console/dist/server/utils/installed-layout.js

@@ -45,6 +45,7 @@ export function resolveUpdateLayout() {
             hostRuntimeDir: paths.hostRuntimeDir,
             pdCliDir: paths.pdCliDir,
             installLayoutDir: paths.installLayoutDir,
+            releaseManagerDir: paths.releaseManagerDir,
             hosts: resolution.manifest?.hosts ?? [],
         };
     }
@@ -55,6 +56,7 @@ export function resolveUpdateLayout() {
         hostRuntimeDir: path.join(legacyPluginDir, 'host-runtime'),
         pdCliDir: path.join(legacyPluginDir, 'pd-cli'),
         installLayoutDir: path.join(legacyPluginDir, 'install-layout'),
+        releaseManagerDir: path.join(legacyPluginDir, 'release-manager'),
         hosts: ['openclaw'],
     };
 }

package/console/package.json

@@ -23,6 +23,7 @@
     "@principles/core": "file:../core",
     "@principles/host-runtime": "file:../host-runtime",
     "@principles/install-layout": "file:../install-layout",
+    "create-principles-disciple": "file:../release-manager",
     "principles-disciple": "file:../plugin",
     "@radix-ui/react-alert-dialog": "^1.1.15",
     "@radix-ui/react-dialog": "^1.1.15",

package/core/dist/runtime-v2/__tests__/architecture-regression.test.js

@@ -3722,6 +3722,16 @@ describe('SEC-BASE-4: log secret redaction & SQL injection guards', () => {
 describe('SEC-BASE-5: network & config isolation guards', () => {
     const REPO_ROOT = pathSync.resolve(__dirname, '../../../../..');
     it('core does not import node:http / node:https / undici / fetch for business', () => {
+        // PRI-683: pi-ai-http-transport.ts is the registered exception
+        // (io-seam-registry.json `pi-ai-http-transport` seam). It owns the LLM
+        // transport's undici Agent config; requests still originate from pi-ai.
+        const registryPath = pathSync.join(REPO_ROOT, 'packages', 'principles-core', 'io-seam-registry.json');
+        const registry = JSON.parse(fsSync.readFileSync(registryPath, 'utf8'));
+        const registeredFiles = new Set();
+        for (const seam of registry.seams) {
+            for (const file of seam.files)
+                registeredFiles.add(file);
+        }
         const coreDir = pathSync.join(REPO_ROOT, 'packages', 'principles-core', 'src');
         const files = fsSync.readdirSync(coreDir, { recursive: true, encoding: 'utf8' })
             .filter((f) => typeof f === 'string' && f.endsWith('.ts') && !f.includes('__tests__'));
@@ -3729,14 +3739,19 @@ describe('SEC-BASE-5: network & config isolation guards', () => {
         for (const f of files) {
             const content = fsSync.readFileSync(pathSync.join(coreDir, f), 'utf8');
             const lines = content.split('\n');
+            const isRegisteredSeam = registeredFiles.has(f.replace(/\\/g, '/'));
             lines.forEach((line, idx) => {
                 if (/^import\s+type/.test(line.trim()))
                     return;
                 if (/from\s+['"]node:http['"]/.test(line) || /from\s+['"]node:https['"]/.test(line)
                     || /from\s+['"]undici['"]/.test(line) || /from\s+['"]node-fetch['"]/.test(line)) {
+                    if (isRegisteredSeam)
+                        return;
                     violations.push(`${f}:${idx + 1}: ${line.trim()}`);
                 }
                 if (!/^\s*(\/\/|\/\*|\*)/.test(line) && /\bfetch\s*\(/.test(line) && !/import/.test(line)) {
+                    if (isRegisteredSeam)
+                        return;
                     violations.push(`${f}:${idx + 1}: ${line.trim()}`);
                 }
             });