cuelo 0.5.2 → 0.5.4

package/Tools/OMP_Global_Config/agent/tools/git-finalizer/index.ts

@@ -1,7 +1,8 @@
 import type { CustomToolFactory } from "@oh-my-pi/pi-coding-agent";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 interface FinalizerResult {
@@ -14,6 +15,102 @@ interface FinalizerResult {
 }
 
 const scriptPath = fileURLToPath(new URL("./finalizer.ps1", import.meta.url));
+const helperPath = "Tools/CUELO_Setup/files/source-build-helper.js";
+const manifestPath = "Tools/CUELO_Setup/files/source-integrity.json";
+const excludedSourcePaths: Record<string, true> = {
+  "HANDOFF.md": true, "PC-SETUP.md": true, ".publicignore": true, ".publicdeny": true,
+  ".github/workflows/publish-public.yml": true,
+};
+const generatedSourceSegments: Record<string, true> = { ".git": true, ".next": true, ".omp": true, node_modules: true };
+// helper.buildFileMap()은 전체 트리를 검사하므로 무관한 writer의 변경까지 읽는다.
+// 여기서는 helper의 source 경계와 LF 해시 규칙을 선택된 파일에만 적용한다.
+const manifestInstructions = `From cwd Tools/CUELO_Setup, run:
+node files/source-build-helper.js create-manifest ../.. files/runtime-integrity.json --output files/source-integrity.json
+node files/source-build-helper.js verify-source ../.. files/source-integrity.json files/runtime-integrity.json
+Then include Tools/CUELO_Setup/files/source-integrity.json in the same commit.`;
+
+function isSourcePath(path: string, packagedTools: string[]): boolean {
+  if (path.split("/").some((segment) => generatedSourceSegments[segment] || segment.endsWith(".tsbuildinfo"))) return false;
+  if (path === "doc" || path.startsWith("doc/") || excludedSourcePaths[path]) return false;
+  if (path.startsWith("Tools/")) {
+    return packagedTools.some((entry) => path === entry || path.startsWith(`${entry}/`));
+  }
+  return true;
+}
+
+async function checkSourceManifest(
+  cwd: string,
+  files: string[],
+  exec: (command: string, args: string[], options: { cwd: string }) => Promise<{ code: number; stdout: string }>,
+): Promise<void> {
+  const targets: { root: string; path: string }[] = [];
+  for (const input of files) {
+    if (isAbsolute(input) || /[\0\r\n]/.test(input)) return; // 잘못된 경로의 최종 판정은 finalizer.ps1에 둔다.
+    const absolute = resolve(cwd, input);
+    let directory = dirname(absolute);
+    while (true) {
+      try {
+        if ((await stat(directory)).isDirectory()) break;
+      } catch { /* finalizer.ps1과 같이 가장 가까운 기존 부모를 찾는다. */ }
+      const parent = dirname(directory);
+      if (parent === directory) return;
+      directory = parent;
+    }
+    const result = await exec("git", ["-C", directory, "rev-parse", "--show-prefix"], { cwd });
+    if (result.code !== 0) return; // 저장소 밖·잘못된 대상은 finalizer.ps1이 판정한다.
+    const prefix = result.stdout.trim().split("/").filter(Boolean);
+    const root = resolve(directory, ...prefix.map(() => ".."));
+    const path = relative(root, absolute).split(sep).join("/");
+    if (!path || path === ".." || path.startsWith("../")) return;
+    targets.push({ root, path });
+  }
+  if (!targets.length || targets.some(({ root }) => root.toLowerCase() !== targets[0].root.toLowerCase())) return;
+
+  const root = targets[0].root;
+  try {
+    await stat(join(root, ...helperPath.split("/")));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+  if (targets.some(({ path }) => path.toLowerCase() === manifestPath.toLowerCase())) return;
+
+  let packagedTools: string[] = [];
+  try {
+    const pkg = JSON.parse(await readFile(join(root, "package.json"), "utf8")) as { files?: unknown };
+    if (Array.isArray(pkg.files)) {
+      packagedTools = pkg.files
+        .filter((entry): entry is string => typeof entry === "string" && entry.startsWith("Tools/"))
+        .map((entry) => entry.replace(/\/+$/, ""));
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+  const sourcePaths = targets.map(({ path }) => path).filter((path) => isSourcePath(path, packagedTools));
+  if (!sourcePaths.length) return;
+
+  let manifest: { files?: Record<string, string> } = {};
+  try {
+    manifest = JSON.parse(await readFile(join(root, ...manifestPath.split("/")), "utf8"));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+  for (const path of sourcePaths) {
+    let bytes: Buffer | undefined;
+    try {
+      bytes = await readFile(join(root, ...path.split("/")));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+    const content = bytes && !bytes.includes(0) && bytes.includes("\r\n")
+      ? Buffer.from(bytes.toString("latin1").replace(/\r\n/g, "\n"), "latin1")
+      : bytes;
+    const hash = content && createHash("sha256").update(content).digest("hex");
+    if (!hash || manifest.files?.[path] !== hash) {
+      throw new Error(`git_finalize: source manifest is stale for ${path}. ${manifestInstructions}`);
+    }
+  }
+}
 
 function parseResult(stdout: string): FinalizerResult | undefined {
   const lines = stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
@@ -46,6 +143,8 @@ const factory: CustomToolFactory = (pi) => ({
     if (!message) throw new Error("git_finalize requires a non-empty commit message.");
     if (process.platform !== "win32") throw new Error("git_finalize currently requires Windows PowerShell.");
 
+    await checkSourceManifest(pi.cwd, files, (command, args, options) => pi.exec(command, args, { ...options, signal }));
+
     onUpdate?.({
       content: [{ type: "text", text: "Repository finalizer lock을 획득하고 변경 경계를 확인하는 중입니다." }],
       details: { phase: "preflight", files },