driftseal 1.3.0 → 1.3.2

package/README.md

@@ -210,17 +210,28 @@ driftseal verify
 `driftseal verify` passes the exact stored string to the operating-system shell.
 The command can therefore read or modify files, access the network, or run any
 other program available to the current user. Treat it as executable code, not as
-passive log data. A locally created open intent is parked in Git metadata and runs
-normally. If the open intent came from the repository's tracked intent log,
-DriftSeal prints the command to stderr and refuses to execute it until you inspect
-it and explicitly run `driftseal verify --allow-tracked-command`. The programmatic
-API and MCP tool expose the equivalent `allowTrackedCommand` opt-in.
+passive log data. DriftSeal records local provenance when an intent is opened:
+the default Git workflow parks the intent in Git metadata, while non-Git and
+custom `DRIFTSEAL_HOME` workflows keep a small local marker outside the intent
+log. Those locally created intents run normally. If an open intent arrives only
+through an intent log, without matching local provenance, DriftSeal cannot confirm
+who chose its command. It prints the command to stderr and refuses to execute it
+until you inspect it and explicitly run
+`driftseal verify --allow-tracked-command`. The programmatic API and MCP tool
+expose the equivalent `allowTrackedCommand` opt-in. Local provenance state is
+removed when the intent closes. Non-Git markers are bound to the local log
+file's identity, so copying a marker with the log does not transfer trust. If
+local provenance is lost or no longer matches, verification fails safe and
+requires the same explicit opt-in.
 
 The verification event records the command's exit status, duration, output
 digest and byte counts, Git HEAD, and a fingerprint of every tracked or
 untracked non-ignored workspace file except the intent event log. A successful
 result becomes stale if those workspace contents change. DriftSeal therefore
 rejects `completed` until the command passes again on the current workspace.
+Command output is spooled to temporary files instead of a fixed in-memory
+buffer, then replayed after the command exits and removed. Output size therefore
+has no DriftSeal-defined limit, though it remains bounded by available disk space.
 Ignored files are deliberately outside this fingerprint. Outside a Git
 worktree the fingerprint is unavailable, so the gate proves only the command's
 recorded exit status and cannot detect later content changes.
@@ -255,7 +266,7 @@ also need no intent. Any other non-Git content change starts a new work round.
 | Command | Purpose |
 | --- | --- |
 | `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | Open a work-round intent. Repeat `--accept` for observable completion criteria; acceptance requires a verification command. |
-| `driftseal verify [--allow-tracked-command]` | Execute the acceptance-bound intent's predeclared command and bind machine evidence to the current Git-visible workspace contents. Commands sourced from the tracked intent log require the explicit opt-in. |
+| `driftseal verify [--allow-tracked-command]` | Execute the acceptance-bound intent's predeclared command and bind machine evidence to the current Git-visible workspace contents. Commands without matching local provenance require the explicit opt-in. |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | Close an intent honestly. |
 | `driftseal status` | Show the intent currently in progress. |
 | `driftseal log [-n N] [--all]` | Review intent history (`--all` includes reclaimed records). |

package/README.zh-CN.md

@@ -199,16 +199,23 @@ driftseal verify
 
 `driftseal verify` 会把日志中保存的完整字符串交给操作系统 shell。这个命令可以
 读写文件、访问网络，也可以运行当前用户有权执行的任何程序；因此它是可执行代码，
-不是被动的日志数据。当前 worktree 本地创建的 open intent 会 park 在 Git metadata
-中，可以直接运行。如果 open intent 来自 repository 中被跟踪的 intent log，
-DriftSeal 会先把命令输出到 stderr，并拒绝执行；只有检查并信任该命令后，才能显式
-运行 `driftseal verify --allow-tracked-command`。Programmatic API 和 MCP tool 中对应的
-显式开关是 `allowTrackedCommand`。
+不是被动的日志数据。创建 intent 时，DriftSeal 会记录本地 provenance：默认 Git
+流程把 open intent park 在 Git metadata 中；非 Git 环境和自定义
+`DRIFTSEAL_HOME` 则在 intent log 之外保存一个很小的本地标记。这些本地创建的
+intent 可以直接验证。如果 open intent 只有 log 记录、没有匹配的本地 provenance，
+DriftSeal 就无法确认是谁选择了其中的命令。此时它会先把命令输出到 stderr 并拒绝
+执行；只有检查并信任该命令后，才能显式运行
+`driftseal verify --allow-tracked-command`。Programmatic API 和 MCP tool 中对应的显式
+开关是 `allowTrackedCommand`。intent 关闭时，本地 provenance 会被清理；如果它提前
+丢失，DriftSeal 会按安全方向处理，仍要求显式 opt in。非 Git marker 还会绑定本地
+log 文件的 identity，因此把 marker 和 log 一起复制到别处也不会转移信任。
 
 验证事件会记录 exit status、耗时、输出摘要及字节数、Git HEAD，以及当前所有
 tracked 和未被 ignore 的 untracked 文件的内容指纹（intent event log 除外）。
 验证后只要这些内容发生变化，成功证据就会过期，必须重新运行；否则 DriftSeal
-会拒绝把 intent 关闭为 `completed`。被 ignore 的文件不在指纹范围内。
+会拒绝把 intent 关闭为 `completed`。命令输出会先写入临时 spool 文件，而不是
+受固定大小的内存 buffer 限制；命令退出后再回放并删除。因此 DriftSeal 不再限制
+输出大小，但实际容量仍受可用磁盘空间约束。被 ignore 的文件不在指纹范围内。
 如果当前目录不是 Git worktree，指纹不可用；此时 gate 只能证明记录到的 exit
 status，无法发现之后发生的内容变化。
 
@@ -240,7 +247,7 @@ intent；会被提交且无法重建的内容改动（比如编辑 `.gitignore`
 | Command | 用途 |
 | --- | --- |
 | `driftseal begin "<intent>" [--accept "<outcome>"] [-v "<command>"] [--decision id] [--force]` | 开启一轮工作。可重复使用 `--accept` 声明可观察的完成条件；一旦声明，就必须同时提供验证命令。 |
-| `driftseal verify [--allow-tracked-command]` | 执行 acceptance-bound intent 预先声明的命令，并把机器证据绑定到当前 Git 可见的工作区内容；来自 tracked intent log 的命令必须显式 opt in。 |
+| `driftseal verify [--allow-tracked-command]` | 执行 acceptance-bound intent 预先声明的命令，并把机器证据绑定到当前 Git 可见的工作区内容；没有匹配本地 provenance 的命令必须显式 opt in。 |
 | `driftseal end [id] [-s status] [-n note] [-r verify-result]` | 诚实地关闭 intent。 |
 | `driftseal status` | 查看当前进行中的 intent。 |
 | `driftseal log [-n N] [--all]` | 查看 intent 历史（`--all` 包含已回收的记录）。 |

package/bin/driftseal.js

@@ -27,6 +27,7 @@ const path = require('path');
 const crypto = require('crypto');
 const os = require('os');
 const { isDeepStrictEqual } = require('util');
+const { StringDecoder } = require('string_decoder');
 const { execFileSync, spawnSync } = require('child_process');
 const { version: PACKAGE_VERSION } = require('../package.json');
 
@@ -48,6 +49,10 @@ const LOCK_INIT_STALE_MS = 5 * 1000;
 const READ_ONLY_NOTICE = '(read-only: another mutation holds the lock; tail repair skipped)';
 const READ_ONLY_LOCK_WAIT_MS = Number(process.env._DRIFTSEAL_TEST_READ_ONLY_LOCK_WAIT_MS) || 1500;
 const MAX_DECISION_SLUG_LENGTH = 180;
+const VERIFICATION_OUTPUT_CHUNK_BYTES = 64 * 1024;
+const CAPTURE_OUTPUT_EDGE_CHARACTERS = 32 * 1024;
+const CAPTURE_OUTPUT_OMISSION = '\n... [driftseal captured output truncated] ...\n';
+const LOCAL_INTENT_PROVENANCE_FILE = '.driftseal-local-intent.json';
 
 class DriftSealError extends Error {
   constructor(message) {
@@ -98,39 +103,70 @@ function usageFor(key) {
 
 let activeOutput = null;
 
+function createBoundedOutputCapture() {
+  return { head: '', tail: '', length: 0, headComplete: false };
+}
+
+function splitsSurrogatePair(text, index) {
+  if (index <= 0 || index >= text.length) return false;
+  const before = text.charCodeAt(index - 1);
+  const after = text.charCodeAt(index);
+  return before >= 0xd800 && before <= 0xdbff && after >= 0xdc00 && after <= 0xdfff;
+}
+
+function appendBoundedOutput(capture, value) {
+  let text = String(value);
+  capture.length += text.length;
+
+  if (!capture.headComplete) {
+    let take = Math.min(CAPTURE_OUTPUT_EDGE_CHARACTERS - capture.head.length, text.length);
+    if (splitsSurrogatePair(text, take)) take -= 1;
+    capture.head += text.slice(0, take);
+    text = text.slice(take);
+    if (text.length > 0) capture.headComplete = true;
+  }
+
+  if (text.length === 0) return;
+  const combined = capture.tail + text;
+  let start = Math.max(0, combined.length - CAPTURE_OUTPUT_EDGE_CHARACTERS);
+  if (splitsSurrogatePair(combined, start)) start += 1;
+  capture.tail = combined.slice(start);
+}
+
+function renderBoundedOutput(capture) {
+  if (capture.length === capture.head.length + capture.tail.length) {
+    return capture.head + capture.tail;
+  }
+  return capture.head + CAPTURE_OUTPUT_OMISSION + capture.tail;
+}
+
+function captureOutput(stream, value) {
+  if (!activeOutput) return false;
+  appendBoundedOutput(activeOutput[stream], value);
+  return true;
+}
+
 function printLine(value = '') {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stdout += text + '\n';
-    return;
-  }
+  if (captureOutput('stdout', text + '\n')) return;
   console.log(text);
 }
 
 function printError(value = '') {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stderr += text + '\n';
-    return;
-  }
+  if (captureOutput('stderr', text + '\n')) return;
   console.error(text);
 }
 
 function writeOutput(value) {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stdout += text;
-    return;
-  }
+  if (captureOutput('stdout', text)) return;
   process.stdout.write(text);
 }
 
 function writeErrorOutput(value) {
   const text = String(value);
-  if (activeOutput) {
-    activeOutput.stderr += text;
-    return;
-  }
+  if (captureOutput('stderr', text)) return;
   process.stderr.write(text);
 }
 
@@ -569,7 +605,12 @@ function parkedOpenIntent(park) {
 
 function appendEvent(event) {
   const park = inProgressFile();
-  if (!park) return appendEventTo(logFile(), event);
+  if (!park) {
+    const stored = appendEventTo(logFile(), event);
+    if (event.type === 'begin') writeLocalIntentProvenance(stored);
+    if (event.type === 'end') clearLocalIntentProvenance(event.id);
+    return stored;
+  }
 
   const open = parkedOpenIntent(park);
   // A park with nothing open left in it belongs in the log; an interrupted end retries here.
@@ -591,9 +632,88 @@ function contentHash(content) {
   return crypto.createHash('sha256').update(content, 'utf8').digest('hex');
 }
 
-function atomicWriteFile(target, content) {
+function localIntentProvenanceFile() {
+  const root = gitWorktreeRoot();
+  const key = contentHash(path.resolve(logFile())).slice(0, 16);
+  if (!root) return path.join(logDir(), LOCAL_INTENT_PROVENANCE_FILE);
+  const gitPath = gitCapture(['rev-parse', '--git-path', `driftseal-local-intent-${key}.json`]);
+  return gitPath ? path.resolve(process.cwd(), gitPath) : null;
+}
+
+function localIntentLogIdentity() {
+  try {
+    const stat = fs.statSync(logFile(), { bigint: true });
+    return contentHash(JSON.stringify([String(stat.dev), String(stat.ino), String(stat.birthtimeNs)]));
+  } catch {
+    return null;
+  }
+}
+
+function localIntentProvenanceFingerprint({ id, ts, verify }) {
+  return contentHash(JSON.stringify([id, ts, verify || null]));
+}
+
+function writeLocalIntentProvenance(event) {
+  const file = localIntentProvenanceFile();
+  if (!file) return;
+  ensureDirectoryDurable(path.dirname(file));
+  atomicWriteFile(
+    file,
+    JSON.stringify({
+      version: 1,
+      id: event.id,
+      fingerprint: localIntentProvenanceFingerprint(event),
+      logIdentity: localIntentLogIdentity(),
+    }) + '\n',
+    0o600
+  );
+}
+
+function readLocalIntentProvenance() {
+  const file = localIntentProvenanceFile();
+  if (!file || !fs.existsSync(file)) return null;
+  try {
+    const provenance = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (
+      provenance.version !== 1 ||
+      typeof provenance.id !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(provenance.fingerprint) ||
+      !/^[a-f0-9]{64}$/.test(provenance.logIdentity)
+    ) {
+      return null;
+    }
+    return provenance;
+  } catch {
+    return null;
+  }
+}
+
+function hasMatchingLocalIntentProvenance(intent) {
+  const provenance = readLocalIntentProvenance();
+  return (
+    provenance !== null &&
+    provenance.id === intent.id &&
+    provenance.logIdentity === localIntentLogIdentity() &&
+    provenance.fingerprint ===
+      localIntentProvenanceFingerprint({
+        id: intent.id,
+        ts: intent.tsBegin,
+        verify: intent.verify,
+      })
+  );
+}
+
+function clearLocalIntentProvenance(id) {
+  const file = localIntentProvenanceFile();
+  const provenance = readLocalIntentProvenance();
+  if (!file || !provenance || provenance.id !== id) return;
+  fs.unlinkSync(file);
+  fsyncDirectory(path.dirname(file));
+}
+
+function atomicWriteFile(target, content, createMode = 0o644) {
   const existed = fs.existsSync(target);
-  const mode = existed ? fs.statSync(target).mode & 0o777 : 0o644;
+  const mode = existed ? fs.statSync(target).mode & 0o777 : createMode;
   const temp = path.join(
     path.dirname(target),
     `.${path.basename(target)}.${process.pid}.${crypto.randomUUID()}.tmp`
@@ -3802,6 +3922,101 @@ function absorbGit(baseFile, oursFile, theirsFile, { abandon, dryRun }) {
   });
 }
 
+function appendVerificationSpawnError(file, error) {
+  const stat = fs.statSync(file);
+  let prefix = '';
+  if (stat.size > 0) {
+    const fd = fs.openSync(file, 'r');
+    const lastByte = Buffer.alloc(1);
+    try {
+      fs.readSync(fd, lastByte, 0, 1, stat.size - 1);
+    } finally {
+      fs.closeSync(fd);
+    }
+    if (lastByte[0] !== 0x0a) prefix = '\n';
+  }
+  fs.appendFileSync(file, `${prefix}${error.message}\n`, 'utf8');
+}
+
+function digestAndReplayVerificationOutput(file, writer, hash) {
+  const fd = fs.openSync(file, 'r');
+  const decoder = new StringDecoder('utf8');
+  const buffer = Buffer.allocUnsafe(VERIFICATION_OUTPUT_CHUNK_BYTES);
+  let bytes = 0;
+  let lastCharacter = null;
+
+  const display = (text) => {
+    if (!text) return;
+    writer(text);
+    lastCharacter = text.at(-1);
+  };
+
+  try {
+    while (true) {
+      const count = fs.readSync(fd, buffer, 0, buffer.length, null);
+      if (count === 0) break;
+      const chunk = buffer.subarray(0, count);
+      hash.update(chunk);
+      bytes += count;
+      display(decoder.write(chunk));
+    }
+    display(decoder.end());
+  } finally {
+    fs.closeSync(fd);
+  }
+
+  return { bytes, endsWithNewline: lastCharacter === '\n' };
+}
+
+function executeVerificationCommand(command) {
+  const spool = fs.mkdtempSync(path.join(os.tmpdir(), 'driftseal-verify-'));
+  const stdoutFile = path.join(spool, 'stdout');
+  const stderrFile = path.join(spool, 'stderr');
+  let stdoutFd;
+  let stderrFd;
+
+  try {
+    stdoutFd = fs.openSync(stdoutFile, 'wx', 0o600);
+    stderrFd = fs.openSync(stderrFile, 'wx', 0o600);
+    const started = process.hrtime.bigint();
+    let result;
+    try {
+      result = spawnSync(command, {
+        cwd: process.cwd(),
+        env: process.env,
+        shell: true,
+        stdio: ['ignore', stdoutFd, stderrFd],
+      });
+    } finally {
+      fs.closeSync(stdoutFd);
+      stdoutFd = undefined;
+      fs.closeSync(stderrFd);
+      stderrFd = undefined;
+    }
+    const durationMs = Number((process.hrtime.bigint() - started) / 1000000n);
+    if (result.error) appendVerificationSpawnError(stderrFile, result.error);
+
+    const hash = crypto.createHash('sha256');
+    const stdout = digestAndReplayVerificationOutput(stdoutFile, writeOutput, hash);
+    if (stdout.bytes > 0 && !stdout.endsWithNewline) printLine();
+    hash.update('\0');
+    const stderr = digestAndReplayVerificationOutput(stderrFile, writeErrorOutput, hash);
+    if (stderr.bytes > 0 && !stderr.endsWithNewline) printError();
+
+    return {
+      result,
+      durationMs,
+      outputHash: hash.digest('hex'),
+      stdoutBytes: stdout.bytes,
+      stderrBytes: stderr.bytes,
+    };
+  } finally {
+    if (stdoutFd !== undefined) fs.closeSync(stdoutFd);
+    if (stderrFd !== undefined) fs.closeSync(stderrFd);
+    fs.rmSync(spool, { recursive: true, force: true });
+  }
+}
+
 function runMachineVerification({ allowTrackedCommand = false } = {}) {
   const snapshot = withMutationLocks([logDir()], () => {
     const intent = openIntent(fold(readEvents({ repairTail: true })));
@@ -3811,56 +4026,31 @@ function runMachineVerification({ allowTrackedCommand = false } = {}) {
     }
     if (!intent.verify) fail(`intent ${intent.id} has no verification command`);
     const park = inProgressFile();
-    const parked = park && fs.existsSync(park) ? parkedOpenIntent(park) : null;
+    const parked = park ? parkedOpenIntent(park) : null;
+    const locallyProvenanced = hasMatchingLocalIntentProvenance(intent);
     return {
       id: intent.id,
       command: intent.verify,
-      fromTrackedLog: isParkableIntentLog() && (!parked || parked.id !== intent.id),
+      requiresExplicitTrust:
+        (!parked || parked.id !== intent.id) && !locallyProvenanced,
     };
   });
 
   const displayedCommand = JSON.stringify(snapshot.command);
   printError(`verification command: ${displayedCommand}`);
-  if (snapshot.fromTrackedLog && !allowTrackedCommand) {
+  if (snapshot.requiresExplicitTrust && !allowTrackedCommand) {
     fail(
-      `refusing to execute a verification command sourced from the repository intent log: ${displayedCommand}\n` +
+      `refusing to execute a verification command that DriftSeal cannot confirm was created locally: ${displayedCommand}\n` +
+        'no matching local intent provenance was found; ' +
         'inspect the command, then re-run with --allow-tracked-command only if you trust it'
     );
   }
 
-  const started = process.hrtime.bigint();
-  const result = spawnSync(snapshot.command, {
-    cwd: process.cwd(),
-    env: process.env,
-    shell: true,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    maxBuffer: 16 * 1024 * 1024,
-  });
-  const durationMs = Number((process.hrtime.bigint() - started) / 1000000n);
-  const stdout = result.stdout || '';
-  let stderr = result.stderr || '';
-  if (result.error) {
-    stderr += `${stderr && !stderr.endsWith('\n') ? '\n' : ''}${result.error.message}\n`;
-  }
-  if (stdout) {
-    writeOutput(stdout);
-    if (!stdout.endsWith('\n')) printLine();
-  }
-  if (stderr) {
-    writeErrorOutput(stderr);
-    if (!stderr.endsWith('\n')) printError();
-  }
-
+  const execution = executeVerificationCommand(snapshot.command);
+  const { result, durationMs, outputHash, stdoutBytes, stderrBytes } = execution;
   const exitCode = Number.isInteger(result.status) ? result.status : 1;
   const signal = typeof result.signal === 'string' ? result.signal : null;
   const passed = exitCode === 0 && signal === null;
-  const outputHash = crypto
-    .createHash('sha256')
-    .update(stdout, 'utf8')
-    .update('\0')
-    .update(stderr, 'utf8')
-    .digest('hex');
   const verificationEvent = {
     type: 'verify',
     id: snapshot.id,
@@ -3872,8 +4062,8 @@ function runMachineVerification({ allowTrackedCommand = false } = {}) {
     signal,
     durationMs,
     outputHash,
-    stdoutBytes: Buffer.byteLength(stdout),
-    stderrBytes: Buffer.byteLength(stderr),
+    stdoutBytes,
+    stderrBytes,
     workspace: workspaceFingerprint(),
     head: gitCapture(['rev-parse', 'HEAD']),
   };
@@ -4727,7 +4917,15 @@ function runCommand(argv, { root = process.cwd(), isolateStorage = false, captur
   const previousIntentHome = process.env.DRIFTSEAL_HOME;
   const previousDecisionHome = process.env.DRIFTSEAL_DECISION_HOME;
   const output = { stdout: '', stderr: '', data: null, exitCode: 0, readOnly: false };
+  const captures = capture
+    ? { stdout: createBoundedOutputCapture(), stderr: createBoundedOutputCapture() }
+    : null;
   const previousOutput = activeOutput;
+  const finalizeCapturedOutput = () => {
+    if (!captures) return;
+    output.stdout = renderBoundedOutput(captures.stdout);
+    output.stderr = renderBoundedOutput(captures.stderr);
+  };
 
   try {
     process.chdir(fixedRoot);
@@ -4735,14 +4933,16 @@ function runCommand(argv, { root = process.cwd(), isolateStorage = false, captur
       delete process.env.DRIFTSEAL_HOME;
       delete process.env.DRIFTSEAL_DECISION_HOME;
     }
-    if (capture) activeOutput = output;
+    if (capture) activeOutput = captures;
     const result = dispatch(argv);
     output.data = result.data;
     output.exitCode = result.exitCode;
     output.readOnly = result.readOnly === true;
+    finalizeCapturedOutput();
     return output;
   } catch (err) {
     if (capture) {
+      finalizeCapturedOutput();
       err.stdout = output.stdout;
       err.stderr = output.stderr;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftseal",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Seal intent, verification, and decisions into an auditable workflow for agentic coding",
   "keywords": [
     "driftseal",