dsh-codex-style-computer-use 1.3.1 → 2.0.0

package/lib/core/native-runtime.js

@@ -8,6 +8,23 @@ import { execFileSync } from 'node:child_process'
 
 const hash = bytes => createHash('sha256').update(bytes).digest('hex')
 const fileHash = file => hash(fs.readFileSync(file))
+export const WORKER_PROTOCOL_VERSION = 2
+
+// Identity comes from the exact executable selected for this worker. A custom
+// executable without a verified manifest stays explicitly unverified.
+export function nativeRuntimeIdentity (binary) {
+  let packageVersion = 'unknown'
+  try { packageVersion = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version } catch {}
+  const binaryHash = fileHash(binary)
+  let manifest
+  try { manifest = JSON.parse(fs.readFileSync(`${binary}.json`, 'utf8')) } catch {}
+  const verified = manifest?.format === 1 && manifest?.platform === 'win32' && manifest?.architecture === 'x64' &&
+    /^[a-f0-9]{64}$/.test(manifest?.sourceSha256 || '') && manifest?.binarySha256 === binaryHash
+  const sourceHash = verified ? manifest.sourceSha256 : null
+  return { packageVersion, protocolVersion: WORKER_PROTOCOL_VERSION, sourceHash, binaryHash,
+    buildId: `${packageVersion}:${sourceHash?.slice(0, 16) || 'unverified'}:${binaryHash.slice(0, 16)}`,
+    verified: !!verified }
+}
 const framework = env => path.join(env.SystemRoot || env.windir || 'C:\\Windows', 'Microsoft.NET', 'Framework64', 'v4.0.30319')
 
 export function workerReferences (env = process.env) {