enigma-memory 0.1.12 → 0.1.14

package/scripts/build-proof-network-packet.mjs

@@ -15,7 +15,7 @@ import {
   validateProofNetworkPacket,
 } from '../packages/proof-network/src/index.js';
 
-export const PROOF_NETWORK_PACKET_RELEASE_TARGET = '0.1.12';
+export const PROOF_NETWORK_PACKET_RELEASE_TARGET = '0.1.14';
 
 const HASH_RE = /^(?:sha256:)?[a-f0-9]{64}$/iu;
 const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|\b(?:raw[\s_-]*memory|plaintext[\s_-]*prompts?|plain[\s_-]*text[\s_-]*prompts?|private[\s_-]*prompts?|provider[\s_-]*responses?|full[\s_-]*transcript|decrypted[\s_-]*memory|credentials?|secrets?|passwords?|private[\s_-]*keys?|api[\s_-]*key[\s_-]*(?:secret|material|value)|api[\s_-]*secrets?|access[\s_-]*tokens?|refresh[\s_-]*tokens?|token[\s_-]*values?|credential[\s_-]*material|tenant[\s_-]*names?)\b)/iu;

package/scripts/install-enigma-local.mjs

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+import { execFile } from 'node:child_process';
+import { mkdir } from 'node:fs/promises';
+import { dirname, isAbsolute, resolve as resolvePath } from 'node:path';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+
+export const INSTALLER_SCHEMA = 'enigma.local_installer.v1';
+export const REQUIRED_NODE_MAJOR = 24;
+export const DEFAULT_BUNDLE_PATH = '.enigma/bundle.json';
+
+const execFileAsync = promisify(execFile);
+const SCRIPT_PATH = fileURLToPath(import.meta.url);
+const DEFAULT_PACKAGE_DIR = resolvePath(dirname(SCRIPT_PATH), '..');
+const SAFE_COMMAND_RE = /^[A-Za-z0-9._-]+$/u;
+
+function readRequiredValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (value === undefined || value.startsWith('--')) throw new Error(`Missing value for ${flag}.`);
+  return value;
+}
+
+export function usage() {
+  return `Usage: node scripts/install-enigma-local.mjs [--dry-run|--execute] [--init-vault] [--bundle <path>]\n\nDry-run is the default. Execute mode runs npm install -g . from the local checkout.\nNo network download command is generated, and vault initialization runs only when --init-vault is present.\n`;
+}
+
+export function parseInstallerArgs(argv = process.argv.slice(2)) {
+  const options = {
+    dryRun: true,
+    execute: false,
+    initVault: false,
+    bundlePath: DEFAULT_BUNDLE_PATH,
+    packageDir: DEFAULT_PACKAGE_DIR,
+    subject: 'local-user',
+    displayName: 'Local user',
+  };
+  let sawDryRun = false;
+  let sawExecute = false;
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--help' || arg === '-h') {
+      options.help = true;
+    } else if (arg === '--dry-run') {
+      sawDryRun = true;
+      options.dryRun = true;
+      options.execute = false;
+    } else if (arg === '--execute') {
+      sawExecute = true;
+      options.dryRun = false;
+      options.execute = true;
+    } else if (arg === '--init-vault') {
+      options.initVault = true;
+    } else if (arg === '--no-init-vault') {
+      options.initVault = false;
+    } else if (arg === '--bundle') {
+      options.bundlePath = readRequiredValue(argv, index, arg);
+      index += 1;
+    } else if (arg === '--package-dir') {
+      options.packageDir = readRequiredValue(argv, index, arg);
+      index += 1;
+    } else if (arg === '--subject') {
+      options.subject = readRequiredValue(argv, index, arg);
+      index += 1;
+    } else if (arg === '--display-name') {
+      options.displayName = readRequiredValue(argv, index, arg);
+      index += 1;
+    } else {
+      throw new Error('Unknown argument.');
+    }
+  }
+
+  if (sawDryRun && sawExecute) throw new Error('Use either --dry-run or --execute, not both.');
+  return options;
+}
+
+export function nodeMajor(version) {
+  const match = String(version ?? '').trim().match(/^v?(\d+)(?:\.\d+){0,2}(?:[-+].*)?$/u);
+  if (!match) throw new Error('Invalid Node version override.');
+  return Number(match[1]);
+}
+
+export function validateNodeVersion(version = process.versions.node, requiredMajor = REQUIRED_NODE_MAJOR) {
+  const major = nodeMajor(version);
+  if (!Number.isSafeInteger(major) || major < requiredMajor) {
+    throw new Error(`Node >=${requiredMajor} is required for the local Enigma installer.`);
+  }
+  return { ok: true, required: `>=${requiredMajor}`, current_major: major };
+}
+
+function commandForPlatform(base, platform) {
+  return platform === 'win32' ? `${base}.cmd` : base;
+}
+
+function rejectUnsafeArg(arg, label) {
+  const value = String(arg ?? '');
+  if (value.length === 0) throw new Error(`${label} must not be empty.`);
+  if (value.includes('\0') || value.includes('\n') || value.includes('\r')) throw new Error(`${label} contains an invalid control character.`);
+}
+
+export function validateCommandSpec(spec) {
+  if (!spec || typeof spec !== 'object' || Array.isArray(spec)) throw new Error('Installer command spec must be an object.');
+  const command = String(spec.command ?? '');
+  if (!SAFE_COMMAND_RE.test(command)) throw new Error('Installer command name is not safe.');
+  const args = Array.isArray(spec.args) ? spec.args.map(String) : [];
+  for (const [index, arg] of args.entries()) rejectUnsafeArg(arg, `Installer command argument ${index}`);
+
+  if (command === 'npm' || command === 'npm.cmd') {
+    if (args.length !== 3 || args[0] !== 'install' || args[1] !== '-g' || args[2] !== '.') {
+      throw new Error('Installer npm command must be exactly npm install -g .');
+    }
+    return true;
+  }
+
+  if (command === 'enigma' || command === 'enigma.cmd') {
+    const bundleIndex = args.indexOf('--bundle');
+    if (args[0] !== 'init' || bundleIndex === -1 || bundleIndex + 1 >= args.length) {
+      throw new Error('Installer Enigma command must initialize a bundle with --bundle.');
+    }
+    return true;
+  }
+
+  throw new Error('Installer command is not allowlisted.');
+}
+
+function publicCommand(command) {
+  if (command.step === 'install_package') return { command: 'npm', args: ['install', '-g', '.'] };
+  return { command: 'enigma', args: ['init', '--bundle', '<bundle-path>', '--subject', '<subject>', '--display-name', '<display-name>'] };
+}
+
+export function buildInstallerPlan(options = {}, runtime = {}) {
+  const platform = runtime.platform ?? process.platform;
+  const cwd = runtime.cwd ?? process.cwd();
+  const requestedPackageDir = String(options.packageDir ?? DEFAULT_PACKAGE_DIR);
+  rejectUnsafeArg(requestedPackageDir, 'Package directory');
+  const packageDir = resolvePath(requestedPackageDir);
+  const requestedBundlePath = String(options.bundlePath ?? DEFAULT_BUNDLE_PATH);
+  rejectUnsafeArg(requestedBundlePath, 'Bundle path');
+  const bundlePath = isAbsolute(requestedBundlePath) ? resolvePath(requestedBundlePath) : resolvePath(cwd, requestedBundlePath);
+
+  const commands = [
+    {
+      step: 'install_package',
+      command: commandForPlatform('npm', platform),
+      args: ['install', '-g', '.'],
+      cwd: packageDir,
+      mutates_global_state: true,
+    },
+  ];
+
+  if (options.initVault === true) {
+    commands.push({
+      step: 'initialize_vault',
+      command: commandForPlatform('enigma', platform),
+      args: ['init', '--bundle', bundlePath, '--subject', String(options.subject ?? 'local-user'), '--display-name', String(options.displayName ?? 'Local user')],
+      cwd: packageDir,
+      mutates_local_filesystem: true,
+    });
+  }
+
+  for (const command of commands) validateCommandSpec(command);
+
+  return {
+    dryRun: options.execute === true ? false : true,
+    execute: options.execute === true,
+    packageDir,
+    bundlePath,
+    bundlePathKind: requestedBundlePath === DEFAULT_BUNDLE_PATH ? 'default' : (isAbsolute(requestedBundlePath) ? 'absolute' : 'relative'),
+    initVault: options.initVault === true,
+    commands,
+  };
+}
+
+function publicCommandRecords(plan, resultByStep = new Map()) {
+  return plan.commands.map((command) => {
+    const publicSpec = publicCommand(command);
+    const runResult = resultByStep.get(command.step);
+    return {
+      step: command.step,
+      command: publicSpec.command,
+      args: publicSpec.args,
+      status: plan.execute ? (runResult?.ok ? 'executed' : 'pending') : 'preview',
+      mutates: command.mutates_global_state === true ? 'global_npm_install' : 'local_bundle_file',
+    };
+  });
+}
+
+function publicOutput(plan, node, commandResults = []) {
+  const resultByStep = new Map(commandResults.map((result) => [result.step, result]));
+  const commands = publicCommandRecords(plan, resultByStep);
+  return {
+    schema: INSTALLER_SCHEMA,
+    ok: commandResults.every((result) => result.ok !== false),
+    mode: plan.execute ? 'execute' : 'dry-run',
+    dry_run: plan.dryRun,
+    execute: plan.execute,
+    public_safe: true,
+    node,
+    package_source: {
+      kind: 'local_checkout',
+      install_boundary: 'Runs npm install -g . against the checked-out package only; it does not download Enigma from a registry.',
+    },
+    bundle: {
+      path: '<bundle-path>',
+      path_kind: plan.bundlePathKind,
+      initialize_requested: plan.initVault,
+      initialized: plan.execute && plan.initVault && resultByStep.get('initialize_vault')?.ok === true,
+    },
+    commands,
+    preview: {
+      commands,
+    },
+    safety: {
+      default_dry_run: true,
+      requires_execute_for_mutation: true,
+      shell: false,
+      network_download_command: false,
+      prints_local_absolute_paths: false,
+      prints_secrets: false,
+    },
+  };
+}
+
+async function runCommand(command, execFileImpl) {
+  try {
+    await execFileImpl(command.command, command.args, { cwd: command.cwd, windowsHide: true });
+    return { step: command.step, ok: true };
+  } catch {
+    throw new Error(`Installer command failed at ${command.step}.`);
+  }
+}
+
+export async function runInstallEnigmaLocal(argv = process.argv.slice(2), runtime = {}) {
+  const options = Array.isArray(argv) ? parseInstallerArgs(argv) : { ...argv };
+  const node = validateNodeVersion(options.nodeVersion ?? runtime.nodeVersion ?? process.versions.node);
+  const plan = buildInstallerPlan(options, runtime);
+  if (plan.dryRun) return publicOutput(plan, node);
+
+  const mkdirImpl = runtime.mkdirImpl ?? mkdir;
+  if (options.initVault === true) await mkdirImpl(dirname(plan.bundlePath), { recursive: true });
+  const execFileImpl = runtime.execFileImpl ?? execFileAsync;
+  const commandResults = [];
+  for (const command of plan.commands) {
+    commandResults.push(await runCommand(command, execFileImpl));
+  }
+  return publicOutput(plan, node, commandResults);
+}
+
+function safeErrorMessage(error) {
+  const message = String(error?.message ?? error);
+  if (/^(Missing value|Unknown argument|Use either|Invalid Node version|Node >=|Installer command)/u.test(message)) return message;
+  return 'Local Enigma installer failed.';
+}
+
+async function main() {
+  const args = parseInstallerArgs();
+  if (args.help) {
+    process.stdout.write(usage());
+    return;
+  }
+  const output = await runInstallEnigmaLocal(args);
+  process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolvePath(process.argv[1])) {
+  main().catch((error) => {
+    process.stdout.write(`${JSON.stringify({ schema: INSTALLER_SCHEMA, ok: false, public_safe: true, error: { code: 'LOCAL_INSTALLER_FAILED', message: safeErrorMessage(error) } }, null, 2)}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/release-audit.mjs

@@ -136,6 +136,10 @@ const KUBERNETES_BACKEND_MANIFEST = resolve(PROJECT_ROOT, 'deploy', 'kubernetes'
 const ENIGMA_INFRASTRUCTURE_READINESS_MANIFEST = 'ENIGMA_INFRASTRUCTURE_READINESS_MANIFEST';
 const ENIGMA_INFRASTRUCTURE_READINESS_LIVE = 'ENIGMA_INFRASTRUCTURE_READINESS_LIVE';
 const SECRET_LOOKING_OUTPUT = /(?:Authorization:\s*Bearer\s+[A-Za-z0-9._~+/=-]{8,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|["']?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|secret|password|private[_-]?key)["']?\s*[:=]\s*["']?[A-Za-z0-9._~+/=-]{16,})/i;
+const TEST_FAILURE_SUMMARY_LIMIT = 8;
+const TEST_OUTPUT_TAIL_LINE_LIMIT = 18;
+const TEST_OUTPUT_TAIL_CHAR_LIMIT = 280;
+const REDACTED_DIAGNOSTIC_LINE = '<redacted secret-looking output>';
 
 function npmInvocation(args) {
   const label = commandLabel('npm', args);
@@ -235,6 +239,68 @@ function tapCounts(output) {
   return counts;
 }
 
+function sanitizeDiagnosticLine(value) {
+  const scrubbed = scrubLocalPathText(value)
+    .replace(/file:\/\/(?=<(?:project-root|public-site-package|temp|user-home|home)>)/g, '')
+    .replace(/[A-Za-z]:\/[^\s'"`),]+/g, '<path>')
+    .replace(/(?:file:\/\/)?\/(?:Users|home|tmp|private\/var|var\/folders)\/[^\s'"`),]+/g, '<path>')
+    .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, '<email>')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!scrubbed) return '';
+  if (
+    SECRET_LOOKING_OUTPUT.test(scrubbed)
+    || RAW_MEMORY_EXAMPLE_FIELD.test(scrubbed)
+    || scrubbed.includes(RAW_MEMORY_SENTINEL)
+  ) return REDACTED_DIAGNOSTIC_LINE;
+  return scrubbed.length > TEST_OUTPUT_TAIL_CHAR_LIMIT
+    ? `${scrubbed.slice(0, TEST_OUTPUT_TAIL_CHAR_LIMIT - 1)}…`
+    : scrubbed;
+}
+
+function diagnosticLines(value) {
+  return String(value).split(/\r?\n/).map(sanitizeDiagnosticLine).filter(Boolean);
+}
+
+function diagnosticMessage(value) {
+  return diagnosticLines(value)[0] ?? 'Command failed.';
+}
+
+function failingTestNames(output) {
+  const names = [];
+  for (const line of diagnosticLines(output)) {
+    const tapMatch = line.match(/^not ok \d+ - (.+)$/);
+    const prettyMatch = line.match(/^✖\s+(.+?)(?:\s+\(\d+(?:\.\d+)?ms\))?$/u);
+    const name = tapMatch?.[1] ?? prettyMatch?.[1] ?? null;
+    if (!name || names.includes(name)) continue;
+    names.push(name);
+    if (names.length >= TEST_FAILURE_SUMMARY_LIMIT) break;
+  }
+  return names;
+}
+
+function diagnosticTail(stdout, stderr) {
+  const stdoutLines = diagnosticLines(stdout);
+  if (stdoutLines.length > 0) {
+    return { key: 'stdout_tail', lines: stdoutLines.slice(-TEST_OUTPUT_TAIL_LINE_LIMIT) };
+  }
+  const stderrLines = diagnosticLines(stderr);
+  if (stderrLines.length > 0) {
+    return { key: 'stderr_tail', lines: stderrLines.slice(-TEST_OUTPUT_TAIL_LINE_LIMIT) };
+  }
+  return null;
+}
+
+export function summarizeNpmTestFailure(stdout, stderr) {
+  const combined = `${stdout}\n${stderr}`;
+  const summary = { tap: tapCounts(combined) };
+  const failed = failingTestNames(combined);
+  const tail = diagnosticTail(stdout, stderr);
+  if (failed.length > 0) summary.failing_tests = failed;
+  if (tail) summary[tail.key] = tail.lines;
+  return summary;
+}
+
 function summarizeCheck(stdout) {
   const line = lines(stdout).find((item) => item.includes('enigma check ok')) ?? lines(stdout).at(-1) ?? '';
   return { message: line };
@@ -490,9 +556,12 @@ async function runCommandGate(name, command, args, options = {}) {
     gate.signal = error.signal ?? null;
     gate.stderr_bytes = Buffer.byteLength(error.stderr ?? '');
     gate.stdout_bytes = Buffer.byteLength(error.stdout ?? '');
+    if (options.summarizeFailure) {
+      gate.evidence = await options.summarizeFailure(error.stdout ?? '', error.stderr ?? '');
+    }
     gate.error = {
       code: error.killed ? 'COMMAND_TIMEOUT' : (error.code ?? 'COMMAND_FAILED'),
-      message: error.message,
+      message: options.summarizeFailure ? diagnosticMessage(error.message) : error.message,
     };
     if (gate.status === 0) {
       gate.error.code = 'OUTPUT_VALIDATION_FAILED';
@@ -5484,7 +5553,7 @@ export async function runReleaseAudit() {
   const test = await nodeTestInvocation();
   const pack = npmInvocation(['pack', '--dry-run']);
   gates.push(await runCommandGate('npm-check', check.command, check.args, { label: check.label, summarize: summarizeCheck }));
-  gates.push(await runCommandGate('npm-test', test.command, test.args, { label: test.label, timeoutMs: TEST_TIMEOUT_MS, summarize: summarizeTests }));
+  gates.push(await runCommandGate('npm-test', test.command, test.args, { label: test.label, timeoutMs: TEST_TIMEOUT_MS, summarize: summarizeTests, summarizeFailure: summarizeNpmTestFailure }));
   gates.push(await runCommandGate('npm-pack-dry-run', pack.command, pack.args, { label: pack.label, summarize: summarizePack }));
   gates.push(await runDirectBinSmokes());
   gates.push(await runNativeHostInstallPlanGate());

package/scripts/run-standard-memory-benchmarks.mjs

@@ -995,7 +995,7 @@ function buildSuiteReport(datasetRows, topK, options) {
     generated_at: options.generated_at ?? new Date().toISOString(),
     package: {
       name: 'enigma-memory',
-      version: '0.1.12',
+      version: '0.1.14',
     },
     public_safe: true,
     top_k: topK,

package/scripts/verify-registry-install.mjs

@@ -24,6 +24,7 @@ export const DEFAULT_REGISTRY_VERSION = PACKAGE_JSON.version;
 export const REGISTRY_INSTALL_CHECKS = Object.freeze([
   Object.freeze({ step: 'check_enigma_help', bin: 'enigma', args: Object.freeze(['--help']) }),
   Object.freeze({ step: 'check_enigma_doctor', bin: 'enigma', args: Object.freeze(['doctor']) }),
+  Object.freeze({ step: 'check_enigma_test_drive_dry_run', bin: 'enigma', args: Object.freeze(['test-drive', '--dry-run']) }),
   Object.freeze({ step: 'check_enigma_relay_demo', bin: 'enigma-relay', args: Object.freeze(['demo']) }),
   Object.freeze({ step: 'check_enigma_gateway_demo', bin: 'enigma-gateway', args: Object.freeze(['demo']) }),
 ]);

package/scripts/wait-for-backend-ready.mjs

@@ -5,9 +5,11 @@
 import https from 'node:https'
 import { parseArgs } from 'node:util'
 
+const RELAY_PORT = process.env.ENIGMA_SIM_RELAY_PORT || '8443'
+const GATEWAY_PORT = process.env.ENIGMA_SIM_GATEWAY_PORT || '9443'
 const ENDPOINTS = [
-  { name: 'relay', url: 'https://localhost:8443/readyz' },
-  { name: 'gateway', url: 'https://localhost:9443/readyz' },
+  { name: 'relay', url: `https://localhost:${RELAY_PORT}/readyz` },
+  { name: 'gateway', url: `https://localhost:${GATEWAY_PORT}/readyz` },
 ]
 
 function parseCliArgs(argv) {