fraim 2.0.344 → 2.0.345

package/dist/src/local-mcp-server/learning-source-record.js

@@ -22,7 +22,7 @@ function safePart(value) {
     return Boolean(value) && value !== '.' && value !== '..' && !/[\\/:*?"<>|\x00-\x1f]/.test(value)
         && value.trim() === value && !/[. ]$/.test(value);
 }
-/** Explicit paths keep parsing pure; otherwise resolve the owning configuration. Callers guard physical source containment. */
+/** Resolve only within the supplied owner. Callers guard physical source containment. */
 function parseLearningSourceRecord(content, filePath, homeRoot, contentRoot, configuredPaths) {
     const invalid = (reason) => ({ status: 'invalid', reason });
     const normalized = content.replace(/^\uFEFF/, '');
@@ -49,7 +49,7 @@ function parseLearningSourceRecord(content, filePath, homeRoot, contentRoot, con
     for (const line of fm[1].split(/\r?\n/)) {
         const match = /^([A-Za-z][A-Za-z0-9]*):[ \t]*(.*)$/.exec(line);
         if (!match) {
-            if (/^\s*["']?(artifactKind|author|date|job|runId|usageSourceRef|synthesized)["']?\s*:/.test(line))
+            if (/^\s*["']?(artifactKind|author|date|job|runId|sourceId|usageSourceRef|synthesized)["']?\s*:/.test(line))
                 malformedField = true;
             continue;
         }
@@ -76,7 +76,7 @@ function parseLearningSourceRecord(content, filePath, homeRoot, contentRoot, con
         return invalid('Unsupported metadata key spelling');
     if (duplicates.size)
         return invalid(`Duplicate metadata: ${[...duplicates].join(', ')}`);
-    for (const field of ['author', 'date', 'job', 'runId', 'usageSourceRef', 'synthesized']) {
+    for (const field of ['author', 'date', 'job', 'runId', 'sourceId', 'usageSourceRef', 'synthesized']) {
         if (!Object.prototype.hasOwnProperty.call(fields, field))
             return invalid(`Missing metadata: ${field}`);
     }
@@ -110,13 +110,22 @@ function parseLearningSourceRecord(content, filePath, homeRoot, contentRoot, con
         return invalid('Source is outside its configured learning location');
     if (state === 'archived' && !fields.synthesized)
         return invalid('Archive has no successful processing date');
-    if (!node_path_1.default.isAbsolute(fields.usageSourceRef) || /[\x00-\x1f]/.test(fields.usageSourceRef)
-        || fields.usageSourceRef.includes('\\')
-        || fields.usageSourceRef !== node_path_1.default.resolve(fields.usageSourceRef).replace(/\\/g, '/')
-        || normalizeLearningSourcePath(fields.usageSourceRef) !== normalizeLearningSourcePath(pendingPath)) {
-        return invalid('usageSourceRef must be the normalized absolute original pending path');
+    const reference = fields.usageSourceRef;
+    const relative = node_path_1.default.relative(homeRoot, pendingPath).replace(/\\/g, '/');
+    if (!relative || relative.split('/').some(part => !part || part === '.' || part === '..') || node_path_1.default.isAbsolute(relative))
+        return invalid('Source escapes its owning root');
+    if (!reference || /[\x00-\x1f]/.test(reference) || reference.includes('\\'))
+        return invalid('Invalid usageSourceRef');
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(fields.sourceId)) {
+        return invalid('Sources require an immutable sourceId UUID');
+    }
+    if (node_path_1.default.posix.isAbsolute(reference) || node_path_1.default.win32.isAbsolute(reference) || reference.includes(':')
+        || reference.split('/').some(part => !part || part === '.' || part === '..') || reference !== relative) {
+        return invalid('usageSourceRef must name the owner-relative pending path');
     }
     return { status: 'valid', record: { artifactKind: fields.artifactKind, kind, author: fields.author,
             date: fields.date, job: fields.job, runId: fields.runId, usageSourceRef: fields.usageSourceRef,
+            usageIdentity: `learning-source:${fields.sourceId}`,
+            sourceId: fields.sourceId,
             synthesized: fields.synthesized, pendingPath, archivePath, state } };
 }

package/dist/src/local-mcp-server/learning-usage-attestation.js

@@ -213,14 +213,14 @@ function runBackfill(workspaceRoot, userId, options) {
                 const { record } = parsed;
                 if (record.kind !== 'retrospective' || record.author !== userId)
                     continue;
-                if (seen.has(record.usageSourceRef))
+                if (seen.has(record.usageIdentity))
                     continue;
-                seen.add(record.usageSourceRef);
+                seen.add(record.usageIdentity);
                 report.filesScanned++;
                 if (record.synthesized)
                     report.synthesizedFilesRead++;
                 const result = recordAttestationsFromRetrospective(workspaceRoot, userId, {
-                    content: parsed.content, source: record.usageSourceRef, job: record.job, date: record.date,
+                    content: parsed.content, source: record.usageIdentity, job: record.job, date: record.date,
                     agent: options.agent, model: options.model, legacy: false,
                     limits, now: options.now, storePath: options.storePath, integrityMode: 'flag',
                 });

package/dist/src/local-mcp-server/learning-usage-command.js

@@ -135,7 +135,7 @@ const recordFiringsCommand = addCommonOptions(new commander_1.Command('record-fi
         throw new Error(`Retrospective not found: ${filePath}`);
     }
     const { content, record } = (0, learning_usage_attestation_1.readRetrospectiveForAttestation)(workspaceRoot, user, filePath);
-    const source = record.usageSourceRef;
+    const source = record.usageIdentity;
     const result = (0, learning_usage_attestation_1.recordAttestationsFromRetrospective)(workspaceRoot, user, {
         content,
         source,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.344",
+  "version": "2.0.345",
   "description": "FRAIM core CLI and MCP package.",
   "main": "index.js",
   "bin": {