jorgex-stack 1.9.58 → 1.9.59

package/README.md

@@ -146,9 +146,9 @@ Install, sync and uninstall back up every managed file before changing it and ar
 
 The package owns Pi's native primary-model projection: `openai-codex/gpt-5.6-sol`, with a local `contextWindow` request of 872K. It merges only missing compatible fields, records field ownership in `PI_CODING_AGENT_DIR/jorgex-pi/sol-lifecycle.v1.json`, and cleanup removes only still-owned canonical values. Stack does not duplicate that package-owned settings/models logic. The 872K value is local OAuth metadata until a real long-context smoke test confirms backend acceptance; it is not the API context limit.
 
-Engram remains mandatory and user-owned. An existing binary is preserved. `install` resolves or installs the verified official v2.0.0 release before configuring any selected runtime; use `--engram` to authorize that download in non-interactive flows. The release installer writes only `~/.local/bin/engram` (or the platform equivalent), checks the pinned size and SHA-256, and does not use Brew or Go. `sync`, dry-run and `--target-dir` never download it. The database and memories are never updated or deleted, and uninstall preserves the official Engram artifacts and never removes the Engram binary. Under `--target-dir`, Stack accepts only `<target>/bin/engram`, isolates Pi/Home/XDG/AppData/temp/npm-cache paths inside the target, and never consults the host Engram or Pi configuration.
+Engram remains mandatory and user-owned. An existing binary is always preserved. When it is missing and the user authorizes installation, Stack resolves GitHub's current official latest stable release at runtime; GitHub's `releases/latest` endpoint excludes prereleases and drafts, and the installer never uses a branch. It matches the exact platform/architecture asset and validates its live metadata —published state, expected name, positive size and SHA-256— before publishing; missing network or metadata fails closed, with no static or offline fallback. Use `--engram` to authorize that download in non-interactive flows. The release installer writes only `~/.local/bin/engram` (or the platform equivalent) and does not use Brew or Go. `sync`, dry-run and `--target-dir` never download it. Update remains explicit and does not replace an existing binary implicitly. The database and memories are never updated or deleted, and uninstall preserves the official Engram artifacts and never removes the Engram binary. Under `--target-dir`, Stack accepts only `<target>/bin/engram`, isolates Pi/Home/XDG/AppData/temp/npm-cache paths inside the target, and never consults the host Engram or Pi configuration. This rolling channel does not mean that every upstream release was pre-reviewed by Stack.
 
-An existing binary older than stable 2.0.0 would make Claude's setup write the obsolete `mcp/engram.json`, so the Claude preflight blocks it before setup and recommends updating to Engram 2.0.0+ and rerunning `install`. Stack never replaces an existing binary automatically. The official Claude plugin contributes hooks and its skill; `engram setup claude-code` registers a separate user-scoped MCP, not a bundled MCP. This integration does not claim an authenticated model-tool smoke.
+Claude's official plugin still requires stable Engram 2.0.0 or newer: an existing binary below that minimum would make its setup write the obsolete `mcp/engram.json`, so the Claude preflight blocks it before setup. Stack never replaces an existing binary automatically; update it explicitly and rerun `install`. The official Claude plugin contributes hooks and its skill; `engram setup claude-code` registers a separate user-scoped MCP, not a bundled MCP. This integration does not claim an authenticated model-tool smoke.
 
 ### Integración oficial de Engram
 

package/dist/cli.js

@@ -3180,16 +3180,28 @@ function githubHeaders() {
     ...authHeaders()
   };
 }
+var ENGRAM_REPO = "Gentleman-Programming/engram";
+var ENGRAM_RELEASES_LATEST_URL = `https://api.github.com/repos/${ENGRAM_REPO}/releases/latest`;
+var ENGRAM_DOWNLOAD_PREFIX = `https://github.com/${ENGRAM_REPO}/releases/download/`;
+function expectedEngramAssetName(version, platform, arch) {
+  const osPart = platform === "win32" ? "windows" : platform === "linux" ? "linux" : platform === "darwin" ? "darwin" : null;
+  const archPart = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : null;
+  if (osPart === null || archPart === null) return null;
+  const ext = osPart === "windows" ? "zip" : "tar.gz";
+  return `engram_${version}_${osPart}_${archPart}.${ext}`;
+}
+async function fetchLatestGithubRelease(repo, fetchFn = globalThis.fetch) {
+  const res = await fetchFn(`https://api.github.com/repos/${repo}/releases/latest`, {
+    headers: githubHeaders(),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok && (res.status === 403 || res.status === 429)) rateLimitHit = true;
+  return res;
+}
 async function latestGithubRelease(repo) {
   try {
-    const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
-      headers: githubHeaders(),
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) {
-      if (res.status === 403 || res.status === 429) rateLimitHit = true;
-      return null;
-    }
+    const res = await fetchLatestGithubRelease(repo);
+    if (!res.ok) return null;
     const data = await res.json();
     return data.tag_name?.replace(/^v/, "") ?? null;
   } catch {
@@ -4603,16 +4615,16 @@ async function resolvePiEngramRequirement(input, deps) {
     };
   }
   const accepted = await deps.confirm({
-    message: "Engram es obligatorio para JorgeX Pi. \xBFInstalar ahora el binario mediante el canal nativo?",
+    message: "Engram es obligatorio para JorgeX Pi. \xBFInstalar ahora el binario oficial verificado?",
     initialValue: false
   });
   if (!accepted) return { kind: "offer", accepted: false };
-  const installed = await deps.installNative({ version: "2.0.0", channels: ["brew", "go", "url"] });
-  if (!installed) {
+  const installed = await deps.installShared();
+  if (!installed.ok) {
     return {
       kind: "blocked",
       reason: "engram-install-failed",
-      remedy: "Instala Engram manualmente o configura ENGRAM_BIN antes de reintentar."
+      remedy: `La instalaci\xF3n de Engram fall\xF3: ${installed.reason} Instala Engram manualmente o configura ENGRAM_BIN antes de reintentar.`
     };
   }
   const detected = deps.detectHost();
@@ -5657,45 +5669,9 @@ import os5 from "os";
 import path25 from "path";
 import { execFileSync as execFileSync6 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-
-// src/lib/engram-release.json
-var engram_release_default = {
-  assets: {
-    darwin_arm64: {
-      name: "engram_2.0.0_darwin_arm64.tar.gz",
-      sha256: "793c695153e0e76144dc53b006a7039771bd24115385856578bc4d6506d46d7f",
-      size: 7210321
-    },
-    darwin_x64: {
-      name: "engram_2.0.0_darwin_amd64.tar.gz",
-      sha256: "f1dcc343ac241c5001617113279b49dec698005550b538250ccf21655fc728ac",
-      size: 7678428
-    },
-    linux_arm64: {
-      name: "engram_2.0.0_linux_arm64.tar.gz",
-      sha256: "a942e73ab424faaa6e2785d1563e0d9d7f20739944dae0c50071223301d44333",
-      size: 6926960
-    },
-    linux_x64: {
-      name: "engram_2.0.0_linux_amd64.tar.gz",
-      sha256: "23be1c2ce9739c455097ff864736213717b925b3e8821a988dfc619685a5abd5",
-      size: 7544949
-    },
-    windows_arm64: {
-      name: "engram_2.0.0_windows_arm64.zip",
-      sha256: "e4d9074ebf8a839573f62d7bd2719421fc428ab25a9affe82ca4b2d5555183d1",
-      size: 6980876
-    },
-    windows_x64: {
-      name: "engram_2.0.0_windows_amd64.zip",
-      sha256: "fba31e7221702f213954c2081aa83b38833e0e9b824a981f976f8cee2c74548c",
-      size: 7738896
-    }
-  },
-  version: "2.0.0"
-};
-
-// src/lib/engram-install.ts
+var MAX_ENGRAM_ARCHIVE_BYTES = 64 * 1024 * 1024;
+var STABLE_TAG = /^v\d+\.\d+\.\d+$/;
+var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 async function installMissingEngram(options = {}) {
   const platform = options.platform ?? process.platform;
   const homeDir = options.homeDir ?? os5.homedir();
@@ -5703,58 +5679,159 @@ async function installMissingEngram(options = {}) {
   const binaryName = platform === "win32" ? "engram.exe" : "engram";
   const bin = path25.join(homeDir, ".local", "bin", binaryName);
   let staging;
+  let outcome;
   try {
     const existing = fs19.lstatSync(bin, { throwIfNoEntry: false });
     if (existing) {
       if (!fs19.statSync(bin).isFile()) throw new Error(`El destino Engram no es un archivo: ${bin}`);
       fs19.accessSync(bin, platform === "win32" ? fs19.constants.F_OK : fs19.constants.X_OK);
-      return { ok: true, bin };
-    }
-    const key = `${platform === "win32" ? "windows" : platform}_${options.arch ?? process.arch}`;
-    const asset = engram_release_default.assets[key];
-    if (!asset) throw new Error(`Engram no dispone de un binario aprobado para ${key}.`);
-    const response = await (options.fetch ?? globalThis.fetch)(
-      `https://github.com/Gentleman-Programming/engram/releases/download/v${engram_release_default.version}/${asset.name}`,
-      { signal: AbortSignal.timeout(12e4) }
-    );
-    if (!response.ok || !response.body) throw new Error(`Descarga Engram fallida: HTTP ${response.status}.`);
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    try {
-      while (true) {
-        const chunk = await reader.read();
-        if (chunk.done) break;
-        size += chunk.value.byteLength;
-        if (size > asset.size) throw new Error("El tama\xF1o descargado de Engram supera el aprobado.");
-        chunks.push(chunk.value);
+      outcome = { ok: true, bin };
+    } else {
+      const fetchFn = options.fetch ?? globalThis.fetch;
+      let releaseRes;
+      try {
+        releaseRes = await fetchLatestGithubRelease(ENGRAM_REPO, fetchFn);
+      } catch (error) {
+        const cause = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `Engram: error de red al consultar los metadatos del release (latest): ${cause}. Reintenta la instalaci\xF3n.`
+        );
       }
-    } finally {
-      await reader.cancel();
-    }
-    const archive = Buffer.concat(chunks);
-    if (size !== asset.size || createHash3("sha256").update(archive).digest("hex") !== asset.sha256) {
-      throw new Error("Engram: tama\xF1o o hash SHA-256 no coincide con el artefacto aprobado.");
-    }
-    fs19.mkdirSync(path25.dirname(bin), { recursive: true });
-    staging = fs19.mkdtempSync(path25.join(path25.dirname(bin), ".engram-install-"));
-    const archivePath = path25.join(staging, asset.name);
-    fs19.writeFileSync(archivePath, archive, { flag: "wx", mode: 384 });
-    const binary = execFileSync6(resolveTarBin(), ["-xOf", archivePath, binaryName], {
-      maxBuffer: 64 * 1024 * 1024,
-      timeout: 3e4,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    if (binary.length === 0) throw new Error("El artefacto Engram no contiene un binario v\xE1lido.");
-    const stagedBin = path25.join(staging, binaryName);
-    fs19.writeFileSync(stagedBin, binary, { flag: "wx", mode: 493 });
-    fs19.linkSync(stagedBin, bin);
-    return { ok: true, bin };
+      if (!releaseRes.ok) {
+        if (releaseRes.status === 429) {
+          throw new Error(
+            "Engram: metadatos del release no disponibles (HTTP 429 rate limit en la consulta latest/metadatos). Espera y reintenta; define GH_TOKEN o inicia sesi\xF3n con gh auth login para elevar el l\xEDmite."
+          );
+        }
+        if (releaseRes.status === 403) {
+          throw new Error(
+            "Engram: metadatos del release no disponibles (HTTP 403 en la consulta latest/metadatos). Posible rate limit o falta de autenticaci\xF3n; define GH_TOKEN o usa gh auth login y reintenta."
+          );
+        }
+        throw new Error(
+          `Engram: metadatos del release no disponibles (HTTP ${releaseRes.status} en la consulta latest).`
+        );
+      }
+      let raw;
+      try {
+        raw = await releaseRes.json();
+      } catch (error) {
+        if (error instanceof SyntaxError) {
+          throw new Error("Engram: metadatos del release inv\xE1lidos: JSON no parseable.");
+        }
+        const cause = error instanceof Error ? error.message : String(error);
+        const hint = error instanceof Error && error.name === "AbortError" ? "interrumpida (red/cancelada)" : "de red";
+        throw new Error(
+          `Engram: lectura de metadatos del release ${hint}: ${cause}. Reintenta la instalaci\xF3n.`
+        );
+      }
+      if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error("Engram: metadatos del release inv\xE1lidos: se esperaba un objeto JSON.");
+      }
+      const releaseJson = raw;
+      const tag = releaseJson.tag_name;
+      if (typeof tag !== "string" || !STABLE_TAG.test(tag)) {
+        throw new Error(`Engram: tag del release inv\xE1lido: ${String(tag)}.`);
+      }
+      const version = tag.slice(1);
+      const expectedName = expectedEngramAssetName(version, platform, options.arch ?? process.arch);
+      if (expectedName === null) {
+        throw new Error(`Engram no dispone de un binario aprobado para ${platform}_${options.arch ?? process.arch}.`);
+      }
+      if (!Array.isArray(releaseJson.assets)) throw new Error("Engram: metadatos del release sin assets.");
+      const matches = releaseJson.assets.filter((asset2) => asset2?.name === expectedName);
+      if (matches.length !== 1) throw new Error("Engram: asset exacto ausente o ambiguo en el release.");
+      const asset = matches[0];
+      if (asset.state !== "uploaded") throw new Error("Engram: asset no publicado.");
+      if (!Number.isInteger(asset.size) || asset.size <= 0) {
+        throw new Error("Engram: tama\xF1o del asset inv\xE1lido.");
+      }
+      const expectedUrl = `${ENGRAM_DOWNLOAD_PREFIX}${tag}/${expectedName}`;
+      if (typeof asset.browser_download_url !== "string" || asset.browser_download_url !== expectedUrl) {
+        throw new Error("Engram: URL del asset no oficial.");
+      }
+      if (typeof asset.digest !== "string" || !DIGEST_RE.test(asset.digest)) {
+        throw new Error("Engram: digest del asset inv\xE1lido.");
+      }
+      const approvedSize = asset.size;
+      if (approvedSize > MAX_ENGRAM_ARCHIVE_BYTES) {
+        throw new Error(
+          `Engram: tama\xF1o del asset aprobado (${approvedSize} bytes) excede el l\xEDmite de 64 MiB (${MAX_ENGRAM_ARCHIVE_BYTES} bytes).`
+        );
+      }
+      const approvedSha = asset.digest.slice("sha256:".length);
+      const response = await fetchFn(asset.browser_download_url, {
+        signal: AbortSignal.timeout(12e4)
+      });
+      if (!response.ok || !response.body) throw new Error(`Descarga Engram fallida: HTTP ${response.status}.`);
+      const reader = response.body.getReader();
+      const chunks = [];
+      let size = 0;
+      let readError;
+      try {
+        try {
+          while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) break;
+            size += chunk.value.byteLength;
+            if (size > approvedSize) throw new Error("El tama\xF1o descargado de Engram supera el aprobado.");
+            chunks.push(chunk.value);
+          }
+        } catch (error) {
+          readError = error;
+          throw error;
+        }
+      } finally {
+        try {
+          await reader.cancel();
+        } catch (cancelError) {
+          const cancelMsg = cancelError instanceof Error ? cancelError.message : String(cancelError);
+          if (readError !== void 0) {
+            const primaryMsg = readError instanceof Error ? readError.message : String(readError);
+            throw new Error(`${primaryMsg} (adem\xE1s fall\xF3 la cancelaci\xF3n del stream: ${cancelMsg})`);
+          }
+          throw cancelError;
+        }
+      }
+      const archive = Buffer.concat(chunks);
+      if (size !== approvedSize || createHash3("sha256").update(archive).digest("hex") !== approvedSha) {
+        throw new Error("Engram: tama\xF1o o hash SHA-256 no coincide con el artefacto aprobado.");
+      }
+      fs19.mkdirSync(path25.dirname(bin), { recursive: true });
+      staging = fs19.mkdtempSync(path25.join(path25.dirname(bin), ".engram-install-"));
+      const archivePath = path25.join(staging, expectedName);
+      fs19.writeFileSync(archivePath, archive, { flag: "wx", mode: 384 });
+      const binary = execFileSync6(resolveTarBin(), ["-xOf", archivePath, binaryName], {
+        maxBuffer: 64 * 1024 * 1024,
+        timeout: 3e4,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      if (binary.length === 0) throw new Error("El artefacto Engram no contiene un binario v\xE1lido.");
+      const stagedBin = path25.join(staging, binaryName);
+      fs19.writeFileSync(stagedBin, binary, { flag: "wx", mode: 493 });
+      fs19.linkSync(stagedBin, bin);
+      outcome = { ok: true, bin };
+    }
   } catch (error) {
-    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
-  } finally {
-    if (staging) fs19.rmSync(staging, { recursive: true, force: true });
+    outcome = { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  if (staging !== void 0) {
+    try {
+      fs19.rmSync(staging, { recursive: true, force: true });
+    } catch (cleanupError) {
+      const cleanupMsg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+      if (outcome !== void 0 && outcome.ok) {
+        outcome = {
+          ok: true,
+          bin: outcome.bin,
+          warning: `Limpieza del directorio temporal ${staging} fallida tras instalar Engram: ${cleanupMsg}. El binario qued\xF3 instalado en ${outcome.bin}.`
+        };
+      } else if (outcome !== void 0 && !outcome.ok) {
+        outcome = { ok: false, reason: `${outcome.reason} (adem\xE1s fall\xF3 la limpieza temporal: ${cleanupMsg})` };
+      }
+    }
   }
+  return outcome ?? { ok: false, reason: "Engram: instalaci\xF3n finaliz\xF3 sin resultado verificable." };
 }
 
 // src/cli.ts
@@ -6088,7 +6165,10 @@ async function resolveHostEngramForInstall(flags) {
   }
   try {
     const result = await installMissingEngram();
-    if (result.ok) return { ok: true, bin: result.bin };
+    if (result.ok) {
+      if (result.warning) p6.log.warn(result.warning);
+      return { ok: true, bin: result.bin };
+    }
     return { ok: false, message: `Engram: ${result.reason}` };
   } catch (error) {
     return { ok: false, message: `Engram: ${error instanceof Error ? error.message : String(error)}` };
@@ -6143,7 +6223,11 @@ async function runSelectedPi(options) {
         const answer = await p6.confirm({ message, initialValue });
         return !p6.isCancel(answer) && answer;
       },
-      installNative: async ({ version }) => updateEngram("Gentleman-Programming/engram", version)
+      installShared: async () => {
+        const result2 = await installMissingEngram();
+        if (result2.ok && result2.warning) p6.log.warn(result2.warning);
+        return result2;
+      }
     });
     if (requirement.kind !== "existing") {
       console.error(requirement.kind === "offer" ? "Pi: instalaci\xF3n cancelada; Engram sigue siendo obligatorio." : `Pi: ${requirement.reason}. ${requirement.remedy}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.58",
+  "version": "1.9.59",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",