jorgex-stack 1.9.61 → 1.9.62

package/dist/pi-ci-artifact.d.ts

@@ -0,0 +1,21 @@
+interface ObservedPiCiArtifact {
+    version: string;
+    tarballUrl: string;
+    integrity: string;
+    bytes: number;
+    sha256: string;
+    sha512: string;
+}
+interface PrepareObservedPiCiArtifactInput {
+    tarballPath: string;
+    candidatePath: string;
+    fetchImpl: typeof fetch;
+}
+/**
+ * T06 CI observed artifact: resolve the live `dist-tags.latest` candidate,
+ * download the exact verified tarball, then freeze the observed identity as
+ * a bounded private JSON. Filesystem guards run before any network.
+ */
+declare function prepareObservedPiCiArtifact(input: PrepareObservedPiCiArtifactInput): Promise<ObservedPiCiArtifact>;
+
+export { type ObservedPiCiArtifact, type PrepareObservedPiCiArtifactInput, prepareObservedPiCiArtifact };

package/dist/pi-ci-artifact.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+import {
+  downloadVerifiedPiTarball,
+  resolveLatestPiRelease
+} from "./chunk-KGL5VNVZ.js";
+
+// src/lib/pi-ci-artifact.ts
+import fs from "fs";
+import path from "path";
+import { randomBytes } from "crypto";
+import { pathToFileURL } from "url";
+var MAX_CANDIDATE_BYTES = 64 * 1024;
+function fail(message) {
+  throw new Error(`pi-ci-artifact: ${message}`);
+}
+function lstatOrNull(p) {
+  try {
+    return fs.lstatSync(p);
+  } catch {
+    return null;
+  }
+}
+function assertAbsolute(label, value) {
+  if (typeof value !== "string" || value === "" || !path.isAbsolute(value)) {
+    fail(`${label} must be a non-empty absolute path`);
+  }
+  return path.resolve(value);
+}
+function assertParentRealDir(resolvedFile, label) {
+  const dir = path.dirname(resolvedFile);
+  const st = lstatOrNull(dir);
+  if (st === null || !st.isDirectory() || st.isSymbolicLink()) {
+    fail(`${label} parent must be a real directory: ${dir}`);
+  }
+  return dir;
+}
+async function prepareObservedPiCiArtifact(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    fail("input must be an object");
+  }
+  const { tarballPath, candidatePath, fetchImpl } = input;
+  if (typeof fetchImpl !== "function") {
+    fail("fetchImpl must be a function");
+  }
+  const tarballResolved = assertAbsolute("tarballPath", tarballPath);
+  const candidateResolved = assertAbsolute("candidatePath", candidatePath);
+  if (tarballResolved === candidateResolved) {
+    fail("tarballPath and candidatePath must differ");
+  }
+  const candidateDir = assertParentRealDir(candidateResolved, "candidatePath");
+  assertParentRealDir(tarballResolved, "tarballPath");
+  const candidateExisting = lstatOrNull(candidateResolved);
+  if (candidateExisting !== null) {
+    fail(`candidate already exists: ${candidateResolved}`);
+  }
+  const tarballExisting = lstatOrNull(tarballResolved);
+  if (tarballExisting !== null && tarballExisting.isSymbolicLink()) {
+    fail(`tarball path must not be a symlink: ${tarballResolved}`);
+  }
+  let release;
+  try {
+    release = await resolveLatestPiRelease(fetchImpl);
+  } catch (error) {
+    if (error instanceof Error && /^(pi-ci-artifact|pi-release-resolver): /.test(error.message)) {
+      throw error;
+    }
+    fail(`provider release resolution failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let artifact;
+  try {
+    artifact = await downloadVerifiedPiTarball(
+      release,
+      tarballResolved,
+      fetchImpl
+    );
+  } catch (error) {
+    if (error instanceof Error && /^(pi-ci-artifact|pi-release-resolver): /.test(error.message)) {
+      throw error;
+    }
+    fail(`verified tarball acquisition failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const payload = {
+    version: release.version,
+    tarballUrl: release.tarballUrl,
+    integrity: release.integrity,
+    bytes: artifact.bytes,
+    sha256: artifact.sha256,
+    sha512: artifact.sha512
+  };
+  const serialized = `${JSON.stringify(payload)}
+`;
+  if (Buffer.byteLength(serialized, "utf8") >= MAX_CANDIDATE_BYTES) {
+    fail("candidate JSON exceeds 64 KiB");
+  }
+  const tempPath = path.join(
+    candidateDir,
+    `pi-ci-candidate-partial-${process.pid}-${randomBytes(8).toString("hex")}.json`
+  );
+  let fd;
+  try {
+    fd = fs.openSync(tempPath, "wx", 384);
+  } catch {
+    fail(`cannot stage candidate temp: ${tempPath}`);
+  }
+  let fdClosed = false;
+  const closeFd = () => {
+    if (fdClosed) return;
+    fdClosed = true;
+    try {
+      fs.closeSync(fd);
+    } catch {
+    }
+  };
+  const discardStaged = () => {
+    closeFd();
+    try {
+      fs.rmSync(tempPath, { force: true });
+    } catch {
+    }
+  };
+  try {
+    try {
+      fs.writeSync(fd, serialized, null, "utf8");
+    } catch {
+      fail("cannot write candidate temp");
+    }
+    closeFd();
+    try {
+      fs.chmodSync(tempPath, 384);
+    } catch {
+      fail("cannot secure candidate temp");
+    }
+    try {
+      fs.linkSync(tempPath, candidateResolved);
+    } catch {
+      fail(`candidate already exists: ${candidateResolved}`);
+    }
+    try {
+      fs.rmSync(tempPath, { force: true });
+    } catch {
+    }
+  } catch (error) {
+    discardStaged();
+    if (error instanceof Error && error.message.startsWith("pi-ci-artifact: ")) throw error;
+    fail(`candidate publish failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return payload;
+}
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const args = process.argv.slice(2);
+  if (args.length !== 2 || args[0] === void 0 || args[1] === void 0) {
+    console.error("pi-ci-artifact: expected <absolute-tarball> <absolute-candidate>");
+    process.exit(1);
+  }
+  const [tarballArg, candidateArg] = args;
+  await prepareObservedPiCiArtifact({
+    tarballPath: tarballArg,
+    candidatePath: candidateArg,
+    fetchImpl: fetch
+  }).catch((error) => {
+    console.error(error instanceof Error ? error.message : "pi-ci-artifact: failed");
+    process.exit(1);
+  });
+}
+export {
+  prepareObservedPiCiArtifact
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.61",
+  "version": "1.9.62",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",