metergraph-cli 0.2.2 → 0.2.4

package/src/setup-interactive.js

@@ -0,0 +1,356 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+
+import { parseArgs } from "./args.js";
+import { resolveProject } from "./auth-binding.js";
+import { runDoctor } from "./doctor.js";
+import { classifyEnvironment, handoffPages, shellArg } from "./environment.js";
+import { prerequisitesFor } from "./setup-deployment.js";
+import { readSetupState } from "./setup-state.js";
+
+// Setup asks for what it is missing only when a person is at a terminal: no
+// --json, stdin and stdout both terminals, and not CI. An agent or a script
+// never gets a question, so nothing waits on input that will never come; it
+// keeps the flag errors and the next_action contract. The answers become the
+// same flags a script would pass, and the full command is printed so it can
+// be rerun without questions.
+
+// The setup parse failures a question can answer. Any other failure, such as
+// an invalid value or two conflicting flags, is reported as it is.
+export const ASKABLE = new Set([
+  "missing_runtime", "non_hosted_origin_required", "non_hosted_workspace_required", "client_required",
+]);
+
+export const LOCAL_BUNDLE_ORIGIN = "http://localhost:8080";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const PROBE_TIMEOUT_MS = 1500;
+
+const DEPLOYMENTS = [
+  ["managed", "Metergraph cloud (app.metergraph.dev)"],
+  ["customer-local", "The Metergraph bundle running on this machine"],
+  ["byoc", "Your company's Metergraph installation on AWS"],
+  ["oss", "The open source Metergraph server"],
+];
+const CLIENTS = [
+  ["claude", "Claude Code"],
+  ["codex", "Codex"],
+  ["cursor", "Cursor"],
+  [null, "None (skip installing the skill)"],
+];
+const URL_QUESTIONS = {
+  "customer-local": "Address of the bundle",
+  byoc: "HTTPS address of the installation",
+  oss: "Address of the server",
+};
+const WORKSPACE_QUESTIONS = {
+  "customer-local": "Workspace ID (./bin/status in the bundle directory prints it)",
+  byoc: "Workspace ID (shown on the installation's Settings page)",
+  oss: "Workspace ID",
+};
+
+export function canAsk(argv, { stdin, stdout, stderr = stdout, env = process.env }) {
+  return !argv.includes("--json") && Boolean(stdin?.isTTY) && Boolean(stdout?.isTTY)
+    && Boolean(stderr?.isTTY) && !classifyEnvironment(env).remote;
+}
+
+// Login needs no client or deployment questions. Only supply the local runtime
+// after the rest of the command validates; callers gate this on canAsk.
+export function fillLoginArgv(argv) {
+  const parsed = parseArgs(argv);
+  if (parsed.command !== "login" || parsed.code !== "missing_runtime") return argv;
+  const candidate = [...argv, "--runtime", "local"];
+  return parseArgs(candidate).ok ? candidate : argv;
+}
+
+// Questions on the terminal. ask resolves with the trimmed answer, or null
+// once the person presses Ctrl-C or Ctrl-D, after which every ask is null.
+export function terminalPrompter(stdin, stdout) {
+  const lines = createInterface({ input: stdin, output: stdout, terminal: true });
+  const stop = new AbortController();
+  let closed = false;
+  lines.on("SIGINT", () => stop.abort());
+  lines.on("close", () => {
+    closed = true;
+    stop.abort();
+  });
+  return {
+    async ask(question) {
+      if (stop.signal.aborted) return null;
+      try {
+        return (await lines.question(question, { signal: stop.signal })).trim();
+      } catch {
+        return null;
+      }
+    },
+    close() {
+      if (!closed) lines.close();
+    },
+  };
+}
+
+// Resolves with argv plus the flags the answers stand for, or null when the
+// person cancelled. Flags already given are never asked for or changed.
+export async function fillSetupArgv(argv, {
+  ask, say, probe = probeLocalBundle, savedProfile = savedSetupProfile, remote = classifyEnvironment().remote,
+}) {
+  const has = (flag) => argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
+  const added = [];
+  // A person at a terminal runs setup for a coding agent on this machine.
+  // Over SSH or in a cloud workspace, setup itself still hands off.
+  if (!has("--runtime")) added.push("--runtime", "local");
+
+  let deployment = valueOf(argv, "--deployment");
+  // A rerun in a project set up before resumes that route without asking.
+  if (deployment === undefined && savedProfile(valueOf(argv, "--project")) === null) {
+    // A remote shell sends no request before setup hands it off to the
+    // person's own machine, and its localhost is not that machine anyway.
+    const found = remote ? false : await probe(LOCAL_BUNDLE_ORIGIN);
+    if (found) say(`Found a Metergraph bundle at ${LOCAL_BUNDLE_ORIGIN}.`);
+    deployment = await choose(ask, say, "Where is Metergraph running?", DEPLOYMENTS,
+      found ? "customer-local" : "managed");
+    if (deployment === undefined) return null;
+    if (deployment !== "managed") added.push("--deployment", deployment);
+  }
+
+  if (deployment !== undefined && deployment !== "managed") {
+    if (!has("--url")) {
+      const url = await askFor(ask, say, URL_QUESTIONS[deployment], {
+        fallback: deployment === "customer-local" ? LOCAL_BUNDLE_ORIGIN : null,
+        valid: (value) => /^https?:\/\/\S+$/.test(value),
+        retry: "Enter an address that starts with http:// or https://.",
+      });
+      if (url === null) return null;
+      added.push("--url", url);
+    }
+    if (!has("--workspace")) {
+      const workspace = await askFor(ask, say, WORKSPACE_QUESTIONS[deployment], {
+        valid: (value) => UUID.test(value),
+        retry: "A workspace ID looks like 11111111-1111-4111-8111-111111111111.",
+      });
+      if (workspace === null) return null;
+      added.push("--workspace", workspace.toLowerCase());
+    }
+    if (deployment === "oss" && !has("--agent-token-file")) {
+      const file = await askFor(ask, say, "Absolute path to a private file holding one MG_AGENT_TOKENS value", {
+        valid: (value) => path.isAbsolute(value),
+        retry: "Enter an absolute path, for example /home/me/.config/metergraph/oss-agent-token.",
+      });
+      if (file === null) return null;
+      added.push("--agent-token-file", file);
+    }
+    if (!has("--confirm-prerequisites")) {
+      say("", "Setup connects to an installation that is already running. It needs these done first:");
+      // Except on the open source server, setup signs in for its own
+      // Metadata access, so that one is not the person's to confirm.
+      for (const { name, guide } of prerequisitesFor(deployment)) {
+        if (name !== "metadata_agent_credential" || deployment === "oss") say(`  - ${guide}`);
+      }
+      const done = await yesNo(ask, "Are they all done? [y/N] ");
+      if (done === null) return null;
+      // Without it, setup reports the first pending prerequisite.
+      if (done) added.push("--confirm-prerequisites");
+    }
+  }
+
+  if (!has("--client") && !has("--skip-skill")) {
+    const client = await choose(ask, say, "Install the Metergraph skill for which coding agent?", CLIENTS, "claude", {
+      ...Object.fromEntries(CLIENTS.map(([value, label]) => [label.toLowerCase(), value])),
+      "skip skill installation": null,
+    });
+    if (client === undefined) return null;
+    if (client === null) added.push("--skip-skill");
+    else added.push("--client", client);
+  }
+  return [...argv, ...added];
+}
+
+export function commandLine(argv) {
+  return ["metergraph", ...argv.map(shellArg)].join(" ");
+}
+
+function valueOf(argv, flag) {
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] === flag) return argv[index + 1];
+    if (argv[index].startsWith(`${flag}=`)) return argv[index].slice(flag.length + 1);
+  }
+  return undefined;
+}
+
+// A numbered menu. Resolves with the chosen value, or undefined on cancel
+// (null is a valid choice: no client).
+async function choose(ask, say, question, options, fallback, aliases = {}) {
+  say("", question);
+  options.forEach(([, label], index) => say(`  ${index + 1}) ${label}`));
+  const fallbackIndex = options.findIndex(([value]) => value === fallback) + 1;
+  for (;;) {
+    const answer = await ask(`Choose 1-${options.length} [${fallbackIndex}]: `);
+    if (answer === null) return undefined;
+    if (Object.hasOwn(aliases, answer.toLowerCase())) return aliases[answer.toLowerCase()];
+    const index = answer === "" ? fallbackIndex : Number(answer);
+    if (Number.isInteger(index) && index >= 1 && index <= options.length) return options[index - 1][0];
+    say(`Enter a number from 1 to ${options.length}.`);
+  }
+}
+
+async function askFor(ask, say, question, { fallback = null, valid, retry }) {
+  for (;;) {
+    const answer = await ask(fallback === null ? `${question}: ` : `${question} [${fallback}]: `);
+    if (answer === null) return null;
+    const value = answer === "" ? fallback : answer;
+    if (value !== null && valid(value)) return value;
+    say(retry);
+  }
+}
+
+async function yesNo(ask, question) {
+  const answer = await ask(question);
+  if (answer === null) return null;
+  return ["y", "yes"].includes(answer.toLowerCase());
+}
+
+async function probeLocalBundle(origin) {
+  try {
+    const { report } = await runDoctor({ origin, timeoutMs: PROBE_TIMEOUT_MS });
+    return report?.deployment_profile === "local";
+  } catch {
+    return false;
+  }
+}
+
+function savedSetupProfile(project) {
+  try {
+    return readSetupState(resolveProject(project))?.value.deployment_profile ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// --- Access for the coding agent on the customer-local bundle ---------------
+
+// Setup signs the agent in with Metadata access only. On the customer-local
+// bundle, bin/agent-key issues a broader key without a sign in and writes it
+// to a private file, never printing it. The command text is fixed here, not
+// taken from the service, so an origin cannot choose what a person is asked
+// to run.
+export const AGENT_KEY_FILE = "~/.config/metergraph/agent.env";
+const AGENT_KEY_GRANTS = [
+  "--role", "debug", "--allow-evaluation-writes", "--allow-evaluation-previews", "--allow-analysis-starts",
+];
+export const AGENT_KEY_COMMAND = ["./bin/agent-key", "create", "--write-to", AGENT_KEY_FILE, ...AGENT_KEY_GRANTS].join(" ");
+
+export function agentAccessOffer(origin) {
+  return {
+    role: "metadata",
+    offer: {
+      kind: "bundle_agent_key",
+      run_in: "bundle_directory",
+      command: AGENT_KEY_COMMAND,
+      requires_person_approval: true,
+      keys_page_url: handoffPages(origin).keys_url,
+      message: "The agent has Metadata access. To let it write evaluations and start analyses, " +
+        "ask the person which access they want, then they run this command in the bundle directory, " +
+        "or the agent runs it with --yes after they agree. The Debug role reads captured prompts and " +
+        "responses, and analysis starts send captured content to the person's model provider and spend " +
+        "money. The command writes the key to the named private file and never prints it. A bundle " +
+        "without bin/agent-key uses the Keys page instead.",
+    },
+  };
+}
+
+// After a customer-local setup at a terminal: offer to run bin/agent-key
+// now. It shows what it grants and asks for its own confirmation. Setup runs
+// in the person's project, which may be a repository they did not write, so
+// nothing there is ever a default: the person types the bundle directory, it
+// must look like a started bundle, and setup names the exact program and asks
+// before running it.
+const BUNDLE_MARKERS = [["bin", "start"], ["docker-compose.yml"], ["metergraph-byoc-release.json"]];
+
+export async function offerAgentAccess({ client, origin, prompter, say, run = runInherited, platform = process.platform }) {
+  say("", "Your coding agent has Metadata access. It can also write evaluations and start analyses.",
+    "That reads captured prompts and responses, and an analysis sends captured content to your model",
+    "provider and spends money on your account.");
+  if (platform === "win32") {
+    // The bundle's commands are shell scripts that run inside WSL, and
+    // Windows has no owner-only file mode to check, so say what to run there.
+    say(`To allow it, run this in the bundle directory inside WSL: ${AGENT_KEY_COMMAND}`);
+    return;
+  }
+  const wanted = await yesNo(prompter.ask, "Give it that access now? [y/N] ");
+  if (!wanted) {
+    say(`Later, run this in the bundle directory: ${AGENT_KEY_COMMAND}`);
+    return;
+  }
+  const answer = await askFor(prompter.ask, say, "Bundle directory (the one you ran bin/start in)", {
+    valid: (value) => BUNDLE_MARKERS.every((parts) => fs.existsSync(path.join(expandHome(value), ...parts))),
+    retry: "That is not a started bundle (it needs bin/start, docker-compose.yml and the release manifest).",
+  });
+  if (answer === null) return;
+  const bundle = fs.realpathSync(expandHome(answer));
+  const command = path.join(bundle, "bin", "agent-key");
+  if (!fs.existsSync(command)) {
+    say("This bundle has no bin/agent-key. Create the key on the Keys page instead:",
+      `  ${handoffPages(origin).keys_url}`);
+    return;
+  }
+  const problem = untrustedProgram(command);
+  if (problem !== null) {
+    say(`Not running ${command}: ${problem}.`);
+    return;
+  }
+  const confirmed = await yesNo(prompter.ask, `Run ${command}? [y/N] `);
+  if (!confirmed) {
+    say(`Later, run this in the bundle directory: ${AGENT_KEY_COMMAND}`);
+    return;
+  }
+  prompter.close();
+  const file = path.join(os.homedir(), ".config", "metergraph", "agent.env");
+  const code = await run(command, ["create", "--write-to", file, ...AGENT_KEY_GRANTS], bundle);
+  if (code !== 0) {
+    say(`bin/agent-key did not finish. Run it again from ${bundle}: ${AGENT_KEY_COMMAND}`);
+    return;
+  }
+  say("", ...connectSteps(client, origin, file));
+}
+
+// Only a regular file the person owns and nobody else can change is run.
+function untrustedProgram(command) {
+  const info = fs.lstatSync(command);
+  if (!info.isFile()) return "it is not a regular file";
+  if (typeof process.getuid === "function" && info.uid !== process.getuid()) return "it is owned by another user";
+  if (info.mode & 0o022) return "other users can change it";
+  return null;
+}
+
+// How the person connects their agent to the key: load the file where the
+// agent starts, and name the variable (never the token) in its MCP settings.
+export function connectSteps(client, origin, file) {
+  const mcp = `${origin}/v1/agent/mcp`;
+  const steps = [`Load the key in the shell that starts your agent: . ${shellArg(file)}`];
+  if (client === "claude") {
+    steps.push("Add the MCP server to Claude Code (it saves the variable name, not the token):",
+      `  claude mcp add-json --scope user metergraph '${JSON.stringify({
+        type: "http", url: mcp, headers: { Authorization: "Bearer ${METERGRAPH_AGENT_TOKEN}" } })}'`);
+  } else if (client === "codex") {
+    steps.push("Add the MCP server to Codex (it saves the variable name, not the token):",
+      `  codex mcp add metergraph --url ${mcp} --bearer-token-env-var METERGRAPH_AGENT_TOKEN`);
+  } else {
+    steps.push("Add the MCP server as the bundle README's 'Let your coding agent run analyses' section shows.");
+  }
+  steps.push("Then restart the agent.");
+  return steps;
+}
+
+function expandHome(value) {
+  return value === "~" || value.startsWith("~/") ? path.join(os.homedir(), value.slice(1)) : value;
+}
+
+function runInherited(command, args, cwd) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, { cwd, stdio: "inherit" });
+    child.on("error", () => resolve(1));
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}

package/src/setup-refusal.js

@@ -1,5 +1,5 @@
 import { randomBytes, randomUUID } from "node:crypto";
-import fs from "node:fs";
+import fs, { withRollback } from "./anchored-fs.js";
 import path from "node:path";
 
 // What the --json --no-browser background waiter is doing with an approval
@@ -80,7 +80,7 @@ function write(root, value) {
     fs.renameSync(temp, fileFor(root));
     return true;
   } catch {
-    try { fs.unlinkSync(temp); } catch { /* no temp */ }
+    try { withRollback(() => fs.unlinkSync(temp)); } catch { /* no temp */ }
     return false;
   }
 }

package/src/setup-state.js

@@ -1,7 +1,9 @@
 import { randomBytes, randomUUID } from "node:crypto";
-import fs from "node:fs";
+import fs, { withRollback } from "./anchored-fs.js";
 import path from "node:path";
 
+import { parseOrigin } from "./origin.js";
+
 import { Stop } from "./auth-store.js";
 
 // Public, non-credential project state. It is persisted before browser
@@ -53,7 +55,7 @@ export function setupReceipt(value) {
 function core(value) {
   return value.schema_version === 1 && UUID.test(value.family_id) &&
     (value.key_id === null || UUID.test(value.key_id)) && PHASES.has(value.phase) &&
-    typeof value.origin === "string" && typeof value.workspace_id === "string" && UUID.test(value.workspace_id);
+    typeof value.origin === "string" && parseOrigin(value.origin) === value.origin && typeof value.workspace_id === "string" && UUID.test(value.workspace_id);
 }
 
 function valid(value) {
@@ -78,6 +80,7 @@ export function readSetupState(root) {
   let stat;
   try { stat = fs.lstatSync(file); }
   catch (error) {
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     if (error.code === "ENOENT") return null;
     throw new Stop("filesystem_error", "setup_state_read_failed");
   }
@@ -95,6 +98,7 @@ export function readSetupState(root) {
       selected_client: null, skill_status: "pending" }) : value, content };
   } catch (error) {
     if (error instanceof Stop) throw error;
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     throw new Stop("conflict", "setup_state_invalid");
   } finally {
     if (fd !== undefined) fs.closeSync(fd);
@@ -134,10 +138,11 @@ export function writeSetupState(root, next, previous) {
     fs.renameSync(temp, dest);
   } catch (error) {
     if (error instanceof Stop) throw error;
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     if (error.code === "EEXIST") throw new Stop("conflict", "setup_state_locked");
     throw new Stop("filesystem_error", "setup_state_write_failed");
   } finally {
-    try { fs.unlinkSync(temp); } catch { /* no temp */ }
-    if (locked) { try { fs.unlinkSync(lock); } catch { /* next run refuses */ } }
+    try { withRollback(() => fs.unlinkSync(temp)); } catch { /* no temp */ }
+    if (locked) { try { withRollback(() => fs.unlinkSync(lock)); } catch { /* next run refuses */ } }
   }
 }

package/src/setup.js

@@ -57,6 +57,9 @@ export async function runSetup(options, progress = () => {}) {
     const where = options.runtime !== "local" ? { kind: "declared_cloud" } : environment;
     return fail("unsupported", "run_on_local_machine", "not_ready", null, remoteSetupAction(where, options.origin, options));
   }
+  if (new URL(options.origin).protocol === "http:") {
+    return fail("unsupported", "local_docker_transport_required", "not_ready", null);
+  }
   const trap = trapSignals();
   let receipt = null;
   let loginVerified = false;
@@ -112,9 +115,14 @@ export async function runSetup(options, progress = () => {}) {
     // An env key this setup does not own stops before any sign in, so the
     // refusal costs no approval and leaves the binding untouched. The check
     // after sign in stays, against a fresh read.
-    if (!saved) {
-      const early = currentEnvValues(preflightEnv({ project: root, envFile: options.envFile, signal: trap.signal }));
-      if (early.token !== null) return stop("conflict", "existing_ingest_key_unowned");
+    const early = currentEnvValues(preflightEnv({ project: root, envFile: options.envFile, signal: trap.signal }));
+    if (early.token !== null) {
+      if (!saved) return stop("conflict", "existing_ingest_key_unowned");
+      // The saved public route cannot choose the destination of a token.
+      // Require its colocated ingest destination before any sign-in request.
+      if (early.ingestUrl !== intendedOrigin && early.ingestUrl !== `${intendedOrigin}/v1/ingest`) {
+        return stop("conflict", "ingest_url_mismatch");
+      }
     }
     const bindingDiffers = bound !== null && (bound.origin !== intendedOrigin ||
       (intendedWorkspace !== null && bound.workspace_id !== intendedWorkspace));
@@ -182,6 +190,10 @@ export async function runSetup(options, progress = () => {}) {
     // being reused. Pending delivery is acknowledged, including after a
     // previous process stopped after the env write.
     if (previous && existing.token !== null) {
+      // Recheck the fresh env snapshot immediately before the bearer sink.
+      if (existing.ingestUrl !== origin && existing.ingestUrl !== `${origin}/v1/ingest`) {
+        return stop("conflict", "ingest_url_mismatch");
+      }
       const checked = await checkCredential(origin, existing.token, previous.value, profile, trap.signal);
       if (checked.ok) {
         if (existing.ingestUrl !== origin && existing.ingestUrl !== `${origin}/v1/ingest`) {

package/src/skill-bundle.js

@@ -5,7 +5,7 @@ import { readFileSync } from "node:fs";
 // public skill at the manifest's source_url. The source has no version of its
 // own, so the revision is derived from the content hash. The hash is pinned
 // here as well as in the manifest, so editing either file alone is detected.
-const PINNED_SHA256 = "ebf784673eff0280d85974504f93c683a1dabfb54156c9d27e091131462e9d5f";
+const PINNED_SHA256 = "f31c24c4074707df0e34502bd9efbfde4fff5703e6fd367e0f60692f9f5878ce";
 
 const ASSET_DIR = new URL("../assets/skill/", import.meta.url);
 const MANIFEST_KEYS = ["file", "manifest_version", "name", "revision", "sha256", "size", "source_url"];
@@ -55,7 +55,7 @@ export function loadBundledSkill() {
 // The workflow skills that "skills install" writes, vendored from the public
 // skills repository at one commit. The manifest's own hash is pinned here, and
 // the manifest pins each skill's hash, so changing any file alone is detected.
-const PINNED_PACK_SHA256 = "11ab983875911c4c2ad03d2a3b7b9e9213c410e77f4ff2d27b4059354b00fe0c";
+const PINNED_PACK_SHA256 = "0460133ebbe3bc4f1ea03e297f36a15b72b291ab9b9efb80a35df863ef974e0c";
 
 const PACK_DIR = new URL("../assets/skills/", import.meta.url);
 const PACK_KEYS = ["commit", "manifest_version", "repository", "skills"];

package/src/skill-trusted.js

@@ -0,0 +1,56 @@
+// Exact bytes of bundled skills from prior public releases and the previous bundle.
+// A repository receipt cannot authorize replacing arbitrary user-authored bytes.
+export const TRUSTED_SKILLS = {
+  "metergraph": [
+    "90f7d8d78a5b0b7a57436f194222f0c73310b0b04201c297c8fbf0b00ad6bb3f",
+    "d527a67efc42a55245b9c2c8fd2687c1f31f553e154a6242d0f31466993e314e",
+    "e7fc4eb7a22eeb16c357bede9d0a080ad3b415aaab1d9c72f164d5350d48c4b1",
+    "ebf784673eff0280d85974504f93c683a1dabfb54156c9d27e091131462e9d5f",
+    "482bdb6c32ad04766ba5159449a612419c90bfe78ea07038eb8d1ca7fb1edb76"
+  ],
+  "metergraph-analyze": [
+    "c45756ad1d33a360c7c845ca299d8c1ab1e2b8162865f635bc25c78358c2a1e6",
+    "e8bf1debf62aa7d33d3dd363e5d95d8f781e8ca23cde4619b5bb4133dd47a7a5",
+    "4544f8183a1259ef805eb89a72346ecc87306c70007b235436d6425787b85474"
+  ],
+  "metergraph-candidates": [
+    "acc0176e29ea5b867855c1f4691e01e4cb9295705b0ffc89ad0b348da9c47d8a",
+    "43de69d168091492310fc2f8851710e861a0b5cd3975c30a5c23d205abfcdfc6"
+  ],
+  "metergraph-evals": [
+    "b115c53c5ff4040ac35ff240aee6cb4b56465db0916d9f104f8ab433bfc77c60",
+    "9baef426288455b2be2ea8af2774a19c344b5b83f8e9046916f24f8bf744f2de"
+  ],
+  "metergraph-investigate": [
+    "470579faf9e8b5f1a562060d51ec5a71d1b9c47213403a2447dd40af56a74869",
+    "775dbe7ca1100b17638d0905302ef1324694a60b90372c6c3df7b598a8f70438",
+    "b06951926490aa0cd7a6ba0de5d8c1f21cac931ccab882552cea7ebea4ab7562"
+  ],
+  "metergraph-iterate": [
+    "9ce5a2cf527e3f9a81fddcabc4bfc0a4e4894df7b502df8672e3d66470e5a5e8",
+    "1c2a2ad249b0fdf7f9f201d99ff76b91a7cdfbf57dd8f43d61612775b9982445"
+  ],
+  "metergraph-local-bundle": [
+    "692cd8952a8a8896ec2c06091b329a7a01912e261e87d62a9458452172a7c9b0",
+    "c31286b7ee6dd8fc228e81565662ebaf4b0faf2ae92229602baf7c809202491b",
+    "3afd094368053023716c3c76893b51f6ae4b45e38211f69e2bbc5117c86d9a51"
+  ],
+  "metergraph-model-swap": [
+    "d77ee37f882ab1e50dc4a093e64a2c3661f4cd9bb59f184da6dccbd76fd51a18",
+    "8fbf010d11b75bbe26fb13f776251038fab4688ccbfe58f3c582c469cf149433"
+  ],
+  "metergraph-onboarding": [
+    "409d105f3b042514fd347a1fffc5489a94c01d1bc8aac55800e8c9f13a66a2c1",
+    "6e6f418933f37b34437035ab3171344d43f37dee3770815b19f97efb62e5f1d1",
+    "8ee73ecfe42894c74b16fbc3675a234452f152f248f8f574be3f04dd6e509805"
+  ],
+  "metergraph-report": [
+    "0cdbeb684c4f7f87932784db832f376cff984fe0220a1167f1a73edd550450b7",
+    "58add8f6a32191e6fc01ca533a700e190a8e6da412e619bca38c65a481ea9fb5",
+    "90d52900067616330ce073d7d47b302120c4d0f4f8ffbef712eeec0a0bae4153"
+  ],
+  "metergraph-workloads": [
+    "caf819780722f941b9d6b2f9564413a7deadda53439c973a7764be1b6eca98e5",
+    "bd28b1710fc5dfc082fa53bbcd32f8a3300338a37b82c14a87c8849d41a3fc24"
+  ]
+};

package/src/skill.js

@@ -1,5 +1,7 @@
+import { TRUSTED_SKILLS } from "./skill-trusted.js";
+
 import { randomBytes } from "node:crypto";
-import fs from "node:fs";
+import fs, { validatePath, withRollback } from "./anchored-fs.js";
 import path from "node:path";
 
 import {
@@ -31,6 +33,7 @@ const ENTRY_KEYS = ["client", "path", "revision", "runtimes", "sha256", "skill"]
 const NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
 
 const MESSAGES = {
+  secure_writes_unavailable: "Secure automatic file writes are unavailable on this platform or the bundled filesystem helper failed verification. Nothing was written.",
   invalid_project: "--project must name an existing directory.",
   client_not_supported:
     "This client cannot load project skill files. Follow the connection guide instead. Nothing was written.",
@@ -114,7 +117,7 @@ function apply(root, context) {
         return plan.status;
       } finally {
         try {
-          fs.unlinkSync(lockPath);
+          withRollback(() => fs.unlinkSync(lockPath));
         } catch {
           // A lock that cannot be removed is reported by the next run.
         }
@@ -134,7 +137,8 @@ function resolveProject(project) {
   try {
     const real = fs.realpathSync(path.resolve(project ?? process.cwd()));
     if (fs.statSync(real).isDirectory()) return real;
-  } catch {
+  } catch (error) {
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     // Fall through to the fixed error.
   }
   throw new Stop("invalid_input", "invalid_project");
@@ -180,6 +184,10 @@ function decide(action, runtime, state, bundle) {
   if (file !== null && (file.content === null || sha256Hex(file.content) !== entry.sha256)) {
     throw new Stop("conflict", "modified");
   }
+  if (file !== null && entry.sha256 !== bundle.sha256 &&
+      !TRUSTED_SKILLS[bundle.name]?.includes(entry.sha256)) {
+    throw new Stop("conflict", "not_owned");
+  }
   const current = entry.revision === bundle.revision;
   if (!current && action === "install") throw new Stop("conflict", "update_required");
   if (file !== null && current) {
@@ -200,6 +208,7 @@ function commit(root, context, state, plan) {
   const receipt = nextReceipt(state.receipt, context, target.relative);
   let createdDirs = [];
   let skillWritten = false;
+  let receiptWritten = false;
   try {
     if (plan.writeSkill) {
       createdDirs = ensureDirs(root, target.dirs);
@@ -208,13 +217,23 @@ function commit(root, context, state, plan) {
     }
     if (state.receiptFile === null || !state.receiptFile.content.equals(receipt)) {
       replaceFile(receiptPath, receipt, state.receiptFile);
+      receiptWritten = true;
     }
+    validatePath(root);
+    validatePath(path.dirname(skillPath));
+    validatePath(path.dirname(receiptPath));
   } catch (error) {
     try {
-      if (skillWritten) {
-        if (state.file === null) fs.unlinkSync(skillPath);
-        else replaceFile(skillPath, state.file.content, { content: bundle.content, mode: state.file.mode });
-      }
+      withRollback(() => {
+        if (receiptWritten) {
+          if (state.receiptFile === null) fs.unlinkSync(receiptPath);
+          else replaceFile(receiptPath, state.receiptFile.content, { content: receipt, mode: state.receiptFile.mode });
+        }
+        if (skillWritten) {
+          if (state.file === null) fs.unlinkSync(skillPath);
+          else replaceFile(skillPath, state.file.content, { content: bundle.content, mode: state.file.mode });
+        }
+      });
     } catch {
       throw new Stop("filesystem_error", "rollback_failed");
     }
@@ -325,7 +344,7 @@ function ensureDirs(root, dirs) {
 function removeDirs(created) {
   for (const dir of [...created].reverse()) {
     try {
-      fs.rmdirSync(dir);
+      withRollback(() => fs.rmdirSync(dir));
     } catch {
       // Not empty or not removable. An empty directory is harmless.
     }
@@ -382,7 +401,7 @@ function replaceFile(dest, content, previous) {
     fs.renameSync(temp, dest);
   } catch (error) {
     try {
-      fs.unlinkSync(temp);
+      withRollback(() => fs.unlinkSync(temp));
     } catch {
       // Already renamed or never created.
     }