metergraph-cli 0.2.3 → 0.2.4

package/src/setup-refusal.js

@@ -1,5 +1,5 @@
 import { randomBytes, randomUUID } from "node:crypto";
-import fs from "node:fs";
+import fs, { withRollback } from "./anchored-fs.js";
 import path from "node:path";
 
 // What the --json --no-browser background waiter is doing with an approval
@@ -80,7 +80,7 @@ function write(root, value) {
     fs.renameSync(temp, fileFor(root));
     return true;
   } catch {
-    try { fs.unlinkSync(temp); } catch { /* no temp */ }
+    try { withRollback(() => fs.unlinkSync(temp)); } catch { /* no temp */ }
     return false;
   }
 }

package/src/setup-state.js

@@ -1,7 +1,9 @@
 import { randomBytes, randomUUID } from "node:crypto";
-import fs from "node:fs";
+import fs, { withRollback } from "./anchored-fs.js";
 import path from "node:path";
 
+import { parseOrigin } from "./origin.js";
+
 import { Stop } from "./auth-store.js";
 
 // Public, non-credential project state. It is persisted before browser
@@ -53,7 +55,7 @@ export function setupReceipt(value) {
 function core(value) {
   return value.schema_version === 1 && UUID.test(value.family_id) &&
     (value.key_id === null || UUID.test(value.key_id)) && PHASES.has(value.phase) &&
-    typeof value.origin === "string" && typeof value.workspace_id === "string" && UUID.test(value.workspace_id);
+    typeof value.origin === "string" && parseOrigin(value.origin) === value.origin && typeof value.workspace_id === "string" && UUID.test(value.workspace_id);
 }
 
 function valid(value) {
@@ -78,6 +80,7 @@ export function readSetupState(root) {
   let stat;
   try { stat = fs.lstatSync(file); }
   catch (error) {
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     if (error.code === "ENOENT") return null;
     throw new Stop("filesystem_error", "setup_state_read_failed");
   }
@@ -95,6 +98,7 @@ export function readSetupState(root) {
       selected_client: null, skill_status: "pending" }) : value, content };
   } catch (error) {
     if (error instanceof Stop) throw error;
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     throw new Stop("conflict", "setup_state_invalid");
   } finally {
     if (fd !== undefined) fs.closeSync(fd);
@@ -134,10 +138,11 @@ export function writeSetupState(root, next, previous) {
     fs.renameSync(temp, dest);
   } catch (error) {
     if (error instanceof Stop) throw error;
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     if (error.code === "EEXIST") throw new Stop("conflict", "setup_state_locked");
     throw new Stop("filesystem_error", "setup_state_write_failed");
   } finally {
-    try { fs.unlinkSync(temp); } catch { /* no temp */ }
-    if (locked) { try { fs.unlinkSync(lock); } catch { /* next run refuses */ } }
+    try { withRollback(() => fs.unlinkSync(temp)); } catch { /* no temp */ }
+    if (locked) { try { withRollback(() => fs.unlinkSync(lock)); } catch { /* next run refuses */ } }
   }
 }

package/src/setup.js

@@ -57,6 +57,9 @@ export async function runSetup(options, progress = () => {}) {
     const where = options.runtime !== "local" ? { kind: "declared_cloud" } : environment;
     return fail("unsupported", "run_on_local_machine", "not_ready", null, remoteSetupAction(where, options.origin, options));
   }
+  if (new URL(options.origin).protocol === "http:") {
+    return fail("unsupported", "local_docker_transport_required", "not_ready", null);
+  }
   const trap = trapSignals();
   let receipt = null;
   let loginVerified = false;
@@ -112,9 +115,14 @@ export async function runSetup(options, progress = () => {}) {
     // An env key this setup does not own stops before any sign in, so the
     // refusal costs no approval and leaves the binding untouched. The check
     // after sign in stays, against a fresh read.
-    if (!saved) {
-      const early = currentEnvValues(preflightEnv({ project: root, envFile: options.envFile, signal: trap.signal }));
-      if (early.token !== null) return stop("conflict", "existing_ingest_key_unowned");
+    const early = currentEnvValues(preflightEnv({ project: root, envFile: options.envFile, signal: trap.signal }));
+    if (early.token !== null) {
+      if (!saved) return stop("conflict", "existing_ingest_key_unowned");
+      // The saved public route cannot choose the destination of a token.
+      // Require its colocated ingest destination before any sign-in request.
+      if (early.ingestUrl !== intendedOrigin && early.ingestUrl !== `${intendedOrigin}/v1/ingest`) {
+        return stop("conflict", "ingest_url_mismatch");
+      }
     }
     const bindingDiffers = bound !== null && (bound.origin !== intendedOrigin ||
       (intendedWorkspace !== null && bound.workspace_id !== intendedWorkspace));
@@ -182,6 +190,10 @@ export async function runSetup(options, progress = () => {}) {
     // being reused. Pending delivery is acknowledged, including after a
     // previous process stopped after the env write.
     if (previous && existing.token !== null) {
+      // Recheck the fresh env snapshot immediately before the bearer sink.
+      if (existing.ingestUrl !== origin && existing.ingestUrl !== `${origin}/v1/ingest`) {
+        return stop("conflict", "ingest_url_mismatch");
+      }
       const checked = await checkCredential(origin, existing.token, previous.value, profile, trap.signal);
       if (checked.ok) {
         if (existing.ingestUrl !== origin && existing.ingestUrl !== `${origin}/v1/ingest`) {

package/src/skill-bundle.js

@@ -5,7 +5,7 @@ import { readFileSync } from "node:fs";
 // public skill at the manifest's source_url. The source has no version of its
 // own, so the revision is derived from the content hash. The hash is pinned
 // here as well as in the manifest, so editing either file alone is detected.
-const PINNED_SHA256 = "ebf784673eff0280d85974504f93c683a1dabfb54156c9d27e091131462e9d5f";
+const PINNED_SHA256 = "f31c24c4074707df0e34502bd9efbfde4fff5703e6fd367e0f60692f9f5878ce";
 
 const ASSET_DIR = new URL("../assets/skill/", import.meta.url);
 const MANIFEST_KEYS = ["file", "manifest_version", "name", "revision", "sha256", "size", "source_url"];
@@ -55,7 +55,7 @@ export function loadBundledSkill() {
 // The workflow skills that "skills install" writes, vendored from the public
 // skills repository at one commit. The manifest's own hash is pinned here, and
 // the manifest pins each skill's hash, so changing any file alone is detected.
-const PINNED_PACK_SHA256 = "11ab983875911c4c2ad03d2a3b7b9e9213c410e77f4ff2d27b4059354b00fe0c";
+const PINNED_PACK_SHA256 = "0460133ebbe3bc4f1ea03e297f36a15b72b291ab9b9efb80a35df863ef974e0c";
 
 const PACK_DIR = new URL("../assets/skills/", import.meta.url);
 const PACK_KEYS = ["commit", "manifest_version", "repository", "skills"];

package/src/skill-trusted.js

@@ -0,0 +1,56 @@
+// Exact bytes of bundled skills from prior public releases and the previous bundle.
+// A repository receipt cannot authorize replacing arbitrary user-authored bytes.
+export const TRUSTED_SKILLS = {
+  "metergraph": [
+    "90f7d8d78a5b0b7a57436f194222f0c73310b0b04201c297c8fbf0b00ad6bb3f",
+    "d527a67efc42a55245b9c2c8fd2687c1f31f553e154a6242d0f31466993e314e",
+    "e7fc4eb7a22eeb16c357bede9d0a080ad3b415aaab1d9c72f164d5350d48c4b1",
+    "ebf784673eff0280d85974504f93c683a1dabfb54156c9d27e091131462e9d5f",
+    "482bdb6c32ad04766ba5159449a612419c90bfe78ea07038eb8d1ca7fb1edb76"
+  ],
+  "metergraph-analyze": [
+    "c45756ad1d33a360c7c845ca299d8c1ab1e2b8162865f635bc25c78358c2a1e6",
+    "e8bf1debf62aa7d33d3dd363e5d95d8f781e8ca23cde4619b5bb4133dd47a7a5",
+    "4544f8183a1259ef805eb89a72346ecc87306c70007b235436d6425787b85474"
+  ],
+  "metergraph-candidates": [
+    "acc0176e29ea5b867855c1f4691e01e4cb9295705b0ffc89ad0b348da9c47d8a",
+    "43de69d168091492310fc2f8851710e861a0b5cd3975c30a5c23d205abfcdfc6"
+  ],
+  "metergraph-evals": [
+    "b115c53c5ff4040ac35ff240aee6cb4b56465db0916d9f104f8ab433bfc77c60",
+    "9baef426288455b2be2ea8af2774a19c344b5b83f8e9046916f24f8bf744f2de"
+  ],
+  "metergraph-investigate": [
+    "470579faf9e8b5f1a562060d51ec5a71d1b9c47213403a2447dd40af56a74869",
+    "775dbe7ca1100b17638d0905302ef1324694a60b90372c6c3df7b598a8f70438",
+    "b06951926490aa0cd7a6ba0de5d8c1f21cac931ccab882552cea7ebea4ab7562"
+  ],
+  "metergraph-iterate": [
+    "9ce5a2cf527e3f9a81fddcabc4bfc0a4e4894df7b502df8672e3d66470e5a5e8",
+    "1c2a2ad249b0fdf7f9f201d99ff76b91a7cdfbf57dd8f43d61612775b9982445"
+  ],
+  "metergraph-local-bundle": [
+    "692cd8952a8a8896ec2c06091b329a7a01912e261e87d62a9458452172a7c9b0",
+    "c31286b7ee6dd8fc228e81565662ebaf4b0faf2ae92229602baf7c809202491b",
+    "3afd094368053023716c3c76893b51f6ae4b45e38211f69e2bbc5117c86d9a51"
+  ],
+  "metergraph-model-swap": [
+    "d77ee37f882ab1e50dc4a093e64a2c3661f4cd9bb59f184da6dccbd76fd51a18",
+    "8fbf010d11b75bbe26fb13f776251038fab4688ccbfe58f3c582c469cf149433"
+  ],
+  "metergraph-onboarding": [
+    "409d105f3b042514fd347a1fffc5489a94c01d1bc8aac55800e8c9f13a66a2c1",
+    "6e6f418933f37b34437035ab3171344d43f37dee3770815b19f97efb62e5f1d1",
+    "8ee73ecfe42894c74b16fbc3675a234452f152f248f8f574be3f04dd6e509805"
+  ],
+  "metergraph-report": [
+    "0cdbeb684c4f7f87932784db832f376cff984fe0220a1167f1a73edd550450b7",
+    "58add8f6a32191e6fc01ca533a700e190a8e6da412e619bca38c65a481ea9fb5",
+    "90d52900067616330ce073d7d47b302120c4d0f4f8ffbef712eeec0a0bae4153"
+  ],
+  "metergraph-workloads": [
+    "caf819780722f941b9d6b2f9564413a7deadda53439c973a7764be1b6eca98e5",
+    "bd28b1710fc5dfc082fa53bbcd32f8a3300338a37b82c14a87c8849d41a3fc24"
+  ]
+};

package/src/skill.js

@@ -1,5 +1,7 @@
+import { TRUSTED_SKILLS } from "./skill-trusted.js";
+
 import { randomBytes } from "node:crypto";
-import fs from "node:fs";
+import fs, { validatePath, withRollback } from "./anchored-fs.js";
 import path from "node:path";
 
 import {
@@ -31,6 +33,7 @@ const ENTRY_KEYS = ["client", "path", "revision", "runtimes", "sha256", "skill"]
 const NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
 
 const MESSAGES = {
+  secure_writes_unavailable: "Secure automatic file writes are unavailable on this platform or the bundled filesystem helper failed verification. Nothing was written.",
   invalid_project: "--project must name an existing directory.",
   client_not_supported:
     "This client cannot load project skill files. Follow the connection guide instead. Nothing was written.",
@@ -114,7 +117,7 @@ function apply(root, context) {
         return plan.status;
       } finally {
         try {
-          fs.unlinkSync(lockPath);
+          withRollback(() => fs.unlinkSync(lockPath));
         } catch {
           // A lock that cannot be removed is reported by the next run.
         }
@@ -134,7 +137,8 @@ function resolveProject(project) {
   try {
     const real = fs.realpathSync(path.resolve(project ?? process.cwd()));
     if (fs.statSync(real).isDirectory()) return real;
-  } catch {
+  } catch (error) {
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     // Fall through to the fixed error.
   }
   throw new Stop("invalid_input", "invalid_project");
@@ -180,6 +184,10 @@ function decide(action, runtime, state, bundle) {
   if (file !== null && (file.content === null || sha256Hex(file.content) !== entry.sha256)) {
     throw new Stop("conflict", "modified");
   }
+  if (file !== null && entry.sha256 !== bundle.sha256 &&
+      !TRUSTED_SKILLS[bundle.name]?.includes(entry.sha256)) {
+    throw new Stop("conflict", "not_owned");
+  }
   const current = entry.revision === bundle.revision;
   if (!current && action === "install") throw new Stop("conflict", "update_required");
   if (file !== null && current) {
@@ -200,6 +208,7 @@ function commit(root, context, state, plan) {
   const receipt = nextReceipt(state.receipt, context, target.relative);
   let createdDirs = [];
   let skillWritten = false;
+  let receiptWritten = false;
   try {
     if (plan.writeSkill) {
       createdDirs = ensureDirs(root, target.dirs);
@@ -208,13 +217,23 @@ function commit(root, context, state, plan) {
     }
     if (state.receiptFile === null || !state.receiptFile.content.equals(receipt)) {
       replaceFile(receiptPath, receipt, state.receiptFile);
+      receiptWritten = true;
     }
+    validatePath(root);
+    validatePath(path.dirname(skillPath));
+    validatePath(path.dirname(receiptPath));
   } catch (error) {
     try {
-      if (skillWritten) {
-        if (state.file === null) fs.unlinkSync(skillPath);
-        else replaceFile(skillPath, state.file.content, { content: bundle.content, mode: state.file.mode });
-      }
+      withRollback(() => {
+        if (receiptWritten) {
+          if (state.receiptFile === null) fs.unlinkSync(receiptPath);
+          else replaceFile(receiptPath, state.receiptFile.content, { content: receipt, mode: state.receiptFile.mode });
+        }
+        if (skillWritten) {
+          if (state.file === null) fs.unlinkSync(skillPath);
+          else replaceFile(skillPath, state.file.content, { content: bundle.content, mode: state.file.mode });
+        }
+      });
     } catch {
       throw new Stop("filesystem_error", "rollback_failed");
     }
@@ -325,7 +344,7 @@ function ensureDirs(root, dirs) {
 function removeDirs(created) {
   for (const dir of [...created].reverse()) {
     try {
-      fs.rmdirSync(dir);
+      withRollback(() => fs.rmdirSync(dir));
     } catch {
       // Not empty or not removable. An empty directory is harmless.
     }
@@ -382,7 +401,7 @@ function replaceFile(dest, content, previous) {
     fs.renameSync(temp, dest);
   } catch (error) {
     try {
-      fs.unlinkSync(temp);
+      withRollback(() => fs.unlinkSync(temp));
     } catch {
       // Already renamed or never created.
     }

package/src/style.js

@@ -1,5 +1,3 @@
-import { EXIT_CODES } from "./constants.js";
-
 // Presentation for human (non --json) output: a status headline, aligned
 // fields and next steps. Color is used only when the stream is a terminal
 // and NO_COLOR is unset (https://no-color.org); FORCE_COLOR turns it on.
@@ -42,18 +40,38 @@ export function toneFor(outcome) {
   return "fail";
 }
 
-export function headline(style, tone, title, outcome = null) {
+export function headline(style, tone, title) {
   const [icon, color] = TONES[tone];
-  let line = `${style[color](icon)} ${style.bold(title)}`;
-  if (outcome !== null && outcome !== "ok") line += `  ${style.dim(`(${outcome}, exit ${EXIT_CODES[outcome]})`)}`;
+  const line = `${style[color](icon)} ${style.bold(title)}`;
+  // Machine outcomes and numeric codes belong to JSON and the scripting reference.
   return line;
 }
 
+// How text output names a workspace: "Name (slug)", or the slug or name
+// alone, from data the service verified. Never by its ID; null when neither
+// is known, and the row is then left out.
+export function workspaceShown(workspace) {
+  if (!workspace) return null;
+  const slug = workspace.slug ?? null;
+  const name = workspace.name ?? null;
+  if (slug !== null && name !== null) return `${name} (${slug})`;
+  return slug ?? name;
+}
+
 // Aligned "label  value" rows. Rows whose value is null or undefined are left out.
 export function fields(style, rows, indent = "  ") {
   const shown = rows.filter(([, value]) => value !== null && value !== undefined);
   const width = Math.max(0, ...shown.map(([label]) => label.length));
-  return shown.map(([label, value]) => `${indent}${style.dim(label.padEnd(width))}  ${value}`);
+  return shown.flatMap(([label, value]) => {
+    if (!Number.isFinite(style.width)) return [`${indent}${style.dim(label.padEnd(width))}  ${value}`];
+    const prefix = `${indent}${label.padEnd(width)}  `;
+    if (prefix.length > style.width / 2) {
+      return [`${indent}${style.dim(label)}`, ...paragraph(style, value, indent + "  ")];
+    }
+    const wrapped = paragraph(style, value, " ".repeat(prefix.length));
+    if (!wrapped.length) return [`${indent}${style.dim(label.padEnd(width))}  `];
+    return [`${indent}${style.dim(label.padEnd(width))}  ${wrapped[0].trimStart()}`, ...wrapped.slice(1)];
+  });
 }
 
 // Indents prose and wraps it to style.width.
@@ -78,7 +96,15 @@ export function steps(style, rows) {
   const shown = rows.filter(([, value]) => value !== null && value !== undefined);
   const width = Math.max(0, ...shown.map(([label]) => label.length));
   return shown.flatMap(([label, value]) => {
-    if (label) return [`${style.cyan("→")} ${label.padEnd(width)}  ${value}`];
+    if (label) {
+      if (!Number.isFinite(style.width)) return [`${style.cyan("→")} ${label.padEnd(width)}  ${value}`];
+      const prefix = `→ ${label.padEnd(width)}  `;
+      if (prefix.length > style.width / 2) {
+        return [`${style.cyan("→")} ${label}`, ...paragraph(style, value, "  ")];
+      }
+      const wrapped = paragraph(style, value, " ".repeat(prefix.length));
+      return [`${style.cyan("→")} ${label.padEnd(width)}  ${wrapped[0]?.trimStart() ?? ""}`, ...wrapped.slice(1)];
+    }
     // Unlabeled steps are prose: wrap them with a hanging indent.
     const [first, ...rest] = paragraph(style, value, "  ");
     return [`${style.cyan("→")} ${first.trimStart()}`, ...rest];

package/src/tools-output.js

@@ -0,0 +1,73 @@
+import { jsonText } from "./output.js";
+import { noticeText, readMessage } from "./read-output.js";
+import { PLAIN, fields, headline, paragraph, render, steps, toneFor, workspaceShown } from "./style.js";
+
+// Fixed text for tools results. A tool's result and error are the service's
+// own JSON, printed with jsonText so no control or bidirectional character
+// reaches the terminal; tool titles are printed with them removed.
+
+const MESSAGES = {
+  tool_unavailable:
+    "This credential cannot use that tool here: the name is unknown, the tool needs more access, or this " +
+    "deployment does not offer it. Nothing was called.",
+  confirmation_required:
+    "This tool writes, starts work or calls a model provider, so it runs only with --yes, once the person has " +
+    "approved this exact call. Nothing was sent.",
+  tool_error: "The service refused the call; the tool error below says why.",
+  tool_rejected: "The service rejected the call's arguments; the tool error below says why.",
+  tool_call_unconfirmed:
+    "The call reached the service, but its answer was not confirmed, so it may have taken effect. Check before " +
+    "calling it again.",
+  tool_response_invalid: "The service's answer to the tool request does not match the MCP protocol.",
+  tools_unavailable: "This service does not list Agent Access tools.",
+  args_invalid: "The arguments are not one JSON object. Nothing was sent.",
+  args_too_large: "The arguments are larger than 1 MiB. Nothing was sent.",
+  args_file_unreadable: "The --args-file file could not be read as a regular file. Nothing was sent.",
+};
+
+export function toolsMessage(outcome, reason) {
+  return MESSAGES[reason] ?? readMessage(outcome, reason);
+}
+
+const CONTROL = /[\u061c\u0000-\u001f\u007f-\u009f‎‏‪-‮⁦-⁩]/g;
+const plain = (value) => (typeof value === "string" ? value.replace(CONTROL, "") : "");
+
+function kindOf(tool) {
+  if (tool.read_only && !tool.open_world) return "read";
+  return tool.open_world ? "calls out, needs --yes" : "writes, needs --yes";
+}
+
+export function toolsText(result, message, style = PLAIN, action) {
+  const data = result.data;
+  const title = action === "list" ? "Agent Access tools" : `Tool ${data.result?.tool ?? ""}`.trim();
+  const lines = [headline(style, result.ok ? "info" : toneFor(result.outcome), result.ok ? title : result.outcome === "unconfirmed" ? "Tool call unconfirmed" : `${title} did not run`, result.outcome), ""];
+  lines.push(...fields(style, [["Origin", data.origin], ["Workspace", workspaceShown(data.workspace)], ["Credential", data.credential === "agent_key" ? "coding-agent key" : "saved sign in"]]), "");
+  for (const notice of data.notices) {
+    const message = noticeText(notice);
+    if (message) lines.push(...paragraph(style, message), "");
+  }
+  if (data.retry_after_seconds !== null) lines.push(...fields(style, [["Retry after", `${data.retry_after_seconds} seconds`]]), "");
+  if (result.ok && action === "list") {
+    const tools = data.result.tools;
+    const width = Math.max(4, ...tools.map((tool) => tool.name.length));
+    for (const tool of tools) {
+      lines.push(`  ${tool.name.padEnd(width)}  ${style.dim(kindOf(tool))}`);
+      if (tool.title) lines.push(`  ${"".padEnd(width)}  ${plain(tool.title)}`);
+    }
+    if (tools.length === 0) lines.push("  No tools are offered to this credential.");
+    lines.push("", ...steps(style, [["", "Call one with metergraph tools call NAME --args '{...}'. Add --json for its input schema."]]));
+    return render(lines);
+  }
+  if (result.ok) {
+    lines.push(...jsonText(data.result.result, 2).split("\n").map((line) => `  ${line}`));
+    return render(lines);
+  }
+  lines.push(...paragraph(style, message));
+  if (data.tool_error) {
+    lines.push("", ...jsonText(data.tool_error, 2).split("\n").map((line) => `  ${line}`));
+  }
+  if (data.next_action?.message) {
+    lines.push("", ...steps(style, [["", data.next_action.message], ["Run", data.next_action.command ?? null]]));
+  }
+  return render(lines);
+}