muse-crew 0.14.4 → 0.14.6

package/lib/publish-content.js

@@ -1,154 +0,0 @@
-// publish-content.js — shared deterministic content-judgment primitives.
-//
-// Parent publish verification (lib/verify-publish.js) and unknown-recovery
-// classification (lib/classify-publish-absence.js) both judge the same
-// question — "does the on-disk source contain the publish commit's diff?" —
-// against the same diff parser, findings parser, and collision-exemption
-// rules. Two copies of the collision logic already diverged once (2026-09-15,
-// task 00bca4b8); this module is the single source of truth.
-//
-// ESM (imported by verify-publish.js and classify-publish-absence.js).
-// Pure and deterministic: no wall-clock reads, no randomness, no I/O except
-// the git subprocesses in makeOldCounter (read-only).
-
-import { execFileSync } from "node:child_process";
-
-export const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-
-// Parse `git diff base commit` into per-file added/removed lines.
-// Byte-identical split to build-readback-request.js and the old
-// verify-publish.js inline parser (the verifier looks raw lines up
-// verbatim, so all consumers must agree on the split).
-export function parseDiff(diffText) {
-  const expected = new Map(); // path -> { added: [], removed: [], isBinary: bool }
-  let curFile = null;
-  for (const line of diffText.split("\n")) {
-    if (line.startsWith("diff --git")) {
-      const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
-      curFile = m ? m[2] : "unknown";
-      expected.set(curFile, { added: [], removed: [], isBinary: false });
-    } else if (curFile && line.startsWith("Binary files ")) {
-      expected.get(curFile).isBinary = true;
-    } else if (curFile && line.startsWith("+") && !line.startsWith("+++")) {
-      expected.get(curFile).added.push(line.slice(1));
-    } else if (curFile && line.startsWith("-") && !line.startsWith("---")) {
-      expected.get(curFile).removed.push(line.slice(1));
-    }
-  }
-  return expected;
-}
-
-// Parse the machine-readable findings block:
-//   FILE: <path>
-//   ADDED: <line> :: PRESENT|ABSENT
-//   REMOVED: <line> :: PRESENT|ABSENT
-//   END_FILE
-export function parseFindings(text) {
-  const findings = new Map(); // path -> { added: Map(line->verdict), removed: Map(line->verdict) }
-  let cur = null;
-  let malformed = null;
-  for (const rawLine of text.split("\n")) {
-    const line = rawLine.trimEnd();
-    if (line.startsWith("FILE: ")) {
-      cur = { added: new Map(), removed: new Map() };
-      findings.set(line.slice(6).trim(), cur);
-    } else if (line === "END_FILE") {
-      cur = null;
-    } else if (cur && (line.startsWith("ADDED: ") || line.startsWith("REMOVED: "))) {
-      const kind = line.startsWith("ADDED: ") ? "added" : "removed";
-      const rest = line.slice(kind === "added" ? 7 : 9);
-      const sep = rest.lastIndexOf(" :: ");
-      if (sep < 0) { malformed = `malformed finding line: ${line.slice(0, 80)}`; break; }
-      const content = rest.slice(0, sep);
-      const verdict = rest.slice(sep + 4).trim();
-      if (verdict !== "PRESENT" && verdict !== "ABSENT") {
-        malformed = `bad verdict: ${verdict}`;
-        break;
-      }
-      cur[kind].set(content, verdict);
-    }
-  }
-  return { findings, malformed };
-}
-
-// Whole-line occurrence counts of a file's content at <base>.
-// [] when the base is the empty tree or the file did not exist there.
-function oldTreeLines(repoPath, base, path) {
-  if (base === EMPTY_TREE) return [];
-  let text;
-  try {
-    text = execFileSync("git", ["-C", repoPath, "show", `${base}:${path}`], {
-      encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
-    });
-  } catch {
-    return [];
-  }
-  if (text === "") return [];
-  const lines = text.split("\n");
-  if (lines[lines.length - 1] === "") lines.pop(); // drop the trailing-newline artifact
-  return lines;
-}
-
-// Returns (path, line) => occurrences of line in path's old tree.
-// Cached per path. Read-only git subprocesses.
-export function makeOldCounter(repoPath, base) {
-  const cache = new Map(); // path -> Map(line -> count)
-  return (path, line) => {
-    let counts = cache.get(path);
-    if (counts === undefined) {
-      counts = new Map();
-      for (const l of oldTreeLines(repoPath, base, path)) {
-        counts.set(l, (counts.get(l) || 0) + 1);
-      }
-      cache.set(path, counts);
-    }
-    return counts.get(line) || 0;
-  };
-}
-
-// Split each file's diff lines into discriminating vs non-discriminating.
-//
-// A line has zero discriminating power when its presence/absence cannot
-// tell "hunk landed" from "hunk dropped":
-//   - added line already in the old tree (colliding pre-existing line):
-//     PRESENT whether or not the hunk landed.
-//   - removed line occurring in the old tree strictly more times than the
-//     diff removes it: PRESENT whether or not the removal happened.
-//
-// Returns Map(path -> {
-//   addedDisc: [...], removedDisc: [...],   // discriminating lines
-//   unjudgeable: null | "binary-or-mode-or-rename" | "fully-colliding-added"
-// }).
-// unjudgeable marks files the line-based judge cannot certify at all:
-// a diff with no content lines (binary, mode-only, rename), or added
-// lines that ALL collide (their PRESENT findings prove nothing).
-export function discriminatingLines(diffMap, oldCount) {
-  const out = new Map();
-  for (const [path, exp] of diffMap) {
-    const entry = { addedDisc: [], removedDisc: [], unjudgeable: null };
-    if (exp.added.length === 0 && exp.removed.length === 0) {
-      entry.unjudgeable = "binary-or-mode-or-rename";
-      out.set(path, entry);
-      continue;
-    }
-    for (const line of exp.added) {
-      if (oldCount(path, line) === 0) entry.addedDisc.push(line);
-    }
-    // The diff may remove the same line more than once; the old tree must
-    // account for every removal before a line counts as colliding.
-    const removedBudget = new Map();
-    for (const line of exp.removed) {
-      removedBudget.set(line, (removedBudget.get(line) || 0) + 1);
-    }
-    for (const line of exp.removed) {
-      if (oldCount(path, line) <= removedBudget.get(line)) {
-        entry.removedDisc.push(line);
-      }
-    }
-    if (exp.added.length > 0 && entry.addedDisc.length === 0) {
-      entry.unjudgeable = "fully-colliding-added";
-    }
-    out.set(path, entry);
-  }
-  return out;
-}

package/lib/readback-disk.js

@@ -1,195 +0,0 @@
-#!/usr/bin/env node
-// readback-disk.js — deterministic disk read-back sensor for parent publish
-// verification (docs/publish-verification.md).
-//
-// The read-back gap (2026-09-14): the platform removed `artifact_inspect`
-// and no agent-callable content read-back existed, so every artifact publish
-// parked at `publish: verification-requested` permanently. The platform's
-// artifact edits land in its on-disk working copy of the artifact source
-// (~/workspace/ts-spaces/<slug>/ — verified empirically 2026-09-15: added
-// lines present, removed lines absent across real platform commits), so a
-// deterministic local sensor can replace the removed inspection tool: no
-// LLM, no async handoff, no prose to parse.
-//
-// This script is the SENSOR; lib/verify-publish.js stays the judge. It
-// emits the exact machine-readable findings block the verifier already
-// parses:
-//
-//   FILE: <path>
-//   ADDED: <exact added line from the diff> :: PRESENT|ABSENT
-//   REMOVED: <exact removed line from the diff> :: PRESENT|ABSENT
-//   END_FILE
-//
-// one ADDED line per (+) diff line and one REMOVED line per (-) diff line,
-// in diff order. The verdict is PRESENT iff that exact line occurs in the
-// file's CURRENT on-disk source (whole-line match), ABSENT otherwise.
-//
-// Authority boundary: the sensor reads the platform's working copy of the
-// artifact source — the tree the hosted artifact is built/served from. If
-// the working copy is stale relative to a just-applied edit, the findings
-// honestly report ABSENT and the verifier fails CLOSED (parked, never a
-// false stamp). Staleness can only park, never certify.
-//
-// Usage:
-//   node readback-disk.js --repo-path <path> --commit <sha> --base <sha>
-//       --slug <artifact-slug> --task-id <uuid> [--spaces-root <dir>]
-//
-// --base is the previously-stamped provenance source_commit (or the
-// empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
-// publish) — the SAME base the verifier uses. --spaces-root defaults to
-// ~/workspace/ts-spaces.
-//
-// Exit codes: 0 ok (findings block on stdout) · 2 usage/validation ·
-// 1 git/diff/read failure. On non-zero exit NOTHING is printed to stdout,
-// so a caller must never save stdout as a findings file.
-//
-// Security: the slug is charset-validated and the resolved space directory
-// must stay under the spaces root (realpath containment); every file path
-// from the diff is likewise contained before reading. A path that escapes
-// is a validation failure (exit 2), never a read.
-
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-
-// --help: before required-arg parsing (shebang⇔CLI contract).
-if (process.argv.slice(2).includes("--help")) {
-  console.log(
-    "usage: node readback-disk.js --repo-path <path> --commit <sha> --base <sha> --task-id <uuid> --slug <artifact-slug> [--spaces-root <dir>]\n" +
-    "the deterministic disk read-back SENSOR: emits the machine-readable findings block (FILE:/ADDED:/REMOVED:/END_FILE)"
-  );
-  process.exit(0);
-}
-
-const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-
-function arg(name) {
-  const i = process.argv.indexOf(name);
-  if (i < 0 || i + 1 >= process.argv.length) {
-    fail("usage", `${name} is required.`, 2);
-  }
-  return process.argv[i + 1];
-}
-function fail(code, message, exitCode) {
-  // stderr only — stdout must stay empty on failure.
-  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
-  process.exit(exitCode);
-}
-
-const repoPath = arg("--repo-path");
-const commit = arg("--commit");
-const base = arg("--base");
-const slug = arg("--slug");
-const taskId = arg("--task-id");
-const spacesRoot = process.argv.includes("--spaces-root")
-  ? arg("--spaces-root")
-  : join(homedir(), "workspace", "ts-spaces");
-
-if (!/^[0-9a-f]{40}$/.test(commit)) fail("usage", "commit must be a 40-char hex sha.", 2);
-if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "base must be a 40-char hex sha.", 2);
-if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(slug)) {
-  fail("usage", `slug ${JSON.stringify(slug)} is not a safe artifact slug.`, 2);
-}
-
-// Resolve the space directory with realpath containment: the slug must not
-// escape the spaces root (no "..", no symlinks pointing out).
-let spaceDir;
-try {
-  const rootReal = realpathSync(spacesRoot);
-  const candReal = realpathSync(join(spacesRoot, slug));
-  if (candReal !== rootReal && !candReal.startsWith(rootReal + "/")) {
-    fail("usage", `slug ${JSON.stringify(slug)} resolves outside the spaces root.`, 2);
-  }
-  spaceDir = candReal;
-} catch (e) {
-  fail("usage", `cannot resolve space dir for slug ${JSON.stringify(slug)}: ${e.message}`, 2);
-}
-try {
-  if (!statSync(spaceDir).isDirectory()) fail("usage", `space dir ${spaceDir} is not a directory.`, 2);
-} catch (e) {
-  fail("usage", `space dir ${spaceDir} unreadable: ${e.message}`, 2);
-}
-
-// The publish delta is base..commit — the same diff the verifier checks the
-// findings against. Refuse a base that is not an ancestor: certifying a
-// diff against an unrelated tree is worse than no read-back.
-if (base !== EMPTY_TREE) {
-  try {
-    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, commit], { stdio: "ignore" });
-  } catch (e) {
-    fail("usage", `base ${base} is not an ancestor of commit ${commit} — refusing to read back an unrelated tree.`, 2);
-  }
-}
-
-let diff;
-try {
-  diff = execFileSync("git", ["-C", repoPath, "diff", base, commit, "--"], {
-    encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
-  });
-} catch (e) {
-  fail("git", `git diff failed: ${e.message}`, 1);
-}
-if (!diff.trim()) {
-  fail("git", "empty diff for commit — nothing to read back.", 1);
-}
-
-// Parse the diff into per-file added/removed lines (byte-identical parser
-// to build-readback-request.js and verify-publish.js: the verifier looks
-// the raw lines up verbatim, so all three must agree on the split).
-const files = [];
-let current = null;
-for (const line of diff.split("\n")) {
-  if (line.startsWith("diff --git")) {
-    const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
-    current = { path: m ? m[2] : "unknown", added: [], removed: [] };
-    files.push(current);
-  } else if (current && line.startsWith("+") && !line.startsWith("+++")) {
-    current.added.push(line.slice(1));
-  } else if (current && line.startsWith("-") && !line.startsWith("---")) {
-    current.removed.push(line.slice(1));
-  }
-}
-
-// Whole-line content of a disk file, normalized for the membership test.
-// Trailing-newline artifact popped (same convention as verify-publish.js
-// oldTreeLines); one trailing CR stripped per line so CRLF working copies
-// compare honestly against LF diffs. The RAW diff lines are still what get
-// emitted — the verifier looks those up verbatim.
-const norm = (s) => (s.endsWith("\r") ? s.slice(0, -1) : s);
-function diskLines(absPath) {
-  if (!existsSync(absPath)) return new Set(); // missing file: every line ABSENT
-  let text;
-  try {
-    text = readFileSync(absPath, "utf8");
-  } catch (e) {
-    fail("read", `cannot read ${absPath}: ${e.message}`, 1);
-  }
-  const lines = text.split("\n");
-  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
-  return new Set(lines.map(norm));
-}
-
-const out = [];
-for (const f of files) {
-  // Contain every diff path inside the space dir before reading.
-  const abs = resolve(spaceDir, f.path);
-  if (abs !== spaceDir && !abs.startsWith(spaceDir + "/")) {
-    fail("usage", `diff path ${JSON.stringify(f.path)} escapes the space dir.`, 2);
-  }
-  const present = diskLines(abs);
-  out.push(`FILE: ${f.path}`);
-  for (const line of f.added) {
-    out.push(`ADDED: ${line} :: ${present.has(norm(line)) ? "PRESENT" : "ABSENT"}`);
-  }
-  for (const line of f.removed) {
-    out.push(`REMOVED: ${line} :: ${present.has(norm(line)) ? "PRESENT" : "ABSENT"}`);
-  }
-  out.push("END_FILE");
-}
-
-process.stdout.write(out.join("\n") + "\n");
-process.stderr.write(JSON.stringify({
-  ok: true, slug, task_id: taskId, commit, base,
-  files: files.map((f) => f.path),
-} ) + "\n");