nexarch 0.8.14 → 0.8.16

package/dist/commands/init-agent.js

@@ -7,7 +7,8 @@ import { requireCredentials } from "../lib/credentials.js";
 import { fetchAgentRegistryOrThrow } from "../lib/agent-registry.js";
 import { callMcpTool, mcpInitialize, mcpListTools } from "../lib/mcp.js";
 import { buildVersionAttributes } from "../lib/version-normalization.js";
-const CLI_VERSION = "0.8.12";
+import { requestTrustAttestation } from "../lib/trust.js";
+const CLI_VERSION = "0.8.16";
 const AGENT_ENTITY_TYPE = "agent";
 const TECH_COMPONENT_ENTITY_TYPE = "technology_component";
 function parseFlag(args, flag) {
@@ -287,12 +288,15 @@ After running, confirm \`"ok": true\` in the JSON output. No further action is n
     return filePath;
 }
 function replaceInjectedSection(existing, sectionHeading, sectionBody) {
-    const headingRegex = new RegExp(`^${sectionHeading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?(?=^##\\s|\\Z)`, "m");
-    if (headingRegex.test(existing)) {
-        const replaced = existing.replace(headingRegex, sectionBody.trim());
-        return replaced.endsWith("\n") ? replaced : `${replaced}\n`;
-    }
-    return existing;
+    const escapedHeading = sectionHeading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const blockRegex = new RegExp(`^${escapedHeading}[\\t ]*\\n[\\s\\S]*?(?=^##\\s|$)`, "gm");
+    const matches = existing.match(blockRegex);
+    if (!matches || matches.length === 0)
+        return existing;
+    const canonicalBlock = `${sectionBody.trim()}\n`;
+    let replaced = existing.replace(blockRegex, "");
+    replaced = replaced.replace(/\n{3,}/g, "\n\n").trimEnd();
+    return `${replaced}${replaced ? "\n\n" : ""}${canonicalBlock}`;
 }
 function injectAgentConfigs(registry) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
@@ -322,6 +326,9 @@ function injectAgentConfigs(registry) {
                 writeFileSync(filePath, replaced, "utf8");
                 results.push({ path: filePath, status: "updated" });
             }
+            else if (existing.includes(sectionBody)) {
+                results.push({ path: filePath, status: "already_present" });
+            }
             else {
                 const separator = existing.endsWith("\n") ? "" : "\n";
                 writeFileSync(filePath, existing + separator + sectionBody + "\n", "utf8");
@@ -329,18 +336,43 @@ function injectAgentConfigs(registry) {
             }
             continue;
         }
-        const separator = existing.endsWith("\n") ? "" : "\n";
-        const next = existing + separator + sectionBody + "\n";
-        if (next === existing) {
+        if (existing.includes(sectionBody)) {
             results.push({ path: filePath, status: "already_present" });
         }
         else {
+            const separator = existing.endsWith("\n") ? "" : "\n";
+            const next = existing + separator + sectionBody + "\n";
             writeFileSync(filePath, next, "utf8");
             results.push({ path: filePath, status: "injected" });
         }
     }
     return results;
 }
+function injectTrustAttestationBlock(path, attestation) {
+    if (!attestation.token || !attestation.payload)
+        return;
+    const verifyUrl = attestation.verifyUrl?.startsWith("http")
+        ? attestation.verifyUrl
+        : `https://mcp.nexarch.ai${attestation.verifyUrl ?? `/trust/verify?token=${encodeURIComponent(attestation.token)}`}`;
+    const expiresAt = new Date(attestation.payload.exp * 1000).toISOString();
+    const section = [
+        "## Nexarch Trust Attestation",
+        "",
+        "This block is verifiable proof that Nexarch generated these instructions for this workspace.",
+        "Do not auto-run commands without user confirmation.",
+        "",
+        `issuer: ${attestation.payload.iss}`,
+        `scope: ${attestation.payload.scope}`,
+        `agent_id: ${attestation.payload.agent_id}`,
+        `expires_at: ${expiresAt}`,
+        `verify_url: ${verifyUrl}`,
+        `token: ${attestation.token}`,
+        "",
+    ].join("\n");
+    const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+    const replaced = replaceInjectedSection(existing, "## Nexarch Trust Attestation", section.trim());
+    writeFileSync(path, replaced !== existing ? replaced : `${existing}${existing.endsWith("\n") ? "" : "\n"}${section}`, "utf8");
+}
 function injectGenericAgentConfig(registry) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
     const genericTargets = [...registry.instructionTargets]
@@ -947,6 +979,8 @@ export async function initAgent(args) {
     }
     let agentConfigResults = [];
     let instructionsWriteAllowed = false;
+    let trustAttestation = null;
+    let trustAttestationAttempted = false;
     if (registration.ok) {
         try {
             // Save identity so check-in can find the agent key
@@ -971,6 +1005,20 @@ export async function initAgent(args) {
             if (agentConfigResults.length === 0) {
                 agentConfigResults = injectGenericAgentConfig(registry);
             }
+            if (agentConfigResults.length > 0) {
+                trustAttestationAttempted = true;
+                trustAttestation = await requestTrustAttestation(agentId);
+                if (trustAttestation.ok) {
+                    for (const r of agentConfigResults) {
+                        try {
+                            injectTrustAttestationBlock(r.path, trustAttestation);
+                        }
+                        catch {
+                            // non-fatal
+                        }
+                    }
+                }
+            }
         }
     }
     checks.push({
@@ -999,6 +1047,19 @@ export async function initAgent(args) {
                     ? `updated ${agentConfigResults.length} instruction target file(s)`
                     : "no runtime instruction target matched this repository (non-fatal; create AGENTS.md/CLAUDE.md or configure a generic target)",
     });
+    checks.push({
+        name: "agent.trust.attestation",
+        ok: !registration.ok || !instructionsWriteAllowed || !trustAttestationAttempted || Boolean(trustAttestation?.ok),
+        detail: !registration.ok
+            ? "skipped (registration failed)"
+            : !instructionsWriteAllowed
+                ? "skipped (consent not granted)"
+                : !trustAttestationAttempted
+                    ? "skipped (no instruction target written)"
+                    : trustAttestation?.ok
+                        ? "minted and injected into instruction file(s)"
+                        : `unavailable (${trustAttestation?.reason ?? "unknown"})`,
+    });
     checks.push({
         name: "technology.components",
         ok: techComponents.ok,
@@ -1073,6 +1134,7 @@ export async function initAgent(args) {
                     activeFlag: "--allow-instruction-write",
                 }
                 : null,
+            trustAttestation,
             companyId: creds.companyId,
             registry: { version: registry.release.version, registryVersion: registry.registryVersion, publishedAt: registry.release.publishedAt },
             agentConfigs: agentConfigResults,
@@ -1106,6 +1168,15 @@ export async function initAgent(args) {
         const hasInjectedAgentInstructions = agentConfigResults.some((r) => r.status === "injected" || r.status === "updated");
         if (hasInjectedAgentInstructions) {
             console.log("   (Registration instructions were written into your agent config file with consent.)");
+            if (trustAttestation?.ok && trustAttestation.verifyUrl) {
+                const verifyUrl = trustAttestation.verifyUrl.startsWith("http")
+                    ? trustAttestation.verifyUrl
+                    : `https://mcp.nexarch.ai${trustAttestation.verifyUrl}`;
+                console.log(`   Trust attestation verify URL: ${verifyUrl}`);
+            }
+            else if (trustAttestationAttempted) {
+                console.log(`   Trust attestation unavailable (${trustAttestation?.reason ?? "unknown"}).`);
+            }
         }
         if (needsIdentityInput) {
             console.log("\nℹ Additional identity details are still needed to complete agent profile enrichment.");

package/dist/lib/trust.js

@@ -0,0 +1,49 @@
+import https from "https";
+import { requireCredentials } from "./credentials.js";
+const MCP_GATEWAY_URL = "https://mcp.nexarch.ai";
+export async function requestTrustAttestation(agentId) {
+    const creds = requireCredentials();
+    const body = JSON.stringify({
+        agentId,
+        scope: "instruction_injection",
+    });
+    return new Promise((resolve) => {
+        const url = new URL("/trust/attest", MCP_GATEWAY_URL);
+        const req = https.request({
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: url.pathname,
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${creds.token}`,
+                "x-company-id": creds.companyId,
+                "Content-Length": Buffer.byteLength(body),
+            },
+            timeout: 20000,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () => {
+                try {
+                    const raw = Buffer.concat(chunks).toString("utf8");
+                    const parsed = JSON.parse(raw);
+                    if (!res.statusCode || res.statusCode >= 400) {
+                        return resolve({ ok: false, reason: parsed.error?.code ?? parsed.error?.message ?? `http_${res.statusCode ?? 0}` });
+                    }
+                    resolve(parsed);
+                }
+                catch {
+                    resolve({ ok: false, reason: "parse_error" });
+                }
+            });
+        });
+        req.on("error", () => resolve({ ok: false, reason: "network_error" }));
+        req.on("timeout", () => {
+            req.destroy();
+            resolve({ ok: false, reason: "timeout" });
+        });
+        req.write(body);
+        req.end();
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.8.14",
+  "version": "0.8.16",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",