nexarch 0.8.15 → 0.8.17

package/dist/commands/init-agent.js

@@ -8,7 +8,7 @@ import { fetchAgentRegistryOrThrow } from "../lib/agent-registry.js";
 import { callMcpTool, mcpInitialize, mcpListTools } from "../lib/mcp.js";
 import { buildVersionAttributes } from "../lib/version-normalization.js";
 import { requestTrustAttestation } from "../lib/trust.js";
-const CLI_VERSION = "0.8.12";
+const CLI_VERSION = "0.8.17";
 const AGENT_ENTITY_TYPE = "agent";
 const TECH_COMPONENT_ENTITY_TYPE = "technology_component";
 function parseFlag(args, flag) {
@@ -287,13 +287,39 @@ After running, confirm \`"ok": true\` in the JSON output. No further action is n
     writeFileSync(filePath, content, "utf8");
     return filePath;
 }
+function managedMarkers(key) {
+    return {
+        start: `<!-- nexarch:${key}:start -->`,
+        end: `<!-- nexarch:${key}:end -->`,
+    };
+}
+function wrapManagedSection(key, body) {
+    const markers = managedMarkers(key);
+    return `${markers.start}\n${body.trim()}\n${markers.end}`;
+}
+function replaceManagedSection(existing, key, body) {
+    const markers = managedMarkers(key);
+    const escapedStart = markers.start.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const escapedEnd = markers.end.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const managedRegex = new RegExp(`${escapedStart}[\\s\\S]*?${escapedEnd}`, "gm");
+    if (!managedRegex.test(existing))
+        return existing;
+    const canonicalBlock = wrapManagedSection(key, body);
+    let replaced = existing.replace(managedRegex, canonicalBlock);
+    // collapse accidental duplicates if multiple managed blocks exist
+    replaced = replaced.replace(new RegExp(`(${escapedStart}[\\s\\S]*?${escapedEnd})(?:\\s*${escapedStart}[\\s\\S]*?${escapedEnd})+`, "gm"), "$1");
+    return replaced.endsWith("\n") ? replaced : `${replaced}\n`;
+}
 function replaceInjectedSection(existing, sectionHeading, sectionBody) {
-    const headingRegex = new RegExp(`^${sectionHeading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?(?=^##\\s|\\Z)`, "m");
-    if (headingRegex.test(existing)) {
-        const replaced = existing.replace(headingRegex, sectionBody.trim());
-        return replaced.endsWith("\n") ? replaced : `${replaced}\n`;
-    }
-    return existing;
+    const escapedHeading = sectionHeading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const blockRegex = new RegExp(`^${escapedHeading}[\\t ]*\\n[\\s\\S]*?(?=^##\\s|$)`, "gm");
+    const matches = existing.match(blockRegex);
+    if (!matches || matches.length === 0)
+        return existing;
+    const canonicalBlock = `${sectionBody.trim()}\n`;
+    let replaced = existing.replace(blockRegex, "");
+    replaced = replaced.replace(/\n{3,}/g, "\n\n").trimEnd();
+    return `${replaced}${replaced ? "\n\n" : ""}${canonicalBlock}`;
 }
 function injectAgentConfigs(registry) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
@@ -312,30 +338,37 @@ function injectAgentConfigs(registry) {
         const sectionBody = template.body.trim();
         const sectionHeading = target.sectionHeading ?? "## Nexarch Agent Registration";
         const sectionMarker = target.sectionMarker ?? sectionHeading;
+        const managedBody = wrapManagedSection("agent-registration", sectionBody);
         if (target.insertionMode === "replace_section") {
-            let replaced = replaceInjectedSection(existing, sectionHeading, sectionBody);
+            let replaced = replaceManagedSection(existing, "agent-registration", sectionBody);
+            if (replaced === existing) {
+                replaced = replaceInjectedSection(existing, sectionHeading, managedBody);
+            }
             if (replaced === existing && existing.includes(sectionMarker)) {
                 const markerIndex = existing.indexOf(sectionMarker);
                 const before = existing.slice(0, markerIndex).replace(/\s*$/, "\n\n");
-                replaced = `${before}${sectionBody}\n`;
+                replaced = `${before}${managedBody}\n`;
             }
             if (replaced !== existing) {
                 writeFileSync(filePath, replaced, "utf8");
                 results.push({ path: filePath, status: "updated" });
             }
+            else if (existing.includes(managedBody) || existing.includes(sectionBody)) {
+                results.push({ path: filePath, status: "already_present" });
+            }
             else {
                 const separator = existing.endsWith("\n") ? "" : "\n";
-                writeFileSync(filePath, existing + separator + sectionBody + "\n", "utf8");
+                writeFileSync(filePath, existing + separator + managedBody + "\n", "utf8");
                 results.push({ path: filePath, status: "injected" });
             }
             continue;
         }
-        const separator = existing.endsWith("\n") ? "" : "\n";
-        const next = existing + separator + sectionBody + "\n";
-        if (next === existing) {
+        if (existing.includes(managedBody) || existing.includes(sectionBody)) {
             results.push({ path: filePath, status: "already_present" });
         }
         else {
+            const separator = existing.endsWith("\n") ? "" : "\n";
+            const next = existing + separator + managedBody + "\n";
             writeFileSync(filePath, next, "utf8");
             results.push({ path: filePath, status: "injected" });
         }
@@ -360,11 +393,33 @@ function injectTrustAttestationBlock(path, attestation) {
         `agent_id: ${attestation.payload.agent_id}`,
         `expires_at: ${expiresAt}`,
         `verify_url: ${verifyUrl}`,
+        `token: ${attestation.token}`,
+        "",
+    ].join("\n");
+    const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+    const managed = wrapManagedSection("trust-attestation", section.trim());
+    let replaced = replaceManagedSection(existing, "trust-attestation", section.trim());
+    if (replaced === existing) {
+        replaced = replaceInjectedSection(existing, "## Nexarch Trust Attestation", managed);
+    }
+    writeFileSync(path, replaced !== existing ? replaced : `${existing}${existing.endsWith("\n") ? "" : "\n"}${managed}\n`, "utf8");
+}
+function injectTrustAttestationUnavailableBlock(path, reason) {
+    const section = [
+        "## Nexarch Trust Attestation",
+        "",
+        "Trust attestation was requested but is currently unavailable.",
+        `status: unavailable (${reason})`,
+        "action: check MCP gateway TRUST_ATTESTATION_SECRET and restart gateway",
         "",
     ].join("\n");
     const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
-    const replaced = replaceInjectedSection(existing, "## Nexarch Trust Attestation", section.trim());
-    writeFileSync(path, replaced !== existing ? replaced : `${existing}${existing.endsWith("\n") ? "" : "\n"}${section}`, "utf8");
+    const managed = wrapManagedSection("trust-attestation", section.trim());
+    let replaced = replaceManagedSection(existing, "trust-attestation", section.trim());
+    if (replaced === existing) {
+        replaced = replaceInjectedSection(existing, "## Nexarch Trust Attestation", managed);
+    }
+    writeFileSync(path, replaced !== existing ? replaced : `${existing}${existing.endsWith("\n") ? "" : "\n"}${managed}\n`, "utf8");
 }
 function injectGenericAgentConfig(registry) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
@@ -378,20 +433,30 @@ function injectGenericAgentConfig(registry) {
         const filePath = join(process.cwd(), target.filePathPattern);
         const sectionBody = template.body.trim();
         const sectionHeading = target.sectionHeading ?? "## Nexarch Agent Registration";
+        const managedBody = wrapManagedSection("agent-registration", sectionBody);
         if (!existsSync(filePath)) {
-            writeFileSync(filePath, `${sectionBody}\n`, "utf8");
+            writeFileSync(filePath, `${managedBody}\n`, "utf8");
             return [{ path: filePath, status: "injected" }];
         }
         const existing = readFileSync(filePath, "utf8");
         if (target.insertionMode === "replace_section") {
-            const replaced = replaceInjectedSection(existing, sectionHeading, sectionBody);
+            let replaced = replaceManagedSection(existing, "agent-registration", sectionBody);
+            if (replaced === existing) {
+                replaced = replaceInjectedSection(existing, sectionHeading, managedBody);
+            }
             if (replaced !== existing) {
                 writeFileSync(filePath, replaced, "utf8");
                 return [{ path: filePath, status: "updated" }];
             }
+            if (existing.includes(managedBody) || existing.includes(sectionBody)) {
+                return [{ path: filePath, status: "already_present" }];
+            }
+        }
+        if (existing.includes(managedBody) || existing.includes(sectionBody)) {
+            return [{ path: filePath, status: "already_present" }];
         }
         const separator = existing.endsWith("\n") ? "" : "\n";
-        writeFileSync(filePath, existing + separator + sectionBody + "\n", "utf8");
+        writeFileSync(filePath, existing + separator + managedBody + "\n", "utf8");
         return [{ path: filePath, status: "injected" }];
     }
     const fallbackTemplate = templateByCode.get("nexarch_agent_registration_v1") ?? registry.instructionTemplates[0];
@@ -399,19 +464,26 @@ function injectGenericAgentConfig(registry) {
         return [];
     const fallbackPath = join(process.cwd(), "AGENTS.md");
     const sectionBody = fallbackTemplate.body.trim();
+    const managedBody = wrapManagedSection("agent-registration", sectionBody);
     if (!existsSync(fallbackPath)) {
-        writeFileSync(fallbackPath, `${sectionBody}\n`, "utf8");
+        writeFileSync(fallbackPath, `${managedBody}\n`, "utf8");
         return [{ path: fallbackPath, status: "injected" }];
     }
     const existing = readFileSync(fallbackPath, "utf8");
     const sectionHeading = "## Nexarch Agent Registration";
-    const replaced = replaceInjectedSection(existing, sectionHeading, sectionBody);
+    let replaced = replaceManagedSection(existing, "agent-registration", sectionBody);
+    if (replaced === existing) {
+        replaced = replaceInjectedSection(existing, sectionHeading, managedBody);
+    }
     if (replaced !== existing) {
         writeFileSync(fallbackPath, replaced, "utf8");
         return [{ path: fallbackPath, status: "updated" }];
     }
+    if (existing.includes(managedBody) || existing.includes(sectionBody)) {
+        return [{ path: fallbackPath, status: "already_present" }];
+    }
     const separator = existing.endsWith("\n") ? "" : "\n";
-    writeFileSync(fallbackPath, existing + separator + sectionBody + "\n", "utf8");
+    writeFileSync(fallbackPath, existing + separator + managedBody + "\n", "utf8");
     return [{ path: fallbackPath, status: "injected" }];
 }
 export async function initAgent(args) {
@@ -973,6 +1045,7 @@ export async function initAgent(args) {
     let agentConfigResults = [];
     let instructionsWriteAllowed = false;
     let trustAttestation = null;
+    let trustAttestationAttempted = false;
     if (registration.ok) {
         try {
             // Save identity so check-in can find the agent key
@@ -998,16 +1071,20 @@ export async function initAgent(args) {
                 agentConfigResults = injectGenericAgentConfig(registry);
             }
             if (agentConfigResults.length > 0) {
+                trustAttestationAttempted = true;
                 trustAttestation = await requestTrustAttestation(agentId);
-                if (trustAttestation?.ok) {
-                    for (const r of agentConfigResults) {
-                        try {
+                for (const r of agentConfigResults) {
+                    try {
+                        if (trustAttestation.ok) {
                             injectTrustAttestationBlock(r.path, trustAttestation);
                         }
-                        catch {
-                            // non-fatal
+                        else {
+                            injectTrustAttestationUnavailableBlock(r.path, trustAttestation.reason ?? "unknown");
                         }
                     }
+                    catch {
+                        // non-fatal
+                    }
                 }
             }
         }
@@ -1038,6 +1115,19 @@ export async function initAgent(args) {
                     ? `updated ${agentConfigResults.length} instruction target file(s)`
                     : "no runtime instruction target matched this repository (non-fatal; create AGENTS.md/CLAUDE.md or configure a generic target)",
     });
+    checks.push({
+        name: "agent.trust.attestation",
+        ok: !registration.ok || !instructionsWriteAllowed || !trustAttestationAttempted || Boolean(trustAttestation?.ok),
+        detail: !registration.ok
+            ? "skipped (registration failed)"
+            : !instructionsWriteAllowed
+                ? "skipped (consent not granted)"
+                : !trustAttestationAttempted
+                    ? "skipped (no instruction target written)"
+                    : trustAttestation?.ok
+                        ? "minted and injected into instruction file(s)"
+                        : `unavailable (${trustAttestation?.reason ?? "unknown"})`,
+    });
     checks.push({
         name: "technology.components",
         ok: techComponents.ok,
@@ -1152,6 +1242,9 @@ export async function initAgent(args) {
                     : `https://mcp.nexarch.ai${trustAttestation.verifyUrl}`;
                 console.log(`   Trust attestation verify URL: ${verifyUrl}`);
             }
+            else if (trustAttestationAttempted) {
+                console.log(`   Trust attestation unavailable (${trustAttestation?.reason ?? "unknown"}).`);
+            }
         }
         if (needsIdentityInput) {
             console.log("\nℹ Additional identity details are still needed to complete agent profile enrichment.");

package/dist/lib/trust.js

@@ -26,20 +26,22 @@ export async function requestTrustAttestation(agentId) {
             res.on("data", (c) => chunks.push(c));
             res.on("end", () => {
                 try {
-                    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-                    if (!res.statusCode || res.statusCode >= 400)
-                        return resolve(null);
+                    const raw = Buffer.concat(chunks).toString("utf8");
+                    const parsed = JSON.parse(raw);
+                    if (!res.statusCode || res.statusCode >= 400) {
+                        return resolve({ ok: false, reason: parsed.error?.code ?? parsed.error?.message ?? `http_${res.statusCode ?? 0}` });
+                    }
                     resolve(parsed);
                 }
                 catch {
-                    resolve(null);
+                    resolve({ ok: false, reason: "parse_error" });
                 }
             });
         });
-        req.on("error", () => resolve(null));
+        req.on("error", () => resolve({ ok: false, reason: "network_error" }));
         req.on("timeout", () => {
             req.destroy();
-            resolve(null);
+            resolve({ ok: false, reason: "timeout" });
         });
         req.write(body);
         req.end();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.8.15",
+  "version": "0.8.17",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",