omakit 0.6.8 → 0.6.10

package/tools/marketplace/review-cost.mjs

@@ -2,7 +2,7 @@
 import { readFileSync } from "node:fs"
 import { join } from "node:path"
 import { pathToFileURL } from "node:url"
-import { requirePin } from "./pin.mjs"
+import { requirePin, updateLabel as updateLabelOf } from "./pin.mjs"
 import { token, issue, parseIssueUrl, compareCommits } from "./github.mjs"
 import { discoverWatchIssues, repositoryFor } from "./watch.mjs"
 import { repositorySlug } from "./registry.mjs"
@@ -12,8 +12,7 @@ import { submissionContract } from "./form.mjs"
 export async function reviewPolicy(repoRoot) {
   const { dir } = requirePin(repoRoot)
   const policy = await import(pathToFileURL(join(dir, "scripts/security-baseline-policy.mjs")).href)
-  const approval = readFileSync(join(dir, "scripts/approve-plugin-update.mjs"), "utf8")
-  const updateLabel = approval.match(/for \(const required of \["([^"]+)"/)?.[1]
+  const updateLabel = updateLabelOf(readFileSync(join(dir, "scripts/approve-plugin-update.mjs"), "utf8"))
   if (!updateLabel) throw new Error("cannot read the update issue label from the pin")
   const manual = policy.currentSecurityBaselinePolicy.maintainerVerificationOutcome
   return { automated: policy.securityBaselineOutcome([], []), manual, updateLabel, reviewLabel: `security-${manual}` }

package/tools/marketplace/submit.mjs

@@ -14,7 +14,7 @@
 import { resolveSubject, SubjectError } from "../subject/resolve.mjs"
 import { requirePin } from "./pin.mjs"
 import { submissionContract, newerCommitChoice, resolveCategory, resolveTags, tagSlug } from "./form.mjs"
-import { idUniverse, checkIdentity, listingOf, baselineFigures, figure, liveRegistry, registrySourceDetail, catalogPresentation, defaultPresentation } from "./registry.mjs"
+import { idUniverse, checkIdentity, listingOf, baselineFigures, figure, liveRegistry, registrySourceDetail, catalogBuilderText, catalogPresentation, defaultPresentation } from "./registry.mjs"
 import { readTree } from "./tree.mjs"
 import { inspectTree } from "./plugin.mjs"
 import { findAgentControl, REMEDY as AGENT_CONTROL_REMEDY } from "./agent-control.mjs"
@@ -283,7 +283,7 @@ export async function submitPreflight(options) {
       error.usage = missing
       throw error
     }
-    const defaults = defaultPresentation(catalogPresentation(pinDir), tree.manifest?.kinds)
+    const defaults = defaultPresentation(catalogPresentation(catalogBuilderText(pinDir)), tree.manifest?.kinds)
     const answers = await options.chooser({ contract, defaults, missing: missing.missing })
     if (answers?.category) chosenCategory = answers.category
     if (answers?.tags) chosenTags = answers.tags

package/tools/marketplace/usage.mjs

@@ -111,26 +111,29 @@ export const COMMANDS = Object.freeze([
   },
   {
     signature: [
-      "omakit lab prove <suite> [--runs <n>] [--json] [--out <file>]",
-      "omakit lab inspect [--verify] [--json] [--out <file>]",
+      "omakit lab prove <suite> [--runs <n>] [--offline] [--json] [--out <file>]",
+      "omakit lab inspect [--verify] [--offline] [--json] [--out <file>]",
       "omakit lab setup [--from <file>] [--toolchain <dir>] [--plugins] [--yes]",
       "omakit lab prune [--keep-iso] [--records] [--yes] [--json]",
     ],
     lines: [
-      "Prove a suite in a disposable Omarchy guest, never on the desktop: the",
-      "pinned 4.0.3 release booted from an immutable verified base, a fresh",
-      "overlay per run, the guest's installed omarchy package read and printed",
-      "before the suite, the document written with that identity. `prove` boots",
-      "nothing until the base, the host and the suite's files are there, and",
-      "names what is missing, what it takes, and the one command; it fetches",
-      "nothing. `inspect` is read-only: the pinned release, its exact size,",
-      "digest and signer, what is on disk and verified, what the host lacks.",
-      "`setup` is the only path that fetches bytes: one consent naming the",
-      "exact size and destination (--yes for an agent), a resumable GET of",
-      "the pinned URL or a copy of --from, verified against the pinned SHA-256",
-      "and the Omarchy signature before anything boots it, then one base built",
-      "by the pinned omarchy-iso toolchain, whose checkout --toolchain records",
-      "and which setup never fetches. `prune` frees the lab cache and says how",
+      "Prove a suite in a disposable Omarchy guest, never on the desktop: an",
+      "Omarchy release booted from an immutable verified base, a fresh overlay",
+      "per run, the guest's installed omarchy package read and printed before",
+      "the suite, the document written with that identity. Every action but",
+      "prune reads Omarchy's release list and says when a newer release is out",
+      "(--offline skips it). `prove` boots nothing until the base, the host",
+      "and the suite's files are there, and names what is missing, what it",
+      "takes, and the one command; it runs the base there, behind or not.",
+      "`inspect` writes nothing: the newest release, its size, digest and",
+      "signer, what is on disk and verified, what the host lacks. `setup` is",
+      "the only path that fetches bytes: it prepares the newest release, with",
+      "one consent naming the exact size and destination (--yes for an agent),",
+      "a resumable GET or a copy of --from, verified against the published",
+      "SHA-256 and the Omarchy signature omakit ships before anything boots it,",
+      "then one base built by the pinned omarchy-iso toolchain, whose checkout",
+      "--toolchain records and which setup never fetches; the old base stays",
+      "until the new one verifies. `prune` frees the lab cache and says how",
       "much. docs/LAB.md is the contract. Suites: run, store, weigh,",
       "weigh-evidence.",
     ],

package/tools/marketplace/watch.mjs

@@ -21,7 +21,7 @@
 import { join } from "node:path"
 import { pathToFileURL } from "node:url"
 import { readFileSync } from "node:fs"
-import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
+import { MARKETPLACE_PIN, requirePin, validatedLabel } from "./pin.mjs"
 import { authenticatedUser, repositoryIssues, defaultBranchHead, issue, issueComments, parseIssueUrl, token, GitHubError } from "./github.mjs"
 import { liveRegistry } from "./registry.mjs"
 import { reviewPolicy, validatedDocumentationDiff } from "./review-cost.mjs"
@@ -266,8 +266,7 @@ export function validationComment(comments, feedback = []) {
  */
 export async function marketplaceLabels(pinDir) {
   const policy = await import(pathToFileURL(join(pinDir, "scripts/security-baseline-policy.mjs")).href)
-  const approval = readFileSync(join(pinDir, "scripts/approve-submission.mjs"), "utf8")
-  const validated = approval.match(/for \(const required of \["submission", "([^"]+)"/)?.[1]
+  const validated = validatedLabel(readFileSync(join(pinDir, "scripts/approve-submission.mjs"), "utf8"))
   if (!validated) throw new Error("cannot read the validated label from the pin")
   const manual = policy.currentSecurityBaselinePolicy.maintainerVerificationOutcome
   return { blocking: [...policy.securityBaselineBlockingLabels], validated, reviewRequired: `security-${manual}` }