owlrunkit 0.17.2 → 0.18.1

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -7,6 +7,7 @@ import {
   readFileSync,
   readdirSync,
   realpathSync,
+  renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
@@ -550,6 +551,48 @@ function workspaceProfiles(
     .filter(Boolean);
 }
 
+function existingProfileSurface(root, relativePath, profilePath) {
+  const absolute = path.join(root, relativePath);
+  try {
+    const stat = lstatSync(absolute);
+    return stat.isDirectory()
+      && !stat.isSymbolicLink()
+      && realpathSync(absolute) === path.resolve(absolute)
+      ? profilePath
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function existingProfileFile(root, candidates) {
+  for (const relativePath of candidates) {
+    try {
+      const absolute = path.join(root, relativePath);
+      const stat = lstatSync(absolute);
+      if (
+        stat.isFile()
+        && !stat.isSymbolicLink()
+        && realpathSync(absolute) === path.resolve(absolute)
+      ) {
+        return relativePath;
+      }
+    } catch {
+      // Continue to the next supported filename.
+    }
+  }
+  return null;
+}
+
+function realOrManifestSurface(root, directorySurfaces) {
+  const paths = directorySurfaces
+    .map(([relativePath, profilePath]) => (
+      existingProfileSurface(root, relativePath, profilePath)
+    ))
+    .filter(Boolean);
+  return paths.length > 0 ? paths : ["package.json"];
+}
+
 function profileCandidates(
   root,
   manifest,
@@ -580,7 +623,7 @@ function profileCandidates(
       .filter(Boolean);
     candidates.push({
       id: "database",
-      paths: ["prisma/**"],
+      paths: realOrManifestSurface(root, [["prisma", "prisma/**"]]),
       role: "primary",
       primary: false,
       requiresProfileIds: [],
@@ -599,7 +642,10 @@ function profileCandidates(
       .filter(Boolean);
     candidates.push({
       id: "node-quality",
-      paths: ["src/**", "tests/**"],
+      paths: realOrManifestSurface(root, [
+        ["src", "src/**"],
+        ["tests", "tests/**"],
+      ]),
       role: "primary",
       primary: false,
       requiresProfileIds: [],
@@ -614,9 +660,17 @@ function profileCandidates(
     const commands = scripts.has("e2e") && npmExecutable
       ? [command(`${packageManager}-e2e`, "e2e", npmExecutable)]
       : [];
+    const configPath = existingProfileFile(root, [
+      "playwright.config.ts",
+      "playwright.config.js",
+    ]);
+    const paths = [
+      configPath,
+      existingProfileSurface(root, "tests/e2e", "tests/e2e/**"),
+    ].filter(Boolean);
     candidates.push({
       id: "web-e2e",
-      paths: ["playwright.config.ts", "tests/e2e/**"],
+      paths: paths.length > 0 ? paths : ["package.json"],
       role: "primary",
       primary: false,
       requiresProfileIds: [],
@@ -753,6 +807,34 @@ function exactRegularFileBytes(absolutePath, expectedBytes) {
   }
 }
 
+function readRegularFileInsideRoot(root, absolutePath) {
+  const stat = lstatSync(absolutePath);
+  const resolved = realpathSync(absolutePath);
+  if (
+    stat.isSymbolicLink()
+    || !stat.isFile()
+    || resolved !== absolutePath
+    || !insideRoot(root, resolved)
+  ) {
+    throw new Error("profile_transaction_file_untrusted");
+  }
+  return readFileSync(absolutePath, "utf8");
+}
+
+function trustedDirectoryInsideRoot(root, absolutePath) {
+  const stat = lstatSync(absolutePath);
+  const resolved = realpathSync(absolutePath);
+  if (
+    stat.isSymbolicLink()
+    || !stat.isDirectory()
+    || resolved !== absolutePath
+    || !insideRoot(root, resolved)
+  ) {
+    throw new Error("profile_transaction_directory_untrusted");
+  }
+  return resolved;
+}
+
 function commitCreateOnlyStagedFile(stagedPath, finalPath, expectedBytes) {
   if (!exactRegularFileBytes(stagedPath, expectedBytes)) {
     throw new Error("profile_apply_staged_file_invalid");
@@ -947,7 +1029,11 @@ function blockedApply(detection, issueCodes, currentProfilesSha256 = null) {
   };
 }
 
-function verifyDetectionInputs(root, detection) {
+function verifyDetectionInputs(
+  root,
+  detection,
+  { allowedApplyStatuses = ["ready_to_apply"] } = {},
+) {
   const issues = [];
   const { detectionSha256, ...body } = detection;
   if (
@@ -958,7 +1044,10 @@ function verifyDetectionInputs(root, detection) {
   ) {
     issues.push("profile_detection_invalid");
   }
-  if (detection.confidence !== "high" || detection.applyStatus !== "ready_to_apply") {
+  if (
+    detection.confidence !== "high"
+    || !allowedApplyStatuses.includes(detection.applyStatus)
+  ) {
     issues.push("profile_detection_not_ready_to_apply");
   }
   issues.push(...validateProfileDocument(detection.proposedProfiles));
@@ -1105,6 +1194,461 @@ export function applyDetectedProfilesV2({
   }
 }
 
+function mergeDetectedProfiles(currentProfiles, detectedProfiles) {
+  const profiles = currentProfiles.profiles.map((profile) => structuredClone(profile));
+  const byId = new Map(profiles.map((profile) => [profile.id, profile]));
+  const addedProfileIds = [];
+  const updatedProfiles = [];
+  for (const detected of [...detectedProfiles.profiles]
+    .sort((left, right) => left.id.localeCompare(right.id))) {
+    const current = byId.get(detected.id);
+    if (!current) {
+      const impact = resolveProfileImpactDetailed({
+        changedPaths: detected.paths.map(representativePath),
+        profiles,
+      });
+      const primaryCoverageComplete = impact.uncoveredPaths.length === 0
+        && !impact.warnings.some((warning) => warning.startsWith("supporting_only_match:"));
+      if (primaryCoverageComplete) continue;
+      const added = { ...structuredClone(detected), primary: false };
+      profiles.push(added);
+      byId.set(added.id, added);
+      addedProfileIds.push(added.id);
+      continue;
+    }
+    const addedPaths = detected.paths
+      .filter((value) => !current.paths.includes(value))
+      .sort();
+    current.paths = [...new Set([...current.paths, ...detected.paths])].sort();
+    const commands = new Map(current.commands.map((entry) => [entry.id, entry]));
+    const addedCommandIds = [];
+    const updatedCommandIds = [];
+    for (const detectedCommand of detected.commands) {
+      const currentCommand = commands.get(detectedCommand.id);
+      if (!currentCommand) {
+        current.commands.push(structuredClone(detectedCommand));
+        commands.set(detectedCommand.id, detectedCommand);
+        addedCommandIds.push(detectedCommand.id);
+      } else if (canonicalJson(currentCommand) !== canonicalJson(detectedCommand)) {
+        const index = current.commands.findIndex((entry) => entry.id === detectedCommand.id);
+        current.commands[index] = structuredClone(detectedCommand);
+        commands.set(detectedCommand.id, detectedCommand);
+        updatedCommandIds.push(detectedCommand.id);
+      }
+    }
+    current.commands.sort((left, right) => left.id.localeCompare(right.id));
+    if (
+      addedPaths.length > 0
+      || addedCommandIds.length > 0
+      || updatedCommandIds.length > 0
+    ) {
+      updatedProfiles.push({
+        profileId: current.id,
+        addedPaths,
+        addedCommandIds: addedCommandIds.sort(),
+        updatedCommandIds: updatedCommandIds.sort(),
+      });
+    }
+  }
+  return {
+    proposedProfiles: {
+      schemaVersion: "OwlCodaRunKitProfilesV1",
+      profiles,
+    },
+    addedProfileIds,
+    updatedProfiles,
+  };
+}
+
+function blockedReconcile(
+  detection,
+  issueCodes,
+  currentProfilesSha256 = null,
+  dryRun = true,
+) {
+  return {
+    schemaVersion: "OwlCodaRunKitProfilesReconcilePlanV1",
+    status: "profiles_reconcile_blocked",
+    valid: false,
+    exitCode: 2,
+    dryRun,
+    writesPerformed: 0,
+    detectionSha256: detection?.detectionSha256 ?? null,
+    currentProfilesSha256,
+    issueCodes: [...new Set(issueCodes)].sort(),
+    authorizationGranted: false,
+  };
+}
+
+function validateReconcileReceipt(receipt, reconcileSha256) {
+  const hash = /^[a-f0-9]{64}$/;
+  const receiptKeys = [
+    "schemaVersion",
+    "status",
+    "exitCode",
+    "writesPerformed",
+    "dryRun",
+    "reconcileSha256",
+    "detectionSha256",
+    "beforeProfilesSha256",
+    "appliedProfilesSha256",
+    "addedProfileIds",
+    "updatedProfiles",
+    "receiptPath",
+    "issueCodes",
+    "authorizationGranted",
+  ];
+  const receiptPath = path.join(
+    ".owlcoda",
+    "runkit",
+    "profile-reconcile-receipts",
+    `${reconcileSha256}.json`,
+  );
+  if (
+    !exactKeys(receipt, receiptKeys)
+    || receiptKeys.some((key) => !Object.hasOwn(receipt, key))
+    || receipt.schemaVersion !== "OwlCodaRunKitProfilesReconcileReceiptV1"
+    || receipt.status !== "profiles_reconciled"
+    || receipt.exitCode !== 0
+    || receipt.writesPerformed !== 2
+    || receipt.dryRun !== false
+    || receipt.reconcileSha256 !== reconcileSha256
+    || !hash.test(receipt.detectionSha256 ?? "")
+    || !hash.test(receipt.beforeProfilesSha256 ?? "")
+    || !hash.test(receipt.appliedProfilesSha256 ?? "")
+    || !Array.isArray(receipt.addedProfileIds)
+    || receipt.addedProfileIds.some((value) => !safeIdentifier(value))
+    || !Array.isArray(receipt.updatedProfiles)
+    || receipt.updatedProfiles.some((update) => (
+      !exactKeys(update, [
+        "profileId",
+        "addedPaths",
+        "addedCommandIds",
+        "updatedCommandIds",
+      ])
+      || !safeIdentifier(update.profileId)
+      || !Array.isArray(update.addedPaths)
+      || update.addedPaths.some((value) => typeof value !== "string")
+      || !Array.isArray(update.addedCommandIds)
+      || update.addedCommandIds.some((value) => !safeIdentifier(value))
+      || !Array.isArray(update.updatedCommandIds)
+      || update.updatedCommandIds.some((value) => !safeIdentifier(value))
+    ))
+    || receipt.receiptPath !== receiptPath
+    || !Array.isArray(receipt.issueCodes)
+    || receipt.issueCodes.length !== 0
+    || receipt.authorizationGranted !== false
+  ) {
+    throw new Error("profile_reconcile_transaction_receipt_invalid");
+  }
+  return receiptPath;
+}
+
+function recoverProfileReconcileTransaction(root) {
+  const runtimeRoot = path.join(root, ".owlcoda", "runkit");
+  if (!existsSync(runtimeRoot)) return null;
+  trustedDirectoryInsideRoot(root, runtimeRoot);
+  const transactionNames = readdirSync(runtimeRoot)
+    .filter((entry) => entry.startsWith(".profile-reconcile-") && entry.endsWith(".lock"));
+  if (transactionNames.length === 0) return null;
+  if (
+    transactionNames.length !== 1
+    || !/^\.profile-reconcile-[a-f0-9]{64}\.lock$/u.test(transactionNames[0])
+  ) {
+    throw new Error("profile_reconcile_transaction_set_invalid");
+  }
+  const transactionName = transactionNames[0];
+  const reconcileSha256 = transactionName.slice(
+    ".profile-reconcile-".length,
+    -".lock".length,
+  );
+  const transactionRoot = path.join(runtimeRoot, transactionName);
+  trustedDirectoryInsideRoot(root, transactionRoot);
+  const entries = readdirSync(transactionRoot).sort();
+  if (
+    entries.some((entry) => ![
+      "previous-profiles.json",
+      "profiles.json",
+      "receipt.json",
+    ].includes(entry))
+  ) {
+    throw new Error("profile_reconcile_transaction_contents_untrusted");
+  }
+  const previousProfiles = path.join(transactionRoot, "previous-profiles.json");
+  const stagedProfiles = path.join(transactionRoot, "profiles.json");
+  const stagedReceipt = path.join(transactionRoot, "receipt.json");
+  const receiptRoot = ensureDirectoryChain(
+    root,
+    ".owlcoda/runkit/profile-reconcile-receipts",
+  );
+  const receiptAbsolutePath = path.join(receiptRoot, `${reconcileSha256}.json`);
+  const receiptSource = existsSync(stagedReceipt) ? stagedReceipt : receiptAbsolutePath;
+  const receipt = JSON.parse(readRegularFileInsideRoot(root, receiptSource));
+  const receiptPath = validateReconcileReceipt(receipt, reconcileSha256);
+  if (path.join(root, receiptPath) !== receiptAbsolutePath) {
+    throw new Error("profile_reconcile_transaction_receipt_path_invalid");
+  }
+  const receiptBytes = `${JSON.stringify(receipt, null, 2)}\n`;
+  if (!exactRegularFileBytes(receiptSource, receiptBytes)) {
+    throw new Error("profile_reconcile_transaction_receipt_mismatch");
+  }
+  const previousBytes = readRegularFileInsideRoot(root, previousProfiles);
+  if (sha256(previousBytes) !== receipt.beforeProfilesSha256) {
+    throw new Error("profile_reconcile_transaction_preimage_mismatch");
+  }
+  const profilesPath = path.join(runtimeRoot, "profiles.json");
+  const currentProfilesSha256 = profilesFileHash(root);
+  if (
+    currentProfilesSha256 !== receipt.beforeProfilesSha256
+    && currentProfilesSha256 !== receipt.appliedProfilesSha256
+  ) {
+    throw new Error("profile_reconcile_transaction_profile_mismatch");
+  }
+  if (existsSync(stagedProfiles)) {
+    const stagedProfilesBytes = readRegularFileInsideRoot(root, stagedProfiles);
+    if (sha256(stagedProfilesBytes) !== receipt.appliedProfilesSha256) {
+      throw new Error("profile_reconcile_transaction_staged_profile_mismatch");
+    }
+  } else if (currentProfilesSha256 !== receipt.appliedProfilesSha256) {
+    throw new Error("profile_reconcile_transaction_staged_profile_missing");
+  }
+  if (
+    existsSync(receiptAbsolutePath)
+    && !exactRegularFileBytes(receiptAbsolutePath, receiptBytes)
+  ) {
+    throw new Error("profile_reconcile_transaction_committed_receipt_mismatch");
+  }
+
+  let profilesCommittedByRecovery = false;
+  try {
+    if (currentProfilesSha256 === receipt.beforeProfilesSha256) {
+      renameSync(stagedProfiles, profilesPath);
+      profilesCommittedByRecovery = true;
+    }
+    if (!existsSync(receiptAbsolutePath)) {
+      commitCreateOnlyStagedFile(stagedReceipt, receiptAbsolutePath, receiptBytes);
+    }
+  } catch (error) {
+    if (
+      profilesCommittedByRecovery
+      && profilesFileHash(root) === receipt.appliedProfilesSha256
+    ) {
+      renameSync(previousProfiles, profilesPath);
+    }
+    throw error;
+  }
+  rmSync(transactionRoot, { recursive: true });
+  return receipt;
+}
+
+export function reconcileProfilesV2({
+  workspaceRoot,
+  apply = false,
+  projectToolResolver,
+  onAfterProfilesCommit,
+} = {}) {
+  const root = resolveBoundedWorkspaceRoot(workspaceRoot);
+  if (apply) {
+    try {
+      const recovered = recoverProfileReconcileTransaction(root);
+      if (recovered !== null) return recovered;
+    } catch {
+      return blockedReconcile(
+        null,
+        ["profile_reconcile_transaction_recovery_invalid"],
+        null,
+        false,
+      );
+    }
+  }
+  let currentProfilesSha256;
+  let currentProfiles;
+  let currentProfilesBytes;
+  try {
+    currentProfilesSha256 = profilesFileHash(root);
+    if (currentProfilesSha256 === null) {
+      return blockedReconcile(null, ["profiles_missing"], null, !apply);
+    }
+    currentProfilesBytes = readFileSync(boundedRegularFile(
+      root,
+      path.join(".owlcoda", "runkit", "profiles.json"),
+    ), "utf8");
+    currentProfiles = readWorkspaceJsonBounded(
+      root,
+      path.join(".owlcoda", "runkit", "profiles.json"),
+    );
+    const documentIssues = validateProfileDocument(currentProfiles);
+    if (documentIssues.length > 0) {
+      return blockedReconcile(null, documentIssues, currentProfilesSha256, !apply);
+    }
+  } catch {
+    return blockedReconcile(
+      null,
+      ["profile_reconcile_current_profiles_invalid"],
+      null,
+      !apply,
+    );
+  }
+
+  const detection = detectProfilesV2({ workspaceRoot: root, projectToolResolver });
+  const detectionIssues = verifyDetectionInputs(root, detection, {
+    allowedApplyStatuses: ["profiles_already_exists"],
+  });
+  if (detection.currentProfilesSha256 !== currentProfilesSha256) {
+    detectionIssues.push("profile_reconcile_detection_preimage_mismatch");
+  }
+  if (detectionIssues.length > 0) {
+    return blockedReconcile(detection, detectionIssues, currentProfilesSha256, !apply);
+  }
+
+  const merged = mergeDetectedProfiles(currentProfiles, detection.proposedProfiles);
+  const proposedIssues = validateProfileDocumentWithDetectedSurfaces(
+    root,
+    merged.proposedProfiles,
+  );
+  if (proposedIssues.length > 0) {
+    return blockedReconcile(detection, proposedIssues, currentProfilesSha256, !apply);
+  }
+  const proposedProfilesBytes = `${JSON.stringify(merged.proposedProfiles, null, 2)}\n`;
+  const proposedProfilesSha256 = sha256(proposedProfilesBytes);
+  const planBody = {
+    detectionSha256: detection.detectionSha256,
+    currentProfilesSha256,
+    proposedProfilesSha256,
+    addedProfileIds: merged.addedProfileIds,
+    updatedProfiles: merged.updatedProfiles,
+  };
+  const reconcileSha256 = sha256(canonicalJson(planBody));
+  const plan = {
+    schemaVersion: "OwlCodaRunKitProfilesReconcilePlanV1",
+    status: proposedProfilesSha256 === currentProfilesSha256
+      ? "profiles_already_current"
+      : "profiles_reconcile_ready",
+    valid: true,
+    exitCode: 0,
+    dryRun: !apply,
+    writesPerformed: 0,
+    reconcileSha256,
+    ...planBody,
+    proposedProfiles: merged.proposedProfiles,
+    issueCodes: [],
+    authorizationGranted: false,
+  };
+  if (!apply || proposedProfilesSha256 === currentProfilesSha256) return plan;
+
+  let runtimeRoot;
+  let receiptRoot;
+  try {
+    runtimeRoot = ensureDirectoryChain(root, ".owlcoda/runkit");
+    receiptRoot = ensureDirectoryChain(
+      root,
+      ".owlcoda/runkit/profile-reconcile-receipts",
+    );
+  } catch {
+    return blockedReconcile(
+      detection,
+      ["profile_reconcile_directory_untrusted"],
+      currentProfilesSha256,
+      false,
+    );
+  }
+  const profilesPath = path.join(runtimeRoot, "profiles.json");
+  const receiptPath = path.join(
+    ".owlcoda",
+    "runkit",
+    "profile-reconcile-receipts",
+    `${reconcileSha256}.json`,
+  );
+  const receiptAbsolutePath = path.join(receiptRoot, `${reconcileSha256}.json`);
+  const receipt = {
+    schemaVersion: "OwlCodaRunKitProfilesReconcileReceiptV1",
+    status: "profiles_reconciled",
+    exitCode: 0,
+    writesPerformed: 2,
+    dryRun: false,
+    reconcileSha256,
+    detectionSha256: detection.detectionSha256,
+    beforeProfilesSha256: currentProfilesSha256,
+    appliedProfilesSha256: proposedProfilesSha256,
+    addedProfileIds: merged.addedProfileIds,
+    updatedProfiles: merged.updatedProfiles,
+    receiptPath,
+    issueCodes: [],
+    authorizationGranted: false,
+  };
+  const receiptBytes = `${JSON.stringify(receipt, null, 2)}\n`;
+  const transactionRoot = path.join(
+    runtimeRoot,
+    `.profile-reconcile-${reconcileSha256}.lock`,
+  );
+  try {
+    mkdirSync(transactionRoot);
+  } catch (error) {
+    return blockedReconcile(
+      detection,
+      [error?.code === "EEXIST"
+        ? "profile_reconcile_transaction_active"
+        : "profile_reconcile_transaction_failed"],
+      currentProfilesSha256,
+      false,
+    );
+  }
+  let profilesCommitted = false;
+  let preserveTransaction = false;
+  try {
+    if (profilesFileHash(root) !== currentProfilesSha256) {
+      throw new Error("profile_reconcile_preimage_changed");
+    }
+    if (existsSync(receiptAbsolutePath)) {
+      throw new Error("profile_reconcile_receipt_already_exists");
+    }
+    const previousProfiles = path.join(transactionRoot, "previous-profiles.json");
+    const stagedProfiles = path.join(transactionRoot, "profiles.json");
+    const stagedReceipt = path.join(transactionRoot, "receipt.json");
+    writeFileSync(previousProfiles, currentProfilesBytes, { flag: "wx" });
+    writeFileSync(stagedProfiles, proposedProfilesBytes, { flag: "wx" });
+    writeFileSync(stagedReceipt, receiptBytes, { flag: "wx" });
+    if (!exactRegularFileBytes(stagedProfiles, proposedProfilesBytes)) {
+      throw new Error("profile_reconcile_staged_profiles_invalid");
+    }
+    renameSync(stagedProfiles, profilesPath);
+    profilesCommitted = true;
+    onAfterProfilesCommit?.();
+    commitCreateOnlyStagedFile(stagedReceipt, receiptAbsolutePath, receiptBytes);
+    return receipt;
+  } catch {
+    let issueCode = "profile_reconcile_transaction_failed";
+    if (
+      profilesCommitted
+      && profilesFileHash(root) === proposedProfilesSha256
+    ) {
+      const previousProfiles = path.join(transactionRoot, "previous-profiles.json");
+      try {
+        if (!exactRegularFileBytes(previousProfiles, currentProfilesBytes)) {
+          throw new Error("profile_reconcile_previous_profiles_invalid");
+        }
+        renameSync(previousProfiles, profilesPath);
+      } catch {
+        preserveTransaction = true;
+        issueCode = "profile_reconcile_transaction_rollback_failed";
+      }
+    } else if (profilesCommitted) {
+      preserveTransaction = true;
+      issueCode = "profile_reconcile_transaction_rollback_failed";
+    }
+    return blockedReconcile(
+      detection,
+      [issueCode],
+      currentProfilesSha256,
+      false,
+    );
+  } finally {
+    if (!preserveTransaction) {
+      rmSync(transactionRoot, { recursive: true, force: true });
+    }
+  }
+}
+
 function exactKeys(value, allowed) {
   return value
     && typeof value === "object"
@@ -1241,6 +1785,53 @@ function validateProfileDocument(config) {
   return [...new Set(issues)].sort();
 }
 
+function profileLauncherIssues(config) {
+  const issues = [];
+  for (const profile of config.profiles ?? []) {
+    for (const command of profile.commands ?? []) {
+      if (typeof command.executable !== "string" || !path.isAbsolute(command.executable)) {
+        continue;
+      }
+      const identity = `${profile.id ?? "unknown"}:${command.id ?? "unknown"}`;
+      try {
+        const stat = lstatSync(command.executable);
+        if (stat.isSymbolicLink()) {
+          issues.push(`profile_launcher_symlink_rejected:${identity}`);
+        } else if (
+          !stat.isFile()
+          || realpathSync(command.executable) !== path.resolve(command.executable)
+        ) {
+          issues.push(`profile_launcher_not_regular_file:${identity}`);
+        }
+      } catch {
+        issues.push(`profile_launcher_unavailable:${identity}`);
+      }
+    }
+  }
+  return issues;
+}
+
+function validateProfileDocumentWithDetectedSurfaces(root, config) {
+  const issues = validateProfileDocument(config);
+  if (issues.length > 0) return issues;
+  issues.push(...profileLauncherIssues(config));
+  const detected = detectProfiles({ workspaceRoot: root });
+  const detectedPaths = detected.candidates.flatMap((profile) =>
+    profile.paths.map(representativePath));
+  if (detectedPaths.length > 0) {
+    const impact = resolveProfileImpactDetailed({
+      changedPaths: detectedPaths,
+      profiles: config.profiles,
+    });
+    issues.push(...impact.uncoveredPaths.map((value) =>
+      `uncovered_detected_surface:${value}`));
+    issues.push(...impact.warnings
+      .filter((warning) => warning.startsWith("supporting_only_match:"))
+      .map((warning) => `detected_surface_${warning}`));
+  }
+  return [...new Set(issues)].sort();
+}
+
 export function validateProfiles({ workspaceRoot } = {}) {
   const root = resolveBoundedWorkspaceRoot(workspaceRoot);
   const issues = [];
@@ -1256,23 +1847,7 @@ export function validateProfiles({ workspaceRoot } = {}) {
         .filter((id) => typeof id === "string")
         .sort()
       : [];
-    issues.push(...validateProfileDocument(config));
-    if (issues.length === 0) {
-      const detected = detectProfiles({ workspaceRoot: root });
-      const detectedPaths = detected.candidates.flatMap((profile) =>
-        profile.paths.map(representativePath));
-      if (detectedPaths.length > 0) {
-        const impact = resolveProfileImpactDetailed({
-          changedPaths: detectedPaths,
-          profiles: config.profiles,
-        });
-        issues.push(...impact.uncoveredPaths.map((value) =>
-          `uncovered_detected_surface:${value}`));
-        issues.push(...impact.warnings
-          .filter((warning) => warning.startsWith("supporting_only_match:"))
-          .map((warning) => `detected_surface_${warning}`));
-      }
-    }
+    issues.push(...validateProfileDocumentWithDetectedSurfaces(root, config));
   } catch (error) {
     issues.push(error instanceof Error ? error.message : String(error));
   }

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -18,6 +18,12 @@ const OFFICIAL_CLI_ENTRYPOINT =
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.18.0", new Set([
+    "sha256:72c481dbafe06a9c56cd940d74a3fe109a82b73a3c43d0bb54923ea6c584c04e",
+  ])],
+  ["0.17.2", new Set([
+    "sha256:67b883b8a763253b873fb6047c7e7e01c81123aa5250a0db5feaabd13cc4d860",
+  ])],
   ["0.17.1", new Set([
     "sha256:5376f3736dd17c07598df8b655a6bbceb3b64b44f3e6630e69f966e420d82e26",
   ])],