pi-daddy 0.44.3 → 0.45.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/README.md +48 -0
- package/dist/kernel/definition-sources.d.ts +13 -0
- package/dist/kernel/definition-sources.d.ts.map +1 -0
- package/dist/kernel/definition-sources.js +2 -0
- package/dist/kernel/definition-sources.js.map +1 -0
- package/dist/kernel/definitions.d.ts +2 -0
- package/dist/kernel/definitions.d.ts.map +1 -1
- package/dist/kernel/definitions.js.map +1 -1
- package/dist/kernel/env-names.d.ts +2 -0
- package/dist/kernel/env-names.d.ts.map +1 -1
- package/dist/kernel/env-names.js +3 -0
- package/dist/kernel/env-names.js.map +1 -1
- package/dist/kernel/propagation.d.ts +1 -1
- package/dist/kernel/propagation.d.ts.map +1 -1
- package/dist/kernel/propagation.js +2 -0
- package/dist/kernel/propagation.js.map +1 -1
- package/dist/kernel/selected-definitions.d.ts +1 -1
- package/dist/kernel/selected-definitions.d.ts.map +1 -1
- package/dist/kernel/selected-definitions.js +19 -10
- package/dist/kernel/selected-definitions.js.map +1 -1
- package/dist/products/public-evidence.d.ts +62 -0
- package/dist/products/public-evidence.d.ts.map +1 -0
- package/dist/products/public-evidence.js +116 -0
- package/dist/products/public-evidence.js.map +1 -0
- package/extensions/definition-describe.ts +4 -1
- package/extensions/delegate-chain.ts +22 -12
- package/extensions/delegation.ts +58 -26
- package/extensions/execution-evidence.ts +103 -0
- package/extensions/public-evidence.ts +90 -0
- package/extensions/run-delegation.ts +20 -4
- package/extensions/session.ts +10 -1
- package/package.json +1 -1
- package/src/kernel/definition-sources.ts +12 -0
- package/src/kernel/definitions.ts +2 -0
- package/src/kernel/env-names.ts +3 -0
- package/src/kernel/propagation.ts +2 -0
- package/src/kernel/selected-definitions.ts +31 -10
- package/src/products/public-evidence.ts +181 -0
package/CHANGELOG.md
CHANGED
|
@@ -12,6 +12,17 @@ the record of how the package got here and are worth keeping; they are not worth
|
|
|
12
12
|
> the record of how the package arrived at what it does, and because the reasoning behind each one is
|
|
13
13
|
> usually the clearest statement of why the current behaviour is what it is.
|
|
14
14
|
|
|
15
|
+
## 0.45.0 — opt-in exact public evidence capture (2026-10-08)
|
|
16
|
+
|
|
17
|
+
- Add operator-only `PI_DADDY_PUBLIC_EVIDENCE_DIR` for local captures of exact public definition/delegation returns, with compact hash-addressed manifest references in model-visible content. Default behavior and retention remain off; existing authored content, result details, error states, typed exceptions and chain handoffs are preserved.
|
|
18
|
+
- Retain immutable selected-source bytes only when opted in, and bind observed definitions to the exact planner context. Capture the dispatched body separately, preserve original requested identities and ordered native receipts, and keep skipped/missing outcomes explicit. No task arguments, private session reasoning or hidden details are collected.
|
|
19
|
+
- Require an existing canonical private Linux root and use bounded exclusive durable writes. Capture failure returns a visible failure status without changing the execution outcome or retrying work. The opt-in is stripped from captured children. These references establish byte integrity, never review approval, task acceptance or new authority; the native ledger schema is unchanged.
|
|
20
|
+
|
|
21
|
+
## 0.44.4 — model-visible execution evidence (2026-10-07)
|
|
22
|
+
|
|
23
|
+
- Add a versioned runtime evidence block to the model-visible result of `delegate`, `delegate_all` and `delegate_chain`. Pi provider conversion sends tool content, not UI-only details; coordinators can now inspect the actual terminal identity, final hash, captured-process cleanup receipt, observation state and terminal flags without reading private sessions. Authored final text and structured result details remain unchanged.
|
|
24
|
+
- Keep missing or unknown evidence explicit, and preserve each returned child/step separately. Process settlement does not establish task acceptance or disposable workspace cleanup. Chain tasks still receive only the previous authored final; the evidence block is returned to the coordinator. No prompts, private reasoning, raw diagnostics or retained-session contents are added to the projection.
|
|
25
|
+
|
|
15
26
|
## 0.44.3 — exported ledger capability grammar (2026-10-07)
|
|
16
27
|
|
|
17
28
|
- Derive the published ledger schema capability namespaces from the runtime source, so actual `context:files` and `context:summary` grants validate. Regenerate the production-builder fixtures and hash chain. Consumers pinned to an older schema must explicitly update their pin; runtime authority and record bytes are unchanged.
|
package/README.md
CHANGED
|
@@ -53,3 +53,51 @@ settings or enforcement.
|
|
|
53
53
|
The full product description is the repository [README](https://github.com/mojomanyana/pi-daddy#readme); the
|
|
54
54
|
[CHANGELOG](./CHANGELOG.md) says what each release changed and what to do about breaking changes. The one shipped
|
|
55
55
|
contract is `contracts/ledger-record/v1`.
|
|
56
|
+
|
|
57
|
+
## Optional local public evidence capture
|
|
58
|
+
|
|
59
|
+
Set `PI_DADDY_PUBLIC_EVIDENCE_DIR` before starting the coordinating Pi process to retain exact public
|
|
60
|
+
`delegate_describe`, `delegate`, `delegate_all` and `delegate_chain` return content. It is off by default,
|
|
61
|
+
including source-byte retention. Create a private directory owned by your user first, then use its canonical
|
|
62
|
+
absolute Linux path (no symlink components):
|
|
63
|
+
|
|
64
|
+
```bash
|
|
65
|
+
mkdir -m 700 "$HOME/pi-public-evidence"
|
|
66
|
+
PI_DADDY_PUBLIC_EVIDENCE_DIR="$(realpath "$HOME/pi-public-evidence")" PI_DADDY_HERDR=0 pi
|
|
67
|
+
```
|
|
68
|
+
|
|
69
|
+
Each returned result keeps its authored text, runtime evidence, error state and structured details. An added
|
|
70
|
+
`Public evidence capture:` text block gives `status: "captured"` and a reusable `{path, sha256}` reference to a
|
|
71
|
+
versioned `pi-daddy-public-evidence-v1` manifest. Read and hash-check that manifest and its referenced files;
|
|
72
|
+
the manifest's `response` copies the exact public `{isError, content}` before the reference block is appended.
|
|
73
|
+
This is the extension-return boundary, not a claim about downstream Pi hooks or provider wire serialization.
|
|
74
|
+
|
|
75
|
+
Selected definition sources are copied from the bytes admitted during discovery, including the inline skill,
|
|
76
|
+
Principal binding manifest, package identity and delegated agent where applicable. The exact dispatched body
|
|
77
|
+
is a separate file. Raw source-copy SHA-256 preserves every byte, including a BOM; `sourceHash` retains the
|
|
78
|
+
runtime's existing decoded-text hash semantics. Changing a source path later does not rewrite the snapshot.
|
|
79
|
+
Manifest `requestedDefinitionId` is the caller's claim; `definitionId` is the observed planner selection.
|
|
80
|
+
Requested execution IDs are allocated occurrences, not proof that those children started. Runtime outcomes
|
|
81
|
+
contain only the existing allowlisted final and process-receipt projection, in original child/step order;
|
|
82
|
+
skipped steps have no invented outcome. `finals` also copies each complete attributed public final separately,
|
|
83
|
+
with its ordinal, execution ID and native session/message/leaf identity. Its byte hash must match the native
|
|
84
|
+
final hash; unavailable finals remain null. Consumers never need to reconstruct a final from report delimiters.
|
|
85
|
+
Process settlement remains separate from workspace cleanup.
|
|
86
|
+
|
|
87
|
+
The configured root must already exist with owner-only permissions. Captures use exclusive ordinary files,
|
|
88
|
+
held directory descriptors and fsync before publishing a reference; each capture is limited to 64 MiB and
|
|
89
|
+
64 files. Files are mode 0600 and capture directories mode 0700. The operator owns total retention and disposal;
|
|
90
|
+
there is no automatic deletion or lifetime disk quota. Partial files can remain after a failure.
|
|
91
|
+
An unavailable source snapshot, bad path, permission error or capture limit produces a loud `failed` status
|
|
92
|
+
without a success reference. It does not rewrite work results, respawn children or turn a failed execution into
|
|
93
|
+
success. Typed exceptions before a result is returned preserve their original behavior and have no returned
|
|
94
|
+
capture. The directory setting is stripped from captured-child environments. The same Pi owner restores its own setting
|
|
95
|
+
on extension reload; unrelated owners do not inherit it. Set the value to literal `off` to explicitly disable
|
|
96
|
+
capture on reload; future calls use the replacement setting while in-flight calls retain their original root.
|
|
97
|
+
|
|
98
|
+
No request task text, tool arguments, credentials, private session/reasoning, raw `details` or hidden diagnostics
|
|
99
|
+
are collected by this feature. Public authored output can itself contain sensitive information, so choose the
|
|
100
|
+
local root deliberately. Hashes identify retained bytes; they do not authenticate against hostile processes
|
|
101
|
+
running as the same user. Capture integrity establishes neither reviewer approval nor task completion and
|
|
102
|
+
adds no grants, ledger events or automatic resumption. Future JEV/LoRA experiments may explicitly consume
|
|
103
|
+
reviewed public evidence offline; this feature sends nothing to an external evaluator.
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
/** Opt-in immutable copies of bytes already admitted by selected-resource discovery. Never authority. */
|
|
2
|
+
export interface DefinitionSource {
|
|
3
|
+
readonly kind: "selected-skill" | "package" | "binding-manifest" | "delegated-agent";
|
|
4
|
+
readonly path: string;
|
|
5
|
+
/** Raw admitted bytes, including any BOM. Runtime sourceHash separately identifies decoded text. */
|
|
6
|
+
readonly base64: string;
|
|
7
|
+
}
|
|
8
|
+
export interface DefinitionSourceSnapshot {
|
|
9
|
+
readonly resources: readonly DefinitionSource[];
|
|
10
|
+
/** Exact body dispatched to the child; some generic definitions trim their source body. */
|
|
11
|
+
readonly body: string;
|
|
12
|
+
}
|
|
13
|
+
//# sourceMappingURL=definition-sources.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"definition-sources.d.ts","sourceRoot":"","sources":["../../src/kernel/definition-sources.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"definition-sources.js","sourceRoot":"","sources":["../../src/kernel/definition-sources.ts"],"names":[],"mappings":""}
|
|
@@ -44,6 +44,8 @@ export interface DefinitionDigest {
|
|
|
44
44
|
*/
|
|
45
45
|
export declare function digestDefinition(definition: SkillDefinition): DefinitionDigest;
|
|
46
46
|
export interface SkillDefinition {
|
|
47
|
+
/** Present only for explicit local public-evidence capture; excluded from authority and identity. */
|
|
48
|
+
sourceSnapshot?: import("./definition-sources.ts").DefinitionSourceSnapshot;
|
|
47
49
|
/** Immutable selected-resource identity, independent of the model-authored name. */
|
|
48
50
|
definitionId?: string;
|
|
49
51
|
selectedSkillHash?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/kernel/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,eAAe,GAAG,gBAAgB,CAM9E;AAED,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAgEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,eAAe,GAAG,iBAAiB,CA2BnF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAU,CAAC;AAE5C,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAEhD,QAAQ,GAAE,OAAO,eAAiC,GACjD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAyCvC"}
|
|
1
|
+
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/kernel/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,eAAe,GAAG,gBAAgB,CAM9E;AAED,MAAM,WAAW,eAAe;IAC9B,qGAAqG;IACrG,cAAc,CAAC,EAAE,OAAO,yBAAyB,EAAE,wBAAwB,CAAC;IAC5E,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAgEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,eAAe,GAAG,iBAAiB,CA2BnF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAU,CAAC;AAE5C,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAEhD,QAAQ,GAAE,OAAO,eAAiC,GACjD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAyCvC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/kernel/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAkBlE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA2B;IAC1D,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC3E,CAAC;AACJ,CAAC;
|
|
1
|
+
{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/kernel/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAkBlE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA2B;IAC1D,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC3E,CAAC;AACJ,CAAC;AA4CD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9B,+FAA+F;QAC/F,mGAAmG;QACnG,oGAAoG;QACpG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM;gBACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5B,CAAC,GAAG,CAAC,CAAC;YACR,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,6FAA6F;QAC7F,IAAI,GAAG,KAAK,UAAU,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxE,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC,GAAG,CAAC,CAAC;YACR,CAAC;YACD,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,IAAI,GAAG,KAAK,eAAe,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;gBAAE,SAAS;QAC/C,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3C,OAAO;QACL,gGAAgG;QAChG,6FAA6F;QAC7F,2FAA2F;QAC3F,oFAAoF;QACpF,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC;QAC/B,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QACzC,kBAAkB,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACjE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QACxC,MAAM;QACN,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA2B;IAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAEnF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAc,CAAC;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,oGAAoG;IACpG,mGAAmG;IACnG,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,sGAAsG;QACtG,wGAAwG;QACxG,qGAAqG;QACrG,uGAAuG;QACvG,wFAAwF;QACxF,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7E,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,CAAC;AAE5C,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,OAAgD;AAChD,4EAA4E;AAC5E,WAAmC,eAAe;IAElD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9D,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE;YAChC,QAAQ,EAAE,oBAAoB;YAC9B,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAChE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE;oBACtE,QAAQ,EAAE,oBAAoB;oBAC9B,SAAS,EAAE,0BAA0B;iBACtC,CAAC,CAAC;gBACH,IAAI,OAA2B,CAAC;gBAChC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;wBACpD,IAAI,0BAA0B,CAAC,SAAS,CAAC;4BAAE,OAAO,GAAG,SAAS,CAAC;oBACjE,CAAC;oBAAC,MAAM,CAAC;wBACP,0GAA0G;oBAC5G,CAAC;gBACH,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7D,IAAI,cAAc;gBAAE,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;QACvF,qGAAqG;QACrG,qGAAqG;aAChG,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACnC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,+CAA+C,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;;YAClF,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
|
|
@@ -37,6 +37,8 @@ export declare const ENV_WORKSPACE_REGISTRY = "PI_DADDY_WORKSPACE_REGISTRY";
|
|
|
37
37
|
export declare const ENV_WORKSPACE_LEASE_DIR = "PI_DADDY_WORKSPACE_LEASE_DIR";
|
|
38
38
|
/** ADR-0042: what each authorised workspace id MEANT when the grant was established. Authority, not metadata. */
|
|
39
39
|
export declare const ENV_WORKSPACE_PIN = "PI_DADDY_WORKSPACE_PIN";
|
|
40
|
+
/** Explicit operator-only local public-response capture; never inherited by a captured child. */
|
|
41
|
+
export declare const ENV_PUBLIC_EVIDENCE_DIR = "PI_DADDY_PUBLIC_EVIDENCE_DIR";
|
|
40
42
|
export declare const ENV_EXECUTION_ARCHIVE = "PI_DADDY_EXECUTION_ARCHIVE";
|
|
41
43
|
export declare const ENV_NATIVE_SESSION_ROOT = "PI_DADDY_NATIVE_SESSION_ROOT";
|
|
42
44
|
export declare const ENV_RETAIN_NATIVE_SESSIONS = "PI_DADDY_RETAIN_NATIVE_SESSIONS";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"env-names.d.ts","sourceRoot":"","sources":["../../src/kernel/env-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AACxD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAIxE,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AACpD,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAC1D,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AACxD,eAAO,MAAM,0BAA0B,4EAA0E,CAAC;AAGlH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,eAAO,MAAM,2BAA2B,qCAAqC,CAAC;AAC9E,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,iHAAiH;AACjH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAClE,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,eAAO,MAAM,0BAA0B,oCAAoC,CAAC;AAC5E,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,yBAAyB,CAAC;AACtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,oHAAoH;AACpH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,mGAAmG;AACnG,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,
|
|
1
|
+
{"version":3,"file":"env-names.d.ts","sourceRoot":"","sources":["../../src/kernel/env-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AACxD,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAIxE,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AACpD,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAC1D,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AACxD,eAAO,MAAM,0BAA0B,4EAA0E,CAAC;AAGlH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAC1C,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,eAAO,MAAM,2BAA2B,qCAAqC,CAAC;AAC9E,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,iHAAiH;AACjH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAClE,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,eAAO,MAAM,0BAA0B,oCAAoC,CAAC;AAC5E,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,yBAAyB,CAAC;AACtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,oHAAoH;AACpH,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,mGAAmG;AACnG,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAgC/C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuB5D,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,CASvE;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAK3E"}
|
package/dist/kernel/env-names.js
CHANGED
|
@@ -42,6 +42,8 @@ export const ENV_WORKSPACE_REGISTRY = "PI_DADDY_WORKSPACE_REGISTRY";
|
|
|
42
42
|
export const ENV_WORKSPACE_LEASE_DIR = "PI_DADDY_WORKSPACE_LEASE_DIR";
|
|
43
43
|
/** ADR-0042: what each authorised workspace id MEANT when the grant was established. Authority, not metadata. */
|
|
44
44
|
export const ENV_WORKSPACE_PIN = "PI_DADDY_WORKSPACE_PIN";
|
|
45
|
+
/** Explicit operator-only local public-response capture; never inherited by a captured child. */
|
|
46
|
+
export const ENV_PUBLIC_EVIDENCE_DIR = "PI_DADDY_PUBLIC_EVIDENCE_DIR";
|
|
45
47
|
export const ENV_EXECUTION_ARCHIVE = "PI_DADDY_EXECUTION_ARCHIVE";
|
|
46
48
|
export const ENV_NATIVE_SESSION_ROOT = "PI_DADDY_NATIVE_SESSION_ROOT";
|
|
47
49
|
export const ENV_RETAIN_NATIVE_SESSIONS = "PI_DADDY_RETAIN_NATIVE_SESSIONS";
|
|
@@ -96,6 +98,7 @@ export const GOVERNANCE_ENV_KEYS = Object.freeze([
|
|
|
96
98
|
ENV_WORKSPACE_REGISTRY,
|
|
97
99
|
ENV_WORKSPACE_LEASE_DIR,
|
|
98
100
|
ENV_WORKSPACE_PIN,
|
|
101
|
+
ENV_PUBLIC_EVIDENCE_DIR,
|
|
99
102
|
ENV_EXECUTION_ARCHIVE,
|
|
100
103
|
ENV_NATIVE_SESSION_ROOT,
|
|
101
104
|
ENV_RETAIN_NATIVE_SESSIONS,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"env-names.js","sourceRoot":"","sources":["../../src/kernel/env-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,2GAA2G;AAC3G,oFAAoF;AACpF,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAC5C,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACxD,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,+BAA+B,CAAC;AAExE,iHAAiH;AACjH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,CAAU,CAAC;AAElH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACtE,iHAAiH;AACjH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAClE,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AACtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,oHAAoH;AACpH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,mGAAmG;AACnG,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAClE,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,wBAAwB;IACxB,GAAG,0BAA0B;IAC7B,SAAS;IACT,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,sBAAsB;IACtB,oBAAoB;IACpB,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,iBAAiB;IACjB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,cAAc;IACd,eAAe;IACf,WAAW;IACX,iBAAiB;IACjB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,eAAe,EAAE,SAAS;IAC1B,eAAe,EAAE,SAAS;IAC1B,mBAAmB,EAAE,aAAa;IAClC,eAAe,EAAE,SAAS;IAC1B,gBAAgB,EAAE,UAAU;IAC5B,kBAAkB,EAAE,YAAY;IAChC,gBAAgB,EAAE,UAAU;IAC5B,mBAAmB,EAAE,aAAa;IAClC,sBAAsB,EAAE,gBAAgB;IACxC,eAAe,EAAE,SAAS;IAC1B,yBAAyB,EAAE,mBAAmB;IAC9C,yBAAyB,EAAE,mBAAmB;IAC9C,uBAAuB,EAAE,iBAAiB;IAC1C,0BAA0B,EAAE,oBAAoB;IAChD,iCAAiC,EAAE,2BAA2B;IAC9D,4BAA4B,EAAE,sBAAsB;IACpD,6BAA6B,EAAE,uBAAuB;IACtD,2BAA2B,EAAE,qBAAqB;IAClD,6BAA6B,EAAE,uBAAuB;IACtD,gCAAgC,EAAE,0BAA0B;IAC5D,kBAAkB,EAAE,mBAAmB;IACvC,kBAAkB,EAAE,mBAAmB;CACxC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,OAA0B;IACjE,OAAO,CACL,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oCAAoC;QAC1G,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,CACrH,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"env-names.js","sourceRoot":"","sources":["../../src/kernel/env-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,2GAA2G;AAC3G,oFAAoF;AACpF,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAClD,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAC5C,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACxD,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,+BAA+B,CAAC;AAExE,iHAAiH;AACjH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,CAAU,CAAC;AAElH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,kCAAkC,CAAC;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACtE,iHAAiH;AACjH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAClE,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AACpD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AACtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,oHAAoH;AACpH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,mGAAmG;AACnG,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAEtE,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAClE,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,wBAAwB;IACxB,GAAG,0BAA0B;IAC7B,SAAS;IACT,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,sBAAsB;IACtB,oBAAoB;IACpB,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,iBAAiB;IACjB,uBAAuB;IACvB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,cAAc;IACd,eAAe;IACf,WAAW;IACX,iBAAiB;IACjB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,eAAe,EAAE,SAAS;IAC1B,eAAe,EAAE,SAAS;IAC1B,mBAAmB,EAAE,aAAa;IAClC,eAAe,EAAE,SAAS;IAC1B,gBAAgB,EAAE,UAAU;IAC5B,kBAAkB,EAAE,YAAY;IAChC,gBAAgB,EAAE,UAAU;IAC5B,mBAAmB,EAAE,aAAa;IAClC,sBAAsB,EAAE,gBAAgB;IACxC,eAAe,EAAE,SAAS;IAC1B,yBAAyB,EAAE,mBAAmB;IAC9C,yBAAyB,EAAE,mBAAmB;IAC9C,uBAAuB,EAAE,iBAAiB;IAC1C,0BAA0B,EAAE,oBAAoB;IAChD,iCAAiC,EAAE,2BAA2B;IAC9D,4BAA4B,EAAE,sBAAsB;IACpD,6BAA6B,EAAE,uBAAuB;IACtD,2BAA2B,EAAE,qBAAqB;IAClD,6BAA6B,EAAE,uBAAuB;IACtD,gCAAgC,EAAE,0BAA0B;IAC5D,kBAAkB,EAAE,mBAAmB;IACvC,kBAAkB,EAAE,mBAAmB;CACxC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,OAA0B;IACjE,OAAO,CACL,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oCAAoC;QAC1G,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,qDAAqD,CACrH,CAAC;AACJ,CAAC"}
|
|
@@ -48,7 +48,7 @@ export { ENV_GRANT, ENV_FANOUT, ENV_PARENT_ID, ENV_EXECUTION_ID, ENV_EPISODE_ID,
|
|
|
48
48
|
* environment into a child's — a governance variable a child inherits by accident is one nobody decided
|
|
49
49
|
* to give it.
|
|
50
50
|
*/
|
|
51
|
-
export declare const GRANT_ENV_KEYS: readonly ["PI_DADDY_ADVISOR_KEY", "PI_DADDY_ADVISOR", "PI_DADDY_ADVISOR_TASK_EGRESS", "PI_DADDY_GRANT", "PI_DADDY_DEPTH", "PI_DADDY_MAX_DEPTH", "PI_DADDY_GATED", "PI_DADDY_LEDGER", "PI_DADDY_APPROVED", "PI_DADDY_FANOUT", "PI_DADDY_PARENT_ID", "PI_DADDY_EXECUTION_ID", "PI_DADDY_EPISODE_ID", "PI_DADDY_EPISODE_COST_CEILING", "PI_DADDY_WORKSPACE_PIN"];
|
|
51
|
+
export declare const GRANT_ENV_KEYS: readonly ["PI_DADDY_PUBLIC_EVIDENCE_DIR", "PI_DADDY_ADVISOR_KEY", "PI_DADDY_ADVISOR", "PI_DADDY_ADVISOR_TASK_EGRESS", "PI_DADDY_GRANT", "PI_DADDY_DEPTH", "PI_DADDY_MAX_DEPTH", "PI_DADDY_GATED", "PI_DADDY_LEDGER", "PI_DADDY_APPROVED", "PI_DADDY_FANOUT", "PI_DADDY_PARENT_ID", "PI_DADDY_EXECUTION_ID", "PI_DADDY_EPISODE_ID", "PI_DADDY_EPISODE_COST_CEILING", "PI_DADDY_WORKSPACE_PIN"];
|
|
52
52
|
export declare const parseList: (raw: string | undefined) => Capability[];
|
|
53
53
|
/**
|
|
54
54
|
* Derive this session's own grant from what it inherited and what pi actually gave it.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"propagation.d.ts","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;
|
|
1
|
+
{"version":3,"file":"propagation.d.ts","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAA6C,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnG,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAqB3E,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH;;;;GAIG;AACH,sGAAsG;AAEtG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,+XA2BjB,CAAC;AAEX,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UAAU,EAI9B,CAAC;AAkBjC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,oBAAoB,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,UAAU,EAAE,CAc/G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAO7E;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAStG;AAED,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;;;;;;;;;GASG;AAqBH,eAAO,MAAM,aAAa,EAAE,UAAU,EAA+E,CAAC;AAEtH;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,EAAE,CAGlE;AAED,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB;;;;;;OAMG;IACH;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,EAAE,CAE3E;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,WAAW,EAAE,SAAS,UAAU,EAAE,GACjC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAK9G;AAED,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAoBlE"}
|
|
@@ -24,6 +24,7 @@
|
|
|
24
24
|
* descendant can exceed the root. It is also defence in depth — even if a spawn slipped past the
|
|
25
25
|
* interceptor and pi handed the child more than the parent held, the intersection clamps it back.
|
|
26
26
|
*/
|
|
27
|
+
import { ENV_PUBLIC_EVIDENCE_DIR } from "./env-names.js";
|
|
27
28
|
import { attenuateWorkspacePin, formatWorkspacePin } from "./workspace-pin.js";
|
|
28
29
|
import { WILDCARD } from "./pi-tools.js";
|
|
29
30
|
import { WORKSPACE_WILDCARD } from "./resolve.js";
|
|
@@ -52,6 +53,7 @@ export { ENV_GRANT, ENV_FANOUT, ENV_PARENT_ID, ENV_EXECUTION_ID, ENV_EPISODE_ID,
|
|
|
52
53
|
* to give it.
|
|
53
54
|
*/
|
|
54
55
|
export const GRANT_ENV_KEYS = [
|
|
56
|
+
ENV_PUBLIC_EVIDENCE_DIR,
|
|
55
57
|
// Not governance state, but the same rule applies for a stronger reason: neither a credential the parent holds
|
|
56
58
|
// nor the switch that points it at a third party is something a child inherits by being spawned (ADR-0077).
|
|
57
59
|
//
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"propagation.js","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;
|
|
1
|
+
{"version":3,"file":"propagation.js","sourceRoot":"","sources":["../../src/kernel/propagation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,EACf,WAAW,EACX,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,EACZ,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH;;;;GAIG;AACH,sGAAsG;AAEtG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,uBAAuB;IACvB,+GAA+G;IAC/G,4GAA4G;IAC5G,EAAE;IACF,iHAAiH;IACjH,6GAA6G;IAC7G,uGAAuG;IACvG,eAAe;IACf,WAAW;IACX,uBAAuB;IACvB,SAAS;IACT,SAAS;IACT,aAAa;IACb,SAAS;IACT,UAAU;IACV,YAAY;IACZ,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,wBAAwB;IACxB,8GAA8G;IAC9G,8DAA8D;IAC9D,oGAAoG;IACpG,2DAA2D;IAC3D,iBAAiB;CACT,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAgB,EAAE,CACjE,CAAC,GAAG,IAAI,EAAE,CAAC;KACR,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEjC,6GAA6G;AAC7G,SAAS,eAAe,CAAC,UAAsB,EAAE,QAAgB;IAC/D,IAAI,UAAU,KAAK,QAAQ,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;AACzG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,UAAsB,EAAW,EAAE,CAC3D,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,oBAAkC,EAAE,aAA8B;IAC/F,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC7D,uFAAuF;IACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC3F,IAAI,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,gGAAgG;QAChG,8BAA8B;QAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,GAAG,OAAO;KACX,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,gGAAgG;IAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAA4B,EAAE,WAA+B;IACvF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;AACnF,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;;GASG;AACH,iHAAiH;AACjH,gHAAgH;AAChH,yGAAyG;AACzG,iCAAiC;AACjC,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,4GAA4G;AAC5G,0GAA0G;AAC1G,0GAA0G;AAC1G,4GAA4G;AAC5G,6GAA6G;AAC7G,EAAE;AACF,6GAA6G;AAC7G,2GAA2G;AAC3G,4GAA4G;AAC5G,2CAA2C;AAC3C,EAAE;AACF,+GAA+G;AAC/G,2GAA2G;AAC3G,MAAM,CAAC,MAAM,aAAa,GAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAEtH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AA+CD;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,GAAG,GAA2B;QAClC,CAAC,SAAS,CAAC,EAAE,CAAC,iCAAiC,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;KACxC,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,sGAAsG;IACtG,mGAAmG;IACnG,sGAAsG;IACtG,wGAAwG;IACxG,kFAAkF;IAClF,GAAG,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,0FAA0F;IAC1F,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IACzE,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,gGAAgG;IAChG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA+B,EAC/B,WAAkC;IAElC,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,SAA4B,EAAE,OAA+B;IACzF,MAAM,MAAM,GAAsB,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,0BAA0B;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,SAAS;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;YAC3C,2EAA2E;YAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,QAA+C,CAAC;YACjE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC;YACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,mGAAmG;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -7,7 +7,7 @@ export interface SelectedCommand {
|
|
|
7
7
|
path?: string;
|
|
8
8
|
};
|
|
9
9
|
}
|
|
10
|
-
export declare function selectedDefinitions(commands: readonly SelectedCommand[]): Promise<{
|
|
10
|
+
export declare function selectedDefinitions(commands: readonly SelectedCommand[], captureSources?: boolean): Promise<{
|
|
11
11
|
definitions: Map<string, SkillDefinition>;
|
|
12
12
|
skills: CatalogEntry[];
|
|
13
13
|
skips: string[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"selected-definitions.d.ts","sourceRoot":"","sources":["../../src/kernel/selected-definitions.ts"],"names":[],"mappings":"AAKA,OAAO,EAA8C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"selected-definitions.d.ts","sourceRoot":"","sources":["../../src/kernel/selected-definitions.ts"],"names":[],"mappings":"AAKA,OAAO,EAA8C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGpG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChC;AAuGD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,cAAc,UAAQ,GACrB,OAAO,CAAC;IACT,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1C,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAqDD"}
|
|
@@ -9,15 +9,17 @@ const phases = ["plan", "build", "review", "debug", "investigate"];
|
|
|
9
9
|
const hash = (value) => createHash("sha256").update(value, "utf8").digest("hex");
|
|
10
10
|
const object = (x) => !!x && typeof x === "object" && !Array.isArray(x);
|
|
11
11
|
const exact = (x, keys) => Object.keys(x).sort().join(",") === [...keys].sort().join(",");
|
|
12
|
-
async function read(path) {
|
|
12
|
+
async function read(path, kind, sources) {
|
|
13
13
|
if (!(await lstat(path)).isFile())
|
|
14
14
|
throw Error(`nonregular selected resource: ${path}`);
|
|
15
15
|
const result = await readBoundedBytes(path, { maxBytes: 1024 * 1024, timeoutMs: 3000 });
|
|
16
16
|
if (!result.ok)
|
|
17
17
|
throw Error(result.detail);
|
|
18
|
-
|
|
18
|
+
const text = new TextDecoder("utf-8", { fatal: true }).decode(result.bytes);
|
|
19
|
+
sources?.push(Object.freeze({ kind, path, base64: result.bytes.toString("base64") }));
|
|
20
|
+
return text;
|
|
19
21
|
}
|
|
20
|
-
async function principalBinding(path, inline, skillText) {
|
|
22
|
+
async function principalBinding(path, inline, skillText, sources) {
|
|
21
23
|
const phase = inline.name;
|
|
22
24
|
const marked = inline.metadata?.["principal-package"] === "principal-pi-skills";
|
|
23
25
|
if (!phases.includes(phase) || path !== join(dirname(dirname(path)), phase, "SKILL.md")) {
|
|
@@ -28,7 +30,7 @@ async function principalBinding(path, inline, skillText) {
|
|
|
28
30
|
const root = dirname(dirname(path));
|
|
29
31
|
let packageText;
|
|
30
32
|
try {
|
|
31
|
-
packageText = await read(join(root, "package.json"));
|
|
33
|
+
packageText = await read(join(root, "package.json"), "package", sources);
|
|
32
34
|
}
|
|
33
35
|
catch (error) {
|
|
34
36
|
if (error.code === "ENOENT" && !marked)
|
|
@@ -41,7 +43,7 @@ async function principalBinding(path, inline, skillText) {
|
|
|
41
43
|
throw Error("marked Principal skill has missing or wrong package identity");
|
|
42
44
|
return inline;
|
|
43
45
|
}
|
|
44
|
-
const manifest = JSON.parse(await read(join(root, "principal-agents.json")));
|
|
46
|
+
const manifest = JSON.parse(await read(join(root, "principal-agents.json"), "binding-manifest", sources));
|
|
45
47
|
if (!object(manifest) ||
|
|
46
48
|
!exact(manifest, ["version", "package", "bindings"]) ||
|
|
47
49
|
manifest.version !== 1 ||
|
|
@@ -66,7 +68,7 @@ async function principalBinding(path, inline, skillText) {
|
|
|
66
68
|
if ((await realpath(agentPath)) !== join(await realpath(root), row.agent) ||
|
|
67
69
|
(await realpath(path)) !== join(await realpath(root), row.skill))
|
|
68
70
|
throw Error("Principal binding path escaped its selected package");
|
|
69
|
-
const agentText = await read(agentPath);
|
|
71
|
+
const agentText = await read(agentPath, "delegated-agent", sources);
|
|
70
72
|
if (hash(skillText) !== row.skillSha256 || hash(agentText) !== row.agentSha256)
|
|
71
73
|
throw Error("Principal binding hash mismatch");
|
|
72
74
|
const agent = parseSkillDefinition(agentPath, agentText);
|
|
@@ -97,7 +99,7 @@ async function principalBinding(path, inline, skillText) {
|
|
|
97
99
|
binding: Object.freeze({ package: "principal-pi-skills", phase }),
|
|
98
100
|
};
|
|
99
101
|
}
|
|
100
|
-
export async function selectedDefinitions(commands) {
|
|
102
|
+
export async function selectedDefinitions(commands, captureSources = false) {
|
|
101
103
|
const definitions = new Map();
|
|
102
104
|
const skills = [], skips = [], seen = new Set();
|
|
103
105
|
for (const command of commands) {
|
|
@@ -114,11 +116,12 @@ export async function selectedDefinitions(commands) {
|
|
|
114
116
|
if (!command.sourceInfo?.path)
|
|
115
117
|
throw Error("selected resource lacks a public source path");
|
|
116
118
|
const path = resolvePath(command.sourceInfo.path);
|
|
117
|
-
const
|
|
119
|
+
const sources = captureSources ? [] : undefined;
|
|
120
|
+
const text = await read(path, "selected-skill", sources);
|
|
118
121
|
const parsed = parseSkillDefinition(path, text);
|
|
119
122
|
if (!parsed || parsed.name !== name)
|
|
120
123
|
throw Error("selected name/path does not match definition");
|
|
121
|
-
const bound = await principalBinding(path, parsed, text);
|
|
124
|
+
const bound = await principalBinding(path, parsed, text, sources);
|
|
122
125
|
const definitionId = hash(JSON.stringify({
|
|
123
126
|
name,
|
|
124
127
|
source: bound.source,
|
|
@@ -132,7 +135,13 @@ export async function selectedDefinitions(commands) {
|
|
|
132
135
|
}));
|
|
133
136
|
if (bound.metadata)
|
|
134
137
|
Object.freeze(bound.metadata);
|
|
135
|
-
definitions.set(name, Object.freeze({
|
|
138
|
+
definitions.set(name, Object.freeze({
|
|
139
|
+
...bound,
|
|
140
|
+
definitionId,
|
|
141
|
+
...(sources
|
|
142
|
+
? { sourceSnapshot: Object.freeze({ resources: Object.freeze(sources), body: bound.body }) }
|
|
143
|
+
: {}),
|
|
144
|
+
}));
|
|
136
145
|
skills.push({ capability: `skill:${name}`, kind: "skill", source: path });
|
|
137
146
|
}
|
|
138
147
|
catch (error) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"selected-definitions.js","sourceRoot":"","sources":["../../src/kernel/selected-definitions.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAwB,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"selected-definitions.js","sourceRoot":"","sources":["../../src/kernel/selected-definitions.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAwB,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAQvC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACnE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/G,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,IAAc,EAAE,EAAE,CAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjE,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAA8B,EAAE,OAA4B;IAC5F,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;QAAE,MAAM,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AACD,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,MAAuB,EACvB,SAAiB,EACjB,OAA4B;IAE5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,KAAK,qBAAqB,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACxF,IAAI,MAAM;YAAE,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACnF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QACjF,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACvD,IAAI,MAAM;YAAE,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;IACnH,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjB,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACpD,QAAQ,CAAC,OAAO,KAAK,CAAC;QACtB,QAAQ,CAAC,OAAO,KAAK,qBAAqB;QAC1C,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAEjC,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IACE,CAAC,MAAM,CAAC,GAAG,CAAC;YACZ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;YAC7D,GAAG,CAAC,KAAK,KAAK,GAAG,IAAI,WAAW;YAChC,GAAG,CAAC,KAAK,KAAK,oBAAoB,IAAI,KAAK;YAC3C,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;YACnC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;YACnC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YAEvC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAA2B,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,IACE,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;QACrE,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;QAEhE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,WAAW;QAC5E,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,CAAC,EAChD,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACjD,IACE,aAAa,CAAC,UAAU;QACxB,gBAAgB,CAAC,UAAU;QAC3B,aAAa,CAAC,QAAQ,CAAC,MAAM;QAC7B,gBAAgB,CAAC,QAAQ,CAAC,MAAM;QAEhC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,OAAO,CAAC;QACtB,SAAS,EAAE,gBAAgB,CAAC,YAAY;QACxC,WAAW,EAAE,aAAa,CAAC,YAAY;QACvC,WAAW,EAAE,KAAK;KACnB,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAE,CAAC;IAClE,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;QAC3B,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC;QAClC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB;QACzE,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAoC,EACpC,cAAc,GAAG,KAAK;IAMtB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvD,MAAM,MAAM,GAAmB,EAAE,EAC/B,KAAK,GAAa,EAAE,EACpB,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI;gBAAE,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,OAAO,GAAmC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACjG,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,IAAI,CACvB,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI;gBACJ,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC,CACH,CAAC;YACF,IAAI,KAAK,CAAC,QAAQ;gBAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClD,WAAW,CAAC,GAAG,CACb,IAAI,EACJ,MAAM,CAAC,MAAM,CAAC;gBACZ,GAAG,KAAK;gBACR,YAAY;gBACZ,GAAG,CAAC,OAAO;oBACT,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE;oBAC5F,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACtG,CAAC"}
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
import type { DefinitionSourceSnapshot } from "../kernel/definition-sources.ts";
|
|
2
|
+
export declare const PUBLIC_EVIDENCE_SCHEMA = "pi-daddy-public-evidence-v1";
|
|
3
|
+
export declare const MAX_PUBLIC_EVIDENCE_BYTES: number;
|
|
4
|
+
export declare const MAX_PUBLIC_EVIDENCE_FILES = 64;
|
|
5
|
+
export interface PublicEvidenceRef {
|
|
6
|
+
path: string;
|
|
7
|
+
sha256: string;
|
|
8
|
+
bytes: number;
|
|
9
|
+
}
|
|
10
|
+
export interface PublicEvidenceOwner {
|
|
11
|
+
readonly directory: string;
|
|
12
|
+
readonly ownerId: string;
|
|
13
|
+
}
|
|
14
|
+
export interface PublicDefinitionEvidence {
|
|
15
|
+
agent: string;
|
|
16
|
+
definitionId: string;
|
|
17
|
+
sourceHash: string | null;
|
|
18
|
+
bodySha256: string;
|
|
19
|
+
binding: Readonly<{
|
|
20
|
+
package: string;
|
|
21
|
+
phase: string;
|
|
22
|
+
}> | null;
|
|
23
|
+
snapshot?: DefinitionSourceSnapshot;
|
|
24
|
+
}
|
|
25
|
+
export interface PublicEvidenceRequest {
|
|
26
|
+
ordinal: number;
|
|
27
|
+
agent: string | null;
|
|
28
|
+
requestedDefinitionId: string | null;
|
|
29
|
+
definitionId: string | null;
|
|
30
|
+
executionId: string | null;
|
|
31
|
+
}
|
|
32
|
+
export interface PublicFinalEvidence {
|
|
33
|
+
ordinal: number;
|
|
34
|
+
executionId: string | null;
|
|
35
|
+
final: {
|
|
36
|
+
state: "complete";
|
|
37
|
+
text: string;
|
|
38
|
+
sessionId: string;
|
|
39
|
+
messageId: string;
|
|
40
|
+
leafId: string;
|
|
41
|
+
sha256: string;
|
|
42
|
+
} | null;
|
|
43
|
+
}
|
|
44
|
+
export interface PublicEvidenceInput {
|
|
45
|
+
toolCallId: string;
|
|
46
|
+
tool: "delegate_describe" | "delegate" | "delegate_all" | "delegate_chain";
|
|
47
|
+
response: {
|
|
48
|
+
isError: boolean;
|
|
49
|
+
content: readonly {
|
|
50
|
+
type: "text";
|
|
51
|
+
text: string;
|
|
52
|
+
}[];
|
|
53
|
+
};
|
|
54
|
+
requested: readonly PublicEvidenceRequest[];
|
|
55
|
+
runtimeEvidence: unknown;
|
|
56
|
+
definitions: readonly PublicDefinitionEvidence[];
|
|
57
|
+
finals: readonly PublicFinalEvidence[];
|
|
58
|
+
}
|
|
59
|
+
export declare function createPublicEvidenceOwner(directory: string | undefined): PublicEvidenceOwner | undefined;
|
|
60
|
+
/** No schema accepts arbitrary filenames, output paths, raw arguments, environment, or native details. */
|
|
61
|
+
export declare function capturePublicEvidence(owner: PublicEvidenceOwner, input: PublicEvidenceInput): PublicEvidenceRef;
|
|
62
|
+
//# sourceMappingURL=public-evidence.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"public-evidence.d.ts","sourceRoot":"","sources":["../../src/products/public-evidence.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAC1D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC7D,QAAQ,CAAC,EAAE,wBAAwB,CAAC;CACrC;AACD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AACD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE;QACL,KAAK,EAAE,UAAU,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;CACV;AACD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,mBAAmB,GAAG,UAAU,GAAG,cAAc,GAAG,gBAAgB,CAAC;IAC3E,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,SAAS;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IACnF,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC5C,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACjD,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACxC;AACD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAIxG;AAGD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,GAAG,iBAAiB,CAyG/G"}
|
|
@@ -0,0 +1,116 @@
|
|
|
1
|
+
/** Exact public extension-return capture. Opt-in local observation, never an authority/acceptance source.
|
|
2
|
+
* Existing operator-created root must be canonical, private and owned by this uid. Held directory
|
|
3
|
+
* descriptors anchor every exclusive write; successful refs are returned only after fsync and close.
|
|
4
|
+
* Hashes detect accidental edits; this does not authenticate against a hostile process with the same uid.
|
|
5
|
+
*/
|
|
6
|
+
import { randomUUID, createHash } from "node:crypto";
|
|
7
|
+
import { constants, openSync, closeSync, fstatSync, fsyncSync, writeFileSync, mkdirSync, realpathSync, statSync, } from "node:fs";
|
|
8
|
+
import { isAbsolute, join, resolve } from "node:path";
|
|
9
|
+
export const PUBLIC_EVIDENCE_SCHEMA = "pi-daddy-public-evidence-v1";
|
|
10
|
+
export const MAX_PUBLIC_EVIDENCE_BYTES = 64 * 1024 * 1024;
|
|
11
|
+
export const MAX_PUBLIC_EVIDENCE_FILES = 64;
|
|
12
|
+
export function createPublicEvidenceOwner(directory) {
|
|
13
|
+
return directory === undefined || directory === "off"
|
|
14
|
+
? undefined
|
|
15
|
+
: Object.freeze({ directory, ownerId: randomUUID() });
|
|
16
|
+
}
|
|
17
|
+
const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
|
|
18
|
+
const json = (value) => Buffer.from(JSON.stringify(value) + "\n", "utf8");
|
|
19
|
+
/** No schema accepts arbitrary filenames, output paths, raw arguments, environment, or native details. */
|
|
20
|
+
export function capturePublicEvidence(owner, input) {
|
|
21
|
+
const directory = owner.directory;
|
|
22
|
+
if (process.platform !== "linux" ||
|
|
23
|
+
!isAbsolute(directory) ||
|
|
24
|
+
resolve(directory) !== directory ||
|
|
25
|
+
realpathSync(directory) !== directory)
|
|
26
|
+
throw Error("public evidence root must be an existing canonical absolute Linux directory");
|
|
27
|
+
const rootFd = openSync(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
|
|
28
|
+
try {
|
|
29
|
+
const root = fstatSync(rootFd);
|
|
30
|
+
if (!root.isDirectory() || root.uid !== process.getuid?.() || (root.mode & 0o077) !== 0)
|
|
31
|
+
throw Error("public evidence root must be owned by this user and private (mode 0700)");
|
|
32
|
+
const captureId = randomUUID(), target = join(directory, captureId);
|
|
33
|
+
const rootPath = `/proc/self/fd/${rootFd}`;
|
|
34
|
+
mkdirSync(join(rootPath, captureId), { mode: 0o700 });
|
|
35
|
+
const captureFd = openSync(join(rootPath, captureId), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
|
|
36
|
+
let manifest;
|
|
37
|
+
try {
|
|
38
|
+
let bytes = 0, files = 0;
|
|
39
|
+
const put = (name, content) => {
|
|
40
|
+
bytes += content.byteLength;
|
|
41
|
+
files += 1;
|
|
42
|
+
if (bytes > MAX_PUBLIC_EVIDENCE_BYTES || files > MAX_PUBLIC_EVIDENCE_FILES)
|
|
43
|
+
throw Error("public evidence capture exceeds its byte/file limit; no complete manifest published");
|
|
44
|
+
const fd = openSync(join(`/proc/self/fd/${captureFd}`, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
|
|
45
|
+
try {
|
|
46
|
+
if (!fstatSync(fd).isFile())
|
|
47
|
+
throw Error("public evidence target is not an ordinary file");
|
|
48
|
+
writeFileSync(fd, content);
|
|
49
|
+
fsyncSync(fd);
|
|
50
|
+
}
|
|
51
|
+
finally {
|
|
52
|
+
closeSync(fd);
|
|
53
|
+
}
|
|
54
|
+
return { path: join(target, name), sha256: sha256(content), bytes: content.byteLength };
|
|
55
|
+
};
|
|
56
|
+
const response = put("response.json", json(input.response));
|
|
57
|
+
const finals = input.finals.map((outcome) => {
|
|
58
|
+
if (!outcome.final)
|
|
59
|
+
return { ordinal: outcome.ordinal, executionId: outcome.executionId, final: null };
|
|
60
|
+
const { text, ...identity } = outcome.final;
|
|
61
|
+
const bytes = Buffer.from(text, "utf8");
|
|
62
|
+
if (sha256(bytes) !== identity.sha256)
|
|
63
|
+
throw Error("attributed final bytes do not match the native final hash");
|
|
64
|
+
if (!text || !input.response.content.some((block) => block.text.includes(text)))
|
|
65
|
+
throw Error("attributed final is not present in the public returned content");
|
|
66
|
+
return {
|
|
67
|
+
ordinal: outcome.ordinal,
|
|
68
|
+
executionId: outcome.executionId,
|
|
69
|
+
final: { ...identity, content: put(`outcome-${outcome.ordinal}-final.txt`, bytes) },
|
|
70
|
+
};
|
|
71
|
+
});
|
|
72
|
+
const definitions = input.definitions.map((definition, index) => {
|
|
73
|
+
if (!definition.snapshot)
|
|
74
|
+
throw Error(`selected source snapshot unavailable for ${definition.agent}`);
|
|
75
|
+
const resources = definition.snapshot.resources.map((source, resource) => ({
|
|
76
|
+
kind: source.kind,
|
|
77
|
+
path: source.path,
|
|
78
|
+
copy: put(`definition-${index}-source-${resource}.bin`, Buffer.from(source.base64, "base64")),
|
|
79
|
+
}));
|
|
80
|
+
const { snapshot: _snapshot, ...identity } = definition;
|
|
81
|
+
return {
|
|
82
|
+
...identity,
|
|
83
|
+
resources,
|
|
84
|
+
body: put(`definition-${index}-body.txt`, Buffer.from(definition.snapshot.body, "utf8")),
|
|
85
|
+
};
|
|
86
|
+
});
|
|
87
|
+
manifest = put("manifest.json", json({
|
|
88
|
+
schema: PUBLIC_EVIDENCE_SCHEMA,
|
|
89
|
+
version: 1,
|
|
90
|
+
captureId,
|
|
91
|
+
ownerId: owner.ownerId,
|
|
92
|
+
toolCallId: input.toolCallId,
|
|
93
|
+
tool: input.tool,
|
|
94
|
+
state: "returned",
|
|
95
|
+
response,
|
|
96
|
+
requested: input.requested,
|
|
97
|
+
runtimeEvidence: input.runtimeEvidence,
|
|
98
|
+
finals,
|
|
99
|
+
definitions,
|
|
100
|
+
}));
|
|
101
|
+
fsyncSync(captureFd);
|
|
102
|
+
}
|
|
103
|
+
finally {
|
|
104
|
+
closeSync(captureFd);
|
|
105
|
+
}
|
|
106
|
+
fsyncSync(rootFd);
|
|
107
|
+
const current = statSync(directory);
|
|
108
|
+
if (realpathSync(directory) !== directory || current.dev !== root.dev || current.ino !== root.ino)
|
|
109
|
+
throw Error("public evidence root changed before reference publication");
|
|
110
|
+
return manifest;
|
|
111
|
+
}
|
|
112
|
+
finally {
|
|
113
|
+
closeSync(rootFd);
|
|
114
|
+
}
|
|
115
|
+
}
|
|
116
|
+
//# sourceMappingURL=public-evidence.js.map
|