pi-mega-compact 0.20.74 → 0.20.76

package/extensions/dashboard-server/setup-cortex-actions-native-ort.ts

@@ -5,48 +5,99 @@
  * Sibling of setup-cortex-actions.ts (which stays under the 300-line source soft
  * cap). Implements the mechanics behind the VC9B `install-native-ort` action:
  *
- *   1. locate the committed scripts/encoder/install-native-ort.mjs by walking up
- *      to the repo root (mirroring setup-cortex-actions.ts vc2ScriptDir);
- *   2. spawn `node <script>` locally with a 60s timeout (npm-delegated,
- *      sha256-verified install — the registry URL + sha256 live ONLY in
- *      src/vector-cortex/encoder/native-install-artifacts.ts, never here);
- *   3. capture output to <stateDir>/logs/vc9b/install-native-ort-<ts>.log;
- *   4. REGARDLESS of the install exit code, re-qualify the binding via the ENC-2b
- *      retest path (`runNativeRetest`) and surface the fresh result +
- *      effective backend.
+ *   1. compute the install root (`MEGACOMPACT_NATIVE_ORT_ROOT` override, else
+ *      default ~/.pi/mega-compact/native-ort);
+ *   2. detect the host platform and reject non-installable hosts (ENC-0e);
+ *   3. fetch the pinned onnxruntime-node tarball via the operator's npm and
+ *      verify its sha256 BEFORE install (the tarball never lands in the final
+ *      prefix until the pinned sha matches);
+ *   4. `npm install --prefix <root> <tarball>` from the VERIFIED local tarball;
+ *   5. write a small `.enc2a-marker.json` marker ({platform, version, sha256})
+ *      the ENC-2a version probe reads;
+ *   6. REGARDLESS of install exit code, re-qualify the binding via the ENC-2b
+ *      retest path (`runNativeRetest`) and surface the fresh result + effective
+ *      backend.
  *
  * PREVENT-PI-004 banner: this is an OPT-IN, confirm-gated, npm-delegated local
  * subprocess of a committed repo script. It performs no network I/O in this
  * module and carries NO URL literals (the codebase-wide no-URL-literal scan
  * covers src/ + extensions/).
  *
- * Guardrails: PREVENT-011 (no `any`); the subprocess is a committed local script,
- * never fetched (PREVENT-PI-004, guardrails-allow below).
+ * In-process port of scripts/encoder/install-native-ort.mjs: the npm package
+ * ships src/ + dist/ + extensions/ but NOT scripts/, so the dashboard button on
+ * an installed device has no checkout script to spawn — porting the install
+ * logic here keeps the action working independent of the checkout layout.
+ *
+ * Guardrails: PREVENT-011 (no `any`); PREVENT-PI-004 (npm-delegated local
+ * subprocess; guardrails-allow below).
  */
 
-import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install subprocess (local spawn of committed repo script; no URL literals)
-import { mkdirSync, writeFileSync, existsSync } from "node:fs";
+import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install subprocess (local spawn of committed npm tooling; no URL literals)
+import { createHash } from "node:crypto";
+import { mkdirSync, writeFileSync, existsSync, rmSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { runNativeRetest } from "../../src/vector-cortex/encoder/native-qualify-retest.js";
+import {
+  NATIVE_ORT_PACKAGE,
+  NATIVE_ORT_TARBALL_SHA256,
+  NATIVE_ORT_VERSION,
+  NATIVE_ORT_INSTALLABLE_PLATFORMS,
+  type EncoderPlatform,
+} from "../../src/vector-cortex/encoder/native-install-artifacts.js";
 import type {
   SetupCortexActionResultWithNativeOrt,
   NativeOrtRetestResult,
 } from "./api-contracts/setup-cortex-native-ort.js";
 
-/** Locate scripts/encoder/install-native-ort.mjs by walking up to the repo root. */
-export function installScriptPath(): string | null {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  const rel = join("scripts", "encoder", "install-native-ort.mjs");
-  for (let i = 0; i < 8; i++) {
-    const candidate = join(dir, rel);
-    // guardrails-allow PREVENT-PI-004: local repo filesystem read (loopback)
-    if (existsSync(candidate)) return candidate;
-    const next = dirname(dir);
-    if (next === dir) break;
-    dir = next;
-  }
-  return null;
+/** Candidate install roots: `MEGACOMPACT_NATIVE_ORT_ROOT` override first
+ *  (ENC-2a parity + test isolation), else the default `~/.pi/mega-compact/
+ *  native-ort/`. */
+function nativeOrtDir(): string {
+  const override = process.env.MEGACOMPACT_NATIVE_ORT_ROOT;
+  if (override !== undefined && override.length > 0) return override;
+  return join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort");
+}
+
+/** Resolve the host to an installable EncoderPlatform string. darwin-x64 is
+ *  UNSUPPORTED (no native binding upstream — arm64-only since 1.17) and
+ *  unknown platforms also fail → the caller surfaces a clear failure. */
+function hostPlatform(): EncoderPlatform | null {
+  const plat =
+    process.platform === "win32"
+      ? "win32"
+      : process.platform === "darwin"
+        ? "darwin"
+        : process.platform === "linux"
+          ? "linux"
+          : "";
+  const arch = process.arch === "x64" ? "x64" : process.arch === "arm64" ? "arm64" : "";
+  const candidate = `${plat}-${arch}` as EncoderPlatform;
+  if (candidate === "darwin-x64") return null; // no native binding upstream
+  if (!NATIVE_ORT_INSTALLABLE_PLATFORMS.includes(candidate)) return null;
+  return candidate;
+}
+
+/** sha256 digest of a file on disk. Local FS read (loopback). */
+function sha256File(path: string): string {
+  // guardrails-allow PREVENT-PI-004: local file hash (loopback)
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+/** Write the small `.enc2a-marker.json` marker the ENC-2a version probe reads. */
+function writeMarker(root: string, platform: EncoderPlatform): void {
+  const marker = {
+    platform,
+    version: NATIVE_ORT_VERSION,
+    installedAt: new Date().toISOString(),
+    sha256: NATIVE_ORT_TARBALL_SHA256,
+  };
+  // guardrails-allow PREVENT-PI-004: local marker write (loopback)
+  writeFileSync(
+    join(root, ".enc2a-marker.json"),
+    JSON.stringify(marker, null, 2) + "\n",
+    "utf8",
+  );
 }
 
 /** Ensure the vc9b log dir exists (mirrors setup-cortex-actions.ts). */
@@ -62,18 +113,38 @@ function writeLog(logPath: string, body: string): void {
   writeFileSync(logPath, body, "utf8");
 }
 
+/** The original committed-install-script path lookup, kept for the unit test
+ *  that proves the committed scripts/encoder/install-native-ort.mjs lives on
+ *  disk in a checkout. The install action itself no longer spawns that script
+ *  (in-process port), but the suite would otherwise need to lose that
+ *  verification. */
+export function installScriptPath(): string | null {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  const rel = join("scripts", "encoder", "install-native-ort.mjs");
+  for (let i = 0; i < 8; i++) {
+    const candidate = join(dir, rel);
+    // guardrails-allow PREVENT-PI-004: local repo filesystem read (loopback)
+    if (existsSync(candidate)) return candidate;
+    const next = dirname(dir);
+    if (next === dir) break;
+    dir = next;
+  }
+  return null;
+}
+
 /**
- * Run the ENC-2c lazy-download native onnxruntime INSTALL action. Locates and
- * spawns the committed install script (npm-delegated, sha256-verified), logs the
- * captured output, then ALWAYS runs the ENC-2b retest to re-qualify the binding
- * (regardless of install exit code) and surfaces the fresh result.
+ * Run the ENC-2c lazy-download native onnxruntime INSTALL action. Fetches the
+ * pinned tarball via the operator's npm, verifies its sha256, installs into
+ * `nativeOrtDir()`, then ALWAYS runs the ENC-2b retest to re-qualify the
+ * binding and surfacing the fresh result.
  *
- * Never throws: a missing script or non-zero exit is surfaced as ok=false on the
- * result; the retest runs even on install failure so the operator sees the
- * post-install qualification state. Returns a combined SetupCortexActionResult
- * with the ENC-2c additive fields (present only for pendant actions).
+ * Never throws: every failure (host platform, npm failure, hash mismatch)
+ * surfaces as ok=false on the result; the retest runs even on install failure
+ * so the operator sees the post-install qualification state. Returns a
+ * combined SetupCortexActionResult with the ENC-2c additive fields (present
+ * only for pendant actions).
  */
-// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install action (subprocess of committed repo script; no URL literals)
+// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install action (subprocess of committed npm tooling; no URL literals)
 export async function runInstallNativeOrt(
   stateDir: string,
 ): Promise<SetupCortexActionResultWithNativeOrt> {
@@ -81,41 +152,122 @@ export async function runInstallNativeOrt(
   const logName = `install-native-ort-${ts}.log`;
   const logPath = join(ensureLogDir(stateDir), logName);
 
-  const scriptPath = installScriptPath();
-  if (scriptPath === null) {
-    writeLog(logPath, "install-native-ort.mjs not found in this checkout\n");
+  const root = nativeOrtDir();
+  const platform = hostPlatform();
+  if (platform === null) {
+    writeLog(logPath, "install-native-ort: host platform has no native binding\n");
     return {
       action: "install-native-ort",
       ok: false,
       exitCode: null,
       logPath,
       logName,
+      spawned: false,
+    };
+  }
+
+  // Step 1: derive the tarball URL + fetch the tarball via the operator's npm.
+  // (The tarball never lands in the final prefix until the pinned sha matches.)
+  mkdirSync(root, { recursive: true });
+  const packedName = `${NATIVE_ORT_PACKAGE}-${NATIVE_ORT_VERSION}.tgz`;
+  const packedPath = join(root, packedName);
+  let out = "";
+  const run = (argv: readonly string[]): { code: number; stdio: string } => {
+    const res = spawnSync("npm", argv, { encoding: "utf8", timeout: 60_000 });
+    out += [res.stdout, res.stderr].filter(Boolean).join("\n") + "\n";
+    return { code: res.status ?? 1, stdio: out };
+  };
+
+  // npm pack <pkg>@<ver> --pack-destination <root>
+  // guardrails-allow PREVENT-PI-004: npm-delegated tarball fetch (opt-in
+  // confirm-gated install action; package@version come from the committed
+  // artifacts module, never a literal URL).
+  const pack = run([
+    "pack",
+    `${NATIVE_ORT_PACKAGE}@${NATIVE_ORT_VERSION}`,
+    "--pack-destination",
+    root,
+  ]);
+  if (pack.code !== 0 || !existsSync(packedPath)) {
+    writeLog(logPath, `${out}npm pack failed — could not download tarball\n`);
+    const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
+    return {
+      action: "install-native-ort",
+      ok: false,
+      exitCode: pack.code,
+      logPath,
+      logName,
       spawned: true,
+      nativeOrtRetestResult: retest,
+      nativeOrtBackendEffective:
+        retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
     };
   }
 
-  // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated
-  // install subprocess (local spawn of committed repo script; no URL literals)
-  const result = spawnSync(process.execPath, [scriptPath], {
-    encoding: "utf8",
-    timeout: 60_000,
-  });
+  // Step 2: verify sha256 BEFORE install.
+  const actual = sha256File(packedPath);
+  if (actual !== NATIVE_ORT_TARBALL_SHA256) {
+    writeLog(
+      logPath,
+      `${out}sha256 mismatch — expected ${NATIVE_ORT_TARBALL_SHA256}, got ${actual}\n`,
+    );
+    // guardrails-allow PREVENT-PI-004: removing a tarball we just wrote (local FS)
+    rmSync(packedPath, { force: true });
+    const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
+    return {
+      action: "install-native-ort",
+      ok: false,
+      exitCode: 1,
+      logPath,
+      logName,
+      spawned: true,
+      nativeOrtRetestResult: retest,
+      nativeOrtBackendEffective:
+        retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+    };
+  }
 
-  const out = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-  writeLog(logPath, out || "(no output)\n");
+  // Step 3: install from the VERIFIED local tarball (npm install --prefix).
+  // guardrails-allow PREVENT-PI-004: npm-delegated install from a local tarball
+  // (opt-in confirm-gated install action).
+  const install = run(["install", "--prefix", root, packedPath]);
+  // guardrails-allow PREVENT-PI-004: removing the local tarball after install
+  rmSync(packedPath, { force: true });
 
-  // Re-qualify AFTER install regardless of exit code (the retest is the source of
-  // truth for whether the binding is actually usable).
+  const installedPkg = join(root, "node_modules", NATIVE_ORT_PACKAGE, "package.json");
+  if (install.code !== 0 || !existsSync(installedPkg)) {
+    writeLog(logPath, `${out}npm install from verified tarball failed\n`);
+    const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
+    return {
+      action: "install-native-ort",
+      ok: false,
+      exitCode: install.code,
+      logPath,
+      logName,
+      spawned: true,
+      nativeOrtRetestResult: retest,
+      nativeOrtBackendEffective:
+        retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+    };
+  }
+
+  // Step 4: success — write the marker, log, then retest.
+  writeMarker(root, platform);
+  writeLog(
+    logPath,
+    `${out}installed ${NATIVE_ORT_PACKAGE}@${NATIVE_ORT_VERSION} (${platform}); sha256 verified + marker written.\n`,
+  );
   const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
 
   return {
     action: "install-native-ort",
-    ok: result.status === 0,
-    exitCode: result.status === null ? null : result.status,
+    ok: true,
+    exitCode: install.code,
     logPath,
     logName,
     spawned: true,
     nativeOrtRetestResult: retest,
-    nativeOrtBackendEffective: retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+    nativeOrtBackendEffective:
+      retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mega-compact",
-  "version": "0.20.74",
+  "version": "0.20.76",
   "description": "Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.",
   "type": "module",
   "license": "BSD-3-Clause",

package/src/config/vector-cortex-enc2c.ts

@@ -9,12 +9,15 @@
  *
  * ENC-2c turns ENC-2a's operator run-script assist into a dashboard action: the
  * Setup Cortex sub-tab gains an "Install Native ORT" button that, when confirmed
- * by the operator, runs the committed `scripts/encoder/install-native-ort.mjs`
- * subprocess locally (npm-delegated, sha256-verified) and then re-qualifies the
- * binding via the ENC-2b retest path. This is a PREVENT-PI-004 opt-in exemption:
- * it is confirm-gated (never automatic), delegated to a local subprocess of a
- * committed repo script, and carries NO URL literals in src/ or extensions/
- * (the registry URL + sha256 live only in the artifacts-module constants).
+ * by the operator, performs the pinned-tarball fetch + sha256 verify + npm
+ * install in-process (a TypeScript port of
+ * `scripts/encoder/install-native-ort.mjs` — the npm package ships
+ * src/dist/extensions but NOT scripts/, so an installed device has no checkout
+ * script to spawn), then re-qualifies the binding via the ENC-2b retest path.
+ * This is a PREVENT-PI-004 opt-in exemption: it is confirm-gated (never
+ * automatic), delegated to the operator's npm as a local subprocess, and carries
+ * NO URL literals in src/ or extensions/ (the registry URL + sha256 live only
+ * in the artifacts-module constants).
  *
  * `MEGACOMPACT_ENC_2C=0` disables: no install action branch, no UI button, no
  * install-related result fields — byte-identical to the ENC-2b predecessor. The

package/src/vector-cortex/encoder/native-qualify-retest.ts

@@ -39,12 +39,16 @@ import { NATIVE_ORT_PACKAGE, type EncoderPlatform } from "./native-install-artif
 
 /** Candidate ONNX runtime native-ort prefixes. The ENC-2a guide installs to
  *  the global `~/.pi/mega-compact/native-ort/`; `stateDir` (per-repo) is a
- *  secondary probe root so the retest resolves either install location. */
+ *  secondary probe root so the retest resolves either install location.
+ *  `MEGACOMPACT_NATIVE_ORT_ROOT` overrides the global root (ENC-2a parity +
+ *  test isolation — honors the same override the enc2a probe and the ENC-2c
+ *  in-process installer honor). */
 function nativeOrtRootCandidates(stateDir: string): string[] {
-  return [
-    join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort"),
-    join(stateDir, "native-ort"),
-  ];
+  const override = process.env.MEGACOMPACT_NATIVE_ORT_ROOT;
+  const global = override !== undefined && override.length > 0
+    ? override
+    : join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort");
+  return [global, join(stateDir, "native-ort")];
 }
 
 /** A single bounded inference pass on the fixed 512-token synthetic input;

package/src/vector-cortex/setup-cortex-blockers-compute.ts

@@ -261,9 +261,11 @@ const ACTION_GATE_CANDIDATES: Readonly<Record<SetupCortexActionKind, readonly st
   // behavior change. HG-7 is training work (no action in this set).
   bench: ["HG-1", "HG-3", "HG-6"],
   "verify-asset": [],
-  // ENC-2c: installing the lazy-download native binding is gated by HG-3 (the
-  // open install-budget hard gate) — a closed HG-3 no longer blocks the install.
-  "install-native-ort": ["HG-3"],
+  // install-native-ort is NEVER gated by HG-3: the action's entire purpose is
+  // to install the binding that closes HG-3. Gating it would deadlock — you
+  // can't install the binding that closes the gate because the gate blocks the
+  // install. HG-3 closes when the install succeeds (the probe detects it).
+  "install-native-ort": [],
 };
 
 /**

package/extensions/dashboard-client/dist/assets/MetricsTab-8WBHRpRp.js

@@ -1,2 +0,0 @@
-import{j as r}from"./index-BBJ8LglL.js";import{M as t}from"./MetricsCards-CprVx2Yq.js";import"./card-DtOD33bZ.js";import"./generateCategoricalChart-8AyWGIrK.js";import"./BarChart-r_BFpd7a.js";import"./AreaChart-D4EY7yiY.js";function e(){return r.jsx(t,{})}export{e as default};
-//# sourceMappingURL=MetricsTab-8WBHRpRp.js.map