planr 1.4.0 → 1.5.1

package/website/build-catalog.mjs

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { mkdir } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, resolve } from "node:path";
-import { projectComposition, safeIdentifier } from "./catalog-model.mjs";
-
-function usage(message) {
-  if (message) console.error(message);
-  console.error(
-    "usage: node website/build-catalog.mjs --manifest <registry.toml> --content-root <dir> --trust-store <trusted.toml> --entry <id=host> [--entry <id=host> ...] --at-unix <unix> --output <catalog.json> [--planr-bin <planr>]",
-  );
-  process.exit(2);
-}
-
-function parseArgs(argv) {
-  const values = { entries: [], planrBin: "planr" };
-  for (let index = 0; index < argv.length; index += 1) {
-    const flag = argv[index];
-    const value = argv[index + 1];
-    if (!value) usage(`missing value for ${flag}`);
-    index += 1;
-    if (flag === "--entry") values.entries.push(value);
-    else if (flag === "--manifest") values.manifest = value;
-    else if (flag === "--content-root") values.contentRoot = value;
-    else if (flag === "--trust-store") values.trustStore = value;
-    else if (flag === "--at-unix") values.atUnix = Number(value);
-    else if (flag === "--output") values.output = value;
-    else if (flag === "--planr-bin") values.planrBin = value;
-    else usage(`unknown argument ${flag}`);
-  }
-  if (
-    !values.manifest ||
-    !values.contentRoot ||
-    !values.trustStore ||
-    !values.output ||
-    !Number.isSafeInteger(values.atUnix) ||
-    values.entries.length === 0
-  ) {
-    usage("all required arguments must be provided");
-  }
-  return values;
-}
-
-function runJson(binary, args, cwd) {
-  const result = spawnSync(binary, args, { cwd, encoding: "utf8" });
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    throw new Error(result.stderr.trim() || result.stdout.trim() || `${binary} exited ${result.status}`);
-  }
-  try {
-    return JSON.parse(result.stdout);
-  } catch (error) {
-    throw new Error(`${binary} returned invalid JSON: ${error.message}`);
-  }
-}
-
-function entrySpec(raw) {
-  const separator = raw.lastIndexOf("=");
-  if (separator < 1 || separator === raw.length - 1) usage(`invalid --entry ${raw}; expected id=host`);
-  return { id: raw.slice(0, separator), host: raw.slice(separator + 1) };
-}
-
-function artifactPath(verified, kind, contentRoot) {
-  const matches = verified.entry.artifacts.filter((artifact) => artifact.kind === kind);
-  if (matches.length !== 1) throw new Error(`entry ${verified.entry.id} must contain one ${kind}`);
-  return resolve(contentRoot, matches[0].path);
-}
-
-const options = parseArgs(process.argv.slice(2));
-const invocationRoot = process.cwd();
-const planrBin =
-  isAbsolute(options.planrBin) || !options.planrBin.includes("/")
-    ? options.planrBin
-    : resolve(invocationRoot, options.planrBin);
-const manifest = resolve(invocationRoot, options.manifest);
-const contentRoot = resolve(invocationRoot, options.contentRoot);
-const trustStore = resolve(invocationRoot, options.trustStore);
-const scratch = mkdtempSync(join(tmpdir(), "planr-preset-site-"));
-
-try {
-  const compositions = options.entries.map((raw) => {
-    const { id, host } = entrySpec(raw);
-    const verified = runJson(
-      planrBin,
-      [
-        "--json",
-        "agents",
-        "preset",
-        "registry",
-        "verify",
-        manifest,
-        "--entry",
-        id,
-        "--content-root",
-        contentRoot,
-        "--trust-store",
-        trustStore,
-        "--at-unix",
-        String(options.atUnix),
-        "--host",
-        host,
-      ],
-      scratch,
-    );
-    const verificationPath = artifactPath(verified, "verification", contentRoot);
-    const policyId = safeIdentifier(verified.entry.evaluation?.policy_id, "policy id");
-    const bindingId = safeIdentifier(verified.entry.evaluation?.binding_id, "binding id");
-    const preview = runJson(
-      planrBin,
-      ["--json", "agents", "preset", "apply", policyId, "--binding", bindingId],
-      scratch,
-    );
-    const verificationEnvelope = JSON.parse(readFileSync(verificationPath, "utf8"));
-    return projectComposition({ verified, preview, verificationEnvelope });
-  });
-  const catalog = {
-    schemaVersion: 1,
-    generatedAtUnix: options.atUnix,
-    source: {
-      state: "verified_registry_projection",
-      manifest: options.manifest,
-      entryCount: compositions.length,
-      trust: "planr_registry_v1",
-    },
-    compositions,
-  };
-  const output = resolve(invocationRoot, options.output);
-  await mkdir(dirname(output), { recursive: true });
-  writeFileSync(output, `${JSON.stringify(catalog, null, 2)}\n`, { mode: 0o644 });
-  console.log(`wrote ${compositions.length} verified composition(s) to ${output}`);
-} finally {
-  rmSync(scratch, { recursive: true, force: true });
-}

package/website/build-site.test.mjs

@@ -1,69 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import test from "node:test";
-import {
-  buildSite,
-  PUBLIC_SITE_FILES,
-  verifyPublication,
-} from "../scripts/build-site.mjs";
-
-async function fixture() {
-  const root = await mkdtemp(join(tmpdir(), "planr-site-build-"));
-  const sourceRoot = join(root, "website");
-  const outputRoot = join(root, "dist", "website");
-  for (const relativePath of PUBLIC_SITE_FILES) {
-    const path = join(sourceRoot, relativePath);
-    await mkdir(join(path, ".."), { recursive: true });
-    await writeFile(path, `public:${relativePath}\n`);
-  }
-  return { root, sourceRoot, outputRoot };
-}
-
-test("builds only the public runtime allowlist and preserves nested catalog bytes", async (t) => {
-  const paths = await fixture();
-  t.after(() => rm(paths.root, { recursive: true, force: true }));
-  await writeFile(join(paths.sourceRoot, "build-catalog.mjs"), "must not be public\n");
-  await mkdir(join(paths.sourceRoot, "registry"), { recursive: true });
-  await writeFile(join(paths.sourceRoot, "registry", "trusted-maintainers.toml"), "not public\n");
-
-  const files = await buildSite(paths);
-
-  assert.deepEqual(files, [...PUBLIC_SITE_FILES].sort());
-  assert.equal(
-    await readFile(join(paths.outputRoot, "data", "catalog.json"), "utf8"),
-    "public:data/catalog.json\n",
-  );
-});
-
-test("fails before replacing output when a required source artifact is missing", async (t) => {
-  const paths = await fixture();
-  t.after(() => rm(paths.root, { recursive: true, force: true }));
-  await mkdir(paths.outputRoot, { recursive: true });
-  await writeFile(join(paths.outputRoot, "sentinel"), "keep on validation failure\n");
-  await rm(join(paths.sourceRoot, "styles.css"));
-
-  await assert.rejects(() => buildSite(paths), /missing public website artifact: styles\.css/);
-  assert.equal(await readFile(join(paths.outputRoot, "sentinel"), "utf8"), "keep on validation failure\n");
-});
-
-test("publication verification rejects unexpected nested output", async (t) => {
-  const paths = await fixture();
-  t.after(() => rm(paths.root, { recursive: true, force: true }));
-  await buildSite(paths);
-  await mkdir(join(paths.outputRoot, "registry"), { recursive: true });
-  await writeFile(join(paths.outputRoot, "registry", "manifest.toml"), "unexpected\n");
-
-  await assert.rejects(() => verifyPublication(paths.outputRoot), /publish output mismatch/);
-});
-
-test("refuses an output directory inside the source tree", async (t) => {
-  const paths = await fixture();
-  t.after(() => rm(paths.root, { recursive: true, force: true }));
-
-  await assert.rejects(
-    () => buildSite({ sourceRoot: paths.sourceRoot, outputRoot: join(paths.sourceRoot, "dist") }),
-    /must not be inside/,
-  );
-});

package/website/catalog-model.mjs

@@ -1,185 +0,0 @@
-const IDENTIFIER = /^[A-Za-z0-9._-]+$/;
-
-export function safeIdentifier(value, label = "identifier") {
-  if (typeof value !== "string" || !IDENTIFIER.test(value)) {
-    throw new Error(`${label} is not a safe registry identifier`);
-  }
-  return value;
-}
-
-export function previewCommand(policyId, bindingId) {
-  return `planr agents preset apply ${safeIdentifier(policyId, "policy id")} --binding ${safeIdentifier(bindingId, "binding id")}`;
-}
-
-export function statusLabel(status) {
-  const labels = {
-    experimental: "Experimental",
-    verified: "Verified",
-    recommended: "Recommended",
-    stale: "Stale",
-    deprecated: "Deprecated",
-  };
-  return labels[status] ?? "Unverified";
-}
-
-export function formatBasisPoints(value) {
-  const basisPoints = Number(value);
-  return Number.isFinite(basisPoints) ? `${(basisPoints / 100).toFixed(2)}%` : "—";
-}
-
-function findArtifact(entry, kind) {
-  const artifacts = entry.artifacts.filter((artifact) => artifact.kind === kind);
-  if (artifacts.length !== 1) {
-    throw new Error(`registry entry must contain exactly one ${kind} artifact`);
-  }
-  return artifacts[0];
-}
-
-function proposedConfig(preview, kind) {
-  const artifact = preview.artifacts.find((candidate) => candidate.kind === kind);
-  const value = artifact?.config_diff?.proposed?.value;
-  if (!value || typeof value !== "object") {
-    throw new Error(`preset preview is missing proposed ${kind} configuration`);
-  }
-  return value;
-}
-
-function matchingCandidate(report, policyId, bindingId) {
-  const candidate = report.candidates?.find(
-    (value) => value.policy?.id === policyId && value.binding?.id === bindingId,
-  );
-  if (!candidate) {
-    throw new Error(`evaluation report has no candidate for ${policyId} + ${bindingId}`);
-  }
-  return candidate;
-}
-
-function recommendationMatches(report, policyId, bindingId) {
-  return Boolean(
-    report.recommended?.some(
-      (value) => value.policy === policyId && value.binding === bindingId && value.status === "recommended",
-    ),
-  );
-}
-
-export function projectComposition({ verified, preview, verificationEnvelope }) {
-  if (!verified?.integrity_verified || !verified?.signature_verified || !verified?.trusted_maintainer) {
-    throw new Error("website projection requires an integrity-verified entry signed by a trusted maintainer");
-  }
-  if (!verified.compatible) {
-    throw new Error("website projection requires a compatible registry entry");
-  }
-  if (!preview?.pack?.safe) {
-    throw new Error("website projection requires a canonical safe-pack preview");
-  }
-
-  const entry = verified.entry;
-  const evaluation = entry.evaluation;
-  if (!evaluation) {
-    throw new Error("website projection requires evaluation binding metadata");
-  }
-  const policyId = safeIdentifier(evaluation.policy_id, "policy id");
-  const bindingId = safeIdentifier(evaluation.binding_id, "binding id");
-  const report = verificationEnvelope.report ?? verificationEnvelope;
-  const candidate = matchingCandidate(report, policyId, bindingId);
-  const reportRecommended = recommendationMatches(report, policyId, bindingId);
-  if (verified.recommended && (!reportRecommended || candidate.status !== "recommended")) {
-    throw new Error("registry recommendation does not match canonical evaluation evidence");
-  }
-
-  const policy = proposedConfig(preview, "active_policy");
-  const agents = proposedConfig(preview, "agent_registry");
-  if (policy.id !== policyId || preview.composition?.binding?.id !== bindingId) {
-    throw new Error("preset preview provenance does not match registry evaluation binding");
-  }
-  const runs = Number(candidate.metrics?.runs ?? 0);
-  const verifiedRoutes = Number(candidate.metrics?.verified_route_runs ?? 0);
-  const policyArtifact = findArtifact(entry, "policy");
-  const bindingArtifact = findArtifact(entry, "host-binding");
-  const verificationArtifact = findArtifact(entry, "verification");
-
-  return {
-    id: `${safeIdentifier(entry.id, "entry id")}@${entry.version}`,
-    entryId: entry.id,
-    entryVersion: entry.version,
-    status: verified.effective_status,
-    statusLabel: statusLabel(verified.effective_status),
-    recommended: verified.recommended,
-    freshness: verified.freshness,
-    lifecycle: entry.lifecycle,
-    replacement: entry.replacement ?? null,
-    policy: {
-      id: policyId,
-      version: evaluation.policy_version,
-      usage: policy.usage,
-      transitions: policy.transitions,
-      materiality: policy.materiality,
-      execution: policy.execution,
-    },
-    binding: {
-      id: bindingId,
-      version: evaluation.binding_version,
-      host: preview.composition.host,
-      profiles: agents.profiles,
-      dispatch: preview.composition.dispatch,
-    },
-    compatibility: {
-      hosts: entry.compatible_hosts,
-      minPlanrVersion: entry.min_planr_version,
-      maxPlanrVersion: entry.max_planr_version,
-    },
-    enforcement: [
-      {
-        dimension: "Policy limits",
-        state: "verified",
-        detail: "Planr validates count, time, concurrency, transition, and safety-stop limits before dispatch.",
-      },
-      {
-        dimension: "Execution permissions",
-        state: "verified",
-        detail: "Registry-safe policy: no commands, hooks, network/MCP grants, secrets, or overwrite permission.",
-      },
-      {
-        dimension: "Model and effort",
-        state: "host_enforced",
-        detail: "The host binding requests concrete routes; the host retains final execution authority.",
-      },
-      {
-        dimension: "Effective route evidence",
-        state: runs > 0 && verifiedRoutes === runs ? "verified" : "unavailable",
-        detail: `${verifiedRoutes} of ${runs} evaluation runs carried verified effective-route evidence.`,
-      },
-    ],
-    evaluation: {
-      suiteId: report.suite?.id,
-      suiteVersion: report.suite?.version,
-      evaluatedAtUnix: report.suite?.evaluated_at_unix,
-      reviewAtUnix: entry.review_at_unix,
-      status: candidate.status,
-      metrics: candidate.metrics,
-      thresholds: candidate.threshold_results,
-      resultHashes: candidate.results?.map((result) => result.result_sha256) ?? [],
-      fixtureSha256: report.suite?.fixture_sha256,
-    },
-    registry: {
-      id: verified.registry_id,
-      version: verified.registry_version,
-      manifestSha256: verified.manifest_sha256,
-      signer: entry.signature?.signer,
-      signatureVerified: true,
-      trustedMaintainer: true,
-      artifacts: [policyArtifact, bindingArtifact, verificationArtifact].map((artifact) => ({
-        path: artifact.path,
-        kind: artifact.kind,
-        sha256: artifact.sha256,
-        sizeBytes: artifact.size_bytes,
-      })),
-    },
-    command: previewCommand(policyId, bindingId),
-  };
-}
-
-export function visibleCompositions(catalog, recommendedOnly = false) {
-  const compositions = Array.isArray(catalog?.compositions) ? catalog.compositions : [];
-  return recommendedOnly ? compositions.filter((entry) => entry.recommended) : compositions;
-}

package/website/catalog-model.test.mjs

@@ -1,124 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import {
-  formatBasisPoints,
-  previewCommand,
-  projectComposition,
-  safeIdentifier,
-  visibleCompositions,
-} from "./catalog-model.mjs";
-
-function fixture() {
-  const verified = {
-    registry_id: "official",
-    registry_version: "2026.07",
-    manifest_sha256: "a".repeat(64),
-    integrity_verified: true,
-    signature_verified: true,
-    trusted_maintainer: true,
-    compatible: true,
-    freshness: "current",
-    effective_status: "recommended",
-    recommended: true,
-    entry: {
-      id: "balanced-codex",
-      version: "1.0.0",
-      lifecycle: "published",
-      compatible_hosts: ["codex"],
-      min_planr_version: "1.3.0",
-      max_planr_version: "1.9.0",
-      review_at_unix: 1815523200,
-      evaluation: {
-        policy_id: "balanced",
-        policy_version: "1.0.0",
-        binding_id: "codex-openai",
-        binding_version: "1.0.0",
-      },
-      signature: { signer: "planr-maintainers" },
-      artifacts: [
-        { path: "pack/policy.toml", kind: "policy", sha256: "1".repeat(64), size_bytes: 1 },
-        { path: "pack/binding.toml", kind: "host-binding", sha256: "2".repeat(64), size_bytes: 2 },
-        { path: "pack/verification.json", kind: "verification", sha256: "3".repeat(64), size_bytes: 3 },
-      ],
-    },
-  };
-  const policy = {
-    id: "balanced",
-    usage: { max_active_agents: 3, max_parallel_writers: 1, max_depth: 1, metering: "trusted" },
-    transitions: { retry: { max_same_route_retries: 1 }, safety_stop: { enabled: true } },
-    materiality: { changed_files_threshold: 10 },
-    execution: { roles: { worker: { commands: [], hooks: [], network_hosts: [], mcp_servers: [] } } },
-  };
-  const preview = {
-    pack: { safe: true },
-    composition: { host: "codex", binding: { id: "codex-openai" }, dispatch: {} },
-    artifacts: [
-      { kind: "active_policy", config_diff: { proposed: { value: policy } } },
-      { kind: "agent_registry", config_diff: { proposed: { value: { profiles: {} } } } },
-    ],
-  };
-  const candidate = {
-    policy: { id: "balanced" },
-    binding: { id: "codex-openai" },
-    status: "recommended",
-    metrics: { runs: 7, verified_route_runs: 7, average_quality_score_bps: 9600 },
-    threshold_results: [{ name: "quality", pass: true }],
-    results: [{ result_sha256: "4".repeat(64) }],
-  };
-  const verificationEnvelope = {
-    report: {
-      suite: { id: "planr-preset-suite", version: "1.8.0", evaluated_at_unix: 1783987200, fixture_sha256: "5".repeat(64) },
-      candidates: [candidate],
-      recommended: [{ policy: "balanced", binding: "codex-openai", status: "recommended" }],
-    },
-  };
-  return { verified, preview, verificationEnvelope };
-}
-
-test("projects only trusted, safe, evidence-bound registry entries", () => {
-  const projected = projectComposition(fixture());
-  assert.equal(projected.status, "recommended");
-  assert.equal(projected.registry.signatureVerified, true);
-  assert.equal(projected.enforcement.at(-1).state, "verified");
-  assert.equal(projected.command, "planr agents preset apply balanced --binding codex-openai");
-});
-
-test("refuses unsigned metadata and recommendation drift", () => {
-  const unsigned = fixture();
-  unsigned.verified.signature_verified = false;
-  assert.throws(() => projectComposition(unsigned), /trusted maintainer/);
-
-  const drifted = fixture();
-  drifted.verificationEnvelope.report.recommended = [];
-  assert.throws(() => projectComposition(drifted), /does not match/);
-});
-
-test("publishes lifecycle-demoted recommendations with visible replacement metadata", () => {
-  const stale = fixture();
-  stale.verified.freshness = "stale";
-  stale.verified.effective_status = "stale";
-  stale.verified.recommended = false;
-  const staleProjected = projectComposition(stale);
-  assert.equal(staleProjected.status, "stale");
-  assert.equal(staleProjected.recommended, false);
-
-  const deprecated = fixture();
-  deprecated.verified.effective_status = "deprecated";
-  deprecated.verified.recommended = false;
-  deprecated.verified.entry.lifecycle = "deprecated";
-  deprecated.verified.entry.replacement = "balanced-codex-v2";
-  const deprecatedProjected = projectComposition(deprecated);
-  assert.equal(deprecatedProjected.status, "deprecated");
-  assert.equal(deprecatedProjected.replacement, "balanced-codex-v2");
-});
-
-test("copy commands accept identifiers only and filtering is deterministic", () => {
-  assert.equal(previewCommand("balanced", "codex-openai"), "planr agents preset apply balanced --binding codex-openai");
-  assert.throws(() => safeIdentifier("balanced; curl evil"), /safe registry identifier/);
-  assert.deepEqual(
-    visibleCompositions({ compositions: [{ recommended: true }, { recommended: false }] }, true),
-    [{ recommended: true }],
-  );
-  assert.equal(formatBasisPoints(9600), "96.00%");
-  assert.equal(formatBasisPoints(undefined), "—");
-});

package/website/cloudflare-launcher.test.mjs

@@ -1,38 +0,0 @@
-import assert from "node:assert/strict";
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-import { cloudflareTestSteps } from "../scripts/cloudflare-test.mjs";
-
-test("launcher keeps deploy and destroy pinned to the test stage", () => {
-  assert.deepEqual(cloudflareTestSteps("deploy"), [
-    ["pnpm", ["site:check"]],
-    ["pnpm", ["exec", "alchemy", "deploy", "--stage", "test"]],
-  ]);
-  assert.deepEqual(cloudflareTestSteps("destroy"), [
-    ["pnpm", ["exec", "alchemy", "destroy", "--stage", "test"]],
-  ]);
-  assert.throws(() => cloudflareTestSteps("prod"), /usage:/);
-});
-
-const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const launcher = join(repositoryRoot, "scripts", "cloudflare-test.mjs");
-for (const version of ["v18.16.1", "v20.19.5"]) {
-  const node = join(homedir(), ".nvm", "versions", "node", version, "bin", "node");
-  test(
-    `direct launcher rejects ${version} before invoking pnpm`,
-    { skip: !existsSync(node) && `local ${version} runtime is unavailable` },
-    () => {
-      const result = spawnSync(node, [launcher, "deploy"], {
-        cwd: repositoryRoot,
-        encoding: "utf8",
-      });
-      assert.equal(result.status, 1);
-      assert.match(result.stderr, /Cloudflare deployment requires Node\.js 22 or newer/);
-      assert.doesNotMatch(result.stderr, /Corepack|ERR_VM|addAbortListener|experimental-strip-types/);
-    },
-  );
-}