praxis-agent 0.65.0 → 0.66.0

package/dist/platform/praxis-build-identity.js

@@ -0,0 +1,204 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promises as fs } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+export const PRAXIS_BUILD_IDENTITY_SCHEMA_VERSION = '1.0';
+const execFileAsync = promisify(execFile);
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+const REVISION = /^git:[0-9a-f]{40}$/u;
+const MAX_BYTES = 512 * 1024 * 1024;
+const MAX_FILES = 10_000;
+const MAX_DEPTH = 32;
+const MAX_METADATA_BYTES = 64 * 1024;
+function invalid(message) {
+    throw new Error(`Invalid Praxis build identity: ${message}`);
+}
+function codeUnitCompare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+async function artifactEntries(outputRoot) {
+    const entries = [];
+    let totalBytes = 0;
+    async function hashFile(path) {
+        const handle = await fs.open(path, 'r');
+        const hash = createHash('sha256');
+        const buffer = Buffer.alloc(64 * 1024);
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile())
+                invalid('emitted runtime tree contains a non-regular JavaScript file');
+            if (stat.size > MAX_BYTES - totalBytes)
+                invalid('emitted runtime tree exceeds byte limit');
+            let fileBytes = 0;
+            while (true) {
+                const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+                if (bytesRead === 0)
+                    break;
+                fileBytes += bytesRead;
+                if (fileBytes > MAX_BYTES - totalBytes)
+                    invalid('emitted runtime tree exceeds byte limit');
+                hash.update(buffer.subarray(0, bytesRead));
+            }
+            totalBytes += fileBytes;
+            return `sha256:${hash.digest('hex')}`;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async function visit(directory, depth) {
+        if (depth > MAX_DEPTH)
+            invalid('emitted runtime tree exceeds depth limit');
+        const children = await fs.readdir(directory, { withFileTypes: true });
+        for (const child of children) {
+            const fullPath = join(directory, child.name);
+            if (child.isSymbolicLink())
+                invalid(`emitted runtime tree contains symlink ${child.name}`);
+            if (child.isDirectory()) {
+                await visit(fullPath, depth + 1);
+                continue;
+            }
+            if (!child.isFile())
+                invalid(`emitted runtime tree contains unsupported entry ${child.name}`);
+            if (!child.name.endsWith('.js'))
+                continue;
+            entries.push({
+                path: relative(outputRoot, fullPath).split(sep).join('/'),
+                sha256: await hashFile(fullPath),
+            });
+            if (entries.length > MAX_FILES)
+                invalid('emitted runtime tree exceeds file limit');
+        }
+    }
+    await visit(outputRoot, 0);
+    if (entries.length === 0)
+        invalid('emitted runtime tree contains no JavaScript files');
+    entries.sort((left, right) => codeUnitCompare(left.path, right.path));
+    return entries;
+}
+async function artifactDigest(outputRoot) {
+    const entries = await artifactEntries(outputRoot);
+    return `sha256:${createHash('sha256').update(JSON.stringify(entries), 'utf8').digest('hex')}`;
+}
+async function sourceState(sourceRoot) {
+    try {
+        const { stdout } = await execFileAsync('git', ['-C', sourceRoot, 'rev-parse', '--verify', 'HEAD'], { encoding: 'utf8' });
+        const revision = stdout.trim();
+        if (!/^[0-9a-f]{40}$/u.test(revision))
+            return { revision: 'unavailable', dirty: null };
+        let status;
+        try {
+            const result = await execFileAsync('git', ['-C', sourceRoot, 'status', '--porcelain=v1', '--untracked-files=all'], { encoding: 'utf8' });
+            status = result.stdout;
+        }
+        catch (error) {
+            throw new Error(`unable to read Git status: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return { revision: `git:${revision}`, dirty: status.length > 0 };
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.message.startsWith('unable to read Git status:'))
+            throw error;
+        return { revision: 'unavailable', dirty: null };
+    }
+}
+export async function writePraxisBuildIdentity({ sourceRoot, outputRoot, }) {
+    const state = await sourceState(resolve(sourceRoot));
+    const identity = {
+        schema_version: PRAXIS_BUILD_IDENTITY_SCHEMA_VERSION,
+        source_revision: state.revision,
+        source_dirty: state.dirty,
+        artifact_sha256: await artifactDigest(resolve(outputRoot)),
+    };
+    const target = join(resolve(outputRoot), 'build-identity.json');
+    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+    await fs.writeFile(temporary, `${JSON.stringify(identity)}\n`, {
+        encoding: 'utf8',
+        mode: 0o644,
+    });
+    await fs.rename(temporary, target);
+    return identity;
+}
+export function validatePraxisBuildIdentity(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        invalid('metadata must be an object');
+    const source = value;
+    const keys = [
+        'schema_version',
+        'source_revision',
+        'source_dirty',
+        'artifact_sha256',
+    ];
+    const unknown = Object.keys(source).find((key) => !keys.includes(key));
+    if (unknown)
+        invalid(`${unknown} is not supported`);
+    if (source.schema_version !== PRAXIS_BUILD_IDENTITY_SCHEMA_VERSION)
+        invalid('schema_version must be "1.0"');
+    if (typeof source.source_revision !== 'string' ||
+        (source.source_revision !== 'unavailable' &&
+            !REVISION.test(source.source_revision)))
+        invalid('source_revision is invalid');
+    if (source.source_revision === 'unavailable') {
+        if (source.source_dirty !== null)
+            invalid('source_dirty must be null when source_revision is unavailable');
+    }
+    else if (typeof source.source_dirty !== 'boolean')
+        invalid('source_dirty must be boolean for an available source revision');
+    if (typeof source.artifact_sha256 !== 'string' ||
+        !DIGEST.test(source.artifact_sha256))
+        invalid('artifact_sha256 must be a sha256 digest');
+    return Object.freeze({
+        schema_version: PRAXIS_BUILD_IDENTITY_SCHEMA_VERSION,
+        source_revision: source.source_revision,
+        source_dirty: source.source_dirty,
+        artifact_sha256: source.artifact_sha256,
+    });
+}
+export async function loadPraxisBuildIdentity(outputRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../dist')) {
+    const target = join(resolve(outputRoot), 'build-identity.json');
+    let raw;
+    try {
+        const handle = await fs.open(target, 'r');
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile())
+                invalid('metadata is not a regular file');
+            const buffer = Buffer.alloc(MAX_METADATA_BYTES + 1);
+            let bytesRead = 0;
+            while (bytesRead < buffer.length) {
+                const result = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);
+                if (result.bytesRead === 0)
+                    break;
+                bytesRead += result.bytesRead;
+            }
+            if (bytesRead > MAX_METADATA_BYTES || stat.size > MAX_METADATA_BYTES)
+                invalid('metadata exceeds 64 KiB');
+            raw = buffer.subarray(0, bytesRead).toString('utf8');
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.message.startsWith('Invalid Praxis build identity:'))
+            throw error;
+        invalid('metadata is missing or unreadable');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        invalid('metadata is not valid JSON');
+    }
+    const identity = validatePraxisBuildIdentity(parsed);
+    const actual = await artifactDigest(resolve(outputRoot));
+    if (actual !== identity.artifact_sha256)
+        invalid('artifact_sha256 does not match emitted JavaScript');
+    return identity;
+}
+//# sourceMappingURL=praxis-build-identity.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",
@@ -28,7 +28,7 @@
     "praxis": "./dist/cli.js"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && node scripts/write-build-identity.mjs",
     "check": "npm run format:check && npm run lint && npm run test:docs && npm run verify:release-automation && npm run verify:ci-coverage && npm run verify:fixture-contracts && npm run check:boundaries && npm run typecheck && npm run build:native && npm run build && npm test",
     "check:boundaries": "node scripts/check-boundaries.mjs",
     "dev": "tsx src/cli.ts",