superpowers-manager 0.5.1 → 0.6.0

package/dist/harnesses/codex/marketplace.js

@@ -0,0 +1,148 @@
+import { copyFile, cp, lstat, mkdir, readdir, rm, writeFile, } from "node:fs/promises";
+import { join } from "node:path";
+import { ARTIFACT_DIGEST_RE, ARTIFACT_RECEIPT, digestArtifactTree, readArtifactObject, } from "../../artifact-tree.js";
+import { assertNoFollowType, classifyPathNoFollow } from "../../safe-path.js";
+import { SafetyError } from "../../safety-error.js";
+import { readCodexAssessment } from "./compatibility.js";
+const MARKETPLACE_PATH = ".agents/plugins/marketplace.json";
+const PLUGIN_PATH = "plugins/superpowers";
+function inspectionError(root, cause) {
+    return new SafetyError("codex-marketplace", `cannot inspect owned Codex marketplace: ${root}`, { cause });
+}
+function validateMarketplace(value) {
+    const plugins = value.plugins;
+    if (!Array.isArray(plugins) || plugins.length !== 1) {
+        throw new Error("marketplace plugins");
+    }
+    const plugin = plugins[0];
+    if (plugin === null || typeof plugin !== "object" || Array.isArray(plugin)) {
+        throw new Error("marketplace plugin");
+    }
+    const source = plugin.source;
+    if (plugin.name !== "superpowers" ||
+        source === null ||
+        typeof source !== "object" ||
+        Array.isArray(source) ||
+        source.source !== "local" ||
+        source.path !== "./plugins/superpowers") {
+        throw new Error("marketplace source");
+    }
+}
+async function requireEntries(root, expected) {
+    const actual = await readdir(root);
+    if (actual.length !== expected.length ||
+        actual.some((entry) => !expected.includes(entry))) {
+        throw new Error("tree entries");
+    }
+}
+async function readMarketplace(root) {
+    try {
+        await assertNoFollowType(root, ["directory"]);
+        const before = await lstat(root);
+        await requireEntries(root, [".agents", "plugins", ARTIFACT_RECEIPT]);
+        await assertNoFollowType(join(root, ".agents"), ["directory"]);
+        await assertNoFollowType(join(root, "plugins"), ["directory"]);
+        await assertNoFollowType(join(root, ARTIFACT_RECEIPT), ["regular-file"]);
+        await requireEntries(join(root, ".agents"), ["plugins"]);
+        await requireEntries(join(root, ".agents", "plugins"), [
+            "marketplace.json",
+        ]);
+        await requireEntries(join(root, "plugins"), ["superpowers"]);
+        const pluginRoot = join(root, PLUGIN_PATH);
+        await assertNoFollowType(pluginRoot, ["directory"]);
+        validateMarketplace(await readArtifactObject(root, join(root, MARKETPLACE_PATH)));
+        const receipt = await readArtifactObject(root, join(root, ARTIFACT_RECEIPT));
+        if (receipt.schema !== 1 ||
+            receipt.manager !== "superpowers-manager" ||
+            receipt.harness !== "codex" ||
+            receipt.generation !== "codex-marketplace-v1" ||
+            typeof receipt.digest !== "string" ||
+            !ARTIFACT_DIGEST_RE.test(receipt.digest)) {
+            throw new Error("receipt");
+        }
+        const digest = await digestArtifactTree(root);
+        if (digest !== receipt.digest)
+            throw new Error("digest");
+        const artifact = await readCodexAssessment(pluginRoot);
+        const after = await lstat(root);
+        if (before.dev !== after.dev || before.ino !== after.ino) {
+            throw new Error("root changed");
+        }
+        return {
+            root,
+            dev: before.dev,
+            ino: before.ino,
+            digest,
+            artifact,
+        };
+    }
+    catch (cause) {
+        throw inspectionError(root, cause);
+    }
+}
+async function removeOwnedCandidate(root, identity) {
+    try {
+        await assertNoFollowType(root, ["directory"]);
+        const current = await lstat(root);
+        if (current.dev !== identity.dev || current.ino !== identity.ino)
+            return;
+        await rm(root, { recursive: true });
+    }
+    catch {
+        // A candidate that cannot still be proven as ours must remain untouched.
+    }
+}
+export async function stageCodexMarketplace(artifact, packageRoot, candidateRoot) {
+    let candidateIdentity = null;
+    try {
+        const assessed = await readCodexAssessment(artifact.root);
+        if (assessed.commit !== artifact.commit)
+            throw new Error("artifact commit");
+        const sourceDigest = await digestArtifactTree(artifact.root);
+        await assertNoFollowType(candidateRoot, ["missing"]);
+        await mkdir(candidateRoot, { mode: 0o700 });
+        const candidate = await lstat(candidateRoot);
+        candidateIdentity = { dev: candidate.dev, ino: candidate.ino };
+        await mkdir(join(candidateRoot, ".agents", "plugins"), { recursive: true });
+        await mkdir(join(candidateRoot, "plugins"), { recursive: true });
+        await copyFile(join(packageRoot, MARKETPLACE_PATH), join(candidateRoot, MARKETPLACE_PATH), 0);
+        await cp(artifact.root, join(candidateRoot, PLUGIN_PATH), {
+            dereference: false,
+            errorOnExist: true,
+            force: false,
+            recursive: true,
+            verbatimSymlinks: true,
+        });
+        const copied = await readCodexAssessment(join(candidateRoot, PLUGIN_PATH));
+        if (copied.commit !== artifact.commit ||
+            (await digestArtifactTree(copied.root)) !== sourceDigest) {
+            throw new Error("copied artifact");
+        }
+        validateMarketplace(await readArtifactObject(candidateRoot, join(candidateRoot, MARKETPLACE_PATH)));
+        const receipt = {
+            schema: 1,
+            manager: "superpowers-manager",
+            harness: "codex",
+            generation: "codex-marketplace-v1",
+            digest: await digestArtifactTree(candidateRoot),
+        };
+        await writeFile(join(candidateRoot, ARTIFACT_RECEIPT), JSON.stringify(receipt) + "\n", { flag: "wx" });
+        return await readMarketplace(candidateRoot);
+    }
+    catch (cause) {
+        if (candidateIdentity !== null) {
+            await removeOwnedCandidate(candidateRoot, candidateIdentity);
+        }
+        throw new SafetyError("codex-marketplace", `cannot stage owned Codex marketplace: ${candidateRoot}`, { cause });
+    }
+}
+export async function readCodexMarketplace(root) {
+    try {
+        if ((await classifyPathNoFollow(root)) === "missing")
+            return null;
+    }
+    catch (cause) {
+        throw inspectionError(root, cause);
+    }
+    return await readMarketplace(root);
+}

package/dist/harnesses/codex/paths.js

@@ -0,0 +1,97 @@
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { assertNoFollowType, canonicalizeProspectivePath, } from "../../safe-path.js";
+import { SafetyError } from "../../safety-error.js";
+export function codexHome(env, cwd) {
+    const configured = env.CODEX_HOME;
+    if (configured !== undefined && configured.length > 0) {
+        return resolve(cwd, configured);
+    }
+    const home = env.HOME;
+    if (home === undefined || home.length === 0) {
+        throw new SafetyError("codex-paths", "cannot determine Codex state root without HOME");
+    }
+    return join(resolve(cwd, home), ".codex");
+}
+export function codexPaths(env, cwd) {
+    const root = codexHome(env, cwd);
+    const managerRoot = join(root, "superpowers-manager");
+    const marketplaceRoot = join(managerRoot, "marketplace");
+    return {
+        codexHome: root,
+        managerRoot,
+        preparedRoot: join(managerRoot, "prepared"),
+        marketplaceRoot,
+        publishedPluginRoot: join(marketplaceRoot, "plugins", "superpowers"),
+        recoveryRoot: join(managerRoot, "recovery"),
+    };
+}
+function overlaps(a, b) {
+    const inside = (root, leaf) => {
+        const suffix = relative(root, leaf);
+        return (suffix === "" ||
+            (!isAbsolute(suffix) && suffix !== ".." && !suffix.startsWith(`..${sep}`)));
+    };
+    return inside(a, b) || inside(b, a);
+}
+function separationError() {
+    return new SafetyError("codex-paths", "preparation overlaps Codex published or recovery storage", { details: { kind: "overlap" } });
+}
+async function inspectRoot(path, root) {
+    try {
+        await assertNoFollowType(path, ["directory", "missing"]);
+        return await canonicalizeProspectivePath(path);
+    }
+    catch (cause) {
+        throw new SafetyError("codex-paths", `cannot inspect ${root} root: ${path}`, { cause, details: { kind: "inspection", root, path } });
+    }
+}
+export function codexPathFailureDetails(cause) {
+    if (!(cause instanceof SafetyError) || cause.module !== "codex-paths") {
+        return null;
+    }
+    const details = cause.details;
+    if (details === null || typeof details !== "object" || !("kind" in details)) {
+        return null;
+    }
+    if (details.kind === "overlap")
+        return { kind: "overlap" };
+    if (details.kind !== "inspection" ||
+        !("root" in details) ||
+        !("path" in details) ||
+        (details.root !== "preparation" &&
+            details.root !== "marketplace" &&
+            details.root !== "recovery") ||
+        typeof details.path !== "string") {
+        return null;
+    }
+    return { kind: "inspection", root: details.root, path: details.path };
+}
+export async function assertCodexPreparationSeparate(preparedRoot, paths) {
+    const recovery = await inspectRoot(paths.recoveryRoot, "recovery");
+    const marketplace = await inspectRoot(paths.marketplaceRoot, "marketplace");
+    let prepared;
+    try {
+        prepared = await inspectRoot(preparedRoot, "preparation");
+    }
+    catch (cause) {
+        const failure = codexPathFailureDetails(cause);
+        if (failure?.kind !== "inspection" || failure.root !== "preparation") {
+            throw cause;
+        }
+        try {
+            const canonical = await canonicalizeProspectivePath(preparedRoot);
+            if (overlaps(canonical, marketplace) || overlaps(canonical, recovery)) {
+                throw separationError();
+            }
+        }
+        catch (resolutionCause) {
+            if (codexPathFailureDetails(resolutionCause)?.kind === "overlap") {
+                throw resolutionCause;
+            }
+        }
+        throw cause;
+    }
+    if (overlaps(prepared, marketplace) || overlaps(prepared, recovery)) {
+        throw separationError();
+    }
+}

package/dist/harnesses/codex/prepare.js

@@ -9,6 +9,8 @@ import { readGeneratedCommitLenient, readStrictProvenanceField, writeProvenance,
 import { classifyPathNoFollow } from "../../safe-path.js";
 import { SafetyError } from "../../safety-error.js";
 import { manifestVersionForRef } from "../../upstream-version.js";
+import { assertCodexPreparationSeparate, codexPathFailureDetails, codexPaths, } from "./paths.js";
+import { readCodexRecovery } from "./recovery.js";
 // Order is inherited from the original prepare command; the first miss wins.
 const REQUIRED_UPSTREAM = [
     { path: "skills", label: "skills/" },
@@ -75,7 +77,7 @@ async function copyPathIfPresent(source, destination) {
     await owned(`cannot clear candidate path: ${destination}`, () => rm(destination, { recursive: true, force: true }));
     await owned(`cannot copy upstream path into candidate: ${source}`, () => cp(source, destination, { recursive: true, verbatimSymlinks: true }));
 }
-export function resolveFromCwd(value, cwd) {
+function resolveFromCwd(value, cwd) {
     return isAbsolute(value) ? value : resolve(cwd, value);
 }
 function manifestTemplate(ctx) {
@@ -86,11 +88,41 @@ function manifestTemplate(ctx) {
 export function codexPreparationLocation(ctx) {
     const env = ctx.env ?? {};
     return {
-        destinationRoot: resolveFromCwd(env.SUPERPOWERS_PLUGIN_ROOT || join(ctx.root, "plugins", "superpowers"), process.cwd()),
+        destinationRoot: env.SUPERPOWERS_PLUGIN_ROOT !== undefined &&
+            env.SUPERPOWERS_PLUGIN_ROOT.length > 0
+            ? resolveFromCwd(env.SUPERPOWERS_PLUGIN_ROOT, process.cwd())
+            : codexPaths(env, process.cwd()).preparedRoot,
         stagingLeaf: "superpowers",
     };
 }
 export async function validateCodexPreparationBeforeFetch(ctx) {
+    const paths = codexPaths(ctx.env ?? {}, process.cwd());
+    const preparedRoot = codexPreparationLocation(ctx).destinationRoot;
+    try {
+        await assertCodexPreparationSeparate(preparedRoot, paths);
+    }
+    catch (cause) {
+        const failure = codexPathFailureDetails(cause);
+        if (failure?.kind === "inspection") {
+            if (failure.root === "recovery") {
+                return failureResult("prepare", "recovery-required", `cannot inspect Codex recovery state at ${paths.recoveryRoot}`, [], []);
+            }
+            return failureResult("prepare", "prepare-failed", failure.root === "marketplace"
+                ? `cannot inspect Codex marketplace storage at ${paths.marketplaceRoot}`
+                : `cannot inspect Codex preparation root at ${preparedRoot}`, [], []);
+        }
+        return failureResult("prepare", failure?.kind === "overlap" ? "preparation-overlap" : "prepare-failed", failure?.kind === "overlap"
+            ? `Codex preparation overlaps Codex published or recovery storage: ${preparedRoot}`
+            : `cannot validate Codex preparation storage separation at ${preparedRoot}`, [], []);
+    }
+    try {
+        if ((await readCodexRecovery(paths)) !== null) {
+            return failureResult("prepare", "recovery-required", `Codex recovery is required before preparation; preserve material at ${paths.recoveryRoot}`, [], []);
+        }
+    }
+    catch {
+        return failureResult("prepare", "recovery-required", `cannot inspect Codex recovery state at ${paths.recoveryRoot}`, [], []);
+    }
     const template = manifestTemplate(ctx);
     if (!(await regularFileExists(template))) {
         return failureResult("prepare", "missing-template", `missing fallback manifest template: ${template}`, [], []);

package/dist/harnesses/codex/presentation.js

@@ -1,8 +1,8 @@
-import { normalizeCodexInstall, normalizeCodexInstalled } from "./harness.js";
 import { displaySource } from "../../selection.js";
+import { hasTerminalControl } from "../../adapter-result.js";
 // One ordered table drives both formats, preserving the public human and
 // porcelain field order exposed through the harness presentation.
-export function fields(f) {
+function fields(f) {
     return [
         { key: "harness", label: "harness", value: f.harness },
         { key: "requested_ref", label: "requested ref", value: f.requestedRef },
@@ -110,23 +110,15 @@ function verificationOutput(kind, hint) {
         stderr.push(`hint: ${hint}`);
     return { stdout: [], stderr };
 }
+function safeHint(value) {
+    return typeof value === "string" && !hasTerminalControl(value) ? value : "";
+}
 export function codexInstallReceipt(missingHint, mismatchHint) {
     return {
-        missingVerificationOutput: verificationOutput("missing", missingHint),
-        mismatchVerificationOutput: verificationOutput("mismatch", mismatchHint),
+        missingVerificationOutput: verificationOutput("missing", safeHint(missingHint)),
+        mismatchVerificationOutput: verificationOutput("mismatch", safeHint(mismatchHint)),
     };
 }
-// Compatibility export target for src/harnesses/codex/lifecycle.ts. Delegate to the production
-// normalizers and renderer so the retained verdict cannot drift from commands.
-export function verifyInstalledFingerprint(desiredCommit, installResult, inspectResult) {
-    const receipt = normalizeCodexInstall(installResult);
-    const inspection = normalizeCodexInstalled(inspectResult, desiredCommit);
-    const output = codexPresentation.renderInstallVerification(desiredCommit, receipt, inspection);
-    const ok = inspection.status === 0 &&
-        inspection.outcome.ok &&
-        inspection.outcome.result.kind === "current";
-    return { ok, stdout: output.stdout, stderr: output.stderr };
-}
 function probeFacts(facts) {
     const selection = facts.selection;
     const saved = selection.saved;
@@ -251,17 +243,18 @@ export const codexPresentation = {
         if (inspection.outcome.result.kind === "current") {
             return { stdout: [...stdout, "manager updated"], stderr: [] };
         }
+        const missing = inspection.outcome.result.kind === "absent" || observed.length === 0;
         if (receipt.status !== 0 || !receipt.outcome.ok) {
             return {
                 stdout,
                 stderr: [
-                    inspection.outcome.result.kind === "absent"
+                    missing
                         ? "error: installed manager fingerprint is not detectable after install."
                         : "error: installed manager fingerprint does not match the prepared plugin after install.",
                 ],
             };
         }
-        const output = inspection.outcome.result.kind === "absent"
+        const output = missing
             ? receipt.outcome.result.missingVerificationOutput
             : receipt.outcome.result.mismatchVerificationOutput;
         return { stdout, stderr: output.stderr };