yam-flow 2.4.0 → 2.5.1

package/dist/lib/skill-installation.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 export const INSTALL_RECEIPT_NAME = '.yam-flow-install-receipt.json';
 export const INSTALL_LOCK_NAME = '.yam-flow-install.lock';
 export const INSTALL_RECEIPT_SCHEMA = 'yam.install-receipt.v1';
@@ -70,7 +71,7 @@ async function collectTreeManifest(root, prefix = '') {
     const files = [];
     async function walk(current, relative) {
         const entries = await fsp.readdir(current, { withFileTypes: true });
-        entries.sort((left, right) => left.name.localeCompare(right.name));
+        entries.sort((left, right) => compareStableText(left.name, right.name));
         for (const entry of entries) {
             const absolute = path.join(current, entry.name);
             const nextRelative = relative ? path.join(relative, entry.name) : entry.name;
@@ -86,7 +87,7 @@ async function collectTreeManifest(root, prefix = '') {
         }
     }
     await walk(root, '');
-    return files.sort((left, right) => left.path.localeCompare(right.path));
+    return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 async function expectedInstallManifest(sourceRoot, skills) {
     const referencesRoot = path.join(sourceRoot, 'references');
@@ -112,7 +113,7 @@ async function expectedInstallManifest(sourceRoot, skills) {
             });
         }
     }
-    return files.sort((left, right) => left.path.localeCompare(right.path));
+    return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 async function copyTree(source, target) {
     const stat = await fsp.lstat(source);
@@ -137,8 +138,11 @@ async function copyTree(source, target) {
     }
 }
 function manifestDigest(files) {
+    return digestManifestFiles([...files].sort((left, right) => compareStableText(left.path, right.path)));
+}
+function digestManifestFiles(files) {
     const digest = createHash('sha256');
-    for (const file of [...files].sort((left, right) => left.path.localeCompare(right.path))) {
+    for (const file of files) {
         digest.update(file.path);
         digest.update('\0');
         digest.update(String(file.bytes));
@@ -148,6 +152,20 @@ function manifestDigest(files) {
     }
     return digest.digest('hex');
 }
+function allowsLegacyManifestOrder(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(String(version || ''));
+    if (!match)
+        return false;
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    const patch = Number(match[3]);
+    return major < 2 || (major === 2 && (minor < 5 || (minor === 5 && patch === 0)));
+}
+function receiptManifestDigestMatches(files, digest, version) {
+    if (digest === manifestDigest(files))
+        return true;
+    return allowsLegacyManifestOrder(version) && digest === digestManifestFiles(files);
+}
 function manifestIssues(expected, actual, label) {
     const issues = [];
     const expectedByPath = new Map(expected.map((file) => [file.path, file]));
@@ -236,7 +254,7 @@ function ownershipReceiptIssues(receipt, packageName, destination) {
     if (value.integrity?.file_count !== files.length) {
         issues.push('install receipt file count does not match its manifest');
     }
-    if (value.integrity?.source_digest !== manifestDigest(files)) {
+    if (!receiptManifestDigestMatches(files, value.integrity?.source_digest, value.package?.version)) {
         issues.push('install receipt source digest does not match its manifest');
     }
     if (Array.isArray(value.skills)) {

package/dist/lib/stable-order.d.ts

@@ -0,0 +1 @@
+export declare function compareStableText(left: string, right: string): number;

package/dist/lib/stable-order.js

@@ -0,0 +1,5 @@
+export function compareStableText(left, right) {
+    if (left === right)
+        return 0;
+    return left < right ? -1 : 1;
+}

package/dist/lib/ueye-artifacts.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { constants as fsConstants } from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 export async function inspectImageFile(file) {
     const absolute = path.resolve(file);
     const buffer = await fsp.readFile(absolute);
@@ -46,7 +47,7 @@ export async function upsertUeyeAsset(input) {
         manifest.assets[existingIndex] = entry;
     else
         manifest.assets.push(entry);
-    manifest.assets.sort((left, right) => left.id.localeCompare(right.id));
+    manifest.assets.sort((left, right) => compareStableText(left.id, right.id));
     manifest.updated_at = new Date().toISOString();
     await writeJsonAtomic(manifestPath, manifest);
     const warnings = assetWarnings(entry);
@@ -152,7 +153,7 @@ export async function archiveUeyeRevision(input) {
     else {
         history.revisions.push(entry);
     }
-    history.revisions.sort((left, right) => left.round - right.round || left.artifact_id.localeCompare(right.artifact_id));
+    history.revisions.sort((left, right) => left.round - right.round || compareStableText(left.artifact_id, right.artifact_id));
     history.updated_at = new Date().toISOString();
     await writeJsonAtomic(manifestPath, history);
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yam-flow",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "Progressive proof-first agent flow: start fast, deepen deliberately, stay honest by design.",
   "type": "module",
   "author": "0kim0bos",
@@ -43,7 +43,7 @@
   ],
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
+    "build": "npm run clean && tsc -p tsconfig.json && node -e \"require('node:fs').chmodSync('dist/bin/yam.js',0o755)\"",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "install:skills": "node ./dist/bin/yam.js install",
     "uninstall:skills": "node ./dist/bin/yam.js uninstall",
@@ -52,7 +52,7 @@
     "doctor": "node ./dist/bin/yam.js doctor",
     "list": "node ./dist/bin/yam.js list",
     "examples": "node ./dist/bin/yam.js examples",
-    "verify:self": "npm run build && node --check ./dist/bin/yam.js && node --check ./dist/lib/trust-kernel.js && node --check ./dist/lib/skill-installation.js && npm run hook-latency-smoke && node ./scripts/install-transaction-smoke.mjs && node ./dist/bin/yam.js verify && node ./dist/bin/yam.js doctor",
+    "verify:self": "npm run build && node --check ./dist/bin/yam.js && node --check ./dist/lib/trust-kernel.js && node --check ./dist/lib/skill-installation.js && node --check ./dist/lib/external-updates.js && npm run hook-latency-smoke && node ./scripts/external-updates-smoke.mjs && node ./scripts/install-transaction-smoke.mjs && npm run package-secrets:check && npm run package-secrets-smoke && node ./dist/bin/yam.js verify && node ./dist/bin/yam.js doctor",
     "prepare": "npm run build",
     "prepack": "npm run verify:self",
     "prepublishOnly": "npm run verify:self",
@@ -61,9 +61,12 @@
     "forbidden-names:check": "node ./scripts/check-forbidden-names.mjs",
     "study-note:check": "node ./dist/bin/yam.js study-note check --json",
     "package-boundary:check": "node ./scripts/check-package-boundary.mjs",
+    "package-secrets:check": "node ./scripts/check-package-secrets.mjs",
+    "package-secrets-smoke": "node ./scripts/package-secrets-smoke.mjs",
     "dist:freshness": "node ./scripts/check-dist-freshness.mjs",
     "registry:check": "node ./scripts/check-registry-version.mjs",
     "cli-smoke": "node ./scripts/cli-smoke.mjs",
+    "external-updates-smoke": "npm run build && node ./scripts/external-updates-smoke.mjs",
     "hook-latency-smoke": "node ./scripts/hook-latency-smoke.mjs",
     "install-transaction-smoke": "npm run build && node ./scripts/install-transaction-smoke.mjs",
     "release:check": "npm run typecheck && npm run forbidden-names:check && npm run verify:self && npm run dist:freshness && npm run package-boundary:check && npm run registry:check && npm run cli-smoke",

package/src/bin/yam.ts

@@ -39,6 +39,19 @@ import {
   installSkillSetTransactional,
   uninstallSkillSetSafely
 } from '../lib/skill-installation.js';
+import {
+  EXTERNAL_UPDATE_COMPONENTS,
+  applyExternalUpdates,
+  checkExternalUpdates
+} from '../lib/external-updates.js';
+import type { ExternalUpdateComponent } from '../lib/external-updates.js';
+import {
+  BoundedInputError,
+  GENERAL_STDIN_MAX_BYTES,
+  HOOK_STDIN_MAX_BYTES,
+  readBoundedStdinJson,
+  readBoundedStdinText
+} from '../lib/bounded-input.js';
 
 type AnyRecord = Record<string, any>;
 
@@ -180,6 +193,9 @@ Usage:
   yam mission queue [--agent-id id] [--scope text] [--changed file] [--verification-hint text] [--json]
   yam mission receipt [--thread-id id] [--role reviewer] [--lifecycle stopped] [--outcome passed] [--evidence text] [--json]
   yam mission gate [--expected-thread id] [--receipt file] [--json]
+  yam update check [--json]
+  yam update apply --component yam|scrapling|insane-search [--json]
+  yam update apply --all [--json]
   yam benchmark report [--baseline n] [--current n] [--unit ms] [--target lower|higher] [--json]
   yam release report [--json]
   yam safety [text...]
@@ -2013,7 +2029,18 @@ async function hookRun(args = []) {
     console.log(JSON.stringify({ continue: true }));
     return;
   }
-  const input = await readStdinJson();
+  let input: AnyRecord;
+  try {
+    input = await readStdinJson();
+  } catch (error) {
+    if (!(error instanceof BoundedInputError)) throw error;
+    const code = error.code === 'invalid_json' ? 'invalid_hook_json' : error.code;
+    console.log(JSON.stringify({
+      continue: true,
+      systemMessage: `yam-${profile} hook input rejected: ${code}; continuing without using or echoing the payload.`
+    }));
+    return;
+  }
   const event = input?.hook_event_name || input?.hookEventName || input?.event || 'UserPromptSubmit';
   const cwd = String(input?.cwd || process.cwd());
   if (profile === 'study-note' && event === 'Stop') {
@@ -2035,15 +2062,7 @@ async function hookRun(args = []) {
 }
 
 async function readStdinJson() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
-  const text = Buffer.concat(chunks).toString('utf8').trim();
-  if (!text) return {};
-  try {
-    return JSON.parse(text);
-  } catch {
-    return {};
-  }
+  return readBoundedStdinJson(process.stdin, HOOK_STDIN_MAX_BYTES);
 }
 
 function extractPrompt(input: AnyRecord = {}) {
@@ -2676,9 +2695,7 @@ function redactSensitiveText(text = '') {
 
 async function readStdinTextIfAvailable() {
   if (process.stdin.isTTY) return '';
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
-  return Buffer.concat(chunks).toString('utf8').trim();
+  return (await readBoundedStdinText(process.stdin, GENERAL_STDIN_MAX_BYTES)).trim();
 }
 
 async function loop(args = []) {
@@ -3564,6 +3581,83 @@ async function mission(args = []) {
   return missionUsage();
 }
 
+async function updateCommand(args: string[] = []) {
+  const subcommand = args[0] || 'help';
+  if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') return updateUsage();
+  if (subcommand === 'check') {
+    const rest = args.slice(1);
+    const invalid = rest.filter((arg) => arg !== '--json');
+    if (invalid.length || rest.filter((arg) => arg === '--json').length > 1) {
+      throw new Error(`invalid update check option: ${invalid[0] || '--json repeated'}`);
+    }
+    const report = await checkExternalUpdates(VERSION);
+    printJsonOrHuman(report, rest.includes('--json'), 'External update check');
+    if (!report.success) process.exitCode = 1;
+    return;
+  }
+  if (subcommand !== 'apply') {
+    throw new Error(`unknown update command: ${subcommand}`);
+  }
+
+  const parsed = parseUpdateApplyArgs(args.slice(1));
+  const report = await applyExternalUpdates(VERSION, {
+    component: parsed.component,
+    all: parsed.all
+  });
+  printJsonOrHuman(report, parsed.json, 'External update apply');
+  if (!report.success) process.exitCode = 1;
+}
+
+function parseUpdateApplyArgs(args: string[]) {
+  let component: ExternalUpdateComponent | undefined;
+  let all = false;
+  let json = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = String(args[index] || '');
+    if (arg === '--json') {
+      if (json) throw new Error('--json may be supplied only once');
+      json = true;
+      continue;
+    }
+    if (arg === '--all') {
+      if (all) throw new Error('--all may be supplied only once');
+      all = true;
+      continue;
+    }
+    if (arg === '--component' || arg.startsWith('--component=')) {
+      if (component) throw new Error('--component may be supplied only once');
+      const value = arg === '--component' ? String(args[index + 1] || '') : arg.slice('--component='.length);
+      if (arg === '--component') index += 1;
+      if (!EXTERNAL_UPDATE_COMPONENTS.includes(value as ExternalUpdateComponent)) {
+        throw new Error('component must be one of: yam, scrapling, insane-search');
+      }
+      component = value as ExternalUpdateComponent;
+      continue;
+    }
+    throw new Error(`invalid update apply option: ${arg}`);
+  }
+  if ((all && component) || (!all && !component)) {
+    throw new Error('choose exactly one of --component yam|scrapling|insane-search or --all');
+  }
+  return { component, all, json };
+}
+
+function updateUsage() {
+  console.log(`yam update
+
+Usage:
+  yam update check [--json]
+  yam update apply --component yam|scrapling|insane-search [--json]
+  yam update apply --all [--json]
+
+Safety:
+  check is read-only. apply requires an explicit component or --all.
+  --all updates Scrapling and Insane Search before yam, then stops at the first failed/manual component.
+  Insane Search is updated only through the official Codex CLI; plugin caches are never edited directly.
+  Every apply attempt records component checks, outcome, side effects, and rollback guidance.
+`);
+}
+
 function missionUsage() {
   console.log(`yam mission
 
@@ -5332,6 +5426,7 @@ function showRequestedHelp(args: string[]) {
     media: mediaUsage,
     runtime: runtimeUsage,
     mission: missionUsage,
+    update: updateUsage,
     benchmark: benchmarkUsage,
     memory: memoryUsage
   };
@@ -5361,6 +5456,7 @@ async function main() {
   if (command === 'media') return media(process.argv.slice(3));
   if (command === 'runtime') return runtime(process.argv.slice(3));
   if (command === 'mission') return mission(process.argv.slice(3));
+  if (command === 'update') return updateCommand(process.argv.slice(3));
   if (command === 'benchmark') return benchmark(process.argv.slice(3));
   if (command === 'release') return release(process.argv.slice(3));
   if (command === 'safety') return safety(process.argv.slice(3));

package/src/lib/bounded-input.ts

@@ -0,0 +1,59 @@
+export const HOOK_STDIN_MAX_BYTES = 1024 * 1024;
+export const GENERAL_STDIN_MAX_BYTES = 4 * 1024 * 1024;
+
+export type BoundedInputErrorCode = 'input_too_large' | 'invalid_json';
+
+export class BoundedInputError extends Error {
+  readonly code: BoundedInputErrorCode;
+  readonly maxBytes?: number;
+
+  constructor(code: BoundedInputErrorCode, options: { maxBytes?: number } = {}) {
+    const detail = code === 'input_too_large' && options.maxBytes
+      ? `stdin input exceeds the ${options.maxBytes}-byte limit`
+      : 'stdin input is not a valid JSON object';
+    super(`[${code}] ${detail}`);
+    this.name = 'BoundedInputError';
+    this.code = code;
+    this.maxBytes = options.maxBytes;
+  }
+}
+
+export async function readBoundedStdinText(
+  input: NodeJS.ReadableStream & AsyncIterable<string | Buffer>,
+  maxBytes: number
+): Promise<string> {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+    throw new Error('stdin byte limit must be a positive safe integer');
+  }
+
+  const chunks: Buffer[] = [];
+  let totalBytes = 0;
+  for await (const chunk of input) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalBytes += bytes.byteLength;
+    if (totalBytes > maxBytes) {
+      throw new BoundedInputError('input_too_large', { maxBytes });
+    }
+    chunks.push(bytes);
+  }
+  return Buffer.concat(chunks, totalBytes).toString('utf8');
+}
+
+export async function readBoundedStdinJson(
+  input: NodeJS.ReadableStream & AsyncIterable<string | Buffer>,
+  maxBytes: number
+): Promise<Record<string, unknown>> {
+  const text = (await readBoundedStdinText(input, maxBytes)).trim();
+  if (!text) return {};
+
+  try {
+    const value = JSON.parse(text);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+      throw new BoundedInputError('invalid_json');
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof BoundedInputError) throw error;
+    throw new BoundedInputError('invalid_json');
+  }
+}