yam-flow 2.5.0 → 2.5.1

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to yam-flow are documented here.
 
+## v2.5.1 - 2026-07-31
+
+### Added
+
+- Added bounded stdin readers with a 1 MiB hook limit and a 4 MiB general CLI limit. Malformed or oversized hook payloads now return a valid fail-open response without echoing or acting on rejected input.
+- Added a final read-only `yam doctor --json` verification to yam updates and automatic rollbacks. The updater accepts success only when the command exits cleanly and returns the expected healthy Doctor contract.
+- Added a release-time secret guard over the actual npm dry-run packlist. It scans regular UTF-8 text files for high-signal private-key and provider credential patterns while reporting only pattern, path, and line metadata.
+
+### Improved
+
+- Install and Ueye integrity manifests now use locale-independent ordinal ordering. Existing yam 2.5.0-and-earlier receipts retain compatibility with their stored legacy order while new digests are deterministic across locales.
+
+### Security
+
+- Rejected stdin payloads are byte-bounded, are not included in diagnostics, and cannot supply hook context or trigger workspace mutation.
+- `verify:self`, `prepack`, `prepublishOnly`, and `release:check` now inherit the npm packlist secret guard; the inner pack inspection disables lifecycle scripts to avoid recursive execution.
+- Updater Doctor output recorded in receipts remains redacted and bounded, and an unhealthy rollback is not reported as an automatic recovery.
+
+### Verification
+
+- TypeScript typecheck and build
+- Bounded hook latency/read-only smoke and packaged CLI smoke
+- Locale-independent install/Ueye manifest regression smokes
+- External update/rollback Doctor smoke
+- Npm packlist secret-pattern and redaction smoke
+
 ## v2.5.0 - 2026-07-30
 
 ### Added

package/README.md

@@ -99,6 +99,8 @@ yam hook status --global
 
 The profile installs `UserPromptSubmit` and `Stop` handlers. At `Stop`, yam checks the latest assistant message with the same read-only Study Note Guard used by `yam study-note check`. If changed artifacts lack the required role, execution point, before/after, expected behavior, syntax/structure, verification, limits, or relevant architecture hygiene, Codex receives one correction prompt. A second failed check warns but does not loop forever. If Git change scope is unavailable, the guard reports partial truth and keeps a manual-inspection warning visible instead of claiming the project is clean. The hook never writes the Study Note or runs verification for the agent.
 
+Hook stdin is limited to 1 MiB. Malformed JSON or an oversized payload produces a valid fail-open response without echoing the rejected content, deriving hook context from it, or mutating the workspace. Other CLI commands that read piped text use a 4 MiB limit and fail closed when it is exceeded.
+
 `yam hook status` reports stale or missing command targets as `broken` and exits nonzero. Run `yam hook enable <profile> --global` again to create a timestamped backup, preserve unrelated hooks, and migrate that profile to the current installed path and event coverage. Restart Codex or open a new task after changing hooks.
 
 ## Install
@@ -120,7 +122,7 @@ yam install --replace-user-skill quick
 
 Repeat `--replace-user-skill <name>` for each reviewed conflict. Unproven legacy, retired, and Codex mirror directories are preserved rather than deleted by name.
 
-A successful install writes `~/.agents/skills/.yam-flow-install-receipt.json`. The receipt records the package version, source identity, install timestamp, destination, managed skill inventory, and per-file hashes. `yam status` independently recomputes source and installed hashes, so a stale package install, local file change, unexpected file, or modified receipt is reported as drift.
+A successful install writes `~/.agents/skills/.yam-flow-install-receipt.json`. The receipt records the package version, source identity, install timestamp, destination, managed skill inventory, and per-file hashes. Integrity paths and digests use locale-independent ordinal ordering; receipts written by yam 2.5.0 and earlier are also checked against their stored legacy order during upgrade. `yam status` independently recomputes source and installed hashes, so a stale package install, local file change, unexpected file, or modified receipt is reported as drift.
 
 The receipt is local integrity provenance, not a cryptographic signature or a security boundary against another process running as the same OS user. An actor that can rewrite both the receipt and every recorded file can forge local ownership evidence.
 
@@ -148,7 +150,7 @@ yam update apply --component yam
 yam update apply --all --json
 ```
 
-`--all` processes Scrapling, then Insane Search, then yam so the running updater replaces itself last. It stops at the first failed or manual-only component. Each attempt writes a component receipt under `~/.local/state/yam/update-receipts/` with the old/new version, source revision, checks, side effects, outcome, and rollback guidance. A lock prevents concurrent apply runs.
+`--all` processes Scrapling, then Insane Search, then yam so the running updater replaces itself last. It stops at the first failed or manual-only component. A yam update is successful only after the installed version and status checks plus a final read-only `yam doctor --json` return the expected healthy contract. Doctor failure triggers the existing rollback path, and rollback is considered automatic only when its own version, status, and Doctor checks pass. Each attempt writes a component receipt under `~/.local/state/yam/update-receipts/` with the old/new version, source revision, checks, side effects, outcome, and rollback guidance. A lock prevents concurrent apply runs.
 
 Scrapling updates install an exact stable PyPI version into a new versioned virtual environment. `pip check`, ordinary HTTP extraction, and headless browser extraction must pass before the executable symlink changes atomically; the previous environment is retained. An existing environment must have a matching `.yam-scrapling-install.json` ownership marker before yam will replace its link. Insane Search uses only the official `codex plugin` commands. yam never edits `.codex/plugins/cache`, never removes the plugin first, and returns `manual_plugin_update_required` when the installed Codex CLI cannot update it safely in place.
 
@@ -255,6 +257,8 @@ yam status
 
 After `yam status` reports all skills and the install receipt as `ok`, restart Codex so the refreshed skills reload.
 
+Before packaging or publishing, `verify:self` inspects the exact file list returned by `npm pack --dry-run --json --ignore-scripts`. The release gate scans regular UTF-8 text files up to 2 MiB for high-signal private-key, npm, GitHub, OpenAI, Anthropic, and AWS credential patterns. Findings expose only the pattern id, package-relative path, and line number; matched text is never printed. Binary, symlink, non-regular, unreadable, outside-root, and oversized entries are reported as skipped rather than silently represented as scanned.
+
 Publishing still requires confirming the final npm package name and account access.
 
 ## Trust Kernel

package/ROADMAP.md

@@ -172,7 +172,7 @@ Tasks:
 
 - Add `.yam/memory/records/*.json` storage. Done.
 - Add `yam memory init/add/list/summary/resolve`. Done.
-- Add lightweight secret-pattern blocking. Done.
+- Add lightweight secret-pattern blocking, including an actual npm dry-run packlist release guard with redacted findings. Done.
 - Teach context reuse to prefer `summary.md`, not full record reads. Done.
 - Keep memory opt-in only. Done.
 
@@ -308,6 +308,7 @@ Tasks:
 - Keep `yam-lite` advisory-only through `UserPromptSubmit`. Done.
 - Add Study Note `UserPromptSubmit` reminder plus one-pass `Stop` completion gate. Done.
 - Detect broken hook targets and migrate stale paths without replacing unrelated hooks. Done.
+- Bound hook/general stdin and fail open safely for rejected hook payloads. Done.
 - Add `references/tool-trust-layer.md`. Done.
 - Add read-only `yam tools doctor`. Done.
 - Add `yam proof` summary command. Done.
@@ -318,6 +319,8 @@ Tasks:
 - Add shallow `.sql` destructive keyword scan. Done.
 - Add `yam proof write`. Done.
 - Prepare npm/npx package metadata and dry-run packaging. Done.
+- Make integrity-critical install and Ueye manifest ordering locale-independent. Done.
+- Require a final read-only Doctor contract for yam update and rollback success. Done.
 - Add small route-scoped trust kernel: truth caps, fake/real policy, runtime truth matrix, and completion proof object. Done.
 
 ### 16. Deferred Triggers

package/dist/bin/yam.js

@@ -12,6 +12,7 @@ import { TRUTH_STATUSES, buildLoopReport, buildMediaGenerationProof, buildMissio
 import { archiveUeyeRevision, inspectImageFile, upsertUeyeAsset, verifyUeyeAssetManifest, verifyUeyeRevisionHistory } from '../lib/ueye-artifacts.js';
 import { inspectSkillInstallation, installSkillSetTransactional, uninstallSkillSetSafely } from '../lib/skill-installation.js';
 import { EXTERNAL_UPDATE_COMPONENTS, applyExternalUpdates, checkExternalUpdates } from '../lib/external-updates.js';
+import { BoundedInputError, GENERAL_STDIN_MAX_BYTES, HOOK_STDIN_MAX_BYTES, readBoundedStdinJson, readBoundedStdinText } from '../lib/bounded-input.js';
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -2008,7 +2009,20 @@ async function hookRun(args = []) {
         console.log(JSON.stringify({ continue: true }));
         return;
     }
-    const input = await readStdinJson();
+    let input;
+    try {
+        input = await readStdinJson();
+    }
+    catch (error) {
+        if (!(error instanceof BoundedInputError))
+            throw error;
+        const code = error.code === 'invalid_json' ? 'invalid_hook_json' : error.code;
+        console.log(JSON.stringify({
+            continue: true,
+            systemMessage: `yam-${profile} hook input rejected: ${code}; continuing without using or echoing the payload.`
+        }));
+        return;
+    }
     const event = input?.hook_event_name || input?.hookEventName || input?.event || 'UserPromptSubmit';
     const cwd = String(input?.cwd || process.cwd());
     if (profile === 'study-note' && event === 'Stop') {
@@ -2029,18 +2043,7 @@ async function hookRun(args = []) {
     console.log(JSON.stringify(output));
 }
 async function readStdinJson() {
-    const chunks = [];
-    for await (const chunk of process.stdin)
-        chunks.push(Buffer.from(chunk));
-    const text = Buffer.concat(chunks).toString('utf8').trim();
-    if (!text)
-        return {};
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return {};
-    }
+    return readBoundedStdinJson(process.stdin, HOOK_STDIN_MAX_BYTES);
 }
 function extractPrompt(input = {}) {
     const candidates = [
@@ -2671,10 +2674,7 @@ function redactSensitiveText(text = '') {
 async function readStdinTextIfAvailable() {
     if (process.stdin.isTTY)
         return '';
-    const chunks = [];
-    for await (const chunk of process.stdin)
-        chunks.push(Buffer.from(chunk));
-    return Buffer.concat(chunks).toString('utf8').trim();
+    return (await readBoundedStdinText(process.stdin, GENERAL_STDIN_MAX_BYTES)).trim();
 }
 async function loop(args = []) {
     const subcommand = args[0] || 'help';

package/dist/lib/bounded-input.d.ts

@@ -0,0 +1,12 @@
+export declare const HOOK_STDIN_MAX_BYTES: number;
+export declare const GENERAL_STDIN_MAX_BYTES: number;
+export type BoundedInputErrorCode = 'input_too_large' | 'invalid_json';
+export declare class BoundedInputError extends Error {
+    readonly code: BoundedInputErrorCode;
+    readonly maxBytes?: number;
+    constructor(code: BoundedInputErrorCode, options?: {
+        maxBytes?: number;
+    });
+}
+export declare function readBoundedStdinText(input: NodeJS.ReadableStream & AsyncIterable<string | Buffer>, maxBytes: number): Promise<string>;
+export declare function readBoundedStdinJson(input: NodeJS.ReadableStream & AsyncIterable<string | Buffer>, maxBytes: number): Promise<Record<string, unknown>>;

package/dist/lib/bounded-input.js

@@ -0,0 +1,48 @@
+export const HOOK_STDIN_MAX_BYTES = 1024 * 1024;
+export const GENERAL_STDIN_MAX_BYTES = 4 * 1024 * 1024;
+export class BoundedInputError extends Error {
+    code;
+    maxBytes;
+    constructor(code, options = {}) {
+        const detail = code === 'input_too_large' && options.maxBytes
+            ? `stdin input exceeds the ${options.maxBytes}-byte limit`
+            : 'stdin input is not a valid JSON object';
+        super(`[${code}] ${detail}`);
+        this.name = 'BoundedInputError';
+        this.code = code;
+        this.maxBytes = options.maxBytes;
+    }
+}
+export async function readBoundedStdinText(input, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+        throw new Error('stdin byte limit must be a positive safe integer');
+    }
+    const chunks = [];
+    let totalBytes = 0;
+    for await (const chunk of input) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        totalBytes += bytes.byteLength;
+        if (totalBytes > maxBytes) {
+            throw new BoundedInputError('input_too_large', { maxBytes });
+        }
+        chunks.push(bytes);
+    }
+    return Buffer.concat(chunks, totalBytes).toString('utf8');
+}
+export async function readBoundedStdinJson(input, maxBytes) {
+    const text = (await readBoundedStdinText(input, maxBytes)).trim();
+    if (!text)
+        return {};
+    try {
+        const value = JSON.parse(text);
+        if (!value || typeof value !== 'object' || Array.isArray(value)) {
+            throw new BoundedInputError('invalid_json');
+        }
+        return value;
+    }
+    catch (error) {
+        if (error instanceof BoundedInputError)
+            throw error;
+        throw new BoundedInputError('invalid_json');
+    }
+}

package/dist/lib/external-updates.js

@@ -354,6 +354,13 @@ async function applyYam(currentYamVersion, deps) {
             break;
         }
     }
+    if (!postFailure) {
+        const doctor = await deps.run('yam', ['doctor', '--json'], { env: deps.env, timeout: 180000 });
+        const validation = doctorValidation('yam_finalize_doctor', doctor);
+        checks.push(validation.check);
+        if (!validation.passed)
+            postFailure = `yam_finalize_doctor failed: ${validation.error}`;
+    }
     if (postFailure) {
         const rollback = await rollbackYam(check.installed_version, deps, checks);
         return persistReceipt(baseReceipt(check, 'failed', checks, {
@@ -392,10 +399,17 @@ async function rollbackYam(previousVersion, deps, checks) {
     const install = await deps.run('yam', ['install'], { env: deps.env, timeout: 180000 });
     const version = await deps.run('yam', ['version'], { env: deps.env, timeout: 30000 });
     const status = await deps.run('yam', ['status'], { env: deps.env, timeout: 120000 });
+    const doctor = await deps.run('yam', ['doctor', '--json'], { env: deps.env, timeout: 180000 });
+    const doctorResult = doctorValidation('automatic_yam_rollback_doctor', doctor);
     checks.push(commandCheck('automatic_yam_rollback_skills', install));
     checks.push(commandCheck('automatic_yam_rollback_version', version));
     checks.push(commandCheck('automatic_yam_rollback_status', status));
-    return install.ok && version.ok && extractVersion(version.stdout) === previousVersion && status.ok;
+    checks.push(doctorResult.check);
+    return (install.ok
+        && version.ok
+        && extractVersion(version.stdout) === previousVersion
+        && status.ok
+        && doctorResult.passed);
 }
 async function applyScrapling(deps) {
     const check = await checkScrapling(deps);
@@ -820,7 +834,7 @@ function yamRollback(previousVersion) {
         automatic: false,
         previous_target: previousVersion,
         guidance: previousVersion
-            ? `Reinstall the exact prior package with \`npm install -g yam-flow@${previousVersion}\`, then run \`yam install\`, \`yam version\`, and \`yam status\`.`
+            ? `Reinstall the exact prior package with \`npm install -g yam-flow@${previousVersion}\`, then run \`yam install\`, \`yam version\`, \`yam status\`, and \`yam doctor --json\`.`
             : 'Inspect the global npm installation before attempting a manual rollback.'
     };
 }
@@ -858,6 +872,57 @@ function commandCheck(id, result) {
         note: commandNote(result)
     };
 }
+function doctorValidation(id, result) {
+    if (!result.ok) {
+        const note = boundedNote(`command failed: ${commandNote(result)}`);
+        return {
+            passed: false,
+            error: note,
+            check: { id, status: 'failed', note }
+        };
+    }
+    let report;
+    try {
+        const parsed = JSON.parse(String(result.stdout || ''));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('not an object');
+        }
+        report = parsed;
+    }
+    catch {
+        const note = 'yam doctor returned invalid JSON';
+        return {
+            passed: false,
+            error: note,
+            check: { id, status: 'failed', note }
+        };
+    }
+    if (report.schema !== 'yam.doctor.v1') {
+        const note = 'yam doctor returned an unexpected schema';
+        return {
+            passed: false,
+            error: note,
+            check: { id, status: 'failed', note }
+        };
+    }
+    if (report.ok !== true) {
+        const note = 'yam.doctor.v1 reported ok=false';
+        return {
+            passed: false,
+            error: note,
+            check: { id, status: 'failed', note }
+        };
+    }
+    const note = 'yam.doctor.v1 reported ok=true';
+    return {
+        passed: true,
+        error: '',
+        check: { id, status: 'passed', note }
+    };
+}
+function boundedNote(text) {
+    return redactSensitiveText(String(text || '')).slice(0, 800);
+}
 function commandNote(result) {
     const text = redactSensitiveText([result.stdout, result.stderr].filter(Boolean).join('\n'));
     const lines = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);

package/dist/lib/skill-installation.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 export const INSTALL_RECEIPT_NAME = '.yam-flow-install-receipt.json';
 export const INSTALL_LOCK_NAME = '.yam-flow-install.lock';
 export const INSTALL_RECEIPT_SCHEMA = 'yam.install-receipt.v1';
@@ -70,7 +71,7 @@ async function collectTreeManifest(root, prefix = '') {
     const files = [];
     async function walk(current, relative) {
         const entries = await fsp.readdir(current, { withFileTypes: true });
-        entries.sort((left, right) => left.name.localeCompare(right.name));
+        entries.sort((left, right) => compareStableText(left.name, right.name));
         for (const entry of entries) {
             const absolute = path.join(current, entry.name);
             const nextRelative = relative ? path.join(relative, entry.name) : entry.name;
@@ -86,7 +87,7 @@ async function collectTreeManifest(root, prefix = '') {
         }
     }
     await walk(root, '');
-    return files.sort((left, right) => left.path.localeCompare(right.path));
+    return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 async function expectedInstallManifest(sourceRoot, skills) {
     const referencesRoot = path.join(sourceRoot, 'references');
@@ -112,7 +113,7 @@ async function expectedInstallManifest(sourceRoot, skills) {
             });
         }
     }
-    return files.sort((left, right) => left.path.localeCompare(right.path));
+    return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 async function copyTree(source, target) {
     const stat = await fsp.lstat(source);
@@ -137,8 +138,11 @@ async function copyTree(source, target) {
     }
 }
 function manifestDigest(files) {
+    return digestManifestFiles([...files].sort((left, right) => compareStableText(left.path, right.path)));
+}
+function digestManifestFiles(files) {
     const digest = createHash('sha256');
-    for (const file of [...files].sort((left, right) => left.path.localeCompare(right.path))) {
+    for (const file of files) {
         digest.update(file.path);
         digest.update('\0');
         digest.update(String(file.bytes));
@@ -148,6 +152,20 @@ function manifestDigest(files) {
     }
     return digest.digest('hex');
 }
+function allowsLegacyManifestOrder(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(String(version || ''));
+    if (!match)
+        return false;
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    const patch = Number(match[3]);
+    return major < 2 || (major === 2 && (minor < 5 || (minor === 5 && patch === 0)));
+}
+function receiptManifestDigestMatches(files, digest, version) {
+    if (digest === manifestDigest(files))
+        return true;
+    return allowsLegacyManifestOrder(version) && digest === digestManifestFiles(files);
+}
 function manifestIssues(expected, actual, label) {
     const issues = [];
     const expectedByPath = new Map(expected.map((file) => [file.path, file]));
@@ -236,7 +254,7 @@ function ownershipReceiptIssues(receipt, packageName, destination) {
     if (value.integrity?.file_count !== files.length) {
         issues.push('install receipt file count does not match its manifest');
     }
-    if (value.integrity?.source_digest !== manifestDigest(files)) {
+    if (!receiptManifestDigestMatches(files, value.integrity?.source_digest, value.package?.version)) {
         issues.push('install receipt source digest does not match its manifest');
     }
     if (Array.isArray(value.skills)) {

package/dist/lib/stable-order.d.ts

@@ -0,0 +1 @@
+export declare function compareStableText(left: string, right: string): number;

package/dist/lib/stable-order.js

@@ -0,0 +1,5 @@
+export function compareStableText(left, right) {
+    if (left === right)
+        return 0;
+    return left < right ? -1 : 1;
+}

package/dist/lib/ueye-artifacts.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { constants as fsConstants } from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 export async function inspectImageFile(file) {
     const absolute = path.resolve(file);
     const buffer = await fsp.readFile(absolute);
@@ -46,7 +47,7 @@ export async function upsertUeyeAsset(input) {
         manifest.assets[existingIndex] = entry;
     else
         manifest.assets.push(entry);
-    manifest.assets.sort((left, right) => left.id.localeCompare(right.id));
+    manifest.assets.sort((left, right) => compareStableText(left.id, right.id));
     manifest.updated_at = new Date().toISOString();
     await writeJsonAtomic(manifestPath, manifest);
     const warnings = assetWarnings(entry);
@@ -152,7 +153,7 @@ export async function archiveUeyeRevision(input) {
     else {
         history.revisions.push(entry);
     }
-    history.revisions.sort((left, right) => left.round - right.round || left.artifact_id.localeCompare(right.artifact_id));
+    history.revisions.sort((left, right) => left.round - right.round || compareStableText(left.artifact_id, right.artifact_id));
     history.updated_at = new Date().toISOString();
     await writeJsonAtomic(manifestPath, history);
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yam-flow",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Progressive proof-first agent flow: start fast, deepen deliberately, stay honest by design.",
   "type": "module",
   "author": "0kim0bos",
@@ -52,7 +52,7 @@
     "doctor": "node ./dist/bin/yam.js doctor",
     "list": "node ./dist/bin/yam.js list",
     "examples": "node ./dist/bin/yam.js examples",
-    "verify:self": "npm run build && node --check ./dist/bin/yam.js && node --check ./dist/lib/trust-kernel.js && node --check ./dist/lib/skill-installation.js && node --check ./dist/lib/external-updates.js && npm run hook-latency-smoke && node ./scripts/external-updates-smoke.mjs && node ./scripts/install-transaction-smoke.mjs && node ./dist/bin/yam.js verify && node ./dist/bin/yam.js doctor",
+    "verify:self": "npm run build && node --check ./dist/bin/yam.js && node --check ./dist/lib/trust-kernel.js && node --check ./dist/lib/skill-installation.js && node --check ./dist/lib/external-updates.js && npm run hook-latency-smoke && node ./scripts/external-updates-smoke.mjs && node ./scripts/install-transaction-smoke.mjs && npm run package-secrets:check && npm run package-secrets-smoke && node ./dist/bin/yam.js verify && node ./dist/bin/yam.js doctor",
     "prepare": "npm run build",
     "prepack": "npm run verify:self",
     "prepublishOnly": "npm run verify:self",
@@ -61,6 +61,8 @@
     "forbidden-names:check": "node ./scripts/check-forbidden-names.mjs",
     "study-note:check": "node ./dist/bin/yam.js study-note check --json",
     "package-boundary:check": "node ./scripts/check-package-boundary.mjs",
+    "package-secrets:check": "node ./scripts/check-package-secrets.mjs",
+    "package-secrets-smoke": "node ./scripts/package-secrets-smoke.mjs",
     "dist:freshness": "node ./scripts/check-dist-freshness.mjs",
     "registry:check": "node ./scripts/check-registry-version.mjs",
     "cli-smoke": "node ./scripts/cli-smoke.mjs",

package/src/bin/yam.ts

@@ -45,6 +45,13 @@ import {
   checkExternalUpdates
 } from '../lib/external-updates.js';
 import type { ExternalUpdateComponent } from '../lib/external-updates.js';
+import {
+  BoundedInputError,
+  GENERAL_STDIN_MAX_BYTES,
+  HOOK_STDIN_MAX_BYTES,
+  readBoundedStdinJson,
+  readBoundedStdinText
+} from '../lib/bounded-input.js';
 
 type AnyRecord = Record<string, any>;
 
@@ -2022,7 +2029,18 @@ async function hookRun(args = []) {
     console.log(JSON.stringify({ continue: true }));
     return;
   }
-  const input = await readStdinJson();
+  let input: AnyRecord;
+  try {
+    input = await readStdinJson();
+  } catch (error) {
+    if (!(error instanceof BoundedInputError)) throw error;
+    const code = error.code === 'invalid_json' ? 'invalid_hook_json' : error.code;
+    console.log(JSON.stringify({
+      continue: true,
+      systemMessage: `yam-${profile} hook input rejected: ${code}; continuing without using or echoing the payload.`
+    }));
+    return;
+  }
   const event = input?.hook_event_name || input?.hookEventName || input?.event || 'UserPromptSubmit';
   const cwd = String(input?.cwd || process.cwd());
   if (profile === 'study-note' && event === 'Stop') {
@@ -2044,15 +2062,7 @@ async function hookRun(args = []) {
 }
 
 async function readStdinJson() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
-  const text = Buffer.concat(chunks).toString('utf8').trim();
-  if (!text) return {};
-  try {
-    return JSON.parse(text);
-  } catch {
-    return {};
-  }
+  return readBoundedStdinJson(process.stdin, HOOK_STDIN_MAX_BYTES);
 }
 
 function extractPrompt(input: AnyRecord = {}) {
@@ -2685,9 +2695,7 @@ function redactSensitiveText(text = '') {
 
 async function readStdinTextIfAvailable() {
   if (process.stdin.isTTY) return '';
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
-  return Buffer.concat(chunks).toString('utf8').trim();
+  return (await readBoundedStdinText(process.stdin, GENERAL_STDIN_MAX_BYTES)).trim();
 }
 
 async function loop(args = []) {

package/src/lib/bounded-input.ts

@@ -0,0 +1,59 @@
+export const HOOK_STDIN_MAX_BYTES = 1024 * 1024;
+export const GENERAL_STDIN_MAX_BYTES = 4 * 1024 * 1024;
+
+export type BoundedInputErrorCode = 'input_too_large' | 'invalid_json';
+
+export class BoundedInputError extends Error {
+  readonly code: BoundedInputErrorCode;
+  readonly maxBytes?: number;
+
+  constructor(code: BoundedInputErrorCode, options: { maxBytes?: number } = {}) {
+    const detail = code === 'input_too_large' && options.maxBytes
+      ? `stdin input exceeds the ${options.maxBytes}-byte limit`
+      : 'stdin input is not a valid JSON object';
+    super(`[${code}] ${detail}`);
+    this.name = 'BoundedInputError';
+    this.code = code;
+    this.maxBytes = options.maxBytes;
+  }
+}
+
+export async function readBoundedStdinText(
+  input: NodeJS.ReadableStream & AsyncIterable<string | Buffer>,
+  maxBytes: number
+): Promise<string> {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+    throw new Error('stdin byte limit must be a positive safe integer');
+  }
+
+  const chunks: Buffer[] = [];
+  let totalBytes = 0;
+  for await (const chunk of input) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalBytes += bytes.byteLength;
+    if (totalBytes > maxBytes) {
+      throw new BoundedInputError('input_too_large', { maxBytes });
+    }
+    chunks.push(bytes);
+  }
+  return Buffer.concat(chunks, totalBytes).toString('utf8');
+}
+
+export async function readBoundedStdinJson(
+  input: NodeJS.ReadableStream & AsyncIterable<string | Buffer>,
+  maxBytes: number
+): Promise<Record<string, unknown>> {
+  const text = (await readBoundedStdinText(input, maxBytes)).trim();
+  if (!text) return {};
+
+  try {
+    const value = JSON.parse(text);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+      throw new BoundedInputError('invalid_json');
+    }
+    return value;
+  } catch (error) {
+    if (error instanceof BoundedInputError) throw error;
+    throw new BoundedInputError('invalid_json');
+  }
+}

package/src/lib/external-updates.ts

@@ -479,6 +479,12 @@ async function applyYam(currentYamVersion: string, deps: ResolvedDependencies) {
       break;
     }
   }
+  if (!postFailure) {
+    const doctor = await deps.run('yam', ['doctor', '--json'], { env: deps.env, timeout: 180000 });
+    const validation = doctorValidation('yam_finalize_doctor', doctor);
+    checks.push(validation.check);
+    if (!validation.passed) postFailure = `yam_finalize_doctor failed: ${validation.error}`;
+  }
   if (postFailure) {
     const rollback = await rollbackYam(check.installed_version, deps, checks);
     return persistReceipt(baseReceipt(check, 'failed', checks, {
@@ -521,10 +527,19 @@ async function rollbackYam(
   const install = await deps.run('yam', ['install'], { env: deps.env, timeout: 180000 });
   const version = await deps.run('yam', ['version'], { env: deps.env, timeout: 30000 });
   const status = await deps.run('yam', ['status'], { env: deps.env, timeout: 120000 });
+  const doctor = await deps.run('yam', ['doctor', '--json'], { env: deps.env, timeout: 180000 });
+  const doctorResult = doctorValidation('automatic_yam_rollback_doctor', doctor);
   checks.push(commandCheck('automatic_yam_rollback_skills', install));
   checks.push(commandCheck('automatic_yam_rollback_version', version));
   checks.push(commandCheck('automatic_yam_rollback_status', status));
-  return install.ok && version.ok && extractVersion(version.stdout) === previousVersion && status.ok;
+  checks.push(doctorResult.check);
+  return (
+    install.ok
+    && version.ok
+    && extractVersion(version.stdout) === previousVersion
+    && status.ok
+    && doctorResult.passed
+  );
 }
 
 async function applyScrapling(deps: ResolvedDependencies) {
@@ -967,7 +982,7 @@ function yamRollback(previousVersion: string) {
     automatic: false,
     previous_target: previousVersion,
     guidance: previousVersion
-      ? `Reinstall the exact prior package with \`npm install -g yam-flow@${previousVersion}\`, then run \`yam install\`, \`yam version\`, and \`yam status\`.`
+      ? `Reinstall the exact prior package with \`npm install -g yam-flow@${previousVersion}\`, then run \`yam install\`, \`yam version\`, \`yam status\`, and \`yam doctor --json\`.`
       : 'Inspect the global npm installation before attempting a manual rollback.'
   };
 }
@@ -1008,6 +1023,61 @@ function commandCheck(id: string, result: ExternalCommandResult): ExternalCompon
   };
 }
 
+function doctorValidation(id: string, result: ExternalCommandResult) {
+  if (!result.ok) {
+    const note = boundedNote(`command failed: ${commandNote(result)}`);
+    return {
+      passed: false,
+      error: note,
+      check: { id, status: 'failed' as const, note }
+    };
+  }
+
+  let report: JsonRecord;
+  try {
+    const parsed = JSON.parse(String(result.stdout || ''));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new Error('not an object');
+    }
+    report = parsed;
+  } catch {
+    const note = 'yam doctor returned invalid JSON';
+    return {
+      passed: false,
+      error: note,
+      check: { id, status: 'failed' as const, note }
+    };
+  }
+
+  if (report.schema !== 'yam.doctor.v1') {
+    const note = 'yam doctor returned an unexpected schema';
+    return {
+      passed: false,
+      error: note,
+      check: { id, status: 'failed' as const, note }
+    };
+  }
+  if (report.ok !== true) {
+    const note = 'yam.doctor.v1 reported ok=false';
+    return {
+      passed: false,
+      error: note,
+      check: { id, status: 'failed' as const, note }
+    };
+  }
+
+  const note = 'yam.doctor.v1 reported ok=true';
+  return {
+    passed: true,
+    error: '',
+    check: { id, status: 'passed' as const, note }
+  };
+}
+
+function boundedNote(text: string) {
+  return redactSensitiveText(String(text || '')).slice(0, 800);
+}
+
 function commandNote(result: ExternalCommandResult) {
   const text = redactSensitiveText([result.stdout, result.stderr].filter(Boolean).join('\n'));
   const lines = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);

package/src/lib/skill-installation.ts

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 
 export const INSTALL_RECEIPT_NAME = '.yam-flow-install-receipt.json';
 export const INSTALL_LOCK_NAME = '.yam-flow-install.lock';
@@ -211,7 +212,7 @@ async function collectTreeManifest(root: string, prefix = ''): Promise<InstallFi
   const files: InstallFileDigest[] = [];
   async function walk(current: string, relative: string): Promise<void> {
     const entries = await fsp.readdir(current, { withFileTypes: true });
-    entries.sort((left, right) => left.name.localeCompare(right.name));
+    entries.sort((left, right) => compareStableText(left.name, right.name));
     for (const entry of entries) {
       const absolute = path.join(current, entry.name);
       const nextRelative = relative ? path.join(relative, entry.name) : entry.name;
@@ -226,7 +227,7 @@ async function collectTreeManifest(root: string, prefix = ''): Promise<InstallFi
   }
 
   await walk(root, '');
-  return files.sort((left, right) => left.path.localeCompare(right.path));
+  return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 
 async function expectedInstallManifest(sourceRoot: string, skills: string[]) {
@@ -253,7 +254,7 @@ async function expectedInstallManifest(sourceRoot: string, skills: string[]) {
       });
     }
   }
-  return files.sort((left, right) => left.path.localeCompare(right.path));
+  return files.sort((left, right) => compareStableText(left.path, right.path));
 }
 
 async function copyTree(source: string, target: string): Promise<void> {
@@ -278,8 +279,12 @@ async function copyTree(source: string, target: string): Promise<void> {
 }
 
 function manifestDigest(files: InstallFileDigest[]) {
+  return digestManifestFiles([...files].sort((left, right) => compareStableText(left.path, right.path)));
+}
+
+function digestManifestFiles(files: InstallFileDigest[]) {
   const digest = createHash('sha256');
-  for (const file of [...files].sort((left, right) => left.path.localeCompare(right.path))) {
+  for (const file of files) {
     digest.update(file.path);
     digest.update('\0');
     digest.update(String(file.bytes));
@@ -290,6 +295,20 @@ function manifestDigest(files: InstallFileDigest[]) {
   return digest.digest('hex');
 }
 
+function allowsLegacyManifestOrder(version: unknown) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(String(version || ''));
+  if (!match) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
+  return major < 2 || (major === 2 && (minor < 5 || (minor === 5 && patch === 0)));
+}
+
+function receiptManifestDigestMatches(files: InstallFileDigest[], digest: unknown, version: unknown) {
+  if (digest === manifestDigest(files)) return true;
+  return allowsLegacyManifestOrder(version) && digest === digestManifestFiles(files);
+}
+
 function manifestIssues(expected: InstallFileDigest[], actual: InstallFileDigest[], label: string) {
   const issues: string[] = [];
   const expectedByPath = new Map(expected.map((file) => [file.path, file]));
@@ -379,7 +398,7 @@ function ownershipReceiptIssues(
   if (value.integrity?.file_count !== files.length) {
     issues.push('install receipt file count does not match its manifest');
   }
-  if (value.integrity?.source_digest !== manifestDigest(files)) {
+  if (!receiptManifestDigestMatches(files, value.integrity?.source_digest, value.package?.version)) {
     issues.push('install receipt source digest does not match its manifest');
   }
   if (Array.isArray(value.skills)) {

package/src/lib/stable-order.ts

@@ -0,0 +1,4 @@
+export function compareStableText(left: string, right: string): number {
+  if (left === right) return 0;
+  return left < right ? -1 : 1;
+}

package/src/lib/ueye-artifacts.ts

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { constants as fsConstants } from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableText } from './stable-order.js';
 
 export interface InspectedImageFile {
   path: string;
@@ -102,7 +103,7 @@ export async function upsertUeyeAsset(input: {
   };
   if (existingIndex >= 0) manifest.assets[existingIndex] = entry;
   else manifest.assets.push(entry);
-  manifest.assets.sort((left, right) => left.id.localeCompare(right.id));
+  manifest.assets.sort((left, right) => compareStableText(left.id, right.id));
   manifest.updated_at = new Date().toISOString();
   await writeJsonAtomic(manifestPath, manifest);
   const warnings = assetWarnings(entry);
@@ -205,7 +206,7 @@ export async function archiveUeyeRevision(input: {
   } else {
     history.revisions.push(entry);
   }
-  history.revisions.sort((left, right) => left.round - right.round || left.artifact_id.localeCompare(right.artifact_id));
+  history.revisions.sort((left, right) => left.round - right.round || compareStableText(left.artifact_id, right.artifact_id));
   history.updated_at = new Date().toISOString();
   await writeJsonAtomic(manifestPath, history);
   return {

package/yam.manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "yam",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "principles": [
     "Direction before execution.",
     "Start fast.",