youmd 0.6.21 → 0.6.27
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/build.d.ts.map +1 -1
- package/dist/commands/build.js +0 -1
- package/dist/commands/build.js.map +1 -1
- package/dist/commands/chat.d.ts.map +1 -1
- package/dist/commands/chat.js +283 -184
- package/dist/commands/chat.js.map +1 -1
- package/dist/commands/export.d.ts +1 -0
- package/dist/commands/export.d.ts.map +1 -1
- package/dist/commands/export.js +5 -0
- package/dist/commands/export.js.map +1 -1
- package/dist/commands/init.d.ts.map +1 -1
- package/dist/commands/init.js +21 -1
- package/dist/commands/init.js.map +1 -1
- package/dist/commands/keys.d.ts.map +1 -1
- package/dist/commands/keys.js +3 -3
- package/dist/commands/keys.js.map +1 -1
- package/dist/commands/link.d.ts.map +1 -1
- package/dist/commands/link.js +3 -3
- package/dist/commands/link.js.map +1 -1
- package/dist/commands/login.d.ts +29 -0
- package/dist/commands/login.d.ts.map +1 -1
- package/dist/commands/login.js +256 -127
- package/dist/commands/login.js.map +1 -1
- package/dist/commands/logs.js +0 -1
- package/dist/commands/logs.js.map +1 -1
- package/dist/commands/mcp.d.ts +14 -0
- package/dist/commands/mcp.d.ts.map +1 -1
- package/dist/commands/mcp.js +284 -28
- package/dist/commands/mcp.js.map +1 -1
- package/dist/commands/okf.d.ts +12 -0
- package/dist/commands/okf.d.ts.map +1 -0
- package/dist/commands/okf.js +411 -0
- package/dist/commands/okf.js.map +1 -0
- package/dist/commands/private.d.ts.map +1 -1
- package/dist/commands/private.js +6 -5
- package/dist/commands/private.js.map +1 -1
- package/dist/commands/project.d.ts.map +1 -1
- package/dist/commands/project.js +9 -5
- package/dist/commands/project.js.map +1 -1
- package/dist/commands/publish.d.ts.map +1 -1
- package/dist/commands/publish.js +0 -1
- package/dist/commands/publish.js.map +1 -1
- package/dist/commands/pull.d.ts +24 -1
- package/dist/commands/pull.d.ts.map +1 -1
- package/dist/commands/pull.js +114 -14
- package/dist/commands/pull.js.map +1 -1
- package/dist/commands/push.d.ts +1 -0
- package/dist/commands/push.d.ts.map +1 -1
- package/dist/commands/push.js +33 -13
- package/dist/commands/push.js.map +1 -1
- package/dist/commands/register.d.ts +6 -0
- package/dist/commands/register.d.ts.map +1 -1
- package/dist/commands/register.js +179 -79
- package/dist/commands/register.js.map +1 -1
- package/dist/commands/skill.d.ts.map +1 -1
- package/dist/commands/skill.js +121 -50
- package/dist/commands/skill.js.map +1 -1
- package/dist/commands/stack.d.ts +16 -0
- package/dist/commands/stack.d.ts.map +1 -0
- package/dist/commands/stack.js +863 -0
- package/dist/commands/stack.js.map +1 -0
- package/dist/commands/status.d.ts.map +1 -1
- package/dist/commands/status.js +25 -5
- package/dist/commands/status.js.map +1 -1
- package/dist/commands/sync.d.ts +23 -0
- package/dist/commands/sync.d.ts.map +1 -1
- package/dist/commands/sync.js +193 -12
- package/dist/commands/sync.js.map +1 -1
- package/dist/commands/whoami.d.ts.map +1 -1
- package/dist/commands/whoami.js +21 -16
- package/dist/commands/whoami.js.map +1 -1
- package/dist/create.js +0 -0
- package/dist/index.js +64 -7
- package/dist/index.js.map +1 -1
- package/dist/lib/api.d.ts +127 -5
- package/dist/lib/api.d.ts.map +1 -1
- package/dist/lib/api.js +142 -5
- package/dist/lib/api.js.map +1 -1
- package/dist/lib/ascii.d.ts +1 -0
- package/dist/lib/ascii.d.ts.map +1 -1
- package/dist/lib/ascii.js +9 -26
- package/dist/lib/ascii.js.map +1 -1
- package/dist/lib/canonical-json.d.ts +8 -0
- package/dist/lib/canonical-json.d.ts.map +1 -0
- package/dist/lib/canonical-json.js +29 -0
- package/dist/lib/canonical-json.js.map +1 -0
- package/dist/lib/capability-router.d.ts +58 -0
- package/dist/lib/capability-router.d.ts.map +1 -0
- package/dist/lib/capability-router.js +54 -0
- package/dist/lib/capability-router.js.map +1 -0
- package/dist/lib/compiler.d.ts +32 -0
- package/dist/lib/compiler.d.ts.map +1 -1
- package/dist/lib/compiler.js +150 -0
- package/dist/lib/compiler.js.map +1 -1
- package/dist/lib/config.d.ts +71 -35
- package/dist/lib/config.d.ts.map +1 -1
- package/dist/lib/config.js +334 -124
- package/dist/lib/config.js.map +1 -1
- package/dist/lib/decompile.d.ts +6 -1
- package/dist/lib/decompile.d.ts.map +1 -1
- package/dist/lib/decompile.js +120 -11
- package/dist/lib/decompile.js.map +1 -1
- package/dist/lib/hash.d.ts.map +1 -1
- package/dist/lib/hash.js +2 -19
- package/dist/lib/hash.js.map +1 -1
- package/dist/lib/heartbeat.d.ts +38 -0
- package/dist/lib/heartbeat.d.ts.map +1 -0
- package/dist/lib/heartbeat.js +70 -0
- package/dist/lib/heartbeat.js.map +1 -0
- package/dist/lib/host-link.d.ts +123 -0
- package/dist/lib/host-link.d.ts.map +1 -0
- package/dist/lib/host-link.js +350 -0
- package/dist/lib/host-link.js.map +1 -0
- package/dist/lib/merge.d.ts +50 -0
- package/dist/lib/merge.d.ts.map +1 -0
- package/dist/lib/merge.js +167 -0
- package/dist/lib/merge.js.map +1 -0
- package/dist/lib/okf-bundle.d.ts +104 -0
- package/dist/lib/okf-bundle.d.ts.map +1 -0
- package/dist/lib/okf-bundle.js +473 -0
- package/dist/lib/okf-bundle.js.map +1 -0
- package/dist/lib/okf-health.d.ts +40 -0
- package/dist/lib/okf-health.d.ts.map +1 -0
- package/dist/lib/okf-health.js +152 -0
- package/dist/lib/okf-health.js.map +1 -0
- package/dist/lib/okf-stack.d.ts +47 -0
- package/dist/lib/okf-stack.d.ts.map +1 -0
- package/dist/lib/okf-stack.js +331 -0
- package/dist/lib/okf-stack.js.map +1 -0
- package/dist/lib/okf-view.d.ts +49 -0
- package/dist/lib/okf-view.d.ts.map +1 -0
- package/dist/lib/okf-view.js +197 -0
- package/dist/lib/okf-view.js.map +1 -0
- package/dist/lib/okf.d.ts +130 -0
- package/dist/lib/okf.d.ts.map +1 -0
- package/dist/lib/okf.js +263 -0
- package/dist/lib/okf.js.map +1 -0
- package/dist/lib/onboarding.d.ts +17 -0
- package/dist/lib/onboarding.d.ts.map +1 -1
- package/dist/lib/onboarding.js +224 -207
- package/dist/lib/onboarding.js.map +1 -1
- package/dist/lib/project.d.ts +5 -0
- package/dist/lib/project.d.ts.map +1 -1
- package/dist/lib/project.js +8 -0
- package/dist/lib/project.js.map +1 -1
- package/dist/lib/projectContext.d.ts +201 -0
- package/dist/lib/projectContext.d.ts.map +1 -0
- package/dist/lib/projectContext.js +597 -0
- package/dist/lib/projectContext.js.map +1 -0
- package/dist/lib/render.d.ts +38 -1
- package/dist/lib/render.d.ts.map +1 -1
- package/dist/lib/render.js +83 -18
- package/dist/lib/render.js.map +1 -1
- package/dist/lib/skill-catalog.d.ts.map +1 -1
- package/dist/lib/skill-catalog.js +22 -2
- package/dist/lib/skill-catalog.js.map +1 -1
- package/dist/lib/skills.d.ts +20 -5
- package/dist/lib/skills.d.ts.map +1 -1
- package/dist/lib/skills.js +116 -58
- package/dist/lib/skills.js.map +1 -1
- package/dist/lib/stackEval.d.ts +87 -0
- package/dist/lib/stackEval.d.ts.map +1 -0
- package/dist/lib/stackEval.js +233 -0
- package/dist/lib/stackEval.js.map +1 -0
- package/dist/lib/stackImprove.d.ts +49 -0
- package/dist/lib/stackImprove.d.ts.map +1 -0
- package/dist/lib/stackImprove.js +313 -0
- package/dist/lib/stackImprove.js.map +1 -0
- package/dist/lib/stackInstall.d.ts +59 -0
- package/dist/lib/stackInstall.d.ts.map +1 -0
- package/dist/lib/stackInstall.js +162 -0
- package/dist/lib/stackInstall.js.map +1 -0
- package/dist/lib/stackSafety.d.ts +126 -0
- package/dist/lib/stackSafety.d.ts.map +1 -0
- package/dist/lib/stackSafety.js +486 -0
- package/dist/lib/stackSafety.js.map +1 -0
- package/dist/lib/stackUpdate.d.ts +44 -0
- package/dist/lib/stackUpdate.d.ts.map +1 -0
- package/dist/lib/stackUpdate.js +256 -0
- package/dist/lib/stackUpdate.js.map +1 -0
- package/dist/lib/stream.d.ts +116 -0
- package/dist/lib/stream.d.ts.map +1 -0
- package/dist/lib/stream.js +368 -0
- package/dist/lib/stream.js.map +1 -0
- package/dist/lib/youstack.d.ts +219 -0
- package/dist/lib/youstack.d.ts.map +1 -0
- package/dist/lib/youstack.js +1049 -0
- package/dist/lib/youstack.js.map +1 -0
- package/dist/mcp/registry.d.ts +133 -0
- package/dist/mcp/registry.d.ts.map +1 -0
- package/dist/mcp/registry.js +833 -0
- package/dist/mcp/registry.js.map +1 -0
- package/dist/mcp/server.d.ts +106 -5
- package/dist/mcp/server.d.ts.map +1 -1
- package/dist/mcp/server.js +851 -498
- package/dist/mcp/server.js.map +1 -1
- package/dist/postinstall.js +11 -2
- package/dist/postinstall.js.map +1 -1
- package/dist/you.d.ts +1 -0
- package/dist/you.js +40 -4
- package/dist/you.js.map +1 -1
- package/examples/youstack-bamfstack-public/docs/quickstart.md +34 -0
- package/examples/youstack-bamfstack-public/prompts/creator-draft-starter.md +15 -0
- package/examples/youstack-bamfstack-public/skills/bamfstack-start/SKILL.md +36 -0
- package/examples/youstack-bamfstack-public/tests/smoke.md +19 -0
- package/examples/youstack-bamfstack-public/workflows/creator-growth-workflow.md +22 -0
- package/examples/youstack-bamfstack-public/youstack.json +172 -0
- package/examples/youstack-personal/docs/quickstart.md +10 -0
- package/examples/youstack-personal/skills/youstack-start/SKILL.md +9 -0
- package/examples/youstack-personal/tests/smoke.md +9 -0
- package/examples/youstack-personal/workflows/startup.md +7 -0
- package/examples/youstack-personal/youstack.json +123 -0
- package/package.json +3 -3
- package/skills/claude-md-generator.md +1 -1
- package/skills/meta-improve.md +8 -3
- package/skills/proactive-context-fill.md +1 -1
- package/skills/youstack-maintainer.md +128 -0
- package/skills/youstack-start.md +78 -0
|
@@ -0,0 +1,486 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* stackSafety.ts — machine-checkable T0-T3 safety contract for YouStack manifests.
|
|
4
|
+
*
|
|
5
|
+
* SELF-IMPROVING-SYSTEM-DESIGN.md §4 defines the four tiers:
|
|
6
|
+
* T0 read-only suggestions (diagnostics, inspect, brief)
|
|
7
|
+
* T1 additive writes to local scratch, always logged
|
|
8
|
+
* T2 modify skills/stacks/identity sections — propose-only unless mode grants more
|
|
9
|
+
* T3 visibility widening, publishing, remote push, deletions, irreversible ops
|
|
10
|
+
*
|
|
11
|
+
* Mode semantics (enforced, not advisory):
|
|
12
|
+
* observe → read-only; smoke/guard FAIL (not warn) if write_local capability exists
|
|
13
|
+
* propose → writes only to proposals/ directory
|
|
14
|
+
* auto_pr → branch + PR, never main; requires humanGate.required === true
|
|
15
|
+
* auto_apply_local→ requires improvement.evals non-empty AND evals green
|
|
16
|
+
*/
|
|
17
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
18
|
+
exports.parseSafetyContract = parseSafetyContract;
|
|
19
|
+
exports.validateSafetyContract = validateSafetyContract;
|
|
20
|
+
exports.tierAllows = tierAllows;
|
|
21
|
+
exports.inferCapabilitiesFromManifest = inferCapabilitiesFromManifest;
|
|
22
|
+
exports.runStackGuard = runStackGuard;
|
|
23
|
+
exports.checkModeConsistency = checkModeConsistency;
|
|
24
|
+
exports.tierRefusalMessage = tierRefusalMessage;
|
|
25
|
+
// ---------------------------------------------------------------------------
|
|
26
|
+
// Tier rules (table from SELF-IMPROVING-SYSTEM-DESIGN.md §4)
|
|
27
|
+
// ---------------------------------------------------------------------------
|
|
28
|
+
// Regex patterns for capability hint inference.
|
|
29
|
+
// We use word-boundary (\b) patterns to avoid false positives on common words
|
|
30
|
+
// like "profile" triggering "pr", or "screen" triggering "create".
|
|
31
|
+
/** Implies filesystem write access beyond read-only. */
|
|
32
|
+
const FS_WRITE_RE = /\b(write|write_local|create|edit|save|update|generate|output|auto_apply|auto-apply|modify|patch)\b/i;
|
|
33
|
+
/** Implies shell/subprocess execution. */
|
|
34
|
+
const SHELL_RE = /\b(shell|exec|bash|script|subprocess)\b/i;
|
|
35
|
+
/** Implies creating a pull request or pushing to a remote branch. */
|
|
36
|
+
const AUTO_PR_RE = /\b(auto_pr|auto-pr|pull[_\s-]request|pull_request)\b/i;
|
|
37
|
+
/** Implies outbound network access (beyond read-only identity retrieval). */
|
|
38
|
+
const NETWORK_RE = /\b(network|http|fetch|api|remote|sync|upload|download|webhook)\b/i;
|
|
39
|
+
// ---------------------------------------------------------------------------
|
|
40
|
+
// Parsing
|
|
41
|
+
// ---------------------------------------------------------------------------
|
|
42
|
+
function isRecord(value) {
|
|
43
|
+
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
44
|
+
}
|
|
45
|
+
/**
|
|
46
|
+
* Parse the `safety` section from a raw manifest object.
|
|
47
|
+
* Returns null if the section is absent.
|
|
48
|
+
*/
|
|
49
|
+
function parseSafetyContract(manifest) {
|
|
50
|
+
const raw = manifest["safety"];
|
|
51
|
+
if (!raw)
|
|
52
|
+
return null;
|
|
53
|
+
if (!isRecord(raw))
|
|
54
|
+
return null;
|
|
55
|
+
const tier = raw["tier"];
|
|
56
|
+
if (typeof tier !== "string" || !["T0", "T1", "T2", "T3"].includes(tier)) {
|
|
57
|
+
return null;
|
|
58
|
+
}
|
|
59
|
+
const capabilitiesRaw = raw["capabilities"];
|
|
60
|
+
const capabilities = isRecord(capabilitiesRaw)
|
|
61
|
+
? {
|
|
62
|
+
fs_write: capabilitiesRaw["fs_write"] === true,
|
|
63
|
+
network: capabilitiesRaw["network"] === true,
|
|
64
|
+
shell: capabilitiesRaw["shell"] === true,
|
|
65
|
+
auto_pr: capabilitiesRaw["auto_pr"] === true,
|
|
66
|
+
}
|
|
67
|
+
: {};
|
|
68
|
+
const gateRaw = raw["humanGate"];
|
|
69
|
+
const humanGate = isRecord(gateRaw)
|
|
70
|
+
? {
|
|
71
|
+
required: gateRaw["required"] === true,
|
|
72
|
+
scopes: Array.isArray(gateRaw["scopes"])
|
|
73
|
+
? gateRaw["scopes"].filter((s) => typeof s === "string")
|
|
74
|
+
: undefined,
|
|
75
|
+
}
|
|
76
|
+
: { required: false };
|
|
77
|
+
return {
|
|
78
|
+
tier: tier,
|
|
79
|
+
capabilities,
|
|
80
|
+
humanGate,
|
|
81
|
+
};
|
|
82
|
+
}
|
|
83
|
+
// ---------------------------------------------------------------------------
|
|
84
|
+
// Validation (tier rules)
|
|
85
|
+
// ---------------------------------------------------------------------------
|
|
86
|
+
/**
|
|
87
|
+
* Validate a safety contract against the T0-T3 tier rules.
|
|
88
|
+
*
|
|
89
|
+
* T0: no fs_write, no auto_pr, no shell.
|
|
90
|
+
* T1: no auto_pr.
|
|
91
|
+
* T2: auto_pr only if humanGate.required === true.
|
|
92
|
+
* T3: humanGate MUST list explicit scopes (non-empty).
|
|
93
|
+
*/
|
|
94
|
+
function validateSafetyContract(contract) {
|
|
95
|
+
const violations = [];
|
|
96
|
+
const warnings = [];
|
|
97
|
+
const { tier, capabilities, humanGate } = contract;
|
|
98
|
+
switch (tier) {
|
|
99
|
+
case "T0":
|
|
100
|
+
if (capabilities.fs_write) {
|
|
101
|
+
violations.push({
|
|
102
|
+
capability: "fs_write",
|
|
103
|
+
reason: "T0 stacks are read-only; fs_write is not allowed",
|
|
104
|
+
tierRule: "T0: no fs_write, no auto_pr, no shell",
|
|
105
|
+
});
|
|
106
|
+
}
|
|
107
|
+
if (capabilities.auto_pr) {
|
|
108
|
+
violations.push({
|
|
109
|
+
capability: "auto_pr",
|
|
110
|
+
reason: "T0 stacks are read-only; auto_pr is not allowed",
|
|
111
|
+
tierRule: "T0: no fs_write, no auto_pr, no shell",
|
|
112
|
+
});
|
|
113
|
+
}
|
|
114
|
+
if (capabilities.shell) {
|
|
115
|
+
violations.push({
|
|
116
|
+
capability: "shell",
|
|
117
|
+
reason: "T0 stacks are read-only; shell execution is not allowed",
|
|
118
|
+
tierRule: "T0: no fs_write, no auto_pr, no shell",
|
|
119
|
+
});
|
|
120
|
+
}
|
|
121
|
+
break;
|
|
122
|
+
case "T1":
|
|
123
|
+
if (capabilities.auto_pr) {
|
|
124
|
+
violations.push({
|
|
125
|
+
capability: "auto_pr",
|
|
126
|
+
reason: "T1 stacks may write to local scratch only; auto_pr is not allowed",
|
|
127
|
+
tierRule: "T1: no auto_pr",
|
|
128
|
+
});
|
|
129
|
+
}
|
|
130
|
+
break;
|
|
131
|
+
case "T2":
|
|
132
|
+
if (capabilities.auto_pr && humanGate.required !== true) {
|
|
133
|
+
violations.push({
|
|
134
|
+
capability: "auto_pr",
|
|
135
|
+
reason: "T2 stacks may use auto_pr only when humanGate.required is true",
|
|
136
|
+
tierRule: "T2: auto_pr only if humanGate.required === true",
|
|
137
|
+
});
|
|
138
|
+
}
|
|
139
|
+
break;
|
|
140
|
+
case "T3":
|
|
141
|
+
if (!humanGate.scopes || humanGate.scopes.length === 0) {
|
|
142
|
+
violations.push({
|
|
143
|
+
capability: "auto_pr",
|
|
144
|
+
reason: "T3 stacks must list explicit humanGate.scopes for every autonomous action",
|
|
145
|
+
tierRule: "T3: humanGate MUST list explicit scopes",
|
|
146
|
+
});
|
|
147
|
+
}
|
|
148
|
+
break;
|
|
149
|
+
}
|
|
150
|
+
if (tier !== "T3" && !humanGate.required && capabilities.auto_pr) {
|
|
151
|
+
warnings.push("auto_pr is declared without humanGate.required; ensure the mode policy enforces approval");
|
|
152
|
+
}
|
|
153
|
+
return {
|
|
154
|
+
ok: violations.length === 0,
|
|
155
|
+
violations,
|
|
156
|
+
warnings,
|
|
157
|
+
};
|
|
158
|
+
}
|
|
159
|
+
// ---------------------------------------------------------------------------
|
|
160
|
+
// tierAllows — runtime capability check
|
|
161
|
+
// ---------------------------------------------------------------------------
|
|
162
|
+
/**
|
|
163
|
+
* Returns true if the declared contract allows the given capability.
|
|
164
|
+
* Used by the guard and runtime routing hook.
|
|
165
|
+
*/
|
|
166
|
+
function tierAllows(contract, capability) {
|
|
167
|
+
const { tier, capabilities } = contract;
|
|
168
|
+
switch (capability) {
|
|
169
|
+
case "fs_write":
|
|
170
|
+
// T0: denied
|
|
171
|
+
if (tier === "T0")
|
|
172
|
+
return false;
|
|
173
|
+
return capabilities.fs_write === true;
|
|
174
|
+
case "shell":
|
|
175
|
+
// T0: denied
|
|
176
|
+
if (tier === "T0")
|
|
177
|
+
return false;
|
|
178
|
+
return capabilities.shell === true;
|
|
179
|
+
case "auto_pr":
|
|
180
|
+
// T0, T1: denied
|
|
181
|
+
if (tier === "T0" || tier === "T1")
|
|
182
|
+
return false;
|
|
183
|
+
// T2: only if humanGate.required
|
|
184
|
+
if (tier === "T2")
|
|
185
|
+
return capabilities.auto_pr === true && contract.humanGate.required === true;
|
|
186
|
+
// T3: declared + non-empty scopes
|
|
187
|
+
return (capabilities.auto_pr === true &&
|
|
188
|
+
Array.isArray(contract.humanGate.scopes) &&
|
|
189
|
+
contract.humanGate.scopes.length > 0);
|
|
190
|
+
case "network":
|
|
191
|
+
// T0 may do read-only network (e.g. fetching public identity)
|
|
192
|
+
// The design-doc says T0 is "read identity, brief, public profile" — always allowed
|
|
193
|
+
// So network is tier-gated by the declared flag
|
|
194
|
+
if (tier === "T0")
|
|
195
|
+
return capabilities.network !== false;
|
|
196
|
+
return capabilities.network !== false;
|
|
197
|
+
}
|
|
198
|
+
}
|
|
199
|
+
// ---------------------------------------------------------------------------
|
|
200
|
+
// Capability hint inference (for guard scanning)
|
|
201
|
+
// ---------------------------------------------------------------------------
|
|
202
|
+
function capabilityHints(cap) {
|
|
203
|
+
const text = [
|
|
204
|
+
cap.id,
|
|
205
|
+
cap.intent,
|
|
206
|
+
cap.workflow,
|
|
207
|
+
cap.skill,
|
|
208
|
+
cap.mcpTool,
|
|
209
|
+
cap.apiEndpoint,
|
|
210
|
+
cap.mutationPolicy,
|
|
211
|
+
...(cap.requiredScopes || []),
|
|
212
|
+
]
|
|
213
|
+
.filter(Boolean)
|
|
214
|
+
.join(" ");
|
|
215
|
+
return {
|
|
216
|
+
fs_write: FS_WRITE_RE.test(text),
|
|
217
|
+
shell: SHELL_RE.test(text),
|
|
218
|
+
auto_pr: AUTO_PR_RE.test(text),
|
|
219
|
+
network: NETWORK_RE.test(text),
|
|
220
|
+
};
|
|
221
|
+
}
|
|
222
|
+
/**
|
|
223
|
+
* Scan a manifest's declared capabilities (and improvement policy) for hints
|
|
224
|
+
* that imply specific capability flags. Returns what was inferred and which
|
|
225
|
+
* capability IDs triggered each flag.
|
|
226
|
+
*/
|
|
227
|
+
function inferCapabilitiesFromManifest(manifest) {
|
|
228
|
+
const result = {
|
|
229
|
+
fs_write: false,
|
|
230
|
+
shell: false,
|
|
231
|
+
auto_pr: false,
|
|
232
|
+
network: false,
|
|
233
|
+
sources: { fs_write: [], shell: [], auto_pr: [], network: [] },
|
|
234
|
+
};
|
|
235
|
+
for (const cap of manifest.capabilities || []) {
|
|
236
|
+
const hints = capabilityHints(cap);
|
|
237
|
+
if (hints.fs_write) {
|
|
238
|
+
result.fs_write = true;
|
|
239
|
+
result.sources.fs_write.push(cap.id);
|
|
240
|
+
}
|
|
241
|
+
if (hints.shell) {
|
|
242
|
+
result.shell = true;
|
|
243
|
+
result.sources.shell.push(cap.id);
|
|
244
|
+
}
|
|
245
|
+
if (hints.auto_pr) {
|
|
246
|
+
result.auto_pr = true;
|
|
247
|
+
result.sources.auto_pr.push(cap.id);
|
|
248
|
+
}
|
|
249
|
+
if (hints.network) {
|
|
250
|
+
result.network = true;
|
|
251
|
+
result.sources.network.push(cap.id);
|
|
252
|
+
}
|
|
253
|
+
}
|
|
254
|
+
// Also check improvement.mode
|
|
255
|
+
const mode = manifest.improvement?.mode;
|
|
256
|
+
if (mode === "auto_pr" || mode === "auto_apply_local") {
|
|
257
|
+
result.auto_pr = true;
|
|
258
|
+
if (!result.sources.auto_pr.includes("improvement.mode")) {
|
|
259
|
+
result.sources.auto_pr.push("improvement.mode");
|
|
260
|
+
}
|
|
261
|
+
}
|
|
262
|
+
if (mode === "auto_apply_local" || mode === "auto_pr") {
|
|
263
|
+
result.fs_write = true;
|
|
264
|
+
if (!result.sources.fs_write.includes("improvement.mode")) {
|
|
265
|
+
result.sources.fs_write.push("improvement.mode");
|
|
266
|
+
}
|
|
267
|
+
}
|
|
268
|
+
// Check evals array for auto_pr references
|
|
269
|
+
for (const evalEntry of manifest.improvement?.evals || []) {
|
|
270
|
+
if (AUTO_PR_RE.test(evalEntry)) {
|
|
271
|
+
result.auto_pr = true;
|
|
272
|
+
if (!result.sources.auto_pr.includes(`evals: ${evalEntry}`)) {
|
|
273
|
+
result.sources.auto_pr.push(`evals: ${evalEntry}`);
|
|
274
|
+
}
|
|
275
|
+
}
|
|
276
|
+
}
|
|
277
|
+
return result;
|
|
278
|
+
}
|
|
279
|
+
/**
|
|
280
|
+
* Run the full guard check against a loaded manifest.
|
|
281
|
+
* Called from the `youmd stack guard` subcommand and from runYouStackDoctor.
|
|
282
|
+
*/
|
|
283
|
+
function runStackGuard(manifest, manifestPath) {
|
|
284
|
+
const rawContract = parseSafetyContract(manifest);
|
|
285
|
+
const warnings = [];
|
|
286
|
+
const checks = [];
|
|
287
|
+
// Missing contract → treat as T0 with a warning
|
|
288
|
+
if (!rawContract) {
|
|
289
|
+
warnings.push("no safety contract declared; treating stack as T0 (read-only). " +
|
|
290
|
+
"Add a `safety` section to youstack.json to declare capabilities explicitly.");
|
|
291
|
+
const impliedContract = {
|
|
292
|
+
tier: "T0",
|
|
293
|
+
capabilities: {},
|
|
294
|
+
humanGate: { required: false },
|
|
295
|
+
};
|
|
296
|
+
const inferred = inferCapabilitiesFromManifest(manifest);
|
|
297
|
+
const caps = ["fs_write", "shell", "auto_pr", "network"];
|
|
298
|
+
for (const cap of caps) {
|
|
299
|
+
const allowed = tierAllows(impliedContract, cap);
|
|
300
|
+
const inf = inferred[cap];
|
|
301
|
+
const inferredFrom = inferred.sources[cap];
|
|
302
|
+
if (inf && !allowed) {
|
|
303
|
+
checks.push({
|
|
304
|
+
capability: cap,
|
|
305
|
+
status: "VIOLATION",
|
|
306
|
+
declared: false,
|
|
307
|
+
inferred: true,
|
|
308
|
+
inferredFrom,
|
|
309
|
+
tierRule: "T0: no fs_write, no auto_pr, no shell",
|
|
310
|
+
message: `inferred ${cap} (from: ${inferredFrom.join(", ")}) but T0 contract disallows it`,
|
|
311
|
+
});
|
|
312
|
+
}
|
|
313
|
+
else {
|
|
314
|
+
checks.push({
|
|
315
|
+
capability: cap,
|
|
316
|
+
status: "PASS",
|
|
317
|
+
declared: false,
|
|
318
|
+
inferred: inf,
|
|
319
|
+
inferredFrom,
|
|
320
|
+
tierRule: allowed ? "allowed by T0" : "not applicable (not inferred)",
|
|
321
|
+
message: inf ? `inferred ${cap} — T0 permits this capability` : `${cap} not inferred`,
|
|
322
|
+
});
|
|
323
|
+
}
|
|
324
|
+
}
|
|
325
|
+
const ok = checks.every((c) => c.status === "PASS");
|
|
326
|
+
return { ok, tier: "T0", manifestPath, checks, contractViolations: [], warnings };
|
|
327
|
+
}
|
|
328
|
+
// Validate the contract itself
|
|
329
|
+
const contractResult = validateSafetyContract(rawContract);
|
|
330
|
+
const inferred = inferCapabilitiesFromManifest(manifest);
|
|
331
|
+
const caps = ["fs_write", "shell", "auto_pr", "network"];
|
|
332
|
+
for (const cap of caps) {
|
|
333
|
+
const allowed = tierAllows(rawContract, cap);
|
|
334
|
+
const declared = rawContract.capabilities[cap] === true;
|
|
335
|
+
const inf = inferred[cap];
|
|
336
|
+
const inferredFrom = inferred.sources[cap];
|
|
337
|
+
// Check: inferred capability exceeds declared tier
|
|
338
|
+
if (inf && !allowed && !declared) {
|
|
339
|
+
checks.push({
|
|
340
|
+
capability: cap,
|
|
341
|
+
status: "VIOLATION",
|
|
342
|
+
declared,
|
|
343
|
+
inferred: inf,
|
|
344
|
+
inferredFrom,
|
|
345
|
+
tierRule: getTierRule(rawContract.tier, cap),
|
|
346
|
+
message: `inferred ${cap} (from: ${inferredFrom.join(", ")}) but ${rawContract.tier} contract does not permit it`,
|
|
347
|
+
});
|
|
348
|
+
}
|
|
349
|
+
else if (declared && !allowed) {
|
|
350
|
+
// Declared but tier doesn't permit
|
|
351
|
+
checks.push({
|
|
352
|
+
capability: cap,
|
|
353
|
+
status: "VIOLATION",
|
|
354
|
+
declared,
|
|
355
|
+
inferred: inf,
|
|
356
|
+
inferredFrom,
|
|
357
|
+
tierRule: getTierRule(rawContract.tier, cap),
|
|
358
|
+
message: `${cap} declared but ${rawContract.tier} tier rule prohibits it`,
|
|
359
|
+
});
|
|
360
|
+
}
|
|
361
|
+
else {
|
|
362
|
+
checks.push({
|
|
363
|
+
capability: cap,
|
|
364
|
+
status: "PASS",
|
|
365
|
+
declared,
|
|
366
|
+
inferred: inf,
|
|
367
|
+
inferredFrom,
|
|
368
|
+
tierRule: allowed ? `${rawContract.tier}: ${cap} allowed` : `${rawContract.tier}: ${cap} not applicable`,
|
|
369
|
+
message: declared
|
|
370
|
+
? `${cap} declared and allowed under ${rawContract.tier}`
|
|
371
|
+
: inf
|
|
372
|
+
? `${cap} inferred and allowed under ${rawContract.tier}`
|
|
373
|
+
: `${cap} not declared or inferred`,
|
|
374
|
+
});
|
|
375
|
+
}
|
|
376
|
+
}
|
|
377
|
+
warnings.push(...contractResult.warnings);
|
|
378
|
+
const ok = contractResult.ok && checks.every((c) => c.status === "PASS");
|
|
379
|
+
return {
|
|
380
|
+
ok,
|
|
381
|
+
tier: rawContract.tier,
|
|
382
|
+
manifestPath,
|
|
383
|
+
checks,
|
|
384
|
+
contractViolations: contractResult.violations,
|
|
385
|
+
warnings,
|
|
386
|
+
};
|
|
387
|
+
}
|
|
388
|
+
function getTierRule(tier, cap) {
|
|
389
|
+
const rules = {
|
|
390
|
+
T0: {
|
|
391
|
+
fs_write: "T0: no fs_write, no auto_pr, no shell",
|
|
392
|
+
shell: "T0: no fs_write, no auto_pr, no shell",
|
|
393
|
+
auto_pr: "T0: no fs_write, no auto_pr, no shell",
|
|
394
|
+
network: "T0: network allowed for read-only identity retrieval",
|
|
395
|
+
},
|
|
396
|
+
T1: {
|
|
397
|
+
fs_write: "T1: fs_write allowed to scratch only, always logged",
|
|
398
|
+
shell: "T1: shell allowed if declared",
|
|
399
|
+
auto_pr: "T1: no auto_pr",
|
|
400
|
+
network: "T1: network allowed if declared",
|
|
401
|
+
},
|
|
402
|
+
T2: {
|
|
403
|
+
fs_write: "T2: fs_write allowed",
|
|
404
|
+
shell: "T2: shell allowed if declared",
|
|
405
|
+
auto_pr: "T2: auto_pr only if humanGate.required === true",
|
|
406
|
+
network: "T2: network allowed if declared",
|
|
407
|
+
},
|
|
408
|
+
T3: {
|
|
409
|
+
fs_write: "T3: all declared capabilities allowed with explicit humanGate.scopes",
|
|
410
|
+
shell: "T3: all declared capabilities allowed with explicit humanGate.scopes",
|
|
411
|
+
auto_pr: "T3: all declared capabilities allowed with explicit humanGate.scopes",
|
|
412
|
+
network: "T3: all declared capabilities allowed with explicit humanGate.scopes",
|
|
413
|
+
},
|
|
414
|
+
};
|
|
415
|
+
return rules[tier][cap];
|
|
416
|
+
}
|
|
417
|
+
/**
|
|
418
|
+
* Mode-compatibility check: verifies the improvement.mode is consistent
|
|
419
|
+
* with the declared safety tier.
|
|
420
|
+
*
|
|
421
|
+
* `observe` → T0 or T1 only; smoke/guard FAIL if a write_local capability exists
|
|
422
|
+
* `propose` → T1 or T2; writes to proposals/ only
|
|
423
|
+
* `auto_pr` → T2 or T3; requires humanGate.required
|
|
424
|
+
* `auto_apply_local` → T2 or T3; requires non-empty evals
|
|
425
|
+
*/
|
|
426
|
+
function checkModeConsistency(manifest, contract) {
|
|
427
|
+
const mode = manifest.improvement?.mode;
|
|
428
|
+
const violations = [];
|
|
429
|
+
if (!mode)
|
|
430
|
+
return { ok: true, violations };
|
|
431
|
+
switch (mode) {
|
|
432
|
+
case "observe":
|
|
433
|
+
// Under observe, write_local capability → FAIL (not warn)
|
|
434
|
+
if (contract.capabilities.fs_write || contract.capabilities.shell) {
|
|
435
|
+
violations.push("improvement.mode is 'observe' but safety.capabilities declares fs_write or shell; " +
|
|
436
|
+
"smoke and guard FAIL (not warn) under observe mode");
|
|
437
|
+
}
|
|
438
|
+
break;
|
|
439
|
+
case "propose":
|
|
440
|
+
if (contract.tier === "T0") {
|
|
441
|
+
violations.push("improvement.mode 'propose' requires at least T1 tier (T0 is read-only)");
|
|
442
|
+
}
|
|
443
|
+
break;
|
|
444
|
+
case "auto_pr":
|
|
445
|
+
if (contract.tier === "T0" || contract.tier === "T1") {
|
|
446
|
+
violations.push(`improvement.mode 'auto_pr' requires T2 or T3 tier; current tier is ${contract.tier}`);
|
|
447
|
+
}
|
|
448
|
+
if (!contract.humanGate.required) {
|
|
449
|
+
violations.push("improvement.mode 'auto_pr' requires humanGate.required to be true");
|
|
450
|
+
}
|
|
451
|
+
break;
|
|
452
|
+
case "auto_apply_local": {
|
|
453
|
+
if (contract.tier === "T0" || contract.tier === "T1") {
|
|
454
|
+
violations.push(`improvement.mode 'auto_apply_local' requires T2 or T3 tier; current tier is ${contract.tier}`);
|
|
455
|
+
}
|
|
456
|
+
const evals = manifest.improvement?.evals || [];
|
|
457
|
+
if (evals.length === 0) {
|
|
458
|
+
violations.push("improvement.mode 'auto_apply_local' requires improvement.evals to be non-empty");
|
|
459
|
+
}
|
|
460
|
+
break;
|
|
461
|
+
}
|
|
462
|
+
}
|
|
463
|
+
return { ok: violations.length === 0, violations };
|
|
464
|
+
}
|
|
465
|
+
/**
|
|
466
|
+
* Refusal message for runtime enforcement — the one-line message the routing
|
|
467
|
+
* hook emits when a request exceeds the declared tier.
|
|
468
|
+
*/
|
|
469
|
+
function tierRefusalMessage(contract, requestedCapability) {
|
|
470
|
+
const requiredTier = requiredTierForCapability(requestedCapability);
|
|
471
|
+
return (`blocked: stack is ${contract.tier} — this action needs ${requiredTier}. ` +
|
|
472
|
+
`Declare a higher tier in youstack.json safety.tier and rerun \`youmd stack guard\`.`);
|
|
473
|
+
}
|
|
474
|
+
function requiredTierForCapability(cap) {
|
|
475
|
+
switch (cap) {
|
|
476
|
+
case "fs_write":
|
|
477
|
+
return "T1 or higher";
|
|
478
|
+
case "shell":
|
|
479
|
+
return "T1 or higher";
|
|
480
|
+
case "auto_pr":
|
|
481
|
+
return "T2 or higher with humanGate.required=true";
|
|
482
|
+
case "network":
|
|
483
|
+
return "T1 or higher";
|
|
484
|
+
}
|
|
485
|
+
}
|
|
486
|
+
//# sourceMappingURL=stackSafety.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"stackSafety.js","sourceRoot":"","sources":["../../src/lib/stackSafety.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAkFH,kDAqCC;AAcD,wDA4EC;AAUD,gCAoCC;AAmDD,sEAyDC;AA6BD,sCAkHC;AAyCD,oDA0DC;AAMD,gDASC;AA7jBD,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,gDAAgD;AAChD,8EAA8E;AAC9E,mEAAmE;AAEnE,wDAAwD;AACxD,MAAM,WAAW,GACf,qGAAqG,CAAC;AAExG,0CAA0C;AAC1C,MAAM,QAAQ,GAAG,0CAA0C,CAAC;AAE5D,qEAAqE;AACrE,MAAM,UAAU,GACd,uDAAuD,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,UAAU,GACd,mEAAmE,CAAC;AAEtE,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,QAAoD;IAEpD,MAAM,GAAG,GAAI,QAAoC,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAuB,QAAQ,CAAC,eAAe,CAAC;QAChE,CAAC,CAAC;YACE,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,KAAK,IAAI;YAC9C,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,KAAK,IAAI;YAC5C,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,IAAI;YACxC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,KAAK,IAAI;SAC7C;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,SAAS,GAAoB,QAAQ,CAAC,OAAO,CAAC;QAClD,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;YACtC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtC,CAAC,CAAE,OAAO,CAAC,QAAQ,CAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACtE,CAAC,CAAC,SAAS;SACd;QACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAExB,OAAO;QACL,IAAI,EAAE,IAAkB;QACxB,YAAY;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CACpC,QAA6B;IAE7B,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IAEnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI;YACP,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,UAAU;oBACtB,MAAM,EAAE,kDAAkD;oBAC1D,QAAQ,EAAE,uCAAuC;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,iDAAiD;oBACzD,QAAQ,EAAE,uCAAuC;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACvB,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,OAAO;oBACnB,MAAM,EAAE,yDAAyD;oBACjE,QAAQ,EAAE,uCAAuC;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QAER,KAAK,IAAI;YACP,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,mEAAmE;oBAC3E,QAAQ,EAAE,gBAAgB;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QAER,KAAK,IAAI;YACP,IAAI,YAAY,CAAC,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACxD,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,SAAS;oBACrB,MAAM,EACJ,gEAAgE;oBAClE,QAAQ,EAAE,iDAAiD;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QAER,KAAK,IAAI;YACP,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvD,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,SAAS;oBACrB,MAAM,EACJ,2EAA2E;oBAC7E,QAAQ,EAAE,yCAAyC;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,MAAM;IACV,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3B,UAAU;QACV,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;GAGG;AACH,SAAgB,UAAU,CACxB,QAA6B,EAC7B,UAA+B;IAE/B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;IAExC,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,aAAa;YACb,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAChC,OAAO,YAAY,CAAC,QAAQ,KAAK,IAAI,CAAC;QAExC,KAAK,OAAO;YACV,aAAa;YACb,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAChC,OAAO,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC;QAErC,KAAK,SAAS;YACZ,iBAAiB;YACjB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACjD,iCAAiC;YACjC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC;YAChG,kCAAkC;YAClC,OAAO,CACL,YAAY,CAAC,OAAO,KAAK,IAAI;gBAC7B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;gBACxC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CACrC,CAAC;QAEJ,KAAK,SAAS;YACZ,8DAA8D;YAC9D,oFAAoF;YACpF,gDAAgD;YAChD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC;YACzD,OAAO,YAAY,CAAC,OAAO,KAAK,KAAK,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,SAAS,eAAe,CAAC,GAAuB;IAM9C,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,EAAE;QACN,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,KAAK;QACT,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;KAC9B;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,OAAO;QACL,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,SAAgB,6BAA6B,CAC3C,QAA0B;IAE1B,MAAM,MAAM,GAAyB;QACnC,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;KAC/D,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;YACtB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACtD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAyBD;;;GAGG;AACH,SAAgB,aAAa,CAC3B,QAA0B,EAC1B,YAAoB;IAEpB,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,gDAAgD;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CACX,iEAAiE;YAC/D,6EAA6E,CAChF,CAAC;QACF,MAAM,eAAe,GAAwB;YAC3C,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC/B,CAAC;QACF,MAAM,QAAQ,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,IAAI,GAA0B,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAChF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,GAAG;oBACf,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI;oBACd,YAAY;oBACZ,QAAQ,EAAE,uCAAuC;oBACjD,OAAO,EAAE,YAAY,GAAG,WAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;iBAC3F,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,GAAG;oBACf,MAAM,EAAE,MAAM;oBACd,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,GAAG;oBACb,YAAY;oBACZ,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,+BAA+B;oBACrE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,+BAA+B,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpF,CAAC;IAED,+BAA+B;IAC/B,MAAM,cAAc,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,IAAI,GAA0B,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;QACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE3C,mDAAmD;QACnD,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,WAAW;gBACnB,QAAQ;gBACR,QAAQ,EAAE,GAAG;gBACb,YAAY;gBACZ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC;gBAC5C,OAAO,EAAE,YAAY,GAAG,WAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,8BAA8B;aAClH,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,mCAAmC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,WAAW;gBACnB,QAAQ;gBACR,QAAQ,EAAE,GAAG;gBACb,YAAY;gBACZ,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC;gBAC5C,OAAO,EAAE,GAAG,GAAG,iBAAiB,WAAW,CAAC,IAAI,yBAAyB;aAC1E,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,MAAM;gBACd,QAAQ;gBACR,QAAQ,EAAE,GAAG;gBACb,YAAY;gBACZ,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,KAAK,GAAG,iBAAiB;gBACxG,OAAO,EAAE,QAAQ;oBACf,CAAC,CAAC,GAAG,GAAG,+BAA+B,WAAW,CAAC,IAAI,EAAE;oBACzD,CAAC,CAAC,GAAG;wBACL,CAAC,CAAC,GAAG,GAAG,+BAA+B,WAAW,CAAC,IAAI,EAAE;wBACzD,CAAC,CAAC,GAAG,GAAG,2BAA2B;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE1C,MAAM,EAAE,GACN,cAAc,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAEhE,OAAO;QACL,EAAE;QACF,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,YAAY;QACZ,MAAM;QACN,kBAAkB,EAAE,cAAc,CAAC,UAAU;QAC7C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB,EAAE,GAAwB;IAC7D,MAAM,KAAK,GAA4D;QACrE,EAAE,EAAE;YACF,QAAQ,EAAE,uCAAuC;YACjD,KAAK,EAAE,uCAAuC;YAC9C,OAAO,EAAE,uCAAuC;YAChD,OAAO,EAAE,sDAAsD;SAChE;QACD,EAAE,EAAE;YACF,QAAQ,EAAE,qDAAqD;YAC/D,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,iCAAiC;SAC3C;QACD,EAAE,EAAE;YACF,QAAQ,EAAE,sBAAsB;YAChC,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,iDAAiD;YAC1D,OAAO,EAAE,iCAAiC;SAC3C;QACD,EAAE,EAAE;YACF,QAAQ,EAAE,sEAAsE;YAChF,KAAK,EAAE,sEAAsE;YAC7E,OAAO,EAAE,sEAAsE;YAC/E,OAAO,EAAE,sEAAsE;SAChF;KACF,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,QAA0B,EAC1B,QAA6B;IAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAE3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,0DAA0D;YAC1D,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBAClE,UAAU,CAAC,IAAI,CACb,oFAAoF;oBAClF,oDAAoD,CACvD,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,SAAS;YACZ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CACb,wEAAwE,CACzE,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,SAAS;YACZ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrD,UAAU,CAAC,IAAI,CACb,sEAAsE,QAAQ,CAAC,IAAI,EAAE,CACtF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrD,UAAU,CAAC,IAAI,CACb,+EAA+E,QAAQ,CAAC,IAAI,EAAE,CAC/F,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,IAAI,CACb,gFAAgF,CACjF,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,QAA6B,EAC7B,mBAAwC;IAExC,MAAM,YAAY,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,CACL,qBAAqB,QAAQ,CAAC,IAAI,wBAAwB,YAAY,IAAI;QAC1E,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAwB;IACzD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,cAAc,CAAC;QACxB,KAAK,OAAO;YACV,OAAO,cAAc,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,2CAA2C,CAAC;QACrD,KAAK,SAAS;YACZ,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* L17 — stack update channel.
|
|
3
|
+
*
|
|
4
|
+
* Checks the upstream registry for a newer version of a YouStack manifest.
|
|
5
|
+
* Falls back to the manifest's `update.source` field if no registry endpoint
|
|
6
|
+
* exists, querying the `repo` field in `owner` with `git ls-remote`.
|
|
7
|
+
*
|
|
8
|
+
* Contract:
|
|
9
|
+
* - checkStackUpdate(loaded) → StackUpdateInfo
|
|
10
|
+
* - applyStackUpdate(loaded, info) → void (writes new files, does NOT commit)
|
|
11
|
+
*/
|
|
12
|
+
import type { LoadedYouStack } from "./youstack";
|
|
13
|
+
export interface StackUpdateInfo {
|
|
14
|
+
/** Version string declared in the local manifest. */
|
|
15
|
+
currentVersion: string;
|
|
16
|
+
/** Version string from upstream. null when no upstream tag/manifest found. */
|
|
17
|
+
latestVersion: string | null;
|
|
18
|
+
/** Whether the upstream is ahead of local. */
|
|
19
|
+
updateAvailable: boolean;
|
|
20
|
+
/** Source used: "registry" | "git-ls-remote" | "source-url" | "none" */
|
|
21
|
+
source: "registry" | "git-ls-remote" | "source-url" | "none";
|
|
22
|
+
/** First line of upstream CHANGELOG.md, if present beside the manifest. */
|
|
23
|
+
changelogHint: string | null;
|
|
24
|
+
/** Human-readable status message (lowercase). */
|
|
25
|
+
message: string;
|
|
26
|
+
}
|
|
27
|
+
/**
|
|
28
|
+
* Check whether the upstream source (registry endpoint → manifest source URL
|
|
29
|
+
* → git ls-remote on owner.repo) has a version newer than the local manifest.
|
|
30
|
+
*/
|
|
31
|
+
export declare function checkStackUpdate(loaded: LoadedYouStack): Promise<StackUpdateInfo>;
|
|
32
|
+
export interface StackApplyResult {
|
|
33
|
+
wrote: string[];
|
|
34
|
+
skipped: string[];
|
|
35
|
+
error: string | null;
|
|
36
|
+
}
|
|
37
|
+
/**
|
|
38
|
+
* Apply an update by fetching the manifest from update.source and writing it
|
|
39
|
+
* into place. Only available when source is "source-url".
|
|
40
|
+
*
|
|
41
|
+
* Does NOT commit or push. Writes the new youstack.json at manifestPath.
|
|
42
|
+
*/
|
|
43
|
+
export declare function applyStackUpdate(loaded: LoadedYouStack): Promise<StackApplyResult>;
|
|
44
|
+
//# sourceMappingURL=stackUpdate.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"stackUpdate.d.ts","sourceRoot":"","sources":["../../src/lib/stackUpdate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,8CAA8C;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,wEAAwE;IACxE,MAAM,EAAE,UAAU,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;IAC7D,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB;AA6FD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAkC3B"}
|