worktrust 0.10.13__py3-none-win_amd64.whl

worktrust-0.10.13.dist-info/METADATA

@@ -0,0 +1,110 @@
+Metadata-Version: 2.4
+Name: worktrust
+Version: 0.10.13
+Summary: The WorkTrust CLI, using the same measurement engine as npm
+License-Expression: MIT
+Project-URL: Homepage, https://worktrust.io
+Project-URL: Source, https://github.com/fhomey/worktrust-cli
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# WorkTrust for Python tool runners
+
+This package launches the same JavaScript measurement engine shipped in the WorkTrust npm
+package. It does not implement another measurement engine or a Python instrumentation SDK.
+Python 3.10+ is required. Supported platform wheels include **Node.js 22.23.3**; no separate
+Node or npm installation is needed. The launcher uses that bundled runtime, never downloads a
+runtime when invoked, and does not silently switch to another CLI version.
+
+Wheels target macOS 11+ (Intel and Apple Silicon), Linux with glibc 2.28+ (x64 and arm64), and
+Windows 10+ (x64 and arm64). Linux also requires the Node-supported system C++ runtime
+(GLIBCXX_3.4.25 or newer). Alpine/musl, 32-bit systems and other platforms are not supported.
+A source distribution cannot fetch Node automatically: a source build requires the explicit
+maintainer preparation step below. Supported users should install the matching wheel.
+
+After publication under a verified WorkTrust-owned PyPI project, the intended commands are:
+
+```sh
+uvx worktrust preserve
+pipx run worktrust preserve
+```
+
+These public commands are not a claim that this package has already been published. Test a
+reviewed local wheel first:
+
+```sh
+uvx --from /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+pipx run --spec /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+```
+
+Use your package manager to choose and update the installed version. The package contains
+the CLI modules and Node runtime, so `preserve` itself needs no network after installation. It reads supported
+local session files and can change retention settings or create local metadata archives;
+only the person runs it. Existing WorkTrust agent safeguards and consent prompts remain.
+Other commands can contact WorkTrust. Package installation itself can contact registries.
+
+After PyPI publication, explicitly request the latest published package when needed:
+
+```sh
+uvx worktrust@latest preserve
+pipx run --no-cache worktrust preserve
+```
+
+For persistent installations, use `uv tool upgrade worktrust` or `pipx upgrade worktrust`.
+An existing cache or version constraint can otherwise keep an older release. `worktrust update`
+refreshes the computer coupling using the selected package; it does not upgrade the Python package.
+
+Runtime bundle hashes detect missing or changed files; they are not hardware attestation or
+independent proof of authenticity. Request and archive signatures retain the existing CLI's
+software-key threat model. See the npm package SECURITY.md and README.md for the data contract.
+
+## Maintainers
+
+Running `node tools/worktrust-cli/sync.mjs` from the monorepo also regenerates the Python JavaScript
+bundle and version. `node scripts/build-python-cli.mjs --check` refuses drift. The native runtime
+is a separate build artifact, excluded from Git and sdists. Explicitly prepare it before building:
+
+```sh
+python tools/worktrust-python/build_runtime.py
+python -m build --wheel tools/worktrust-python
+python -m build --sdist tools/worktrust-python
+```
+
+`build_runtime.py` downloads one official Node archive from nodejs.org at build time, verifies its
+committed SHA256 from `runtime-lock.json`, and extracts only the executable and complete LICENSE.
+It accepts `--target` for a reviewed target and `--cache` for a build cache. Platform wheel tags
+follow the selected runtime. Never label these wheels `any`. Building a wheel from the sdist
+fails closed until this explicit preparation step has been performed; no install hook downloads code.
+
+Run `python tools/worktrust-python/tests/test_runtime_build.py`, then
+`node scripts/test-python-cli.mjs` with a Python containing the build requirements (select it with
+`WORKTRUST_TEST_PYTHON`). Tests build and exercise a real wheel using its own runtime with no Node
+on PATH; they use synthetic homes and metadata only. Native execution must pass independently on
+all six claimed OS/architecture combinations before release. Cross-building alone is not that proof.
+Set `WORKTRUST_REQUIRE_TOOL_RUNNERS=1` to require actual uv and pipx wheel smoke tests, and
+`WORKTRUST_TEST_ARTIFACT_DIR` to a fresh directory to retain the exact tested wheel and sdist.
+Existing artifacts are never overwritten. Canonical module bytes match across channels;
+bit-for-bit reproducibility of whole wheel or sdist archives is not asserted.
+
+The public `fhomey/worktrust-cli` repository carries this package under `python/`, alongside the
+npm package at its root. There, install `python/requirements-release.txt`, run
+`python python/build_runtime.py`, then `python python/tests/test_distribution.py` with
+`WORKTRUST_TEST_CLI_SOURCE` set to the repository's absolute path and
+`WORKTRUST_REQUIRE_TOOL_RUNNERS=1`. The test derives Node from the built wheel; it does not require
+a system Node installation. Keep build-only workflow results distinct from successful publication.
+
+The inactive `release-pypi.yml.example` targets this public layout. Its intended active filename
+is `.github/workflows/release-pypi.yml`, using the protected `pypi` environment and PyPI Trusted
+Publishing. Once activated, the same GitHub release triggers both registries; manual execution
+supports the initial Python publication and retries. npm also requires the supported-platform Python
+artifact/parity tests before publishing. Both channels use the same version and module bytes.
+Approvals and registry failures remain separate; confirm both publications before announcing a
+release as available on both channels. Neither workflow invokes a Vercel deployment.
+
+Do not edit generated `bundle/`, `VERSION` or `LICENSE`. Publication requires confirmed
+PyPI ownership and a configured Trusted Publisher; source readiness does not grant that.
+
+Official runtime platform requirements: https://github.com/nodejs/node/blob/v22.23.3/BUILDING.md
+Pinned upstream archive checksums: https://nodejs.org/dist/v22.23.3/SHASUMS256.txt

worktrust-0.10.13.dist-info/RECORD

@@ -0,0 +1,26 @@
+worktrust-0.10.13.dist-info/licenses/LICENSE,sha256=Ki1_xmffV4aEorLyoSLIuEneaNNxa6_-34oPERYt8F0,1066
+worktrust_cli/__init__.py,sha256=BykjYnxG83EtV2oUloviRAf6PnnM4li5L9Alz0J9LOk,4109
+worktrust_cli/__main__.py,sha256=K6urUhz9vfSGXuwgaNA4kmUJf0GnO3L30gPDlScqYI0,48
+worktrust_cli/bundle/chat-exports.mjs,sha256=EcjB-fd0kW15t2i4jwdzHcx-d3GohQNoUbn5OFYYVjE,16550
+worktrust_cli/bundle/config-edits.mjs,sha256=DrovF27296-6Bx1uAN4P8ZuisoMYCoAd_ZV6o4we3ZQ,5336
+worktrust_cli/bundle/count-behaviour.mjs,sha256=IN01BZwM90GDoL-8oJYoETJOKqyFysGZ7UNwAkYd43c,108221
+worktrust_cli/bundle/log-session.mjs,sha256=LBzONGAuFfpYLw0s6rv6TBVNErIVW1BhZDXSDxMWxZU,101744
+worktrust_cli/bundle/manifest.json,sha256=Mo_Fk-zKMyAu7BGIMmoKY9dqY3hjC81DC-k2FOxZ02c,1347
+worktrust_cli/bundle/preserve-lines.mjs,sha256=eUVy9N5z9KY3FelnGZkBOhf3SUuSP4FFWgCbQGSvfjg,23827
+worktrust_cli/bundle/preserve-summary.mjs,sha256=Vo_q5_MkbAdfuhTVT1gPrJ7mpUzukYZO0CZyspiuXTc,3326
+worktrust_cli/bundle/preserve.mjs,sha256=OPg72TOFOphv72H05FLCfUo63GAA9ckgHvcPJwtATqw,31466
+worktrust_cli/bundle/runtime-install.mjs,sha256=HtIxahEU8WNYP5nFNwMnztfU6kIoFc44avSVDe6vUT4,4837
+worktrust_cli/bundle/session-databases.mjs,sha256=VD_TuC0o2W14m-Ch3JGGxfr6eD6YuH5bOxeyEVQuK00,35647
+worktrust_cli/bundle/setup-mcp.mjs,sha256=cPY7Yc8eKPsrdHHndo1ZawzxZszcnRzoWe5Y0psuyrw,32284
+worktrust_cli/bundle/stack-rules.mjs,sha256=sjxW5y7Fa6ArF-2JX4aRctmIxGiml-jWAmsOJo9h5Ik,7106
+worktrust_cli/bundle/stretch-evidence.mjs,sha256=WzGm8pt4XSd-kiV1MvPHzuNmp5dZ3sx6dc-67CaG7hM,54279
+worktrust_cli/bundle/transcript-readers.mjs,sha256=MdpJ-NaKu5TsIivVfAO2tP6-Cz_lMRUqZ1ALJCTVrIg,22282
+worktrust_cli/bundle/worktrust.mjs,sha256=sjJaFACn6z1erszrIkdlQwhZ7tRW2axOwtCQf52OUXs,91080
+worktrust_cli/runtime/LICENSE,sha256=jMm7RmsZ_H58yZ0D6d8RMgIf2osB7qJiTFi7Ny2-9XY,148217
+worktrust_cli/runtime/node.exe,sha256=nJJFFmtKjhguC3l9qcIBNhF_8kNo6v8f7INDoSPI2w4,86973768
+worktrust_cli/runtime/runtime.json,sha256=LUbXJqD0rRIQu488si9hojV_nWuABkAictwDmOqsc10,362
+worktrust-0.10.13.dist-info/METADATA,sha256=AzUyejS1ZP6cONyb8OuA1670y-USWPSNnAagPchVmRg,6403
+worktrust-0.10.13.dist-info/WHEEL,sha256=Zx98gwb_dQKckJK3HEOVKnxxD52EfU_PXDG_usMJ2ng,98
+worktrust-0.10.13.dist-info/entry_points.txt,sha256=bVqGAPH_xUP_nIQQmT3ekm324-cLyzqCykjYdI98Dc4,49
+worktrust-0.10.13.dist-info/top_level.txt,sha256=F8SowabDAnIBJZ3OUoVKO0BKeEzsewR7GLlsQfklnsc,14
+worktrust-0.10.13.dist-info/RECORD,,

worktrust-0.10.13.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: false
+Tag: py3-none-win_amd64
+

worktrust-0.10.13.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+worktrust = worktrust_cli:main

worktrust-0.10.13.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WorkTrust
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

worktrust-0.10.13.dist-info/top_level.txt

@@ -0,0 +1 @@
+worktrust_cli

worktrust_cli/__init__.py

@@ -0,0 +1,88 @@
+"""Distribution launcher only. All evidence calculation remains in the Node CLI."""
+import hashlib
+import json
+import os
+import platform
+from pathlib import Path
+import re
+import subprocess
+import sys
+
+
+def verified_entry():
+    root = Path(__file__).resolve().parent / "bundle"
+    manifest_path = root / "manifest.json"
+    if manifest_path.is_symlink():
+        raise ValueError("bundle manifest must not be a symlink")
+    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    if set(manifest) != {"version", "files"} or not re.fullmatch(r"\d+\.\d+\.\d+", manifest["version"]):
+        raise ValueError("invalid bundle manifest")
+    files = manifest["files"]
+    if not isinstance(files, dict) or "worktrust.mjs" not in files:
+        raise ValueError("invalid bundle file list")
+    if set(p.name for p in root.iterdir()) != set(files) | {"manifest.json"}:
+        raise ValueError("bundle file list mismatch")
+    for name, digest in files.items():
+        if not re.fullmatch(r"[a-z][a-z0-9-]*\.mjs", name) or not re.fullmatch(r"[a-f0-9]{64}", digest):
+            raise ValueError("invalid bundle file identity")
+        path = root / name
+        if path.is_symlink() or not path.is_file() or hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+            raise ValueError("bundle integrity check failed")
+    return root / "worktrust.mjs"
+
+
+def verified_runtime():
+    root = Path(__file__).resolve().parent / "runtime"
+    descriptor = root / "runtime.json"
+    if root.is_symlink() or descriptor.is_symlink():
+        raise ValueError("bundled runtime must not use symlinks")
+    metadata = json.loads(descriptor.read_text(encoding="utf-8"))
+    if set(metadata) != {"version","platform","executable","archive_sha256","files"}:
+        raise ValueError("invalid bundled runtime descriptor")
+    system = {"Darwin":"darwin","Linux":"linux","Windows":"win"}.get(platform.system())
+    arch = {"x86_64":"x64","amd64":"x64","aarch64":"arm64","arm64":"arm64"}.get(platform.machine().lower())
+    if metadata["platform"] != f"{system}-{arch}":
+        raise ValueError("bundled runtime does not support this OS/architecture")
+    executable = "node.exe" if os.name == "nt" else "node"
+    if metadata["executable"] != executable or set(metadata["files"]) != {executable,"LICENSE"}:
+        raise ValueError("invalid bundled runtime file list")
+    if not re.fullmatch(r"\d+\.\d+\.\d+", metadata["version"]) or not re.fullmatch(r"[a-f0-9]{64}", metadata["archive_sha256"]):
+        raise ValueError("invalid bundled runtime identity")
+    if {path.name for path in root.iterdir()} != {executable,"LICENSE","runtime.json"}:
+        raise ValueError("bundled runtime file list mismatch")
+    for name,digest in metadata["files"].items():
+        path = root/name
+        if path.is_symlink() or not path.is_file() or not re.fullmatch(r"[a-f0-9]{64}",digest) or hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+            raise ValueError("bundled runtime integrity check failed")
+    return root/executable
+
+
+def main():
+    try:
+        entry = verified_entry()
+        node = verified_runtime()
+        env = dict(os.environ)
+        # Package-manager selection is authoritative. This does not disable agent detection.
+        env["WORKTRUST_RELAYED"] = "1"
+        env["WORKTRUST_BUNDLED_RUNTIME_DIR"] = str(node.parent)
+        argv = [str(node), str(entry), *sys.argv[1:]]
+        if os.name != "nt":
+            os.execve(node, argv, env)
+        child = subprocess.Popen(argv, env=env)
+        try:
+            return child.wait()
+        except KeyboardInterrupt:
+            # Windows delivers console Ctrl-C to both processes; allow the child to finish.
+            try:
+                return child.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                child.terminate()
+                child.wait()
+                return 130
+    except (OSError, ValueError, TypeError, KeyError, subprocess.SubprocessError) as error:
+        print(f"worktrust: {error}", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

worktrust_cli/__main__.py

@@ -0,0 +1,4 @@
+import sys
+from . import main
+
+sys.exit(main())

worktrust_cli/bundle/chat-exports.mjs

@@ -0,0 +1,240 @@
+/**
+ * A WEB CHAT'S DATA EXPORT, READ ONCE FOR TWO READERS (CLI 0.10.10, owner 2026-10-10). ChatGPT (Settings → Data
+ * controls → Export data) and Claude on the web (Settings → Privacy → Export data) each hand a person a zip with a
+ * `conversations.json` in it. The counter reads it for signals; the session hook reads it as HISTORY, so a person's
+ * years of browser chats appear on their record. One reader here, imported by both, so the two cannot drift.
+ *
+ * WHAT IT NEVER DOES. It opens nothing of the zip but `conversations.json` (a vendor's export carries the account's
+ * profile, memories and files beside it: those are never inflated). It hands the text to the counter's rubric on this
+ * computer, as it always did, and to the hook it hands clocks, roles and a model name only: the conversation's title
+ * and every message stay here. Hours from an export are RECONSTRUCTED, never measured: the file can be edited before
+ * it is read and no device key witnessed it, so the record shows them with their origin and never in verified hours.
+ *
+ *   readExport(path)          { vendor, conversations, digest }   a folder holding conversations.json, the file, or the zip
+ *   exportSessions(path, …)   one session per conversation, in the transcript's own shape (type, timestamp, message)
+ *   exportRef(vendor, id, day) the stretch's stable name: the same on any computer, so a second send is the same line
+ *   findExports(dir)          the exports lying in one folder (its top level only), by path and vendor
+ */
+import { createHash } from "node:crypto";
+import { existsSync, openSync, readSync, closeSync, fstatSync, readdirSync, statSync, constants } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+import { inflateRawSync } from "node:zlib";
+
+/** The two vendors, by the client name the door reads as their product (chatgpt → chatgpt_web, claude-web → claude_web). */
+export const EXPORT_CLIENTS = ["chatgpt", "claude-web"];
+/** The neutral line each vendor's conversation is filed under: never the conversation's own title. */
+export const EXPORT_TITLES = { chatgpt: "A conversation in ChatGPT", "claude-web": "A conversation in Claude on the web" };
+const PRODUCT_NAMES = { chatgpt: "ChatGPT", "claude-web": "Claude on the web" };
+export const exportProductName = (vendor) => PRODUCT_NAMES[vendor] ?? vendor;
+const FILE = "conversations.json";
+const expand = (path) => String(path).replace(/^~(?=\/|$)/, homedir());
+
+// Bound allocations and parsing work before touching untrusted sizes. Large attachment-bearing ZIPs
+// need not fit in memory; only the directory and conversations entry are ever read. No limit override.
+export const EXPORT_LIMITS = Object.freeze({ fileBytes: 2 * 1024 ** 3, directoryBytes: 8 * 1024 ** 2,
+  jsonBytes: 64 * 1024 ** 2, compressedBytes: 64 * 1024 ** 2, depth: 64, structure: 1_000_000, conversations: 50_000 });
+const limit = (condition, label) => { if (!condition) throw Error(`export limit exceeded: ${label}`); };
+const damaged = (condition) => { if (!condition) throw Error("a damaged zip archive"); };
+/** One descriptor, bounded reads: reject special files/short reads and bound concurrent file growth. */
+function openExport(path, maximum) {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile()) throw Error("export must be a regular file");
+    limit(stat.size <= maximum, "file bytes");
+    const readAt = (at, length, end = stat.size) => {
+      damaged(Number.isSafeInteger(at) && Number.isSafeInteger(length) && at >= 0 && length >= 0 && at + length <= end && end <= stat.size);
+      const buffer = Buffer.alloc(length);
+      let got = 0;
+      while (got < length) { const count = readSync(fd, buffer, got, length - got, at + got); damaged(count > 0); got += count; }
+      return buffer;
+    };
+    return { fd, size: stat.size, readAt };
+  } catch (error) { closeSync(fd); throw error; }
+}
+
+/**
+ * A ZIP, READ FOR ONE ENTRY. No dependency: the end-of-central-directory record is found from the back, the central
+ * directory walked for the one name, and only that entry's bytes inflated (stored or deflated; anything else, and a
+ * zip64 archive, is refused by name). Nothing else in the archive is touched.
+ */
+function zipEntry(path, wanted) {
+  const { fd, size, readAt } = openExport(path, EXPORT_LIMITS.fileBytes);
+  try {
+    const tailLength = Math.min(size, 65_557);
+    const tail = readAt(size - tailLength, tailLength);
+    let eocd = -1;
+    for (let at = tail.length - 22; at >= 0; at -= 1) if (tail.readUInt32LE(at) === 0x06054b50 && at + 22 + tail.readUInt16LE(at + 20) === tail.length) { eocd = at; break; }
+    if (eocd < 0) throw Error(`not a zip archive: ${path}`);
+    const entries = tail.readUInt16LE(eocd + 10), directorySize = tail.readUInt32LE(eocd + 12), directoryAt = tail.readUInt32LE(eocd + 16);
+    if (entries === 0xffff || directorySize === 0xffffffff || directoryAt === 0xffffffff) throw Error(`a zip64 archive is not read: ${path}`);
+    if (tail.readUInt16LE(eocd + 4) !== 0 || tail.readUInt16LE(eocd + 6) !== 0) throw Error("unsupported zip: multiple disks");
+    damaged(tail.readUInt16LE(eocd + 8) === entries);
+    limit(directorySize <= EXPORT_LIMITS.directoryBytes, "zip directory bytes");
+    damaged(directoryAt + directorySize === size - tailLength + eocd);
+    const directory = readAt(directoryAt, directorySize);
+    let at = 0, selected = null;
+    for (let index = 0; index < entries; index += 1) {
+      damaged(at + 46 <= directory.length && directory.readUInt32LE(at) === 0x02014b50);
+      const method = directory.readUInt16LE(at + 10), compressed = directory.readUInt32LE(at + 20), uncompressed = directory.readUInt32LE(at + 24);
+      const nameLength = directory.readUInt16LE(at + 28), extraLength = directory.readUInt16LE(at + 30), commentLength = directory.readUInt16LE(at + 32), localAt = directory.readUInt32LE(at + 42);
+      const flags = directory.readUInt16LE(at + 8), disk = directory.readUInt16LE(at + 34);
+      damaged(at + 46 + nameLength + extraLength + commentLength <= directory.length);
+      const name = directory.toString("utf8", at + 46, at + 46 + nameLength);
+      at += 46 + nameLength + extraLength + commentLength;
+      if (basename(name) !== wanted || name.endsWith("/")) continue;
+      if (compressed === 0xffffffff || uncompressed === 0xffffffff || localAt === 0xffffffff) throw Error(`a zip64 entry is not read: ${path}`);
+      limit(compressed <= EXPORT_LIMITS.compressedBytes, "compressed entry bytes");
+      limit(uncompressed <= EXPORT_LIMITS.jsonBytes, "expanded entry bytes");
+      if ((flags & (1 | 64)) !== 0 || disk !== 0) throw Error("unsupported zip: encrypted or multi-disk entry");
+      damaged(selected === null);
+      selected = { name, method, flags, compressed, uncompressed, localAt };
+    }
+    damaged(at === directory.length);
+    if (!selected) return null;
+    const { name, method, flags, compressed, uncompressed, localAt } = selected;
+    const local = readAt(localAt, 30, directoryAt);
+    damaged(local.readUInt32LE(0) === 0x04034b50 && local.readUInt16LE(8) === method && local.readUInt16LE(6) === flags);
+    const nameLength = local.readUInt16LE(26), dataAt = localAt + 30 + nameLength + local.readUInt16LE(28);
+    damaged(readAt(localAt + 30, nameLength, directoryAt).toString("utf8") === name);
+    if (!(flags & 8)) damaged(local.readUInt32LE(18) === compressed && local.readUInt32LE(22) === uncompressed);
+    const bytes = readAt(dataAt, compressed, directoryAt);
+    if (method === 0) { damaged(compressed === uncompressed); return bytes; }
+    if (method !== 8) throw Error(`${wanted} in ${path} is compressed in a way this reader does not open (method ${method})`);
+    let inflated;
+    try { inflated = inflateRawSync(bytes, { maxOutputLength: Math.max(1, uncompressed) }); }
+    catch { throw Error("a damaged zip archive or export limit exceeded: expanded entry bytes"); }
+    damaged(inflated.length === uncompressed);
+    return inflated;
+  } finally { closeSync(fd); }
+}
+
+/** The bytes of `conversations.json`, wherever the given path keeps them: a folder, the file itself, or the vendor's zip. */
+function exportBytes(given) {
+  let path = expand(given);
+  let stat; try { stat = statSync(path); } catch { throw Error(`export not found: ${given}`); }
+  if (stat.isDirectory()) { path = join(path, FILE); if (!existsSync(path)) throw Error(`no ${FILE} in ${given}`); }
+  if (/\.zip$/i.test(path)) { const bytes = zipEntry(path, FILE); if (!bytes) throw Error(`no ${FILE} in ${given}`); return { bytes, path }; }
+  const { fd, size, readAt } = openExport(path, EXPORT_LIMITS.jsonBytes);
+  try { return { bytes: readAt(0, size), path }; } finally { closeSync(fd); }
+}
+
+/** Scan bytes before JSON.parse allocates an object graph; escaped quotes/brackets inside strings
+ * are content, not structure. JSON.parse remains responsible for syntax and UTF-8 string handling. */
+function boundJson(bytes) {
+  let quoted = false, escaped = false, depth = 0, structure = 0;
+  for (const byte of bytes) {
+    if (quoted) { if (escaped) escaped = false; else if (byte === 92) escaped = true; else if (byte === 34) quoted = false; continue; }
+    if (byte === 34) quoted = true;
+    else if (byte === 91 || byte === 123) { depth += 1; structure += 1; limit(depth <= EXPORT_LIMITS.depth, "JSON depth"); }
+    else if (byte === 93 || byte === 125) depth -= 1;
+    else if (byte === 44 || byte === 58) structure += 1;
+    limit(structure <= EXPORT_LIMITS.structure, "JSON structure");
+  }
+}
+
+/** Which vendor wrote these conversations, by their shape alone; mixed or unknown shapes are refused, never guessed. */
+export function vendorOf(conversations) {
+  if (!Array.isArray(conversations) || conversations.length === 0) return null;
+  const shapes = new Set(conversations.map((c) => (c && typeof c === "object" && c.mapping && typeof c.mapping === "object" ? "chatgpt" : c && typeof c === "object" && Array.isArray(c.chat_messages) ? "claude-web" : "unknown")));
+  return shapes.size === 1 ? [...shapes][0] : null;
+}
+
+/** One export, read: its vendor by shape, its conversations, and the digest of its bytes (what `sent` is remembered by). */
+export function readExport(given, expect = null) {
+  const { bytes, path } = exportBytes(given);
+  boundJson(bytes);
+  let conversations; try { conversations = JSON.parse(bytes.toString("utf8")); } catch { throw Error(`export unreadable: ${path}`); }
+  if (!Array.isArray(conversations)) throw Error(`${path} must contain an array of conversations`);
+  limit(conversations.length <= EXPORT_LIMITS.conversations, "conversation count");
+  const vendor = vendorOf(conversations);
+  if (conversations.length > 0 && !vendor) throw Error(`${path} is neither a ChatGPT nor a Claude export (or mixes the two)`);
+  if (expect && vendor && vendor !== expect) throw Error(`${path} is a ${exportProductName(vendor)} export, not ${exportProductName(expect)}`);
+  return { vendor: vendor ?? expect, conversations, digest: createHash("sha256").update(bytes).digest("hex"), path };
+}
+
+/** The kept branch of one ChatGPT conversation, oldest first: from `current_node` up through the parents. */
+function chatgptBranch(conversation) {
+  const mapping = conversation?.mapping && typeof conversation.mapping === "object" ? conversation.mapping : {};
+  const branch = [];
+  const seen = new Set();
+  for (let id = conversation?.current_node; id && mapping[id] && !seen.has(id); id = mapping[id].parent) { seen.add(id); branch.push(mapping[id]); }
+  return branch.reverse();
+}
+/** A ChatGPT conversation's lines: the person and the model only; system prompts, tools and what the app hides are neither. */
+function chatgptLines(conversation) {
+  const lines = [];
+  for (const node of chatgptBranch(conversation)) {
+    const m = node?.message;
+    const role = m?.author?.role;
+    if ((role !== "user" && role !== "assistant") || m?.metadata?.is_visually_hidden_from_conversation) continue;
+    const parts = Array.isArray(m?.content?.parts) ? m.content.parts.filter((part) => typeof part === "string") : [];
+    const text = parts.join("\n");
+    if (text.length === 0) continue;
+    const seconds = Number(m?.create_time ?? conversation?.create_time);
+    const at = Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * 1000).toISOString() : null;
+    const model = typeof m?.metadata?.model_slug === "string" ? m.metadata.model_slug : undefined;
+    lines.push({ type: role === "user" ? "user" : "assistant", timestamp: at, message: { ...(role === "assistant" && model ? { model } : {}), content: [{ type: "text", text }] } });
+  }
+  return lines;
+}
+/** A claude.ai conversation's messages in the transcript's own shape; the export names no model. */
+function claudeLines(conversation) {
+  const messages = Array.isArray(conversation?.chat_messages) ? conversation.chat_messages : [];
+  return messages.map((m) => {
+    const text = typeof m?.text === "string" && m.text.length > 0 ? m.text : (Array.isArray(m?.content) ? m.content.filter((c) => c?.type === "text" && typeof c.text === "string").map((c) => c.text).join("\n") : "");
+    const at = m?.created_at ?? conversation?.created_at ?? null;
+    return { type: m?.sender === "human" ? "user" : "assistant", timestamp: at, message: { content: [{ type: "text", text }] } };
+  });
+}
+const titleOf = (vendor, conversation) => String((vendor === "chatgpt" ? conversation?.title : conversation?.name) ?? "");
+const idOf = (vendor, conversation, index) => String((vendor === "chatgpt" ? conversation?.conversation_id ?? conversation?.id : conversation?.uuid) ?? `#${index}`);
+
+/**
+ * Every conversation of an export as one session: `key` names the vendor and the conversation's id, `lines` carry
+ * the transcript shape both readers measure. `excluded(title)` skips a conversation by its title before anything of
+ * it is read (the same `--exclude` as a project directory); the title itself goes no further than that call.
+ * `given` is a path, or an export `readExport` already returned (so a zip is inflated once).
+ */
+export function* exportSessions(given, { expect = null, excluded = () => false, skipped = null } = {}) {
+  const { vendor, conversations } = typeof given === "string" ? readExport(given, expect) : given;
+  for (let index = 0; index < conversations.length; index += 1) {
+    const conversation = conversations[index];
+    const title = titleOf(vendor, conversation);
+    if (excluded(title)) { skipped?.push(title.slice(0, 40)); continue; }
+    const lines = vendor === "chatgpt" ? chatgptLines(conversation) : claudeLines(conversation);
+    if (lines.length === 0) continue;
+    const id = idOf(vendor, conversation, index);
+    yield { key: `${vendor === "chatgpt" ? "chatgpt" : "claude.ai"}:${id}`, projectDir: vendor === "chatgpt" ? "chatgpt" : "claude-ai", basename: vendor === "chatgpt" ? "chatgpt" : "claude.ai", vendor, id, lines };
+  }
+}
+
+/**
+ * THE STRETCH'S NAME (the hook's `stretch_ref`, 43 characters): a hash of the vendor, the conversation's id and the
+ * UTC day, the same on any computer and on any copy of the export, so the same export sent twice, or from two
+ * computers, is each line once. The conversation's id is a vendor's opaque id; the hash carries nothing readable.
+ */
+export const exportRef = (vendor, id, day) => createHash("sha256").update(`worktrust-export|${vendor}|${id}|${day}`).digest("base64url");
+
+/**
+ * THE EXPORTS IN ONE FOLDER, its top level only (the Downloads folder, where a vendor's export lands): a zip holding
+ * `conversations.json`, a folder holding one, or the file itself. Each is read to tell its vendor and digest; a file
+ * that is none of these, or not an export, is passed over without a word.
+ */
+export function findExports(dir = join(homedir(), "Downloads")) {
+  const root = expand(dir);
+  let names = []; try { names = readdirSync(root); } catch { return []; }
+  const found = [];
+  for (const name of names.sort()) {
+    const path = join(root, name);
+    let stat; try { stat = statSync(path); } catch { continue; }
+    const candidate = stat.isDirectory() ? existsSync(join(path, FILE)) : /\.zip$/i.test(name) || name === FILE;
+    if (!candidate) continue;
+    try {
+      const { vendor, conversations, digest } = readExport(path);
+      if (vendor && conversations.length > 0) found.push({ path, vendor, digest, conversations: conversations.length });
+    } catch { /* not an export, or not one this reader opens */ }
+  }
+  return found;
+}

worktrust_cli/bundle/config-edits.mjs

@@ -0,0 +1,87 @@
+/**
+ * CONFIG EDITS — a YAML file edited line by line, never re-serialised (2026-10-05).
+ *
+ * Hermes Agent and Goose keep their settings in YAML, written by people, with comments and their own indentation.
+ * setup-mcp.mjs puts WorkTrust's entry into them and takes it out again with these: a section is found by its key at
+ * a known indent, an entry is added at the indent its siblings use, and a removal leaves every other byte as it was.
+ * Only block style is handled; a section written inline (`key: { … }`) makes placeUnder return false, and the caller
+ * leaves the file alone. No dependency: it ships beside setup-mcp.mjs.
+ */
+const indentOf = (line) => line.length - line.trimStart().length;
+const meaningful = (line) => line.trim() !== "" && !line.trimStart().startsWith("#");
+/** `key:` at `indent` between start and stop: its line and the end of its block, or the inline value it carries. */
+function section(lines, start, stop, indent, key) {
+  for (let i = start; i < stop; i += 1) {
+    if (!meaningful(lines[i]) || indentOf(lines[i]) !== indent) continue;
+    const match = new RegExp(`^\\s*${key}:(?:\\s+(.*?))?\\s*$`).exec(lines[i]);
+    if (!match) continue;
+    const inline = match[1] && !match[1].startsWith("#") ? match[1] : null;
+    let end = i + 1;
+    while (end < stop && (!meaningful(lines[end]) || indentOf(lines[end]) > indent || (indentOf(lines[end]) === indent && lines[end].trimStart().startsWith("-")))) end += 1;
+    while (end > i + 1 && !meaningful(lines[end - 1])) end -= 1;
+    return { at: i, end, inline };
+  }
+  return null;
+}
+/** The entries of a block (a mapping's keys or a list's items), each [from, to). */
+function entries(lines, at, end) {
+  const starts = [];
+  const first = lines.slice(at + 1, end).find(meaningful);
+  const child = first === undefined ? null : indentOf(first);
+  for (let i = at + 1; i < end; i += 1) if (meaningful(lines[i]) && indentOf(lines[i]) === child) starts.push(i);
+  return { child, ranges: starts.map((from, n) => [from, starts[n + 1] ?? end]) };
+}
+const EMPTY_INLINE = new Set(["{}", "[]", "null", "~"]);
+/** Puts `unit` under the path, making each section that is missing; false when one is written inline. */
+export function placeUnder(lines, path, unit) {
+  let start = 0, stop = lines.length, indent = 0;
+  for (const [n, key] of path.entries()) {
+    let found = section(lines, start, stop, indent, key);
+    if (found?.inline && !EMPTY_INLINE.has(found.inline)) return false;
+    if (found?.inline) lines[found.at] = `${" ".repeat(indent)}${key}:`;
+    if (!found) { lines.splice(stop, 0, `${" ".repeat(indent)}${key}:`); found = { at: stop, end: stop + 1 }; }
+    const child = entries(lines, found.at, found.end).child ?? indent + 2;
+    if (n === path.length - 1) { lines.splice(found.end, 0, ...unit.map((line) => " ".repeat(child) + line)); return true; }
+    start = found.at + 1; stop = found.end; indent = child;
+  }
+  return true;
+}
+/** The section at the end of a path, in block style; null when absent or inline. */
+function find(lines, path) {
+  let start = 0, stop = lines.length, indent = 0, found = null;
+  for (const key of path) {
+    found = section(lines, start, stop, indent, key);
+    if (!found || found.inline) return null;
+    start = found.at + 1; stop = found.end; indent = entries(lines, found.at, found.end).child ?? indent + 2;
+  }
+  return found;
+}
+/** Takes out every entry under the path that is ours, and a section that leaves empty. */
+export function takeOut(lines, path, mine) {
+  const found = find(lines, path);
+  if (!found) return;
+  let removed = 0;
+  for (const [from, to] of entries(lines, found.at, found.end).ranges.reverse()) if (mine(lines.slice(from, to).join("\n"))) { lines.splice(from, to - from); removed += 1; }
+  if (removed > 0) for (let depth = path.length; depth > 0; depth -= 1) {
+    const left = find(lines, path.slice(0, depth));
+    if (left && !lines.slice(left.at + 1, left.end).some(meaningful)) lines.splice(left.at, left.end - left.at);
+  }
+}
+
+/**
+ * ONLY THE HOUSE'S OWN DOOR (0.6.16, audit L5; the same rule as log-session.mjs and count-behaviour.mjs): an MCP address is
+ * WorkTrust's when its path is /api/mcp and its host is worktrust.io or a subdomain over https, the host WORKTRUST_MCP_URL
+ * names, or WorkTrust's own port on this computer. `/api/mcp` alone is every hosted MCP server's conventional path, so another product's entry is
+ * never adopted as the coupling, and never taken out with it.
+ */
+/** WorkTrust's own local doors (the app in development, 3011; a module branch, 3021). Another product's local MCP server
+ * (the Advisory Board on 3007, 2026-10-09) is not one: it was offered for removal on update, and could have been adopted. */
+const LOCAL_DOOR_PORTS = new Set(["3011", "3021"]);
+export const isWorkTrustDoor = (url) => {
+  try {
+    const parsed = new URL(String(url));
+    if (!/\/api\/mcp\/?$/.test(parsed.pathname)) return false;
+    const own = process.env.WORKTRUST_MCP_URL ? new URL(process.env.WORKTRUST_MCP_URL).host : null;
+    return parsed.protocol === "https:" && (parsed.hostname === "worktrust.io" || parsed.hostname.endsWith(".worktrust.io")) || (own !== null && parsed.host === own) || ((parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") && LOCAL_DOOR_PORTS.has(parsed.port));
+  } catch { return false; }
+};