FilesExpand file tree

main

/

verify-package-pack.mjs

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

83 lines (79 loc) · 2.98 KB

main

/

verify-package-pack.mjs

Copy path

Top

File metadata and controls

• Code
• Blame

83 lines (79 loc) · 2.98 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

import { importVerifierSource } from "./lib/verifier-source-loader.mjs";

import { mkdir } from "node:fs/promises";

import { join } from "node:path";

import { FULL_CATALOG_IDENTITY } from "../dist/catalogIdentity.js";

import { parseTarListing } from "./lib/verify-package-listing.mjs";

import { verifyPackedBridge } from "./verify-packed-bridge.mjs";

const { parseSkillManifestMetadata } = await importVerifierSource(

new URL("../src/domain/skillManifest.ts", import.meta.url).href,

import.meta.url,

);

/** Create a tarball and assert production packaging constraints. */

export async function verifyPackagePack({ root, workspace, commands }) {

const packDirectory = join(workspace, "pack");

await mkdir(packDirectory);

const tarball = join(

packDirectory,

(

await commands.execNpm(

["pack", "--silent", "--pack-destination", packDirectory],

{

cwd: root,

},

)

).stdout.trim(),

);

const packedFiles = parseTarListing(

(await commands.exec("tar", ["-tf", tarball])).stdout,

);

const packedManifest = JSON.parse(

(await commands.exec("tar", ["-xOf", tarball, "package/package.json"]))

.stdout,

);

if (

packedManifest.scripts?.postinstall !== undefined ||

packedManifest.dependencies?.["node-pty"] !== undefined ||

packedManifest.dependencies?.["@lydell/node-pty"] !== "1.1.0"

)

throw new Error("package retained a lifecycle-dependent PTY installation");

if (

packedManifest.bin?.rea !== "scripts/rea.mjs" ||

packedManifest.bin?.["rea-agents"] !== "scripts/rea.mjs"

)

throw new Error("package did not expose both rea command entry points");

if (packedManifest.mcpName !== "io.github.morluto/rea")

throw new Error("package did not retain its MCP Registry ownership marker");

if (!packedFiles.includes("package/scripts/lib/cli-process-environment.mjs"))

throw new Error("package omitted the CLI process environment owner");

if (packedFiles.some((path) => path.startsWith("package/.agents/")))

throw new Error(

"package included authored skill sources instead of only the generated bundle",

);

if (packedFiles.some((path) => path.startsWith("package/.cache/")))

throw new Error("package included development cache or test metadata");

const skill = (

await commands.exec("tar", [

"-xOf",

tarball,

"package/skills/reverse-engineer-anything/SKILL.md",

])

).stdout;

const skillMetadata = parseSkillManifestMetadata(skill);

if (

!skillMetadata.ok ||

skillMetadata.value.toolCount !== FULL_CATALOG_IDENTITY.counts.mcp_tools ||

skillMetadata.value.hasCatalogDigest

)

throw new Error(

"packaged skill metadata did not match the catalog shipped in the package",

);

if (

packedFiles.some(

(path) => path.includes("__pycache__") || path.endsWith(".pyc"),

)

) {

throw new Error("package contained generated Python bytecode");

}

await verifyPackedBridge({ tarball, packedFiles, commands });

return { tarball };

}