93 lines
7.1 KiB
JavaScript
93 lines
7.1 KiB
JavaScript
// Static assessment of retained REA exports only. Never reads the original installation.
|
|
const fs = require('node:fs/promises')
|
|
const path = require('node:path')
|
|
const crypto = require('node:crypto')
|
|
const assert = require('node:assert/strict')
|
|
const archive = path.resolve('.tmp/rea-runtime-scripts.json')
|
|
const output = path.resolve('.tmp/connector-assessment-20261016')
|
|
const evidence = 'ev_717fa5e846e64d67ac19c8925d121bff632c0d3aefb3603b10858559cabb2dcb'
|
|
const sha = text => crypto.createHash('sha256').update(text, 'utf8').digest('hex')
|
|
;(async () => {
|
|
const source = JSON.parse(await fs.readFile(archive, 'utf8'))
|
|
assert.equal(source.evidence_id, evidence)
|
|
const files = source.items.map(item => {
|
|
const artifact = item.source?.artifact, text = artifact?.text
|
|
const actualSha256 = typeof text === 'string' ? sha(text) : null
|
|
return { name: path.win32.basename(item.file_path), declaredLength: item.length, textLength: text?.length ?? null,
|
|
sha256: artifact?.sha256 ?? null, actualSha256, verified: actualSha256 !== null && actualSha256 === artifact?.sha256 }
|
|
})
|
|
const failures = files.filter(file => !file.verified)
|
|
assert.equal(failures.length, 0, 'Every retained script body must match its REA artifact SHA before assessment')
|
|
const args = process.argv.slice(2)
|
|
if (args[0] === '--find') {
|
|
const file = source.items.find(item => path.win32.basename(item.file_path) === args[1])
|
|
assert.ok(file, 'Select an exact retained REA filename')
|
|
const text = file.source.artifact.text
|
|
console.log(JSON.stringify({ file: args[1], sha256: file.source.artifact.sha256, matches: args.slice(2).map(term => {
|
|
const offsets = []; let offset = -1
|
|
while ((offset = text.indexOf(term, offset + 1)) !== -1) offsets.push(offset)
|
|
return { term, offsets }
|
|
}) }))
|
|
return
|
|
}
|
|
if (args[0] === '--excerpt') {
|
|
const file = source.items.find(item => path.win32.basename(item.file_path) === args[1])
|
|
assert.ok(file, 'Select an exact retained REA filename')
|
|
const start = Number(args[2]), length = Number(args[3] || 4000)
|
|
assert.ok(Number.isInteger(start) && start >= 0 && Number.isInteger(length) && length > 0 && length <= 16000)
|
|
console.log(JSON.stringify({ evidenceId: evidence, file: args[1], sha256: file.source.artifact.sha256,
|
|
offsetUnit: 'zero-based JavaScript UTF-16 code units', start, end: start + length, text: file.source.artifact.text.slice(start, start + length) }))
|
|
return
|
|
}
|
|
const selectedNames = new Set(['store-BKmTj0KI.js', 'contexts-BMeWSUHk.js', 'common-DRZ6FwkK.js', 'adapters-SPAem2E3.js',
|
|
'skills-panel-CvMlV3m8.js', 'wb-input-add-B045GnIg.js', 'runtime-B7PLES2V.js', 'workbuddy-provider-DkH2YFYM.js',
|
|
'desktop-sdk-setup-C2AUiJmx.js', 'main-content-core-Dlaq72qt.js', 'services-Dz7-cD7Y.js', 'zh-cn-Dfzn8myY.js', 'wb-CocRQn4C.js'])
|
|
const selected = source.items.filter(item => /connector|mcp-server-loader|mcp-token-config|oauth-contract/.test(path.win32.basename(item.file_path)) || selectedNames.has(path.win32.basename(item.file_path))).map(item => {
|
|
const name = path.win32.basename(item.file_path), text = item.source.artifact.text
|
|
return { ...files.find(file => file.name === name), functions: [...text.matchAll(/function ([\w$]+)\(/g)]
|
|
.filter(match => /connector|mcp|oauth|tokenConfig|catalog|category/i.test(match[1]))
|
|
.map(match => ({ name: match[1], offset: match.index })) }
|
|
})
|
|
const supplementaryPath = path.resolve('.tmp/rea-expert-runtime-scripts-20261016.json')
|
|
let supplementary
|
|
try {
|
|
const newer = JSON.parse(await fs.readFile(supplementaryPath, 'utf8'))
|
|
assert.equal(newer.evidence_id, 'ev_e91787b1d4dea651582c6cf12827775b9068b0ee8b80c68ba08d4c1d87d94e90')
|
|
const verified = newer.items.map(item => ({ name: path.win32.basename(item.file_path), sha256: item.source?.artifact?.sha256,
|
|
actualSha256: sha(item.source.artifact.text) }))
|
|
assert.ok(verified.every(file => file.sha256 === file.actualSha256), 'Supplementary REA body SHA mismatch')
|
|
supplementary = { archive: supplementaryPath, evidenceId: newer.evidence_id, total: verified.length, verified: verified.length,
|
|
changedFromBaseline: verified.filter(file => files.some(before => before.name === file.name && before.sha256 !== file.sha256)),
|
|
newNames: verified.filter(file => !files.some(before => before.name === file.name)).map(file => file.name) }
|
|
} catch (error) { if (error.code !== 'ENOENT') throw error }
|
|
const cssManifest = JSON.parse(await fs.readFile('.tmp/rea-css-recovered/manifest.json', 'utf8'))
|
|
const css = []
|
|
for (const file of cssManifest.files.filter(file => /^(connector-(?:device-code|token-config)-modal|skills-panel)-/.test(file.file))) {
|
|
const bytes = await fs.readFile(path.join('.tmp/rea-css-recovered', file.file))
|
|
const actualSha256 = crypto.createHash('sha256').update(bytes).digest('hex')
|
|
assert.equal(actualSha256, file.sha256, 'Retained connector CSS SHA mismatch')
|
|
css.push({ file: file.file, sha256: file.sha256, bytes: bytes.length, rules: file.rules, verified: true })
|
|
}
|
|
const runtimeBaselines = []
|
|
for (const directory of ['rea-market-connectors-static-20261016', 'rea-custom-connectors-static-20261016', 'rea-connector-detail-20261016']) {
|
|
const capture = path.join('.tmp', directory), layout = JSON.parse(await fs.readFile(path.join(capture, 'layout.json'), 'utf8'))
|
|
const bytes = await fs.readFile(path.join(capture, 'workbuddy.png'))
|
|
assert.equal(crypto.createHash('sha256').update(bytes).digest('hex'), layout.artifact.sha256)
|
|
const retained = JSON.parse(await fs.readFile(layout.archive, 'utf8')), probe = retained.normalized_result.visuals.probe
|
|
const frames = []
|
|
for (const [index, frame] of (probe?.frames || []).entries()) {
|
|
const bytes = await fs.readFile(path.join(capture, `frame-${String(index).padStart(3, '0')}.png`))
|
|
assert.equal(crypto.createHash('sha256').update(bytes).digest('hex'), frame.artifact.sha256)
|
|
frames.push({ index, stepId: frame.step_id, sha256: frame.artifact.sha256 })
|
|
}
|
|
runtimeBaselines.push({ directory, evidenceId: layout.evidenceId, screenshotSha256: layout.artifact.sha256,
|
|
probe: probe && { status: probe.status, steps: probe.steps, restoration: probe.restoration, frames } })
|
|
}
|
|
await fs.mkdir(output, { recursive: true })
|
|
const report = { result: 'PASS retained-script integrity', archive, evidenceId: evidence, version: 'WorkBuddy 5.8.2',
|
|
offsetUnit: 'zero-based JavaScript UTF-16 code units', filesTotal: files.length, verifiedCount: files.filter(file => file.verified).length,
|
|
files, selected, supplementary, css: { evidenceId: cssManifest.sourceEvidenceId, files: css }, runtimeBaselines, limitations: ['Retained REA exports only; this audit performs no original runtime actions or authentication.', 'Function presence does not establish backend behavior or current catalog contents.'] }
|
|
await fs.writeFile(path.join(output, 'integrity-and-anchors.json'), JSON.stringify(report, null, 2))
|
|
console.log(JSON.stringify({ result: report.result, total: files.length, verified: report.verifiedCount, selected: selected.length, report: path.join(output, 'integrity-and-anchors.json') }))
|
|
})().catch(error => { console.error(error); process.exitCode = 1 })
|