nx_sitepublish_tool_register.nx source
↩ module page · 24 lines · 2431 B
1// nx_sitepublish_tool_register.nx -- register nx_site_publish (artifact-publish) into the discovery
2// registry -> mcp__nishi__nx_site_publish stub: agents place pages into the live docroot SAFELY (atomic,
3// .prev preserved, traversal/secret/device denied) instead of ssh-cat. Idempotent; verifies by READBACK.
4// expect_exit: 0 license_tier: ORIGINAL
5import "nx_tool_registry.nx"
6
7func pr_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
8
9func main() -> i64 {
10 pr_puts("=== nx_sitepublish_tool_register -- artifact-publish into the discovery registry ===\n" as *u8)
11 let w: i64 = tool_register("nx_site_publish" as *u8,
12 "ARTIFACT-PUBLISH: place a NAS-local file into the live sites docroot the SAFE way (retires ssh-cat for pages). VERB: publish <src-file> <site> <relpath> -> sites/<site>/<relpath>. Guarantees: ATOMIC placement (tmp+fsync+rename via the IO layer -- a browser never sees a torn page); PRIOR VERSION PRESERVED to <relpath>.prev before overwrite; DENIED BY CONSTRUCTION: '..' traversal or absolute site/relpath, secret-needle paths, the OS device namespace, the tool allowlist. Source over the organ's 1MiB cap is REFUSED (use the mgmt upload lane). CONTRACT: after publish, verify browser-grade with nx_page_verify <url> from a WAN vantage (on-NAS bare-domain fetches hit DSM -- documented trap). Proven live: published its own status page https://nishifamily.com/iolayer.html -> page_verify GREEN." as *u8,
13 "over /mcp: tools/call name=nx_site_publish arguments={argv:[\"publish\",\"<src>\",\"<site>\",\"<relpath>\"]} + cap granting nx_site_publish. e.g. {argv:[\"publish\",\"_scratch/page.html\",\"nishifamily\",\"page.html\"]}. exit 0 ok | 2 usage | 3 src absent | 4 io | 5 DENIED." as *u8,
14 "GREEN (nx_site_publish_gate 6/6: fresh-lands, republish-preserves-prev, relpath-traversal-denied, absolute-site-denied, secret-relpath-denied, absent-source-honest; live publish + browser-grade page_verify GREEN)" as *u8)
15 let p: *i64 = sys_mmap(8) as *i64
16 let l: *i64 = sys_mmap(8) as *i64
17 let g: i64 = tool_get("nx_site_publish" as *u8, p, l)
18 if w == 0 { if g == 1 { if l[0] > 0 {
19 pr_puts("verdict=GREEN (nx_site_publish discoverable -> mcp__nishi__nx_site_publish stub)\n" as *u8)
20 sys_exit(0); return 0
21 } } }
22 pr_puts("REGISTER FAILED\nverdict=RED\n" as *u8)
23 sys_exit(1); return 1
24}