feat: product file-integrity section for the agent API - #46
Merged
Conversation
Detects installed ThemeIsle products (themeisle-sdk bundlers, plugins
and themes, plus themeisle_sdk_products registrations), verifies their
files against the release checksum manifest and reports
modified/missing/added files. Manifest source is chosen by the SDK's
'WordPress Available' header: wp.org plugin-checksums for free plugins,
api.themeisle.com/checksum for pro products and themes, with a one-hop
404 fallback. /integrity/{slug}/file returns bounded base64 chunks
(symlink/traversal-safe, under the 256KB respond() cap).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Diagnostic-only field with no consumer in the integrity flow; keeps the payload lean. SDK-dir presence still drives detection. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
TI_Parrot_Integrityand three agent-API routes:GET /integrity— ThemeIsle products detected on the site (plugins/themes bundlingvendor/codeinwp/themeisle-sdk, plusthemeisle_sdk_productsregistrations; deduped, with version, active flag and theWordPress Availableheader).GET /integrity/{slug}— verifies local files against the release checksum manifest and reportsmodified(with expected/actual sha256),missing,added(VCS/junk ignored) andskipped, with full counts, list caps andpartialstatus under time/byte budgets. Manifest source is chosen by the SDK'sWordPress Available:header — wp.org plugin-checksums for free plugins,api.themeisle.com/checksum/{slug}/{version}for pro products and themes (wp.org has no theme checksums), one-hop 404 fallback.GET /integrity/{slug}/file?path&offset&length— bounded base64 chunks (default 128 KiB, max 176 KiB so the JSON stays under the 256 KBrespond()cap), traversal- and symlink-safe./manifestgrows anintegritysection;SCHEMA_VERSION→ 1.1.Server side: Codeinwp/themeisle-lambda-functions#31 serves the manifests generated by Codeinwp/action-release-checksums.
Tests: 24 new (detection incl. real plugin/theme dirs, source selection, fallback order, budgets, truncation, chunk reassembly, traversal/symlink rejection, redact() path survival, auth); suite 54/54; parse-safe to the PHP 5.4 CI floor.
🤖 Generated with Claude Code