feat: add SHA256 content hashing to agent registry

[vreshch]

Summary

Add contentHash (SHA256) to agent versions to support agent.lock.json on the CLI side.

Changes

Shared Types (packages/shared/src/types/agent.types.ts)

• Add latestContentHash to AgentDocument interface
• Add contentHash to AgentVersionDocument interface
• Add latestContentHash to AgentDetailUiResponse interface
• Add contentHash to AgentVersionUiResponse and versions array in AgentDetailUiResponse

Collection Schemas

• Add latestContentHash to agents collection schema
• Add contentHash to agent_versions collection schema

Agent Service (packages/backend/src/services/agent.service.ts)

• Add computeContentHash helper function using Node.js crypto module
• Compute and store SHA256 hash when publishing agents (both new and version updates)

Response Mappers (packages/backend/src/utils/agent-response.mapper.ts)

• Include latestContentHash in mapAgentToDetailResponse
• Include contentHash in mapAgentVersionToResponse

Route Handlers

• POST /api/agents: Return contentHash in publish response
• GET /api/agents/:owner/:name: Return latestContentHash and include contentHash in versions array

API Changes

POST /api/agents (Publish)

{
  "success": true,
  "agent": {
    "name": "my-agent",
    "owner": "username",
    "version": "2025-12-01",
    "contentHash": "a1b2c3d4e5f6789...",
    "visibility": "public",
    "publishedAt": "2025-12-01T12:00:00Z"
  }
}

GET /api/agents/:owner/:name

{
  "success": true,
  "data": {
    "latestContentHash": "a1b2c3d4e5f6789...",
    "versions": [
      {
        "version": "2025-12-01",
        "contentHash": "a1b2c3d4e5f6789...",
        "isLatest": true
      }
    ]
  }
}

Benefits

• Integrity verification: Verify installed agents match registry content
• Lock file support: Track exact versions with cryptographic hashes
• Reproducible installs: Guarantee identical agent content across environments

Migration Notes

Existing agents/versions won't have contentHash. A migration script can be run to backfill existing documents. The CLI should handle missing hashes gracefully.

Related

• Spec: specs/update-publish-endpoints.md

[github-actions]

✅ Pull Request Validation Successful

Step Results:

• ✅ 📦 Install dependencies: true
• ✅ 🔍 Run linting: true
• ✅ 🧪 Run tests: true
• ✅ 🏗️ Build packages: true

🎉 All quality checks passed! Ready to merge.

📋 View workflow run

---

🐳 Docker Images Built Successfully!

🏷️ Tag: pr-14

• Backend: ✅ Built
• Frontend: ✅ Built

📋 View workflow

---

⏰ Generated at: 2025-12-01T22:24:50.166Z