0xray 3.4.1 → 3.4.3

package/scripts/node/pre-publish-guard.js

@@ -2,30 +2,29 @@
 
 /**
  * Pre-Publish Validation Script
- * 
- * Enforces all requirements before publishing:
- * 1. Git status clean (committed & pushed)
- * 2. package.json version matches version manager
- * 3. Version been manager has run
- * 4. All tests pass
- * 5. Build succeeds
- * 
- * Usage:
- *   node scripts/node/pre-publish-guard.js
- *   npm run pre-publish-guard
+ *
+ * Full mode: git + reconcile + build + test + consumer smoke
+ * --verify-only: git + reconcile + (optional smoke via release-gate)
+ * --skip-smoke: skip consumer install smoke
+ * --skip-build / --skip-tests: skip redundant steps when gate already ran
  */
 
 import { execSync } from 'child_process';
 import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { createRequire } from 'module';
 
-const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const rootDir = path.resolve(__dirname, '../..');
 
-// Colors
+const verifyOnly = process.argv.includes('--verify-only');
+const skipSmoke =
+  process.argv.includes('--skip-smoke') ||
+  process.env.SKIP_CONSUMER_SMOKE === '1' ||
+  verifyOnly;
+const skipBuild = process.argv.includes('--skip-build') || verifyOnly;
+const skipTests = process.argv.includes('--skip-tests') || verifyOnly;
+
 const RED = '\x1b[31m';
 const GREEN = '\x1b[32m';
 const YELLOW = '\x1b[33m';
@@ -48,228 +47,168 @@ function log(msg, type = 'info') {
 
 function run(cmd, options = {}) {
   try {
-    return execSync(cmd, { 
-      cwd: rootDir, 
-      stdio: 'pipe', 
+    return execSync(cmd, {
+      cwd: rootDir,
+      stdio: 'pipe',
       encoding: 'utf-8',
-      ...options 
+      ...options,
     }).trim();
-  } catch (e) {
+  } catch {
     return null;
   }
 }
 
+/** Runtime/generated paths only — never ignore scripts/, src/, or CHANGELOG */
+const ARTIFACT_PREFIXES = [
+  '.opencode/codex.codex',
+  '.opencode/enforcer-config.json',
+  '.opencode/package.json',
+  '.opencode/command/',
+  '.opencode/activity-report.json',
+  '.opencode/init.sh',
+  '.xray/inference/',
+  'logs/',
+  'backups/',
+  '.ci-reports/',
+];
+
 function checkGitStatus() {
   log('Checking git status...', 'step');
-  
-  // Check for uncommitted changes
+
   const status = run('git status --porcelain');
   if (status && status.length > 0) {
-    // Allow untracked files but not uncommitted changes
-    const lines = status.split('\n').filter(l => !l.startsWith('??'));
-    
-    // Filter out files modified by prepare-consumer and version:sync (build artifacts)
-    // These are generated from source and don't need separate commits
-    const artifactPrefixes = [
-      '.opencode/codex.codex',
-      '.opencode/enforcer-config.json',
-      '.opencode/package.json',
-      '.opencode/command/',
-      '.opencode/activity-report.json',
-      'command/',
-      'enforcer-config.json',
-      'docs/',
-      'tests/',
-      'tweets/',
-      'scripts/',
-      'src/__tests__/',
-      'src/skills/registry.json',
-      'CHANGELOG.md',
-      'AGENTS.md',
-      'AGENTS-full.md',
-      'AGENTS-consumer.md',
-      'README.md',
-      'logs/',
-      'backups/',
-      'Users/',
-      '.xray/inference/',
-    ];
-    
-    const realChanges = lines.filter(l => {
-      const filePath = l.slice(3); // skip status prefix (e.g., " M " or "M  ")
-      return !artifactPrefixes.some(prefix => filePath.startsWith(prefix));
+    const lines = status.split('\n').filter((l) => !l.startsWith('??'));
+
+    const realChanges = lines.filter((l) => {
+      const filePath = l.slice(2).trim();
+      return !ARTIFACT_PREFIXES.some((prefix) => filePath.startsWith(prefix));
     });
-    
+
     if (realChanges.length > 0) {
-      errors.push(`Git has uncommitted source changes:\n${realChanges.join('\n')}`);
-      log('Git has uncommitted source changes', 'error');
+      errors.push(`Git has uncommitted changes:\n${realChanges.join('\n')}`);
+      log('Uncommitted changes block release', 'error');
       return false;
     }
-    
+
     if (lines.length > 0) {
-      log('Uncommitted build artifacts present (OK — generated by version sync)', 'info');
+      log('Generated artifacts present (OK)', 'info');
     }
-    log('Untracked files present (OK)', 'warn');
   }
-  
-  // Check if current branch is up to date with remote
+
   const currentBranch = run('git rev-parse --abbrev-ref HEAD');
   const remoteCommit = run(`git rev-parse origin/${currentBranch} 2>/dev/null || echo ""`);
   const localCommit = run('git rev-parse HEAD');
-  
+
   if (remoteCommit && remoteCommit !== localCommit) {
-    errors.push(`Local commit ${localCommit.slice(0,7)} not pushed to origin/${currentBranch}`);
+    errors.push(`Local commit ${localCommit.slice(0, 7)} not pushed to origin/${currentBranch}`);
     log(`Not pushed to origin/${currentBranch}`, 'error');
     return false;
   }
-  
-  log(`Git status OK (committed & pushed)`, 'success');
+
+  log('Git status OK', 'success');
   return true;
 }
 
-function checkVersionSync() {
-  log('Checking version synchronization...', 'step');
-
-  const pkgPath = path.join(rootDir, 'package.json');
-  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
-  const pkgVersion = pkg.version;
-
-  const vmPath = path.join(rootDir, 'scripts/node/universal-version-manager.js');
-  const vmContent = fs.readFileSync(vmPath, 'utf-8');
-  const usesPackageSsot =
-    vmContent.includes('readPackageVersion()') &&
-    /version:\s*PACKAGE_VERSION/.test(vmContent);
-
-  if (usesPackageSsot) {
-    log(`Version SSOT: package.json (${pkgVersion})`, 'success');
+function checkVersionReconcile() {
+  log('Checking version reconcile...', 'step');
+  try {
+    execSync('node scripts/node/reconcile-version.mjs --check', {
+      cwd: rootDir,
+      stdio: 'inherit',
+    });
+    log('Version reconcile OK', 'success');
     return true;
-  }
-
-  const versionMatch = vmContent.match(/framework:\s*\{[\s\S]*?version:\s*"([^"]+)"/);
-  if (!versionMatch) {
-    errors.push('Cannot find framework version in version manager');
+  } catch {
+    errors.push('Version reconcile failed — run: npm run version:reconcile');
     return false;
   }
-
-  const vmVersion = versionMatch[1];
-  if (pkgVersion !== vmVersion) {
-    warnings.push(`Version mismatch: package.json (${pkgVersion}) != version manager (${vmVersion})`);
-    log(`Version mismatch: package.json=${pkgVersion}, version-manager=${vmVersion}`, 'warn');
-  } else {
-    log(`Versions aligned: ${pkgVersion}`, 'success');
-  }
-  return true;
 }
 
-function checkVersionManagerRan() {
-  log('Checking version manager was run...', 'step');
-  
-  // Check that version manager script has current date as lastUpdated
-  const vmPath = path.join(rootDir, 'scripts/node/universal-version-manager.js');
-  const vmContent = fs.readFileSync(vmPath, 'utf-8');
-  
-  // Check that files have been updated (look for recent timestamps or version)
-  const { resolveConfigPath } = require('../helpers/resolve-config-path.cjs');
-  let features;
+function runBuild() {
+  if (skipBuild) {
+    log('Build skipped', 'info');
+    return true;
+  }
+  log('Running build...', 'step');
   try {
-    const featuresPath = resolveConfigPath('features.json', rootDir);
-    features = JSON.parse(fs.readFileSync(featuresPath, 'utf-8'));
-    // Version manager should have updated version fields
-    if (!features.version && !features.xray_version) {
-      warnings.push('features.json may not have been synced by version manager');
-      log('features.json may need version sync', 'warn');
-    } else {
-      log('Version manager appears to have run', 'success');
-    }
+    execSync('npm run build', { cwd: rootDir, stdio: 'inherit' });
+    log('Build succeeded', 'success');
+    return true;
   } catch {
-    log('features.json not found — skipping version sync check', 'warn');
+    errors.push('Build failed');
+    return false;
   }
-  
-  return true;
 }
 
 function runTests() {
+  if (skipTests) {
+    log('Tests skipped', 'info');
+    return true;
+  }
   log('Running tests...', 'step');
-  
   try {
     execSync('npm test', { cwd: rootDir, stdio: 'inherit' });
     log('Tests passed', 'success');
     return true;
-  } catch (e) {
+  } catch {
     errors.push('Tests failed');
-    log('Tests failed', 'error');
     return false;
   }
 }
 
-function runBuild() {
-  log('Running build...', 'step');
-  
+function runConsumerSmoke() {
+  if (skipSmoke) {
+    log('Consumer smoke skipped', 'warn');
+    return true;
+  }
+  log('Running consumer install smoke...', 'step');
   try {
-    execSync('npm run build', { cwd: rootDir, stdio: 'inherit' });
-    log('Build succeeded', 'success');
+    execSync('node scripts/node/consumer-install-smoke.mjs', { cwd: rootDir, stdio: 'inherit' });
+    log('Consumer smoke passed', 'success');
     return true;
-  } catch (e) {
-    errors.push('Build failed');
-    log('Build failed', 'error');
+  } catch {
+    errors.push('Consumer install smoke failed');
     return false;
   }
 }
 
 function main() {
   console.log('\n' + '='.repeat(60));
-  log('PRE-PUBLISH VALIDATION', 'step');
+  log(verifyOnly ? 'PRE-PUBLISH VERIFY' : 'PRE-PUBLISH VALIDATION', 'step');
   console.log('='.repeat(60) + '\n');
-  
+
   const checks = [
-    { name: 'Git Status', fn: checkGitStatus },
-    { name: 'Version Sync', fn: checkVersionSync },
-    { name: 'Version Manager', fn: checkVersionManagerRan },
-    { name: 'Build', fn: runBuild },
-    { name: 'Tests', fn: runTests },
+    checkGitStatus,
+    checkVersionReconcile,
+    runBuild,
+    runTests,
+    runConsumerSmoke,
   ];
-  
+
   let allPassed = true;
-  for (const check of checks) {
-    if (!check.fn()) {
+  for (const fn of checks) {
+    if (!fn()) {
       allPassed = false;
       break;
     }
   }
-  
+
   console.log('\n' + '='.repeat(60));
-  
+
   if (allPassed) {
-    log('ALL CHECKS PASSED - Ready to publish!', 'success');
+    log('ALL CHECKS PASSED', 'success');
     console.log('='.repeat(60) + '\n');
-    console.log(`Run: ${GREEN}npm publish${RESET}\n`);
     process.exit(0);
-  } else {
-    log('VALIDATION FAILED', 'error');
-    console.log('='.repeat(60) + '\n');
-    
-    if (errors.length > 0) {
-      console.log(`${RED}Errors:${RESET}`);
-      errors.forEach(e => console.log(`  • ${e}`));
-      console.log('');
-    }
-    
-    if (warnings.length > 0) {
-      console.log(`${YELLOW}Warnings:${RESET}`);
-      warnings.forEach(w => console.log(`  • ${w}`));
-      console.log('');
-    }
-    
-    console.log(`${YELLOW}To fix:${RESET}`);
-    console.log('  1. Commit & push all changes: git add -A && git commit -m "..." && git push');
-    console.log('  2. Bump version in package.json');
-    console.log('  3. Update version in scripts/node/universal-version-manager.js');
-    console.log('  4. Run: npm run version:sync');
-    console.log('  5. Commit & push version changes');
-    console.log('  6. Run: npm run pre-publish-guard\n');
-    
-    process.exit(1);
   }
+
+  log('VALIDATION FAILED', 'error');
+  console.log('='.repeat(60) + '\n');
+  if (errors.length) {
+    console.log(`${RED}Errors:${RESET}`);
+    errors.forEach((e) => console.log(`  • ${e}`));
+  }
+  console.log(`\n${YELLOW}Fix:${RESET} npm run release:gate  or  npm run version:reconcile\n`);
+  process.exit(1);
 }
 
-main();
+main();

package/scripts/node/reconcile-version.mjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * reconcile-version.mjs — Single version truth before bump/tag/publish.
+ *
+ * Sources: npm registry, package.json, latest git tag.
+ *
+ * Usage:
+ *   node scripts/node/reconcile-version.mjs              # report
+ *   node scripts/node/reconcile-version.mjs --check        # fail if not publish-ready
+ *   node scripts/node/reconcile-version.mjs patch        # print next patch target
+ *   node scripts/node/reconcile-version.mjs patch --apply # write package.json
+ */
+
+import { execSync } from "child_process";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const rootDir = path.resolve(__dirname, "../..");
+const pkgPath = path.join(rootDir, "package.json");
+
+const args = process.argv.slice(2);
+const checkMode = args.includes("--check");
+const applyMode = args.includes("--apply");
+const printTarget = args.includes("--print-target");
+const bumpType = args.find((a) => ["major", "minor", "patch"].includes(a)) || null;
+
+function run(cmd) {
+  try {
+    return execSync(cmd, { cwd: rootDir, encoding: "utf-8" }).trim();
+  } catch {
+    return null;
+  }
+}
+
+function readLocalVersion() {
+  return JSON.parse(fs.readFileSync(pkgPath, "utf-8")).version;
+}
+
+function readPublishedVersion() {
+  const v = run("npm view 0xray version");
+  return v || "0.0.0";
+}
+
+function readLatestTag() {
+  const tag = run('git describe --tags --abbrev=0 2>/dev/null');
+  if (!tag) return null;
+  return tag.replace(/^v/, "");
+}
+
+function parseVersion(version) {
+  const [major, minor, patch] = version.split(".").map((n) => parseInt(n, 10));
+  return { major, minor, patch };
+}
+
+function bumpVersion(version, type) {
+  const v = parseVersion(version);
+  switch (type) {
+    case "major":
+      return `${v.major + 1}.0.0`;
+    case "minor":
+      return `${v.major}.${v.minor + 1}.0`;
+    case "patch":
+      return `${v.major}.${v.minor}.${v.patch + 1}`;
+    default:
+      return version;
+  }
+}
+
+function compare(a, b) {
+  const va = parseVersion(a);
+  const vb = parseVersion(b);
+  if (va.major !== vb.major) return va.major - vb.major;
+  if (va.minor !== vb.minor) return va.minor - vb.minor;
+  return va.patch - vb.patch;
+}
+
+function maxVersion(...versions) {
+  return versions.reduce((best, cur) => (compare(cur, best) > 0 ? cur : best));
+}
+
+function fail(msg) {
+  console.error(`❌ ${msg}`);
+  process.exit(1);
+}
+
+function main() {
+  const local = readLocalVersion();
+  const npm = readPublishedVersion();
+  const tag = readLatestTag();
+
+  const baseline = maxVersion(npm, tag || "0.0.0");
+  const target = bumpType ? bumpVersion(baseline, bumpType) : local;
+
+  if (printTarget && bumpType) {
+    console.log(target);
+    return;
+  }
+
+  console.log("\n=== Version Reconcile ===\n");
+  console.log(`  npm registry : ${npm}`);
+  console.log(`  package.json : ${local}`);
+  console.log(`  latest tag   : ${tag ? `v${tag}` : "(none)"}`);
+  if (bumpType) {
+    console.log(`  bump ${bumpType}  : ${target} (from baseline ${baseline})`);
+  }
+
+  if (applyMode && bumpType) {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    pkg.version = target;
+    fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+    console.log(`\n✅ Updated package.json → ${target}`);
+  }
+
+  if (!checkMode) {
+    if (compare(local, npm) <= 0 && !bumpType) {
+      console.log("\n⚠️  Local version is not ahead of npm — bump before publishing.");
+    } else {
+      console.log("\n✅ Reconcile report complete.");
+    }
+    return;
+  }
+
+  // Strict checks for release gate / pre-tag
+  if (compare(local, npm) <= 0) {
+    fail(`package.json (${local}) must be > npm (${npm}). Run: node scripts/node/reconcile-version.mjs patch --apply`);
+  }
+
+  if (tag && compare(local, tag) < 0) {
+    fail(`package.json (${local}) is behind latest tag v${tag}`);
+  }
+
+  if (tag && compare(local, tag) === 0 && compare(npm, local) < 0) {
+    fail(`tag v${tag} exists but npm is only ${npm} — publish or retag`);
+  }
+
+  if (tag && compare(local, tag) > 0 && compare(npm, tag) === 0) {
+    console.log(`✅ Ready to tag v${local} (npm at ${npm})`);
+  } else if (compare(local, npm) > 0) {
+    console.log(`✅ Ready to publish ${local} (npm at ${npm})`);
+  } else {
+    console.log("✅ Version reconcile OK");
+  }
+}
+
+main();

package/scripts/node/release-gate.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/**
+ * release-gate.mjs — Single release checkpoint.
+ *
+ * Modes:
+ *   (default)     build + test + consumer smoke — run once before commit
+ *   --verify-only git + reconcile + release docs + consumer smoke — after push, before tag
+ *   --skip-smoke  skip consumer install smoke
+ *   --skip-docs   skip release docs validation (not recommended for publish)
+ *
+ * Usage:
+ *   node scripts/node/release-gate.mjs
+ *   node scripts/node/release-gate.mjs --verify-only
+ */
+
+import { execSync } from "child_process";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const rootDir = path.resolve(__dirname, "../..");
+const verifyOnly = process.argv.includes("--verify-only");
+const skipSmoke = process.argv.includes("--skip-smoke");
+const skipDocs = process.argv.includes("--skip-docs");
+
+function step(label, cmd) {
+  console.log(`\n${"─".repeat(60)}\n🔄 ${label}\n${"─".repeat(60)}\n`);
+  execSync(cmd, { cwd: rootDir, stdio: "inherit" });
+}
+
+function main() {
+  const mode = verifyOnly ? "verify" : "full";
+  console.log("\n╔════════════════════════════════════════════════════════╗");
+  console.log(`║        🛡️  0xRay Release Gate (${mode})`.padEnd(57) + "║");
+  console.log("╚════════════════════════════════════════════════════════╝");
+
+  try {
+    if (verifyOnly) {
+      step("1/4 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
+      if (!skipDocs) {
+        step("2/4 Release docs", "node scripts/node/validate-release-docs.mjs");
+      }
+      if (!skipSmoke) {
+        step("3/4 Consumer install smoke", "node scripts/node/consumer-install-smoke.mjs");
+      }
+    } else {
+      step("1/4 Build", "npm run build");
+      step("2/4 Tests", "npm test");
+      if (!skipSmoke) {
+        step("3/4 Consumer install smoke", "node scripts/node/consumer-install-smoke.mjs");
+      }
+      if (!skipDocs && process.argv.includes("--with-docs")) {
+        step("4/4 Release docs", "node scripts/node/validate-release-docs.mjs");
+      }
+    }
+
+    console.log("\n╔════════════════════════════════════════════════════════╗");
+    console.log("║  ✅ RELEASE GATE PASSED                                ║");
+    console.log("╚════════════════════════════════════════════════════════╝\n");
+  } catch {
+    console.error("\n❌ RELEASE GATE FAILED — do not tag or publish\n");
+    process.exit(1);
+  }
+}
+
+main();