@dzhechkov/harness-core 0.8.43 → 0.8.45

package/src/publish-sibling-drift.ts

@@ -44,7 +44,7 @@ export type SiblingDriftStatus = 'same' | 'drift' | 'unavailable';
  * symmetric by construction (same function, same rules, both sides) but can miss a file
  * `.npmignore` excludes or include one npm would never ship.
  */
-export type InventorySource = 'npm-pack' | 'pnpm-pack' | 'readdir-approximation';
+export type InventorySource = 'pack-artifact' | 'npm-pack' | 'pnpm-pack' | 'readdir-approximation';
 
 export interface SiblingDriftResult {
   readonly name: string;
@@ -98,7 +98,7 @@ export interface DetectSiblingDriftOptions {
    * drift".
    */
   readonly localInventory?: LocalInventory;
-  /** Label for the injected provider's source (default `'npm-pack'`); the CLI passes `'pnpm-pack'` for a packed tree. */
+  /** Label for the injected provider (default 'npm-pack'); CLI uses 'pack-artifact'. */
   readonly localInventorySource?: InventorySource;
 }
 
@@ -140,6 +140,8 @@ export interface PackInventoryUnavailable {
  */
 export interface PackedTree {
   readonly packedDir: string;
+  /** Exact files from packArtifact().files; old providers may omit this. */
+  readonly paths?: readonly string[];
 }
 
 export type LocalInventoryResult = PackInventory | PackedTree | PackInventoryUnavailable;
@@ -453,7 +455,9 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
       }
       try {
         workspaceHashes = 'packedDir' in localResult
-          ? hashTreeFull(localResult.packedDir, workspaceManifest)
+          ? localResult.paths !== undefined
+            ? hashTreeFromPaths(localResult.packedDir, localResult.paths, workspaceManifest)
+            : hashTreeFull(localResult.packedDir, workspaceManifest)
           : hashTreeFromPaths(workspaceDir, localResult.paths, workspaceManifest);
       } catch (err) {
         if (!(err instanceof InventoryListingError)) throw err;
@@ -496,3 +500,12 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
   }
   return results;
 }
+
+
+/** Named drift evidence for both the publish BLOCKED line and its durable audit row. */
+export function formatDriftFiles(changedFiles: readonly string[], source: InventorySource, max = 5): string {
+  const shown = changedFiles.slice(0, Math.max(0, max));
+  const remaining = changedFiles.length - shown.length;
+  const names = [...shown, ...(remaining > 0 ? [`… (+${remaining} more)`] : [])].join(', ');
+  return `${names || '(no changed files)'} [source: ${source}]`;
+}

package/src/publish.ts

@@ -23,7 +23,7 @@ import { createHash } from 'node:crypto';
 
 import { claimCheck } from './claim-check.js';
 import { findReleaseLine, rewriteReleaseLine, isReleaseLineToken, shortPackageName } from './release-line.js';
-import { packedTarballName } from './packed-install-smoke.js';
+import { packArtifact, rewriteWorkspaceSpecs } from './pack-artifact.js';
 
 export type ProbeOutcome = {
   readonly attempt: number;
@@ -263,27 +263,7 @@ function maxPublished(name: string, localVersion: string, exec: PublishExec = ex
  * Mirror pnpm's package-time expansion of the three shorthand workspace dependency specs.
  * Pure by construction: callers provide both the source bytes and the sibling version table.
  */
-export function rewriteWorkspaceSpecs(
-  pkgJsonText: string,
-  siblingVersions: ReadonlyMap<string, string>,
-): string {
-  const pkg = JSON.parse(pkgJsonText) as Record<string, unknown>;
-  const fields = ['dependencies', 'peerDependencies', 'optionalDependencies', 'devDependencies'] as const;
-  for (const field of fields) {
-    const candidate = pkg[field];
-    if (candidate === null || typeof candidate !== 'object' || Array.isArray(candidate)) continue;
-    const table = candidate as Record<string, unknown>;
-    for (const [dep, spec] of Object.entries(table)) {
-      if (typeof spec !== 'string') continue;
-      const match = /^workspace:([*^~])$/.exec(spec);
-      const version = siblingVersions.get(dep);
-      if (match === null || version === undefined) continue;
-      const marker = match[1]!;
-      table[dep] = marker === '*' ? version : `${marker}${version}`;
-    }
-  }
-  return JSON.stringify(pkg, null, 2) + '\n';
-}
+export { rewriteWorkspaceSpecs } from './pack-artifact.js';
 
 /**
  * Pure half: which `workspace:`-declared deps of a package would pack to a floor that is neither
@@ -1311,34 +1291,13 @@ export function publishPackages(
       }
 
       if (opts.packedTransport !== undefined) {
-        // AM-1: pack ONCE, from a package.json whose workspace: specs are already resolved to each
-        // sibling's PINNED version — the SAME transformation `rewriteWorkspaceSpecs` performs — so
-        // the tarball about to be smoked is exactly what `npm publish <tgzPath>` ships. Lifecycle
-        // scripts already ran during the `build` step above; `prepublishOnly` is dropped here to
-        // mirror what pnpm itself strips at pack time (the manifest-freshness guard, cli.ts, does
-        // the identical transformation for verification — this is that same convention, now used
-        // to actually PRODUCE the artifact rather than merely check one).
-        const bumpedText = readFileSync(pkgJsonPath, 'utf-8'); // already carries newVersion
-        const rewritten = JSON.parse(rewriteWorkspaceSpecs(bumpedText, pinVersions)) as Record<string, unknown>;
-        const scripts = rewritten['scripts'];
-        if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts)) {
-          delete (scripts as Record<string, unknown>)['prepublishOnly'];
-        }
-        const stagedText = JSON.stringify(rewritten, null, 2) + '\n';
-        let tgzPath: string;
-        let digest: string;
-        writeFileSync(pkgJsonPath, stagedText);
-        try {
-          const packOptions = { cwd: pkg.dir, stdio: 'pipe' as const, encoding: 'utf-8' as const };
-          if (opts.exec) opts.exec(`npm pack . --pack-destination ${JSON.stringify(opts.packedTransport.packDestDir)}`, packOptions);
-          else execSync(`npm pack . --pack-destination ${JSON.stringify(opts.packedTransport.packDestDir)}`, packOptions);
-          tgzPath = join(opts.packedTransport.packDestDir, packedTarballName(pkg.name, newVersion));
-          digest = sha256File(tgzPath);
-        } finally {
-          // The COMMITTED tree keeps `workspace:` specs (only the version bump is meant to stick) —
-          // the rewrite above is packing-only and is undone here regardless of pack's outcome.
-          writeFileSync(pkgJsonPath, bumpedText);
-        }
+        // Pack, inventory and digest the exact artifact later handed to npm publish.
+        const { tgzPath, sha256: digest } = packArtifact({
+          pkgDir: pkg.dir,
+          destDir: opts.packedTransport.packDestDir,
+          exec: opts.exec ?? execSync,
+          pinVersions,
+        });
         pendingPacked.push({
           name: pkg.name,
           dir: pkg.dir,

package/src/setup.ts

@@ -21,6 +21,7 @@ import { basename, dirname, isAbsolute, join, relative } from 'node:path';
 import { execSync, spawnSync } from 'node:child_process';
 
 import { mergeManagedHookEntries } from './managed-hooks.js';
+import { writeUniqueStampedFile } from './stamped-path.js';
 import {
   CLAUDE_DESTRUCTIVE_HOOK_COMMAND,
   CLAUDE_DESTRUCTIVE_HOOK_MATCHER,
@@ -1115,8 +1116,8 @@ export function runSetup(opts: SetupOptions): SetupResult {
         if (foreign && current !== null) {
           // Same shape as the codex `hooks.json` backup: the original beside the original, stamped,
           // so `--force` is recoverable rather than merely loud.
-          backupPath = `${hookPath}.bak-${new Date().toISOString().replace(/[:.]/g, '-')}`;
-          writeFileSync(backupPath, current);
+          const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+          backupPath = writeUniqueStampedFile(`${hookPath}.bak-`, stamp, current, writeFileSync);
         }
         mkdirSync(dirname(hookPath), { recursive: true });
         writeFileSync(hookPath, generateClaudeDestructiveHook(), { mode: 0o755 });

package/src/stamped-path.ts

@@ -0,0 +1,41 @@
+/**
+ * Pure on purpose: harness-core's IO ratchet (test/core-boundary.test.ts) counts files that import node:fs — callers that
+ * already do IO pass their own `exists` / `write` (MEASURED 2026-09-25: a default `existsSync` here tripped it, 65 → 66).
+ */
+
+export type StampedWrite = (path: string, data: string | Uint8Array, options: { flag: 'wx' }) => void;
+
+/**
+ * Return the first unused stamped path, adding a counter suffix on collision.
+ * check-then-act: safe within one process or under a lock; for unlocked cross-process writers use writeUniqueStampedFile
+ */
+export function uniqueStampedPath(
+  base: string,
+  stamp: string,
+  exists: (p: string) => boolean,
+): string {
+  let candidate = `${base}${stamp}`;
+  for (let n = 1; exists(candidate); n += 1) candidate = `${base}${stamp}-${n}`;
+  return candidate;
+}
+
+/** Atomically create a stamped file, trying at most 1000 candidates on EEXIST. */
+export function writeUniqueStampedFile(
+  base: string,
+  stamp: string,
+  data: string | Uint8Array,
+  write: StampedWrite,
+): string {
+  for (let n = 0; n < 1000; n += 1) {
+    const candidate = n === 0 ? `${base}${stamp}` : `${base}${stamp}-${n}`;
+    try {
+      write(candidate, data, { flag: 'wx' });
+      return candidate;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException | null)?.code !== 'EEXIST') throw error;
+    }
+  }
+  const error = new Error(`No free stamped file after 1000 attempts: ${base}${stamp}`);
+  error.name = 'UniqueStampedFileExhaustedError';
+  throw error;
+}