@gatedpath/preflight 0.2.4 → 0.2.5

package/README.md

@@ -64,7 +64,8 @@ passes; `--json` for agents. The fix text is the failure table's (`@gatedpath/ag
 | `forge`, `anvil`, `cast` | yes | each on PATH and answering `--version` |
 | `foundry-version` | yes | the three report one version |
 | `foundry-exit-code` | yes | each hands its exit code back. The `@foundry-rs` npm packages (1.7.1) install a Node shim that exits 0 whatever the binary returned, so a failed `forge build` reports success; doctor probes with a flag no binary knows (the real ones exit 2, the shim 0), names the shim, and prints the `ln -sf` line to the real binary it found in the platform package beside it |
-| `slither`, `aderyn` | no | on PATH; a warning when missing or not at the version CI pins (0.11.6, 0.6.8) |
+| `slither` | no | on PATH; a warning when missing or not at the version CI pins (0.11.6) |
+| `aderyn` | no | reported, never a warning: Cyfrin retired Aderyn in November 2026 and withdrew its binaries and npm archives, so the scaffold's CI no longer runs it (0.2.5). A copy already installed is named with its version |
 | `env-tracked` | yes | no `.env` or `.env.*` (other than `.env.example`) in `git ls-files` |
 | `vendor` | yes | in a scaffold, each `vendor/redbelly-*/package.json` version equals the record the scaffolder wrote under `redbelly.vendor` in the root `package.json`; a scaffold without the record warns |
 

package/dist/doctor-cli.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-export declare const DOCTOR_HELP = "redbelly-doctor [options]\n\nChecks the machine before the first command: Node 22 or later; forge, anvil and cast on\nPATH, one version, and the real binaries rather than the @foundry-rs npm shim that exits 0\nwhatever the binary returned; slither and aderyn (optional); git; no .env tracked by git;\nand, in a scaffold, vendor/ matching the versions the scaffolder recorded. One line per\ncheck with the fix on the same line. Touches no network and no key.\n\n  --project <dir>   scaffold root, its contracts/ folder, or any directory (default: cwd)\n  --json            print the report as JSON\n  --version, --help\n\nExit 0 when every required check passes (optional checks may warn), 1 otherwise, 2 on bad arguments.\n";
+export declare const DOCTOR_HELP = "redbelly-doctor [options]\n\nChecks the machine before the first command: Node 22 or later; forge, anvil and cast on\nPATH, one version, and the real binaries rather than the @foundry-rs npm shim that exits 0\nwhatever the binary returned; slither (optional); git; no .env tracked by git;\nand, in a scaffold, vendor/ matching the versions the scaffolder recorded. One line per\ncheck with the fix on the same line. Touches no network and no key.\n\n  --project <dir>   scaffold root, its contracts/ folder, or any directory (default: cwd)\n  --json            print the report as JSON\n  --version, --help\n\nExit 0 when every required check passes (optional checks may warn), 1 otherwise, 2 on bad arguments.\n";
 export declare function parseDoctorArgs(argv: readonly string[]): {
     project?: string;
     json: boolean;

package/dist/doctor-cli.js

@@ -8,7 +8,7 @@ export const DOCTOR_HELP = `redbelly-doctor [options]
 
 Checks the machine before the first command: Node 22 or later; forge, anvil and cast on
 PATH, one version, and the real binaries rather than the @foundry-rs npm shim that exits 0
-whatever the binary returned; slither and aderyn (optional); git; no .env tracked by git;
+whatever the binary returned; slither (optional); git; no .env tracked by git;
 and, in a scaffold, vendor/ matching the versions the scaffolder recorded. One line per
 check with the fix on the same line. Touches no network and no key.
 

package/dist/doctor.d.ts

@@ -37,6 +37,10 @@ export interface DoctorReport {
 }
 export declare const NODE_MIN_MAJOR = 22;
 export declare const SLITHER_PIN = "0.11.6";
+/**
+ * @deprecated Cyfrin retired Aderyn in November 2026 and withdrew its binaries and npm archives, so
+ * CI no longer runs it and doctor no longer compares against a pin. Kept so imports of 0.2.4 still resolve.
+ */
 export declare const ADERYN_PIN = "0.6.8";
 declare const FOUNDRY_TOOLS: readonly ["forge", "anvil", "cast"];
 type FoundryTool = (typeof FOUNDRY_TOOLS)[number];

package/dist/doctor.js

@@ -1,6 +1,6 @@
 // redbelly-doctor: the machine before the first command. Node 22 or later; forge, anvil and cast
 // present, one version, and the real binaries rather than the @foundry-rs npm shim that exits 0
-// whatever the binary returned; slither and aderyn optional; git; no .env tracked; and, in a
+// whatever the binary returned; slither optional; aderyn reported, never warned on (retired); git; no .env tracked; and, in a
 // scaffold, vendor/ matching the versions the scaffolder recorded. One line per check with the fix
 // on the same line. The fix text comes from the failure table in @gatedpath/agent-rules, so
 // explain_failure and doctor use the same words. Nothing here touches a network or a key.
@@ -14,6 +14,10 @@ export const DOCTOR_VERSION = require('../package.json').version;
 export const DOCTOR_CHECK_IDS = ['node', 'git', 'forge', 'anvil', 'cast', 'foundry-version', 'foundry-exit-code', 'slither', 'aderyn', 'env-tracked', 'vendor'];
 export const NODE_MIN_MAJOR = 22;
 export const SLITHER_PIN = '0.11.6';
+/**
+ * @deprecated Cyfrin retired Aderyn in November 2026 and withdrew its binaries and npm archives, so
+ * CI no longer runs it and doctor no longer compares against a pin. Kept so imports of 0.2.4 still resolve.
+ */
 export const ADERYN_PIN = '0.6.8';
 const FOUNDRY_TOOLS = ['forge', 'anvil', 'cast'];
 /** The flag no Foundry binary knows. clap exits 2 on it; the npm shim exits 0. */
@@ -160,20 +164,34 @@ export async function runDoctor(opts = {}) {
         const concrete = shims.map((t) => (found[t].real ? `ln -sf ${found[t].real} ${found[t].path}` : null)).filter(Boolean).join(' && ');
         checks.push({ id: 'foundry-exit-code', required: true, status: 'fail', reason: `${detail}. A failed forge build or test reports success through it.`, fix: concrete || fixFor('foundry-exit-code-shim'), kind: 'foundry-exit-code-shim', data: { shims: shims.map((t) => ({ tool: t, path: found[t].path, real: found[t].real })) } });
     }
-    // slither, aderyn (optional)
-    for (const [tool, pin, kind] of [['slither', SLITHER_PIN, 'slither-not-found'], ['aderyn', ADERYN_PIN, 'aderyn-not-found']]) {
-        const path = whichOnPath(tool, env, platform);
+    // slither (optional)
+    {
+        const path = whichOnPath('slither', env, platform);
         if (!path) {
-            checks.push({ id: tool, required: false, status: 'warn', reason: `not found on PATH (optional${tool === 'slither' ? '; pre-flight wants its report before a deploy' : ''}).`, fix: fixFor(kind), kind });
-            continue;
+            checks.push({ id: 'slither', required: false, status: 'warn', reason: 'not found on PATH (optional; pre-flight wants its report before a deploy).', fix: fixFor('slither-not-found'), kind: 'slither-not-found' });
+        }
+        else {
+            const v = await toolVersion(path);
+            if (!v.version)
+                checks.push({ id: 'slither', required: false, status: 'warn', reason: `${path} did not answer --version (optional).`, fix: fixFor('slither-not-found'), kind: 'slither-not-found', data: { path } });
+            else if (v.version !== SLITHER_PIN)
+                checks.push({ id: 'slither', required: false, status: 'warn', reason: `${v.version} at ${path}; CI pins ${SLITHER_PIN}, so findings may differ.`, fix: null, kind: null, data: { path, version: v.version, pin: SLITHER_PIN } });
+            else
+                checks.push({ id: 'slither', required: false, status: 'pass', reason: `${v.version} at ${path}`, fix: null, kind: null, data: { path, version: v.version } });
+        }
+    }
+    // aderyn: reported, never warned on. Cyfrin retired it in November 2026 and withdrew every install route,
+    // so a missing copy is the normal case and there is nothing for the builder to fix. The id stays so the
+    // report keeps its shape for agents that read it.
+    {
+        const path = whichOnPath('aderyn', env, platform);
+        if (!path) {
+            checks.push({ id: 'aderyn', required: false, status: 'pass', reason: 'not installed, and not needed: Cyfrin retired Aderyn in November 2026; Slither is the analyser CI and pre-flight use.', fix: null, kind: null });
+        }
+        else {
+            const v = await toolVersion(path);
+            checks.push({ id: 'aderyn', required: false, status: 'pass', reason: `${v.version ?? 'a copy'} at ${path}; retired by Cyfrin in November 2026, so CI no longer runs it, but npm run lint:aderyn still does.`, fix: null, kind: null, data: { path, version: v.version } });
         }
-        const v = await toolVersion(path);
-        if (!v.version)
-            checks.push({ id: tool, required: false, status: 'warn', reason: `${path} did not answer --version (optional).`, fix: fixFor(kind), kind, data: { path } });
-        else if (v.version !== pin)
-            checks.push({ id: tool, required: false, status: 'warn', reason: `${v.version} at ${path}; CI pins ${pin}, so findings may differ.`, fix: null, kind: null, data: { path, version: v.version, pin } });
-        else
-            checks.push({ id: tool, required: false, status: 'pass', reason: `${v.version} at ${path}`, fix: null, kind: null, data: { path, version: v.version } });
     }
     // no .env tracked
     if (!gitPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatedpath/preflight",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Pre-flight checks before deploying to Redbelly Network (151 mainnet, 153 testnet): chain ID, deployer verification, Safe admin, compiler pins, secrets in git history, RBNT balance, Slither report.",
   "license": "MIT",
   "repository": {
@@ -40,8 +40,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@gatedpath/agent-rules": "0.2.4",
-    "@gatedpath/chains": "0.2.4"
+    "@gatedpath/agent-rules": "0.2.5",
+    "@gatedpath/chains": "0.2.5"
   },
   "devDependencies": {
     "@types/node": "^22.20.2",