@hasna/recordings 0.4.0 → 0.5.0

package/scripts/ci-linux-suite.ts

@@ -29,6 +29,7 @@
  *
  * Usage:
  *   bun scripts/ci-linux-suite.ts --check                 validate the quarantine file, print counts
+ *   bun scripts/ci-linux-suite.ts --all                   every discovered tracked test, including quarantine
  *   bun scripts/ci-linux-suite.ts --gated                 newline-separated gated files
  *   bun scripts/ci-linux-suite.ts --quarantined           newline-separated quarantined files
  *   bun scripts/ci-linux-suite.ts --verify-run <log>      assert a gated run honoured the partition
@@ -41,6 +42,13 @@ import { spawnSync } from "node:child_process";
 export const QUARANTINE_FILE = ".github/linux-quarantine.txt";
 
 const TEST_SUFFIX = ".test.ts";
+const BUN_TEST_SUFFIX = /[._](?:test|spec)\.(?:[cm]?[jt]sx?)$/;
+
+function supportedTestFiles(paths: string[]): string[] {
+  const unsupported = paths.filter(path => BUN_TEST_SUFFIX.test(path) && !path.endsWith(TEST_SUFFIX));
+  if (unsupported.length) throw new Error(`unsupported test suffix; extend discovery and JUnit contracts before adding:\n${unsupported.join("\n")}`);
+  return paths.filter(path => path.endsWith(TEST_SUFFIX));
+}
 
 /** Directories never worth walking. `.build` holds SwiftPM output, which can be enormous. */
 const SKIPPED_DIRS = new Set([".git", "node_modules", ".build", "dist"]);
@@ -92,7 +100,7 @@ export function entriesMissingReason(text: string): string[] {
  * in the working tree.
  */
 export function testFilesFromGit(repoRoot: string): string[] {
-  const result = spawnSync("git", ["-C", repoRoot, "ls-files", "-z", `*${TEST_SUFFIX}`], {
+  const result = spawnSync("git", ["-C", repoRoot, "ls-files", "-z"], {
     encoding: "utf8",
   });
   if (result.status !== 0) {
@@ -100,7 +108,7 @@ export function testFilesFromGit(repoRoot: string): string[] {
   }
   // -z because a path may legally contain a newline, and a newline-split enumeration would report
   // one such path as two missing files — a disagreement that reads as a broken walker.
-  return result.stdout.split("\0").filter((path) => path.length > 0).sort();
+  return supportedTestFiles(result.stdout.split("\0").filter((path) => path.length > 0)).sort();
 }
 
 /**
@@ -118,13 +126,13 @@ export function testFilesFromWalk(repoRoot: string): string[] {
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
         walk(absolute);
-      } else if (entry.isFile() && entry.name.endsWith(TEST_SUFFIX)) {
+      } else if (entry.isFile()) {
         found.push(relative(repoRoot, absolute).split(sep).join("/"));
       }
     }
   };
   walk(repoRoot);
-  return found.sort();
+  return supportedTestFiles(found).sort();
 }
 
 export type DiscoveryDisagreement = { trackedNotOnDisk: string[]; onDiskUntracked: string[] };
@@ -257,7 +265,7 @@ function fail(message: string): never {
   process.exit(1);
 }
 
-function loadPartition(repoRoot: string): Partition & { discovered: string[] } {
+function loadPartition(repoRoot: string, requireNonemptyGated = true): Partition & { discovered: string[] } {
   const fromGit = testFilesFromGit(repoRoot);
   const { trackedNotOnDisk, onDiskUntracked } = compareDiscovery(fromGit, testFilesFromWalk(repoRoot));
   if (trackedNotOnDisk.length > 0) {
@@ -293,16 +301,14 @@ function loadPartition(repoRoot: string): Partition & { discovered: string[] } {
   } catch (error) {
     fail(error instanceof Error ? error.message : String(error));
   }
-  if (split.gated.length === 0) {
+  if (requireNonemptyGated && split.gated.length === 0) {
     fail(
       `Every discovered test file is quarantined by ${QUARANTINE_FILE}. The gate would run nothing.`,
     );
   }
-  // The workflow expands `--gated` unquoted so the runner receives one argument per file, which is
-  // only safe while no path contains whitespace. Asserting it here keeps that assumption in the
-  // same place as the list, instead of leaving a shell-quoting bug to be discovered by a suite that
-  // silently stopped being gated.
-  const whitespace = split.gated.filter((path) => /\s/.test(path));
+  // Keep the established newline/shell-safe manifest contract in both selections.
+  // Quarantined paths are still executable inputs to the explicit all-tests mode.
+  const whitespace = fromGit.filter((path) => /\s/.test(path));
   if (whitespace.length > 0) {
     fail(
       "Test paths containing whitespace cannot be passed through unquoted word splitting:\n" +
@@ -318,8 +324,12 @@ function main(argv: string[]): void {
     fail(`Run this from the repository root; ${QUARANTINE_FILE} is not there.`);
   }
   const mode = argv[0];
-  const { gated, quarantined, discovered } = loadPartition(repoRoot);
+  const { gated, quarantined, discovered } = loadPartition(repoRoot, mode !== "--all");
 
+  if (mode === "--all") {
+    console.log(discovered.join("\n"));
+    return;
+  }
   if (mode === "--gated") {
     console.log(gated.join("\n"));
     return;
@@ -395,7 +405,7 @@ function main(argv: string[]): void {
     }
     return;
   }
-  fail("usage: --check | --gated | --quarantined | --verify-run <junit.xml>");
+  fail("usage: --check | --all | --gated | --quarantined | --verify-run <junit.xml>");
 }
 
 if (import.meta.main) {

package/scripts/macos_artifact.ts

@@ -1385,41 +1385,48 @@ export function verifyAndExtractArchiveDescriptors(
     throw new Error("artifact verifier archive digest mismatch");
   }
   const entries = inspectZipArchiveBytes(archive);
-  const outputRoot = `/dev/fd/${outputDirectoryDescriptor}`;
-  if (readdirSync(outputRoot).length !== 0) {
-    throw new Error("artifact verifier output directory must be empty");
-  }
-  const ordered = [...entries].sort((left, right) => {
-    const depth = left.name.split("/").length - right.name.split("/").length;
-    if (depth !== 0) return depth;
-    if (left.isDirectory !== right.isDirectory) return left.isDirectory ? -1 : 1;
-    return compareUnsignedUtf8(left.name, right.name);
-  });
-  for (const entry of ordered) {
-    const leaf = entry.isDirectory ? entry.name.slice(0, -1) : entry.name;
-    const target = join(outputRoot, ...leaf.split("/"));
-    const mode = entry.unixMode & 0o777;
-    if (entry.isDirectory) {
-      mkdirSync(target, { mode });
-      chmodSync(target, mode);
-      continue;
-    }
-    const descriptor = openSync(
-      target,
-      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
-      mode,
-    );
-    try {
-      const payload = zipEntryPayload(archive, entry);
-      let offset = 0;
-      while (offset < payload.length) offset += writeSync(descriptor, payload, offset);
-      fchmodSync(descriptor, mode);
-      fsyncSync(descriptor);
-    } finally {
-      closeSync(descriptor);
+  // /dev/fd/<directory>/child is not traversable on Darwin. Keep all
+  // extraction relative to the borrowed capability, including every ancestor.
+  const guard = nativeFsGuard();
+  const outputRoot = guard.duplicateDirectoryDescriptor(outputDirectoryDescriptor);
+  try {
+    if (guard.readDir(outputRoot).length !== 0) {
+      throw new Error("artifact verifier output directory must be empty");
+    }
+    const ordered = [...entries].sort((left, right) => {
+      const depth = left.name.split("/").length - right.name.split("/").length;
+      if (depth !== 0) return depth;
+      if (left.isDirectory !== right.isDirectory) return left.isDirectory ? -1 : 1;
+      return compareUnsignedUtf8(left.name, right.name);
+    });
+    for (const entry of ordered) {
+      const parts = (entry.isDirectory ? entry.name.slice(0, -1) : entry.name).split("/");
+      const leaf = parts.pop()!;
+      let parent = outputRoot;
+      try {
+        // Close each ancestor as we descend; even a large ZIP keeps only a
+        // bounded number of descriptors open. openDirAt refuses symlinks.
+        for (const component of parts) {
+          const ancestor = parent;
+          parent = guard.openDirAt(ancestor, component);
+          if (ancestor !== outputRoot) guard.close(ancestor);
+        }
+        const mode = entry.unixMode & 0o777;
+        if (entry.isDirectory) {
+          const directory = guard.mkdirAt(parent, leaf, mode);
+          guard.close(directory);
+        } else {
+          guard.writeFileAt(parent, leaf, zipEntryPayload(archive, entry), mode);
+        }
+        guard.fsyncHandle(parent);
+      } finally {
+        if (parent !== outputRoot) guard.close(parent);
+      }
     }
+    guard.fsyncHandle(outputRoot);
+  } finally {
+    guard.close(outputRoot);
   }
-  fsyncSync(outputDirectoryDescriptor);
 }
 
 export function withPrivatelyExtractedArchiveApp<T>(

package/scripts/native/recordings_fs_guard.c

@@ -5,6 +5,7 @@
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <limits.h>
 #include <stdint.h>
 #include <stdbool.h>
 #include <signal.h>
@@ -314,6 +315,32 @@ static napi_value open_trusted_home(napi_env env, napi_callback_info info) {
   return make_handle(env, fd);
 }
 
+static napi_value duplicate_directory_descriptor(napi_env env, napi_callback_info info) {
+  napi_value argv[1];
+  size_t argc = 1;
+  double descriptor;
+  if (!check_napi(env, napi_get_cb_info(env, info, &argc, argv, NULL, NULL), "duplicateDirectoryDescriptor args") || argc != 1 ||
+      !check_napi(env, napi_get_value_double(env, argv[0], &descriptor), "read directory descriptor")) return NULL;
+  if (!(descriptor >= 0 && descriptor <= INT_MAX) || descriptor != (int)descriptor) {
+    throw_message(env, "INVALID_DESCRIPTOR", "directory descriptor must be a non-negative integer");
+    return NULL;
+  }
+  // Borrow the caller's capability, never its path or ownership of the fd.
+  int fd = fcntl((int)descriptor, F_DUPFD_CLOEXEC, 0);
+  if (fd < 0) { throw_errno(env, "duplicate directory descriptor"); return NULL; }
+  struct stat details;
+  if (fstat(fd, &details) != 0) {
+    int saved_errno = errno;
+    close(fd); errno = saved_errno; throw_errno(env, "stat duplicated directory"); return NULL;
+  }
+  if (!S_ISDIR(details.st_mode)) {
+    close(fd);
+    throw_message(env, "INVALID_DESCRIPTOR", "descriptor must reference a directory");
+    return NULL;
+  }
+  return make_handle(env, fd);
+}
+
 static napi_value open_dir_at(napi_env env, napi_callback_info info) {
   napi_value argv[2];
   size_t argc = 2;
@@ -370,8 +397,13 @@ static napi_value read_dir(napi_env env, napi_callback_info info) {
   if (stream == NULL) { close(iterator_fd); throw_errno(env, "open directory stream"); return NULL; }
   if (!check_napi(env, napi_create_array(env, &array), "create directory array")) { closedir(stream); return NULL; }
   uint32_t index = 0;
-  errno = 0;
-  for (struct dirent *entry = readdir(stream); entry != NULL; entry = readdir(stream)) {
+  int saved_errno = 0;
+  for (;;) {
+    /* EOF preserves errno. Successful N-API work in the preceding iteration
+     * need not preserve it, so only the immediately following read owns it. */
+    errno = 0;
+    struct dirent *entry = readdir(stream);
+    if (entry == NULL) { saved_errno = errno; break; }
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) continue;
     if (!valid_leaf(entry->d_name)) {
       closedir(stream);
@@ -385,7 +417,6 @@ static napi_value read_dir(napi_env env, napi_callback_info info) {
       return NULL;
     }
   }
-  int saved_errno = errno;
   closedir(stream);
   if (saved_errno != 0) { errno = saved_errno; throw_errno(env, "read directory capability"); return NULL; }
   return array;
@@ -717,7 +748,7 @@ static napi_value write_file_at(napi_env env, napi_callback_info info) {
     }
     offset += (size_t)count;
   }
-  if (fsync(fd) != 0) {
+  if (fchmod(fd, (mode_t)(mode & 0777)) != 0 || fsync(fd) != 0) {
     saved_errno = errno; close(fd); errno = saved_errno; throw_errno(env, "fsync written file"); return NULL;
   }
   if (close(fd) != 0) { throw_errno(env, "close written file"); return NULL; }
@@ -1132,6 +1163,7 @@ static napi_value unlink_file_handle_at(napi_env env, napi_callback_info info) {
 
 static napi_value init(napi_env env, napi_value exports) {
   const napi_property_descriptor properties[] = {
+    { "duplicateDirectoryDescriptor", NULL, duplicate_directory_descriptor, NULL, NULL, NULL, napi_default, NULL },
     { "openTrustedHome", NULL, open_trusted_home, NULL, NULL, NULL, napi_default, NULL },
     { "openDirAt", NULL, open_dir_at, NULL, NULL, NULL, napi_default, NULL },
     { "openRegularAt", NULL, open_regular_at, NULL, NULL, NULL, napi_default, NULL },

package/scripts/native-core-receipt.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""Describe reviewed npm bytes; registry verification is an explicit read-only step."""
+import argparse
+import base64
+import hashlib
+import io
+import json
+import pathlib
+import re
+import subprocess
+import tarfile
+import urllib.request
+from datetime import datetime, timezone
+
+PACKAGE = '@hasna/recordings'
+CORE = 'src/native/Recordings/'
+REGISTRY = 'https://registry.npmjs.org/'
+LIMIT = 128 * 1024 * 1024
+
+
+def digest(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def read_archive(blob):
+    if not blob or len(blob) > LIMIT:
+        raise ValueError('Archive size is outside the allowed range')
+    files = {}
+    total = 0
+    seen = set()
+    with tarfile.open(fileobj=io.BytesIO(blob), mode='r:*') as archive:
+        for member in archive:
+            parts = member.name.rstrip('/').split('/')
+            if (len(seen) >= 20000 or member.name in seen or len(member.name) > 1024
+                    or parts[0] != 'package' or any(p in ('', '.', '..') for p in parts)
+                    or '\\' in member.name or any(ord(c) < 32 for c in member.name)
+                    or not (member.isfile() or member.isdir())):
+                raise ValueError('Archive contains an unsafe or duplicate entry')
+            seen.add(member.name)
+            if member.isdir():
+                continue
+            total += member.size
+            if member.size > LIMIT or total > LIMIT * 2:
+                raise ValueError('Expanded archive is too large')
+            handle = archive.extractfile(member)
+            if handle is None:
+                raise ValueError('Archive member cannot be read')
+            data = handle.read(member.size + 1)
+            if len(data) != member.size:
+                raise ValueError('Archive member is truncated')
+            files['/'.join(parts[1:])] = (data, member.mode & 0o777)
+    return files
+
+
+def create_receipt(blob, revision):
+    if not re.fullmatch('[a-f0-9]{40}', revision):
+        raise ValueError('A full public source revision is required')
+    files = read_archive(blob)
+    try:
+        package = json.loads(files['package.json'][0])
+        version = package['version']
+        if package['name'] != PACKAGE or not re.fullmatch(r'\d+\.\d+\.\d+', version):
+            raise ValueError('Unexpected package identity')
+        manifest = files[CORE + 'Package.swift'][0].decode()
+        for required in ('Package.resolved', 'RecordingsLib/RecordingEngine.swift', 'RecordingsLib/RecordingProvider.swift'):
+            if CORE + required not in files:
+                raise ValueError('Required native source is missing')
+        if (not re.search(r'\.library\(\s*name:\s*"RecordingsLib"\s*,\s*targets:\s*\["RecordingsLib"\]', manifest)
+                or not re.search(r'swift-tools-version:\s*6\.2\b', manifest)
+                or not re.search(r'\.macOS\(\s*\.v26\s*\)', manifest)):
+            raise ValueError('Required Swift library or platform declaration is missing')
+    except (KeyError, TypeError, UnicodeError, json.JSONDecodeError) as error:
+        raise ValueError('Invalid native package metadata') from error
+    native = [{'path': path[len(CORE):], 'sha256': digest(data), 'bytes': len(data), 'mode': mode}
+              for path, (data, mode) in sorted(files.items()) if path.startswith(CORE)]
+    tree = ''.join(f"{f['path']}\0{f['mode']:o}\0{f['bytes']}\0{f['sha256']}\n" for f in native).encode()
+    return {
+        'schemaVersion': 1, 'kind': 'hasna.recordings.native-core',
+        'package': {'name': PACKAGE, 'version': version},
+        'source': {'repository': 'https://github.com/hasna/apps', 'revision': revision},
+        'distribution': {'status': 'prepared'},
+        'archive': {'url': REGISTRY + '@hasna/recordings/-/recordings-' + version + '.tgz',
+                    'bytes': len(blob), 'sha256': digest(blob),
+                    'integrity': 'sha512-' + base64.b64encode(hashlib.sha512(blob).digest()).decode()},
+        'native': {'packagePath': CORE.rstrip('/'), 'product': 'RecordingsLib',
+                   'swiftToolsVersion': '6.2', 'minimumMacOS': '26.0',
+                   'treeSHA256': digest(tree), 'files': native},
+    }
+
+
+class NoRedirects(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        raise ValueError('Registry redirects are not accepted')
+
+
+def registry_bytes(url):
+    if not url.startswith(REGISTRY):
+        raise ValueError('Unexpected registry authority')
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirects())
+    with opener.open(url, timeout=30) as response:
+        data = response.read(LIMIT + 1)
+        if len(data) > LIMIT:
+            raise ValueError('Registry response is too large')
+        return data
+
+
+def verify_registry(receipt, fetch=registry_bytes):
+    version = receipt['package']['version']
+    metadata = json.loads(fetch(REGISTRY + '@hasna%2Frecordings/' + version))
+    if (metadata.get('name') != PACKAGE or metadata.get('version') != version
+            or metadata.get('dist', {}).get('tarball') != receipt['archive']['url']
+            or metadata.get('dist', {}).get('integrity') != receipt['archive']['integrity']):
+        raise ValueError('Registry metadata differs from the reviewed archive')
+    remote = fetch(receipt['archive']['url'])
+    if len(remote) != receipt['archive']['bytes'] or digest(remote) != receipt['archive']['sha256']:
+        raise ValueError('Registry archive differs from the reviewed bytes')
+    receipt['distribution'] = {'status': 'published', 'registry': REGISTRY,
+                               'verifiedAt': datetime.now(timezone.utc).isoformat()}
+
+
+def verify_source(receipt, repository):
+    revision = receipt['source']['revision']
+    prefix = 'apps/recordings/' + CORE
+    result = subprocess.run(['git', '-c', 'tar.umask=0022', 'archive', '--format=tar', revision, '--', prefix, 'apps/recordings/package.json'],
+                            cwd=repository, check=True, capture_output=True, timeout=30)
+    with tarfile.open(fileobj=io.BytesIO(result.stdout), mode='r:') as archive:
+        package = archive.extractfile('apps/recordings/package.json')
+        metadata = json.load(package) if package else {}
+        if metadata.get('name') != PACKAGE or metadata.get('version') != receipt['package']['version']:
+            raise ValueError('Package version differs from the public source revision')
+        for expected in receipt['native']['files']:
+            try:
+                member = archive.getmember(prefix + expected['path'])
+                handle = archive.extractfile(member)
+                data = handle.read() if handle else b''
+            except KeyError as error:
+                raise ValueError('Native archive member is absent from the source revision') from error
+            if (not member.isfile() or len(data) != expected['bytes'] or digest(data) != expected['sha256']
+                    or member.mode & 0o777 != expected['mode']):
+                raise ValueError('Native archive bytes differ from the public source revision')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('archive', type=pathlib.Path)
+    parser.add_argument('--source-revision', required=True)
+    parser.add_argument('--repository', type=pathlib.Path, default=pathlib.Path(__file__).resolve().parents[3])
+    parser.add_argument('--output', required=True, type=pathlib.Path)
+    parser.add_argument('--verify-registry', action='store_true', help='Compare public registry bytes; does not publish')
+    args = parser.parse_args()
+    if args.archive.is_symlink() or not args.archive.is_file() or args.archive.stat().st_size > LIMIT:
+        raise ValueError('Expected a regular bounded npm archive')
+    blob = args.archive.read_bytes()
+    receipt = create_receipt(blob, args.source_revision)
+    verify_source(receipt, args.repository)
+    if args.verify_registry:
+        verify_registry(receipt)
+    # Refuse replacement: a new verification writes a separate reviewable receipt.
+    with args.output.open('x') as output:
+        json.dump(receipt, output, indent=2)
+        output.write('\n')
+    print(json.dumps({'status': receipt['distribution']['status'], 'package': receipt['package'],
+                      'archiveSHA256': receipt['archive']['sha256'], 'nativeTreeSHA256': receipt['native']['treeSHA256']}))
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except Exception:
+        # Exception messages can contain local paths or registry/credential diagnostics.
+        raise SystemExit('Native core receipt verification failed; no published receipt was produced.')

package/scripts/native_fs_guard.ts

@@ -16,6 +16,7 @@ export type NativeMetadata = {
 export type NativeHandle = object;
 
 export type NativeFsGuard = {
+  duplicateDirectoryDescriptor(descriptor: number): NativeHandle;
   openTrustedHome(path: string, uid: number): NativeHandle;
   openDirAt(parent: NativeHandle, leaf: string): NativeHandle;
   openRegularAt(
@@ -122,6 +123,7 @@ export function nativeFsGuard(): NativeFsGuard {
   }
   const loaded = createRequire(import.meta.url)(path) as Partial<NativeFsGuard>;
   for (const name of [
+    "duplicateDirectoryDescriptor",
     "openTrustedHome",
     "openDirAt",
     "openRegularAt",