@pareto4/pp-core 1.5.0

package/scripts/check-npm-integrity.cjs

@@ -0,0 +1,215 @@
+'use strict';
+// check-npm-integrity.cjs — Node.js port of scripts/check-npm-integrity.sh
+// Shell-agnostic replacement for the "Dependency integrity gate" CI step.
+// Invoked as: node scripts/check-npm-integrity.cjs [--ignore-extraneous]
+//
+// Parses package-lock.json in cwd and exits non-zero if any package is:
+//   INVALID    — resolved version does not satisfy declared semver range
+//   MISSING    — declared in package.json but absent from lockfile packages map
+//   EXTRANEOUS — marked extraneous: true in lockfile (unless --ignore-extraneous)
+//
+// Exit codes:
+//   0 = clean
+//   1 = integrity drift detected
+//   2 = tool error (lockfile missing, JSON parse failure, unknown arg)
+
+const fs = require('fs');
+const path = require('path');
+
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+// ---- Minimal semver satisfies -----------------------------------------------
+
+function parseVersion(v) {
+  const m = String(v).match(/^(\d+)\.(\d+)\.(\d+)/);
+  if (!m) return null;
+  return [parseInt(m[1], 10), parseInt(m[2], 10), parseInt(m[3], 10)];
+}
+
+function cmpVersion(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function satisfies(installed, range) {
+  range = String(range).trim();
+  if (!range || range === '*' || range === 'latest') return true;
+  if (/^\d/.test(range)) {
+    const iv = parseVersion(installed);
+    const rv = parseVersion(range);
+    if (!iv || !rv) return installed === range;
+    return cmpVersion(iv, rv) === 0;
+  }
+  if (range[0] === '^') {
+    const base = parseVersion(range.slice(1));
+    const inst = parseVersion(installed);
+    if (!base || !inst) return false;
+    if (cmpVersion(inst, base) < 0) return false;
+    if (base[0] > 0) return inst[0] === base[0];
+    if (base[1] > 0) return inst[0] === 0 && inst[1] === base[1];
+    return inst[0] === 0 && inst[1] === 0 && inst[2] === base[2];
+  }
+  if (range[0] === '~') {
+    const tbase = parseVersion(range.slice(1));
+    const tinst = parseVersion(installed);
+    if (!tbase || !tinst) return false;
+    if (cmpVersion(tinst, tbase) < 0) return false;
+    return tinst[0] === tbase[0] && tinst[1] === tbase[1];
+  }
+  const opMatch = range.match(/^(>=|<=|>|<|=)\s*(.+)/);
+  if (opMatch) {
+    const op = opMatch[1];
+    const ov = parseVersion(opMatch[2]);
+    const iv2 = parseVersion(installed);
+    if (!ov || !iv2) return false;
+    const c = cmpVersion(iv2, ov);
+    if (op === '>=') return c >= 0;
+    if (op === '<=') return c <= 0;
+    if (op === '>')  return c > 0;
+    if (op === '<')  return c < 0;
+    if (op === '=')  return c === 0;
+  }
+  if (range.includes(' ')) {
+    return range.split(/\s+/).every(part => satisfies(installed, part));
+  }
+  return installed === range;
+}
+
+function main() {
+  // ---- Argument parsing -------------------------------------------------------
+
+  let ignoreExtraneous = false;
+
+  for (const arg of process.argv.slice(2)) {
+    if (arg === '--ignore-extraneous') {
+      ignoreExtraneous = true;
+    } else if (arg === '--help' || arg === '-h') {
+      process.stdout.write(
+        'Usage: node scripts/check-npm-integrity.cjs [--ignore-extraneous]\n'
+      );
+      return 0;
+    } else {
+      process.stderr.write(`ERROR: Unknown argument: ${arg}\n`);
+      throw new ExitError(2);
+    }
+  }
+
+  // ---- Locate lockfile --------------------------------------------------------
+
+  const lockfilePath = path.join(process.cwd(), 'package-lock.json');
+
+  if (!fs.existsSync(lockfilePath)) {
+    process.stderr.write(`ERROR: package-lock.json not found in ${process.cwd()}\n`);
+    throw new ExitError(2);
+  }
+
+  // ---- Parse lockfile ---------------------------------------------------------
+
+  let lock;
+  try {
+    lock = JSON.parse(fs.readFileSync(lockfilePath, 'utf-8'));
+  } catch (e) {
+    process.stderr.write(`ERROR: Failed to parse package-lock.json: ${e.message}\n`);
+    throw new ExitError(2);
+  }
+
+  const lockVersion = lock.lockfileVersion || 1;
+  if (lockVersion < 2) {
+    process.stderr.write(
+      `ERROR: package-lock.json lockfileVersion ${lockVersion} is not supported. ` +
+      'Run `npm install` to upgrade to v3.\n'
+    );
+    throw new ExitError(2);
+  }
+
+  const packages = lock.packages || {};
+  const rootEntry = packages[''] || {};
+
+  // Collect declared dependency ranges from root entry.
+  const declaredRanges = {};
+  for (const field of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+    for (const [name, range] of Object.entries(rootEntry[field] || {})) {
+      if (!declaredRanges[name]) declaredRanges[name] = range;
+    }
+  }
+
+  // ---- Walk packages map ------------------------------------------------------
+
+  const invalids = [];
+  const missings = [];
+  const extraneousFound = [];
+
+  for (const [key, entry] of Object.entries(packages)) {
+    if (!key.startsWith('node_modules/')) continue;
+    const rest = key.slice('node_modules/'.length);
+    const isScoped = rest[0] === '@';
+    const slashCount = (rest.match(/\//g) || []).length;
+    if (isScoped && slashCount > 1) continue;
+    if (!isScoped && slashCount > 0) continue;
+
+    const pkgName = rest;
+    const installedVersion = entry.version || '';
+
+    if (entry.extraneous) {
+      extraneousFound.push({ name: pkgName, version: installedVersion });
+      continue;
+    }
+
+    if (!declaredRanges[pkgName]) continue;
+
+    if (!satisfies(installedVersion, declaredRanges[pkgName])) {
+      invalids.push({ name: pkgName, version: installedVersion, declared: declaredRanges[pkgName] });
+    }
+  }
+
+  for (const name of Object.keys(declaredRanges)) {
+    if (!packages[`node_modules/${name}`]) {
+      missings.push({ name, required: declaredRanges[name] });
+    }
+  }
+
+  // ---- Verdict ----------------------------------------------------------------
+
+  const failInvalid = invalids.length > 0;
+  const failMissing = missings.length > 0;
+  const failExtra   = !ignoreExtraneous && extraneousFound.length > 0;
+
+  if (!failInvalid && !failMissing && !failExtra) {
+    process.stderr.write('check-npm-integrity.cjs: clean\n');
+    return 0;
+  }
+
+  const lines = ['FAIL: dependency integrity drift detected', ''];
+
+  if (failInvalid) {
+    lines.push('  INVALID (installed version does not satisfy declared range):');
+    for (const { name, declared, version } of invalids) {
+      lines.push(`    ${name}: declared=${declared}  installed=${version}`);
+    }
+    lines.push('');
+  }
+
+  if (failMissing) {
+    lines.push('  MISSING (declared but absent from lockfile packages map):');
+    for (const { name, required } of missings) {
+      lines.push(`    ${name}@${required}`);
+    }
+    lines.push('');
+  }
+
+  if (failExtra) {
+    lines.push('  EXTRANEOUS (in lockfile but not declared as a dependency):');
+    for (const { name, version } of extraneousFound) {
+      lines.push(`    ${name}@${version}`);
+    }
+    lines.push('');
+  }
+
+  lines.push('Remediation: rm -rf node_modules && npm ci');
+  process.stderr.write(lines.join('\n') + '\n');
+  throw new ExitError(1);
+}
+
+runMain(main);

package/scripts/ci-guard-runner.cjs

@@ -0,0 +1,22 @@
+'use strict';
+// ci-guard-runner.cjs — Assert the current runner is github-hosted.
+// Replaces the inline bash "Guard — require GitHub-hosted runner" step.
+// Shell-agnostic: invoked as `node scripts/ci-guard-runner.cjs` from any shell.
+//
+// Exit 0 = github-hosted runner confirmed.
+// Exit 1 = not a github-hosted runner (emits GitHub Actions error annotation).
+
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const env = process.env.RUNNER_ENVIRONMENT || '';
+
+function main() {
+  if (env !== 'github-hosted') {
+    throw new ExitError(
+      1,
+      `::error::Expected github-hosted runner. RUNNER_ENVIRONMENT=${env || 'unset'}`
+    );
+  }
+}
+
+runMain(main);

package/scripts/ci-prepare-test-scope.cjs

@@ -0,0 +1,93 @@
+'use strict';
+// ci-prepare-test-scope.cjs — Write .ci-selected-tests.txt for scoped CI runs.
+// Replaces the inline bash "Prepare scoped test list" step.
+// Shell-agnostic: invoked as `node scripts/ci-prepare-test-scope.cjs` from any shell.
+//
+// Required environment variables (set by the workflow step's `env:` block):
+//   TEST_SCOPE       — "windows" | "targeted"
+//   TARGETED_TESTS   — space-separated test file list (from ci-test-scope.cjs output)
+//   WINDOWS_TESTS    — space-separated test file list for the windows lane
+//
+// Writes: .ci-selected-tests.txt (one file per line, no blanks)
+// Exit 0 = success; exit 1 = unknown scope.
+
+const fs = require('fs');
+const path = require('path');
+
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+// Suite sentinels understood by run-tests.cjs (scripts/run-tests.cjs SUITES).
+// A sentinel resolves to its live file set at run time, so — unlike an explicit
+// filename — it can never reference a since-deleted test file.
+const SUITE_SENTINELS = ['all', 'unit', 'integration', 'install', 'security', 'slow'];
+
+// Fast smoke set used when scope detection yields no targeted tests. Each entry
+// MUST resolve via run-tests.cjs: an existing repo-relative test file or a
+// SUITE_SENTINELS token. A stale filename here (a test deleted by a refactor)
+// is exactly what broke CI in #1329 — `tests/core.test.cjs`, deleted in #1291,
+// was still listed and crashed every scoped lane that hit this fallback. The
+// parity guard in tests/bug-641-files-from-suite-token.test.cjs fails the
+// moment an entry stops resolving; resolveSelection() filters at write time so
+// a stale entry degrades instead of crashing the lane.
+const FALLBACK = [
+  'tests/command-contract.test.cjs',
+  'tests/commands.test.cjs',
+  'tests/package-manifest.test.cjs',
+];
+
+// Last-resort selector when every FALLBACK entry has been deleted: the whole
+// unit suite, resolved live by run-tests.cjs (the #408/#641 sentinel path).
+const FALLBACK_SENTINEL = 'unit';
+
+// An entry is runnable if it is a suite sentinel or an existing file under root.
+function isResolvable(entry, root) {
+  return SUITE_SENTINELS.includes(entry) || fs.existsSync(path.join(root, entry));
+}
+
+// Resolve the scoped test selection for the lane. Pure (no I/O beyond the
+// existence probe under `root`) so it can be unit-tested directly.
+function resolveSelection({ scope, targeted, windows, root }) {
+  let selected;
+  if (scope === 'windows') {
+    selected = windows;
+  } else if (scope === 'targeted') {
+    selected = targeted;
+  } else {
+    throw new ExitError(1, `::error::Unknown test scope: ${scope}`);
+  }
+
+  // Detected list passes through verbatim: affected-tests-lib.cjs already filters
+  // deleted files, and the list may legitimately carry a suite sentinel.
+  const detected = (selected || '').split(/\s+/).filter(Boolean);
+  if (detected.length > 0) {
+    return detected;
+  }
+
+  // Empty detection → smoke fallback, existence-filtered so a stale entry can
+  // never crash the scoped lane (#1329). If nothing survives, use the unit
+  // sentinel, which run-tests.cjs always resolves.
+  const survivors = FALLBACK.filter((f) => isResolvable(f, root));
+  return survivors.length > 0 ? survivors : [FALLBACK_SENTINEL];
+}
+
+function main() {
+  const root = process.cwd();
+  const lines = resolveSelection({
+    scope: process.env.TEST_SCOPE || '',
+    targeted: process.env.TARGETED_TESTS || '',
+    windows: process.env.WINDOWS_TESTS || '',
+    root,
+  });
+
+  const content = lines.join('\n') + '\n';
+  fs.writeFileSync(path.join(root, '.ci-selected-tests.txt'), content, 'utf-8');
+
+  process.stdout.write('Scoped tests:\n');
+  process.stdout.write(content);
+}
+
+if (require.main === module) {
+  runMain(main);
+}
+
+module.exports = { FALLBACK, FALLBACK_SENTINEL, SUITE_SENTINELS, resolveSelection, main };

package/scripts/ci-rebase-check.cjs

@@ -0,0 +1,86 @@
+'use strict';
+// ci-rebase-check.cjs — Merge the PR base branch into the current PR head.
+// Replaces the inline bash "Rebase check — merge PR base branch into PR head" step.
+// Shell-agnostic: invoked as `node scripts/ci-rebase-check.cjs` from any shell.
+//
+// Required environment variables (set by the workflow step's `env:` block):
+//   GITHUB_TOKEN    — access token for remote set-url
+//   GITHUB_BASE_REF — PR base branch name (set by GitHub Actions on pull_request events)
+//   GITHUB_REPOSITORY — owner/repo (set by GitHub Actions)
+//
+// Exit 0 = merged cleanly (or merge was a no-op).
+// Exit 1 = merge conflict or fetch failure.
+
+const { execFileSync } = require('child_process');
+
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+function run(cmd, args, opts) {
+  try {
+    execFileSync(cmd, args, { stdio: 'inherit', ...opts });
+    return true; // success sentinel; execFileSync returns null with stdio:'inherit'
+  } catch (e) {
+    return false;
+  }
+}
+
+function runOrThrow(cmd, args, label) {
+  try {
+    execFileSync(cmd, args, { stdio: 'inherit' });
+  } catch (e) {
+    throw new ExitError(1, `::error::${label} failed`);
+  }
+}
+
+const token = process.env.GITHUB_TOKEN || '';
+const baseBranch = process.env.GITHUB_BASE_REF || 'main';
+const repo = process.env.GITHUB_REPOSITORY || '';
+
+function main() {
+  // Configure git identity (needed for merge commit).
+  runOrThrow('git', ['config', 'user.email', 'ci@gsd-redux'], 'git config user.email');
+  runOrThrow('git', ['config', 'user.name', 'CI Rebase Check'], 'git config user.name');
+
+  // Set authenticated remote URL.
+  if (token && repo) {
+    runOrThrow(
+      'git',
+      ['remote', 'set-url', 'origin', `https://x-access-token:${token}@github.com/${repo}.git`],
+      'git remote set-url'
+    );
+  }
+
+  // Fetch base branch with retry.
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    const result = run('git', ['fetch', 'origin', baseBranch]);
+    if (result) {
+      break;
+    }
+    if (attempt === 3) {
+      throw new ExitError(1, `::error::git fetch origin ${baseBranch} failed after 3 attempts.`);
+    }
+    // Wait before retry: attempt * 4 seconds.
+    const waitMs = attempt * 4000;
+    const deadline = Date.now() + waitMs;
+    while (Date.now() < deadline) { /* busy wait, acceptable in CI */ }
+  }
+
+  // Attempt merge.
+  try {
+    execFileSync('git', ['merge', '--no-edit', '--no-ff', `origin/${baseBranch}`], { stdio: 'inherit' });
+  } catch (e) {
+    process.stderr.write(
+      `::error::This PR cannot cleanly merge origin/${baseBranch}. Rebase your branch onto current ${baseBranch} and push again.\n`
+    );
+    process.stderr.write('::error::Conflicting files:\n');
+    try {
+      execFileSync('git', ['diff', '--name-only', '--diff-filter=U'], { stdio: 'inherit' });
+    } catch (_) { /* ignore */ }
+    try {
+      execFileSync('git', ['merge', '--abort'], { stdio: 'inherit' });
+    } catch (_) { /* ignore */ }
+    throw new ExitError(1);
+  }
+}
+
+runMain(main);