@quolu/lattice 0.1.0

package/src/factory-diagnostics.mjs

@@ -0,0 +1,187 @@
+import { readFile, lstat } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * dotagents工場の native factory diagnostics 面（親plan L6要件）。
+ *
+ * - schema `lattice.native_factory_diagnostics.v1`: exact key・bounded・秘密なしJSON。
+ * - read-only: provider・network・run store書込・index生成を一切行わない。
+ * - 非0意味論: overall `failed` → exit 1。CLI usage違反は既存contractどおり exit 2。
+ * - 既存 `doctor --json`（bootstrap diagnostics・RC3特性化で凍結）は変更しない加算面。
+ */
+
+const SCHEMA = 'lattice.native_factory_diagnostics.v1';
+const PRODUCT = 'lattice';
+const MAX_DETAIL_LENGTH = 256;
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const UNKNOWN_VERSION_SENTINEL = '0.0.0-unknown';
+const NODE_VERSION_PATTERN = /^v(\d+)\.(\d+)\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+const ENGINES_FLOOR_PATTERN = /^>=(\d+)(?:\.(\d+))?(?:\.\d+)?$/;
+const CHECK_IDS = Object.freeze([
+  'package_version',
+  'node_runtime',
+  'cli_surface',
+  'mcp_entry',
+  'sensor_attribution',
+]);
+
+const rootDirDefault = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    && Object.getPrototypeOf(value) === Object.prototype;
+}
+
+function hasExactKeys(value, keys) {
+  const actualKeys = Object.keys(value).sort();
+  const expectedKeys = [...keys].sort();
+  return actualKeys.length === expectedKeys.length
+    && actualKeys.every((key, index) => key === expectedKeys[index]);
+}
+
+function check(id, ok, detail) {
+  return { id, status: ok ? 'ok' : 'failed', detail: String(detail).slice(0, MAX_DETAIL_LENGTH) };
+}
+
+async function isNonEmptyFile(absolutePath) {
+  try {
+    const stats = await lstat(absolutePath);
+    return stats.isFile() && stats.size > 0;
+  } catch {
+    return false;
+  }
+}
+
+function checkPackageVersion(packageJson) {
+  const version = packageJson?.version;
+  if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {
+    return check('package_version', false, 'package.json version is missing or not semver');
+  }
+  if (version === UNKNOWN_VERSION_SENTINEL) {
+    // ADR 0049 Decision 3(c): sentinel versionはビルド破損＝沈黙させない。
+    return check('package_version', false, `sentinel version ${UNKNOWN_VERSION_SENTINEL} means a broken build`);
+  }
+  return check('package_version', true, version);
+}
+
+function checkNodeRuntime(nodeVersion, enginesNode) {
+  const runtime = NODE_VERSION_PATTERN.exec(nodeVersion ?? '');
+  if (!runtime) {
+    return check('node_runtime', false, 'node version is unreadable');
+  }
+  const floor = ENGINES_FLOOR_PATTERN.exec(enginesNode ?? '');
+  if (!floor) {
+    return check('node_runtime', false, 'package.json engines.node floor is unreadable');
+  }
+  const [major, minor] = [Number(runtime[1]), Number(runtime[2])];
+  const [floorMajor, floorMinor] = [Number(floor[1]), Number(floor[2] ?? '0')];
+  const satisfied = major > floorMajor || (major === floorMajor && minor >= floorMinor);
+  return check(
+    'node_runtime',
+    satisfied,
+    satisfied ? `${nodeVersion} satisfies engines.node ${enginesNode}` : `${nodeVersion} is below engines.node ${enginesNode}`,
+  );
+}
+
+async function checkCliSurface(rootDir) {
+  try {
+    const runtimeCli = await import(path.join(rootDir, 'src', 'runtime-cli.mjs'));
+    if (typeof runtimeCli.runRuntimeCli !== 'function') {
+      return check('cli_surface', false, 'src/runtime-cli.mjs does not export runRuntimeCli');
+    }
+    return check('cli_surface', true, 'runtime CLI surface loads and exports runRuntimeCli');
+  } catch (error) {
+    return check('cli_surface', false, `runtime CLI failed to load: ${error?.constructor?.name ?? 'Error'}`);
+  }
+}
+
+async function checkMcpEntry(rootDir) {
+  const ok = await isNonEmptyFile(path.join(rootDir, 'bin', 'lattice-mcp.mjs'));
+  return check('mcp_entry', ok, ok ? 'bin/lattice-mcp.mjs is present' : 'bin/lattice-mcp.mjs is missing or empty');
+}
+
+async function checkSensorAttribution(rootDir) {
+  // ADR 0047: fork吸収の受入条件＝MIT license noticeとattributionの維持。
+  const license = await isNonEmptyFile(path.join(rootDir, 'sensor', 'LICENSE'));
+  const notice = await isNonEmptyFile(path.join(rootDir, 'sensor', 'NOTICE'));
+  const ok = license && notice;
+  return check(
+    'sensor_attribution',
+    ok,
+    ok ? 'sensor/LICENSE and sensor/NOTICE are present' : 'sensor/LICENSE or sensor/NOTICE is missing or empty',
+  );
+}
+
+/**
+ * Builds the bounded, read-only native factory diagnostics object.
+ * @param {{ rootDir?: string, nodeVersion?: string }} options
+ * @returns {Promise<object>}
+ */
+export async function buildFactoryDiagnostics({ rootDir = rootDirDefault, nodeVersion = process.version } = {}) {
+  let packageJson = null;
+  try {
+    packageJson = JSON.parse(await readFile(path.join(rootDir, 'package.json'), 'utf8'));
+  } catch {
+    packageJson = null;
+  }
+
+  const checks = [
+    checkPackageVersion(packageJson),
+    checkNodeRuntime(nodeVersion, packageJson?.engines?.node),
+    await checkCliSurface(rootDir),
+    await checkMcpEntry(rootDir),
+    await checkSensorAttribution(rootDir),
+  ];
+
+  const diagnostics = {
+    schema: SCHEMA,
+    product: PRODUCT,
+    version: typeof packageJson?.version === 'string' ? packageJson.version.slice(0, MAX_DETAIL_LENGTH) : UNKNOWN_VERSION_SENTINEL,
+    overall: checks.every((entry) => entry.status === 'ok') ? 'ok' : 'failed',
+    checks,
+  };
+
+  if (!validateFactoryDiagnostics(diagnostics)) {
+    throw new TypeError('invalid factory diagnostics output');
+  }
+
+  return diagnostics;
+}
+
+/**
+ * Strictly validates the public native factory diagnostics schema.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function validateFactoryDiagnostics(value) {
+  if (!isPlainObject(value) || !hasExactKeys(value, ['schema', 'product', 'version', 'overall', 'checks'])) {
+    return false;
+  }
+  if (value.schema !== SCHEMA || value.product !== PRODUCT) {
+    return false;
+  }
+  if (typeof value.version !== 'string' || value.version.length === 0 || value.version.length > MAX_DETAIL_LENGTH) {
+    return false;
+  }
+  if (value.overall !== 'ok' && value.overall !== 'failed') {
+    return false;
+  }
+  if (!Array.isArray(value.checks) || value.checks.length !== CHECK_IDS.length) {
+    return false;
+  }
+  const allOk = value.checks.every((entry) => isPlainObject(entry)
+    && hasExactKeys(entry, ['id', 'status', 'detail'])
+    && (entry.status === 'ok' || entry.status === 'failed')
+    && typeof entry.detail === 'string'
+    && entry.detail.length <= MAX_DETAIL_LENGTH);
+  if (!allOk) {
+    return false;
+  }
+  const ids = value.checks.map((entry) => entry.id);
+  if (ids.some((id, index) => id !== CHECK_IDS[index])) {
+    return false;
+  }
+  const expectedOverall = value.checks.every((entry) => entry.status === 'ok') ? 'ok' : 'failed';
+  return value.overall === expectedOverall;
+}

package/src/isolation-runner.mjs

@@ -0,0 +1,333 @@
+import {
+  lstat,
+  mkdtemp,
+  readdir,
+  readFile,
+  readlink,
+  rm,
+} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+
+function run(command, args, { cwd, allowExitCodes = [0], env } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd,
+      shell: false,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      ...(env === undefined ? {} : { env }),
+    });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on('data', (chunk) => stdout.push(chunk));
+    child.stderr.on('data', (chunk) => stderr.push(chunk));
+    child.once('error', reject);
+    child.once('close', (code, signal) => {
+      const result = { code, signal, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) };
+      if (allowExitCodes.includes(code) && signal === null) resolve(result);
+      else reject(Object.assign(new Error(`${command} failed (${signal ?? code}): ${result.stderr.toString('utf8').trim()}`), result));
+    });
+  });
+}
+
+function bufferDigest(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+const PROTECTED_PATHS = Object.freeze(['src', 'test']);
+
+function verificationReceipt(verifier, result, outcome) {
+  const stdout = Buffer.isBuffer(result?.stdout) ? result.stdout : Buffer.alloc(0);
+  const stderr = Buffer.isBuffer(result?.stderr) ? result.stderr : Buffer.alloc(0);
+  return {
+    command: verifier.command,
+    args: [...verifier.args],
+    outcome,
+    exit_code: Number.isSafeInteger(result?.code) && result.code >= 0 ? result.code : 1,
+    stdout_digest: bufferDigest(stdout),
+    stderr_digest: bufferDigest(stderr),
+  };
+}
+
+function verifierEnvironment() {
+  const env = { ...process.env, NO_COLOR: '1' };
+  delete env.NODE_TEST_CONTEXT;
+  delete env.FORCE_COLOR;
+  return env;
+}
+
+function safeRelativePath(value) {
+  return typeof value === 'string'
+    && value.length > 0
+    && !value.includes('\0')
+    && !path.posix.isAbsolute(value)
+    && value === path.posix.normalize(value)
+    && !value.split('/').includes('..');
+}
+
+function isAllowed(changedPath, allowedPaths) {
+  return allowedPaths.some((allowedPath) => changedPath === allowedPath || changedPath.startsWith(`${allowedPath}/`));
+}
+
+function statusPaths(status) {
+  const fields = status.toString('utf8').split('\0');
+  const paths = [];
+  for (let index = 0; index < fields.length - 1; index += 1) {
+    const entry = fields[index];
+    if (!entry) continue;
+    const code = entry.slice(0, 2);
+    paths.push(entry.slice(3));
+    if (code[0] === 'R' || code[0] === 'C') paths.push(fields[++index]);
+  }
+  return [...new Set(paths)].sort();
+}
+
+async function rejectUnsafeEntry(worktreePath, baseSha, changedPath) {
+  const segments = changedPath.split('/');
+  for (let index = 1; index <= segments.length; index += 1) {
+    const candidate = path.join(worktreePath, ...segments.slice(0, index));
+    try {
+      const stat = await lstat(candidate);
+      if (stat.isSymbolicLink()) throw new Error(`symlink change is not allowed: ${changedPath}`);
+      if (index === segments.length && !stat.isFile()) throw new Error(`special file change is not allowed: ${changedPath}`);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+  const tree = await run('git', ['ls-tree', '-z', baseSha, '--', changedPath], { cwd: worktreePath });
+  if (tree.stdout.length > 0) {
+    const mode = tree.stdout.toString('utf8').slice(0, 6);
+    if (mode === '120000') throw new Error(`symlink change is not allowed: ${changedPath}`);
+    if (mode === '160000') throw new Error(`submodule change is not allowed: ${changedPath}`);
+    if (mode !== '100644' && mode !== '100755') throw new Error(`special file change is not allowed: ${changedPath}`);
+  }
+}
+
+async function buildPatch(worktreePath, changedPaths) {
+  const tracked = await run('git', ['diff', '--binary', 'HEAD'], { cwd: worktreePath });
+  const parts = [tracked.stdout];
+  for (const changedPath of changedPaths) {
+    const trackedPath = await run('git', ['ls-files', '--error-unmatch', '--', changedPath], {
+      cwd: worktreePath,
+      allowExitCodes: [0, 1],
+    });
+    if (trackedPath.code === 0) continue;
+    const added = await run('git', ['diff', '--binary', '--no-index', '--', '/dev/null', changedPath], {
+      cwd: worktreePath,
+      allowExitCodes: [0, 1],
+    });
+    if (added.stdout.length > 0) parts.push(added.stdout);
+  }
+  return Buffer.concat(parts);
+}
+
+async function captureSnapshot(worktreePath, baseSha, allowedPaths) {
+  const changedPaths = statusPaths((await run('git', [
+    'status', '--porcelain=v1', '-z', '--untracked-files=all', '--ignored=matching',
+  ], { cwd: worktreePath })).stdout);
+  for (const changedPath of changedPaths) {
+    if (!safeRelativePath(changedPath) || !isAllowed(changedPath, allowedPaths)) {
+      throw new Error(`change outside allowed paths: ${changedPath}`);
+    }
+    await rejectUnsafeEntry(worktreePath, baseSha, changedPath);
+  }
+  return { changedPaths, patch: await buildPatch(worktreePath, changedPaths) };
+}
+
+async function assertSnapshotUnchanged(worktreePath, baseSha, allowedPaths, expected, actor) {
+  const actual = await captureSnapshot(worktreePath, baseSha, allowedPaths);
+  if (actual.changedPaths.length !== expected.changedPaths.length
+    || actual.changedPaths.some((changedPath, index) => changedPath !== expected.changedPaths[index])
+    || !actual.patch.equals(expected.patch)) {
+    throw new Error(`${actor} mutated isolated snapshot`);
+  }
+}
+
+async function fingerprintEntry(repoRoot, relativePath, records) {
+  const absolutePath = path.join(repoRoot, relativePath);
+  let stat;
+  try {
+    stat = await lstat(absolutePath);
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      records.push({ path: relativePath, type: 'missing', content_digest: null });
+      return;
+    }
+    throw error;
+  }
+  if (stat.isDirectory()) {
+    records.push({ path: relativePath, type: 'directory', content_digest: null });
+    const entries = await readdir(absolutePath, { withFileTypes: true });
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      await fingerprintEntry(repoRoot, path.posix.join(relativePath, entry.name), records);
+    }
+    return;
+  }
+  if (stat.isFile()) {
+    records.push({
+      path: relativePath,
+      type: 'file',
+      content_digest: bufferDigest(await readFile(absolutePath)),
+    });
+    return;
+  }
+  if (stat.isSymbolicLink()) {
+    records.push({
+      path: relativePath,
+      type: 'symlink',
+      content_digest: bufferDigest(Buffer.from(await readlink(absolutePath), 'utf8')),
+    });
+    return;
+  }
+  records.push({ path: relativePath, type: 'special', content_digest: null });
+}
+
+async function protectedFingerprint(repoRoot) {
+  const records = [];
+  for (const protectedPath of PROTECTED_PATHS) {
+    await fingerprintEntry(repoRoot, protectedPath, records);
+  }
+  return {
+    digest: bufferDigest(Buffer.from(JSON.stringify(records), 'utf8')),
+    entry_count: records.length,
+  };
+}
+
+async function captureSourceState(repoRoot) {
+  const [head, visibleStatus, ignoredStatus, protectedContent] = await Promise.all([
+    run('git', ['rev-parse', 'HEAD'], { cwd: repoRoot }),
+    run('git', ['status', '--porcelain=v1', '-z'], { cwd: repoRoot }),
+    run('git', [
+      'status', '--porcelain=v1', '-z', '--untracked-files=all', '--ignored=matching',
+    ], { cwd: repoRoot }),
+    protectedFingerprint(repoRoot),
+  ]);
+  return {
+    head: head.stdout.toString('utf8').trim(),
+    visibleStatus: visibleStatus.stdout,
+    ignoredStatus: ignoredStatus.stdout,
+    protectedContent,
+  };
+}
+
+function sourceInvariantComparison(before, after) {
+  const compareBuffers = (left, right) => ({
+    before_digest: bufferDigest(left),
+    after_digest: bufferDigest(right),
+    equal: left.equals(right),
+  });
+  const receipt = {
+    schema: 'lattice.source_invariant_receipt.v1',
+    protected_paths: [...PROTECTED_PATHS],
+    outcome: 'passed',
+    head: {
+      before: before.head,
+      after: after.head,
+      equal: before.head === after.head,
+    },
+    visible_status: compareBuffers(before.visibleStatus, after.visibleStatus),
+    ignored_paths: compareBuffers(before.ignoredStatus, after.ignoredStatus),
+    protected_content: {
+      before_digest: before.protectedContent.digest,
+      after_digest: after.protectedContent.digest,
+      before_entry_count: before.protectedContent.entry_count,
+      after_entry_count: after.protectedContent.entry_count,
+      equal: before.protectedContent.digest === after.protectedContent.digest,
+    },
+  };
+  receipt.outcome = [
+    receipt.head.equal,
+    receipt.visible_status.equal,
+    receipt.ignored_paths.equal,
+    receipt.protected_content.equal,
+  ].every(Boolean) ? 'passed' : 'failed';
+  return receipt;
+}
+
+async function assertSourceUnchanged(repoRoot, sourceState) {
+  const receipt = sourceInvariantComparison(sourceState, await captureSourceState(repoRoot));
+  if (receipt.outcome !== 'passed') {
+    const error = new Error('source repository changed during isolated transform');
+    error.sourceInvariant = receipt;
+    throw error;
+  }
+  return receipt;
+}
+
+export async function runIsolatedTransform({ repoRoot, baseRef, allowedPaths, transform, verifyCommands, observe } = {}) {
+  if (!safeRelativePath('.') || typeof repoRoot !== 'string' || typeof baseRef !== 'string'
+    || !Array.isArray(allowedPaths) || allowedPaths.some((entry) => !safeRelativePath(entry))
+    || typeof transform !== 'function' || !Array.isArray(verifyCommands)
+    || (observe !== undefined && typeof observe !== 'function')) {
+    throw new TypeError('invalid isolated transform arguments');
+  }
+
+  const sourceState = await captureSourceState(repoRoot);
+  if (sourceState.visibleStatus.length > 0) throw new Error('source repository must be clean');
+  const baseSha = (await run('git', ['rev-parse', '--verify', `${baseRef}^{commit}`], { cwd: repoRoot })).stdout.toString('utf8').trim();
+  const worktreePath = await mkdtemp(path.join(os.tmpdir(), 'lattice-isolated-transform-'));
+  let added = false;
+  let primaryError;
+  let result;
+  let snapshot;
+  let sourceInvariant;
+  const verifications = [];
+  try {
+    await run('git', ['worktree', 'add', '--detach', worktreePath, baseSha], { cwd: repoRoot });
+    added = true;
+    await transform({ worktreePath });
+    snapshot = await captureSnapshot(worktreePath, baseSha, allowedPaths);
+    for (const verifier of verifyCommands) {
+      if (!verifier || typeof verifier.command !== 'string' || !Array.isArray(verifier.args) || verifier.args.some((arg) => typeof arg !== 'string')) {
+        throw new TypeError('verifyCommands must contain command and string args');
+      }
+      try {
+        const verification = await run(verifier.command, verifier.args, {
+          cwd: worktreePath,
+          env: verifierEnvironment(),
+        });
+        verifications.push(verificationReceipt(verifier, verification, 'passed'));
+      } catch (error) {
+        verifications.push(verificationReceipt(verifier, error, 'failed'));
+        throw new Error(`verifier failed (${error.signal ?? error.code}): ${verifier.command}`);
+      }
+      await assertSnapshotUnchanged(worktreePath, baseSha, allowedPaths, snapshot, 'verifier');
+    }
+    if (observe) {
+      await observe({ worktreePath, changedPaths: snapshot.changedPaths, patch: snapshot.patch, baseSha });
+      await assertSnapshotUnchanged(worktreePath, baseSha, allowedPaths, snapshot, 'observe');
+    }
+    result = { baseSha, ...snapshot, verifications };
+  } catch (error) {
+    primaryError = error;
+  }
+  let cleanupError;
+  try {
+    if (added) await run('git', ['worktree', 'remove', '--force', worktreePath], { cwd: repoRoot });
+    await rm(worktreePath, { recursive: true, force: true });
+  } catch (error) {
+    cleanupError = new Error(`cleanup failed: ${error.message}`);
+  }
+  let sourceInvariantError;
+  try {
+    sourceInvariant = await assertSourceUnchanged(repoRoot, sourceState);
+  } catch (error) {
+    sourceInvariant = error.sourceInvariant;
+    sourceInvariantError = error;
+  }
+  const errors = [primaryError, cleanupError, sourceInvariantError].filter(Boolean);
+  const transformEvidence = {
+    baseSha,
+    changedPaths: snapshot ? [...snapshot.changedPaths] : [],
+    patch: snapshot ? Buffer.from(snapshot.patch) : null,
+    verifications: structuredClone(verifications),
+    sourceInvariant: sourceInvariant ? structuredClone(sourceInvariant) : null,
+  };
+  for (const error of errors) error.transformEvidence = transformEvidence;
+  if (errors.length === 1) throw errors[0];
+  if (errors.length > 1) throw new AggregateError(errors, 'isolated transform failed; source repository changed or cleanup failed');
+  return { ...result, sourceInvariant };
+}

package/src/node-version-guard.mjs

@@ -0,0 +1,43 @@
+/**
+ * lattice-mcp bin向けNode versionガード（ADR 0049 wave2レビューでのスコープ外
+ * 発見の修理 — bin/lattice-mcp.mjs が sensor/dist/index.js を直import して
+ * MCPServer を起動する経路には、sensor CLI (sensor/src/bin/codegraph.ts) が
+ * 持つNode versionガードが一切通っていなかった）。
+ *
+ * 閾値・banner文言は複製せず、sensor CLI と同じ
+ * `sensor/dist/bin/node-version-check.js`（Node 25.x のV8 turboshaft WASM JIT
+ * Zone allocatorバグと、MIN_NODE_MAJOR未満のfloorを扱う）から再利用する。
+ *
+ * 判定ロジックだけをここに切り出し、process.versions.node / env を直接
+ * 読まない純関数にすることで、境界値（MIN_NODE_MAJOR-1 / MIN_NODE_MAJOR /
+ * 24 / 25、override有無）をunit testで固定できるようにする。
+ */
+
+import {
+  MIN_NODE_MAJOR,
+  buildNode25BlockBanner,
+  buildNodeTooOldBanner,
+} from '../sensor/dist/bin/node-version-check.js';
+
+export { MIN_NODE_MAJOR };
+
+/**
+ * @param {string} nodeVersion - process.versions.node相当の文字列 (例: "26.5.0")
+ * @param {boolean} overrideActive - CODEGRAPH_ALLOW_UNSAFE_NODE が設定されているか
+ * @returns {{ blocked: boolean, banner: string | null }}
+ *   banner: 表示すべきbanner文言（sensor CLIと同一文言）。null ならサポート
+ *     対象内で表示不要。
+ *   blocked: true なら呼び出し側は起動を止める（exit 1 相当）。
+ *     override有効時は nodeMajor が範囲外でも blocked は false になるが、
+ *     banner は「表示のみ」で non-null のまま返る（sensor CLIと同一意味論）。
+ */
+export function evaluateNodeVersionGuard(nodeVersion, overrideActive) {
+  const nodeMajor = parseInt(nodeVersion.split('.')[0] ?? '0', 10);
+  if (nodeMajor >= 25) {
+    return { blocked: !overrideActive, banner: buildNode25BlockBanner(nodeVersion) };
+  }
+  if (nodeMajor < MIN_NODE_MAJOR) {
+    return { blocked: !overrideActive, banner: buildNodeTooOldBanner(nodeVersion) };
+  }
+  return { blocked: false, banner: null };
+}