@smoothbricks/cli 0.11.13 → 0.11.15

package/src/monorepo/secret-references.test.ts

@@ -389,148 +389,69 @@ describe('resolveSecretEnvironment', () => {
 });
 
 /**
- * The remote cache half is exercised the way the managed shell runs it — the
- * raw script as a program, its stdout `eval`-ed — because that round trip is
- * the contract: shell text on stdout, guidance on stderr, and a status that
- * never keeps a shell from opening.
+ * Redaction is a byte operation on output the caller already captured, so the
+ * harness carries both directions as base64: a text-only round trip would
+ * hide exactly the invalid-UTF-8 bytes a failing install can emit.
  */
-describe('remote cache shell export', () => {
-  const SERVER = 'https://nx-cache.example.net';
-
-  async function exportFor(root: string, env: Record<string, string>): Promise<{ stdout: string; stderr: string }> {
-    const proc = Bun.spawn({
-      cmd: ['bun', RAW_RESOLVER, root],
-      env: { PATH: process.env['PATH'], HOME: process.env['HOME'], ...env },
-      stdin: 'ignore',
-      stdout: 'pipe',
-      stderr: 'pipe',
-    });
-    const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited,
-    ]);
-    // A cache is an optimization: nothing it does may fail shell entry.
-    expect(exitCode).toBe(0);
-    return { stdout, stderr };
-  }
-
-  /** The value a shell ends up with after eval-ing the script's output. */
-  async function evaluated(root: string, env: Record<string, string>, name: string): Promise<string> {
-    const { stdout } = await exportFor(root, env);
-    const shell = Bun.spawnSync({
-      cmd: ['sh', '-c', `${stdout}printf %s "\${${name}:-}"`],
-      env: { PATH: process.env['PATH'] ?? '/usr/bin:/bin' },
-    });
-    expect(shell.exitCode).toBe(0);
-    return shell.stdout.toString();
-  }
+const MASK_SCRIPT = `
+const resolver = await import(Bun.argv[1]);
+const { output, values } = JSON.parse(Bun.argv[2]);
+const captured = Buffer.from(output, 'base64');
+const masked = resolver.maskSecretValues(captured, values);
+process.stdout.write(JSON.stringify({
+  masked: Buffer.from(masked).toString('base64'),
+  captured: captured.toString('base64'),
+}));
+`;
 
-  it('exports the pair from an ambient token and nothing from an absent declaration', async () => {
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        expect((await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' })).stdout).toBe(
-          `export NX_SELF_HOSTED_REMOTE_CACHE_SERVER='${SERVER}'\nexport NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN='ambient-token'\n`,
-        );
-      },
+describe('maskSecretValues', () => {
+  const mask = async (output: Uint8Array, values: readonly string[]): Promise<{ masked: Buffer; captured: Buffer }> => {
+    const { stdout, stderr, exitCode } = await runInBootstrap(
+      MASK_SCRIPT,
+      JSON.stringify({ output: Buffer.from(output).toString('base64'), values }),
     );
-    await withFixture({ secrets: {} }, async (root) => {
-      expect(await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' })).toEqual({ stdout: '', stderr: '' });
-    });
-  });
+    expect(stderr).toBe('');
+    expect(exitCode).toBe(0);
+    const value: unknown = JSON.parse(stdout);
+    if (
+      typeof value !== 'object' ||
+      value === null ||
+      !('masked' in value) ||
+      typeof value.masked !== 'string' ||
+      !('captured' in value) ||
+      typeof value.captured !== 'string'
+    ) {
+      throw new Error(`bootstrap harness returned a malformed envelope: ${stdout}`);
+    }
+    return { masked: Buffer.from(value.masked, 'base64'), captured: Buffer.from(value.captured, 'base64') };
+  };
 
-  it('exports nothing and names the variable when the token has no value', async () => {
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        const { stdout, stderr } = await exportFor(root, {});
-        // Half a pair is worse than none: Nx enables its cache on the server
-        // alone and then fails every task on 401.
-        expect(stdout).toBe('');
-        expect(stderr).toContain('NX_REMOTE_CACHE_TOKEN');
-        expect(stderr).toContain(SERVER);
-      },
-    );
+  it('replaces every occurrence and leaves the surrounding failure legible', async () => {
+    const output = Buffer.from('error: 401 for https://x:hunter2@registry/pkg\nretrying with hunter2\n');
+    const { masked, captured } = await mask(output, ['hunter2']);
+    expect(masked.toString()).toBe('error: 401 for https://x:*******@registry/pkg\nretrying with *******\n');
+    expect(masked.length).toBe(output.length);
+    // The caller keeps its captured bytes: redaction returns a copy, and a
+    // node Buffer's `slice` would have handed back a view of these.
+    expect(captured.toString()).toBe(output.toString());
   });
 
-  it('reports a broken provider as a lost cache, never as a failed install', async () => {
-    await withFixture(
-      {
-        secrets: { NX_REMOTE_CACHE_TOKEN: { command: ['definitely-not-a-real-smoo-binary-xyz'] } },
-        remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      },
-      async (root) => {
-        const { stdout, stderr } = await exportFor(root, {});
-        expect(stdout).toBe('');
-        expect(stderr).toContain('NX_REMOTE_CACHE_TOKEN');
-        expect(stderr).toContain('remote cache off');
-        // Nothing here stopped an install, and the message may not say it did.
-        expect(stderr).not.toContain('dependencies were not installed');
-      },
-    );
+  it('redacts each declared value even when one is a prefix of another', async () => {
+    expect((await mask(Buffer.from('AB ABCD AB'), ['ABCD', 'AB'])).masked.toString()).toBe('** **** **');
   });
 
-  it('leaves a server the environment already carries alone', async () => {
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        // A CI job env names the address its own runners reach; the public
-        // origin must not replace it.
-        expect(
-          await exportFor(root, {
-            NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'http://10.89.0.1:8765',
-            NX_REMOTE_CACHE_TOKEN: 'ambient-token',
-          }),
-        ).toEqual({ stdout: '', stderr: '' });
-      },
-    );
+  it('survives a false start on the first byte', async () => {
+    expect((await mask(Buffer.from('aab aaab'), ['aab'])).masked.toString()).toBe('*** a***');
   });
 
-  it('resolves a provider-declared token, and only that one secret', async () => {
-    await withFixture(
-      {
-        secrets: {
-          NX_REMOTE_CACHE_TOKEN: { command: emit('provider-token') },
-          SMOO_OTHER: { command: ['definitely-not-a-real-smoo-binary-xyz'] },
-        },
-        remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      },
-      async (root) => {
-        // The unrunnable sibling proves no other declared secret is resolved
-        // here, and that none of them reaches the shell.
-        const { stdout } = await exportFor(root, {});
-        expect(stdout).toContain("export NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN='provider-token'");
-        expect(stdout).not.toContain('SMOO_OTHER');
-      },
-    );
+  it('masks whole bytes and carries invalid UTF-8 through untouched', async () => {
+    const output = Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from('kå'), Buffer.from([0x00])]);
+    const { masked } = await mask(output, ['kå']);
+    expect([...masked]).toEqual([0xff, 0xfe, 0x2a, 0x2a, 0x2a, 0x00]);
   });
 
-  it('survives eval with a token full of shell metacharacters', async () => {
-    const hostile = `it's $(touch /tmp/smoo-cache-pwned) \`x\` "q" \\`;
-    await withFixture(
-      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
-      async (root) => {
-        expect(
-          await evaluated(root, { NX_REMOTE_CACHE_TOKEN: hostile }, 'NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN'),
-        ).toBe(hostile);
-      },
-    );
-  });
-
-  it('refuses a declaration Nx could not use, naming the field', async () => {
-    for (const remoteCache of [
-      { server: `${SERVER}/`, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      { server: '', tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
-      { server: SERVER, tokenSecret: 'has-dash' },
-      { server: SERVER },
-      'https://nx-cache.example.net',
-    ]) {
-      await withFixture({ secrets: {}, remoteCache }, async (root) => {
-        const { stdout, stderr } = await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' });
-        expect(stdout).toBe('');
-        expect(stderr).toContain('smoo.remoteCache');
-      });
-    }
+  it('leaves output alone when nothing is declared or a value is empty', async () => {
+    expect((await mask(Buffer.from('nothing to hide'), [])).masked.toString()).toBe('nothing to hide');
+    expect((await mask(Buffer.from('nothing to hide'), [''])).masked.toString()).toBe('nothing to hide');
   });
 });

package/src/release/github-release.ts

@@ -1,6 +1,8 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import type { ChangelogOptions } from 'nx/src/command-line/release/command-object.js';
 import type { NxReleaseConfiguration } from 'nx/src/config/nx-json.js';
 import { type ReleasePackageInfo, releaseTag } from './core.js';
@@ -34,7 +36,7 @@ export interface GithubReleaseWriteShell {
 
 export async function renderNxProjectChangelogContents(input: RenderNxProjectChangelogInput): Promise<string> {
   return withNxWorkspaceRoot(input.root, async () => {
-    const { createAPI } = await import('nx/src/command-line/release/changelog.js');
+    const { createAPI } = await importWorkspaceNx(input.root, 'src/command-line/release/changelog.js');
     const result = await createAPI(
       nxRenderOnlyReleaseConfig,
       false,
@@ -124,8 +126,35 @@ function isPrereleaseVersion(version: string): boolean {
   return version.includes('-');
 }
 
+/**
+ * A module of the WORKSPACE's Nx, not of smoo's own dependency. smoo installs
+ * with its own `nx` in the global virtual store, where the workspace's
+ * node_modules is invisible: that Nx cannot resolve the workspace's
+ * `versionActions` plugin (`Unable to resolve the "versionActions"
+ * implementation ... "@smoothbricks/nx-plugin/version-actions"`), and it is
+ * a second Nx version driving one release. Every in-process Nx call for a
+ * workspace resolves from that workspace's root, exactly as `nx` on its PATH
+ * would.
+ */
+interface WorkspaceNxModules {
+  'src/utils/workspace-root.js': typeof import('nx/src/utils/workspace-root.js');
+  'src/command-line/release/version.js': typeof import('nx/src/command-line/release/version.js');
+  'src/command-line/release/changelog.js': typeof import('nx/src/command-line/release/changelog.js');
+}
+
+export async function importWorkspaceNx<Subpath extends keyof WorkspaceNxModules>(
+  root: string,
+  subpath: Subpath,
+): Promise<WorkspaceNxModules[Subpath]> {
+  const resolved = createRequire(join(root, 'package.json')).resolve(`nx/${subpath}`);
+  // A dynamic specifier types as `any`; the map above is the declared shape of
+  // the module the workspace's Nx serves at that subpath.
+  const module: WorkspaceNxModules[Subpath] = await import(pathToFileURL(resolved).href);
+  return module;
+}
+
 export async function withNxWorkspaceRoot<T>(root: string, run: () => Promise<T>): Promise<T> {
-  const workspaceRootModule = await import('nx/src/utils/workspace-root.js');
+  const workspaceRootModule = await importWorkspaceNx(root, 'src/utils/workspace-root.js');
   const previousWorkspaceRoot = workspaceRootModule.workspaceRoot;
   const previousEnvWorkspaceRoot = process.env.NX_WORKSPACE_ROOT_PATH;
   const previousCwd = process.cwd();

package/src/release/index.ts

@@ -88,6 +88,7 @@ import {
 import {
   createOrUpdateGithubRelease,
   githubReleaseLookupExists,
+  importWorkspaceNx,
   renderNxProjectChangelogContents,
   withNxWorkspaceRoot,
 } from './github-release.js';
@@ -881,8 +882,8 @@ async function runNxReleaseVersion(
 
 async function runNxReleaseVersionPreview(root: string, projects: string, bump: string): Promise<ReleasePackage[]> {
   return withNxWorkspaceRoot(root, async () => {
-    const { createAPI } = await import('nx/src/command-line/release/version.js');
-    const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+    const { createAPI } = await importWorkspaceNx(root, 'src/command-line/release/version.js');
+    const { createAPI: createChangelogAPI } = await importWorkspaceNx(root, 'src/command-line/release/changelog.js');
     const projectNames = projects.split(',').filter(Boolean);
     const result = await createAPI(
       {},