audit-tools 0.51.1 → 0.51.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.51.1",
+  "version": "0.51.2",
   "private": false,
   "license": "ISC",
   "description": "Provider-neutral code auditing and remediation workflows for arbitrary repositories.",
@@ -51,11 +51,14 @@
     "test": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "test:single": "npm run build && node scripts/shared/run-vitest-gate.mjs",
     "verify:guards": "node scripts/shared/run-vitest-gate.mjs --retry=2 --exclude \"**/audit-code-completion-*.test.ts\" --exclude \"**/audit-code-wrapper-*.test.ts\" --exclude \"**/audit/next-step-core-*.test.ts\" --exclude \"**/seam-host-only-next-step.test.ts\" --exclude \"**/*-e2e.test.*\" --exclude \"**/next-step-implement-dispatch.test.ts\" --exclude \"**/next-step-pipeline-dispatch.test.ts\"",
-    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:shared-primitives check:version-gates check:guard-reach check:ci-trigger-paths check:loop-core-patterns check:loop-core-closure check:constitutional-doc-paths check:runtime-artifact-names check:friction-categories check:executor-producers check:spec-mirrors check:cli-surface check:ingestion-checks check:deadcode check:orphan-modules check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:readme-sample-report check:proposal-red-at check:handoff-roadmap check:backlog-index check:memory-citations check:backlog-budget check:backlog-status check:backlog-line-numbers check:tests build check:scripts verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code",
+    "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:shared-primitives check:version-gates check:guard-reach check:generated-artifacts check:invariant-glossary check:nightly-inbox check:ci-trigger-paths check:loop-core-patterns check:loop-core-closure check:constitutional-doc-paths check:runtime-artifact-names check:friction-categories check:executor-producers check:spec-mirrors check:cli-surface check:ingestion-checks check:deadcode check:orphan-modules check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:readme-sample-report check:proposal-red-at check:handoff-roadmap check:backlog-index check:memory-citations check:backlog-budget check:backlog-status check:backlog-line-numbers check:tests build check:scripts verify:hosts verify:remediate-hosts pack:smoke smoke:packaged-audit-code smoke:packaged-remediate-code",
     "verify:release": "npm run verify:checks && node scripts/shared/run-vitest-gate.mjs && npm run smoke:linked-audit-code && npm run smoke:linked-remediate-code",
     "check:control-bytes": "node scripts/check-control-bytes.mjs",
     "check:shared-primitives": "node scripts/check-shared-primitives.mjs",
     "check:guard-reach": "node scripts/check-guard-reach.mjs",
+    "check:generated-artifacts": "node scripts/check-generated-artifacts.mjs",
+    "check:invariant-glossary": "node scripts/check-invariant-glossary.mjs",
+    "check:nightly-inbox": "node scripts/nightly/render-inbox.mjs --check",
     "closeout": "node scripts/render-closeout.mjs",
     "check:ci-trigger-paths": "node scripts/shared/generate-ci-trigger-paths.mjs --check",
     "check:deadcode": "knip --no-config-hints",

package/scripts/postinstall.mjs

@@ -8,9 +8,20 @@
 // corrupts the other's, and surface a non-zero exit if EITHER reports a failure
 // (INV-remediate-infra-08: a partial deploy must not report success).
 import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
+const packageRoot = fileURLToPath(new URL("..", import.meta.url));
 let failed = false;
+
+// A published tarball already carries dist/. A source checkout does not, and
+// npm's postinstall runs only after dependencies are present, so this is the
+// first reliable point at which it can build the shared export. Without this
+// bootstrap a fresh checkout partially deployed host assets and skipped both
+// OpenCode config and artifact .gitignore management until a human happened to
+// rerun postinstall after the first build.
+if (!ensureSourceCheckoutBuilt()) failed = true;
+
 for (const script of ["./audit/postinstall.mjs", "./remediate/postinstall.mjs"]) {
   const scriptPath = fileURLToPath(new URL(script, import.meta.url));
   const result = spawnSync(process.execPath, [scriptPath], { stdio: "inherit", windowsHide: true });
@@ -32,6 +43,37 @@ await manageArtifactGitignore();
 
 process.exit(failed ? 1 : 0);
 
+function ensureSourceCheckoutBuilt() {
+  const sharedEntry = fileURLToPath(new URL("../dist/shared/index.js", import.meta.url));
+  if (existsSync(sharedEntry)) return true;
+
+  const sourceTree = fileURLToPath(new URL("../src", import.meta.url));
+  const tsconfig = fileURLToPath(new URL("../tsconfig.json", import.meta.url));
+  if (!existsSync(sourceTree) || !existsSync(tsconfig)) return true;
+
+  const npmCli = process.env.npm_execpath;
+  if (!npmCli) {
+    console.warn(
+      "[audit-tools] postinstall: source checkout needs a shared build, but npm_execpath is unavailable.",
+    );
+    return false;
+  }
+
+  console.log("[audit-tools] postinstall: building shared output for this source checkout...");
+  const result = spawnSync(process.execPath, [npmCli, "run", "build"], {
+    cwd: packageRoot,
+    stdio: "inherit",
+    windowsHide: true,
+  });
+  if (result.error || (result.status ?? 0) !== 0 || result.signal) {
+    console.warn(
+      `[audit-tools] postinstall: source-checkout build failed (${result.error?.message ?? result.signal ?? `exit ${result.status}`}).`,
+    );
+    return false;
+  }
+  return existsSync(sharedEntry);
+}
+
 async function manageArtifactGitignore() {
   try {
     const shared = await import("audit-tools/shared");