browser-commander 0.17.0 → 0.17.1

package/.changeset/config.json

@@ -1,6 +1,7 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
   "changelog": "@changesets/cli/changelog",
+  "format": "prettier",
   "commit": false,
   "fixed": [],
   "linked": [],

package/.jscpd-baseline.json

@@ -18,7 +18,7 @@
     "0caa402c4eae32d8": 1,
     "0fd23be8410c2c95": 1,
     "0fe4f3b5e5e939b3": 1,
-    "10b6201c3ca1fbe0": 1,
+    "1019ebbe7f07a5ad": 1,
     "1273365073edd790": 1,
     "1296adc3c3128048": 1,
     "13c4b58d3ea0719b": 1,
@@ -51,6 +51,7 @@
     "2c0f8b5c6f28420b": 1,
     "2d2d6fd6c7c0f30d": 1,
     "2e70be24d2268673": 1,
+    "2f4c9810eae87d6f": 1,
     "2f9e15467cc2f12a": 1,
     "3101802d3ea65339": 1,
     "33357ce94e07cc4b": 1,
@@ -60,7 +61,6 @@
     "3a9f1672ecc1d55b": 1,
     "3adca52a3f04837c": 1,
     "3c1017def7b3216c": 1,
-    "3d7e17ad32108a7f": 1,
     "3da23cbee214a1a5": 1,
     "3dced48baf70eb36": 1,
     "3fa2ebbb416120f0": 1,
@@ -73,6 +73,7 @@
     "46e3f58cfb14a43a": 1,
     "4b0d3cc5c27227e7": 1,
     "4c3b94caa28045d0": 1,
+    "4e090d6bb30e6551": 1,
     "4f3c541b3f3e3f23": 1,
     "4fe5663c69a426cb": 1,
     "505d98bd14b63a6c": 1,
@@ -109,6 +110,7 @@
     "69d50e6f6a5f2ee9": 1,
     "6a7ed9ad3fc00a39": 1,
     "6af3c307939ef75e": 1,
+    "6b35b48512756192": 1,
     "6cd00d6b6a039022": 1,
     "6e2457cd3e1f69e7": 1,
     "6fa62e2642cc73c3": 1,
@@ -140,6 +142,7 @@
     "876d2c8edfc8c40a": 1,
     "8b013ac20e436d76": 1,
     "8c2b1408886c1db1": 1,
+    "8c36ed4fc291ae47": 1,
     "8cb9a984bf19a062": 1,
     "8ec18cdbd4a96518": 1,
     "8ecf2e554a04d2ef": 1,
@@ -154,6 +157,7 @@
     "97c5a112fdde7be8": 1,
     "98cc22079feaa004": 1,
     "990d87f21678fa96": 1,
+    "9a72b1c2f22156ca": 1,
     "9b6ef4df04562546": 1,
     "9c055dfd90c369bf": 1,
     "9cb19f1b972e811e": 1,
@@ -196,6 +200,7 @@
     "be0900fb3e87164e": 1,
     "bf452b9431c092ad": 1,
     "c0b027bebd7bd737": 1,
+    "c189fe5122a7dc91": 1,
     "c2c155adbcb46f3c": 1,
     "c30737d62069fc02": 1,
     "c3c3569357673af8": 1,
@@ -203,15 +208,16 @@
     "c461a83b51eb7740": 1,
     "c9cf3c28bed33a5b": 1,
     "cbd444e9a6a9072e": 1,
-    "cc60029bf62920a3": 1,
     "cd49f39b43d14635": 1,
     "cebff7d1cc87f646": 1,
     "cf6116d195199f8a": 1,
     "cfd68135b744c27b": 1,
     "d097f41a6f43e634": 1,
+    "d0da8714c4b7de30": 1,
     "d17201496391f6cc": 1,
     "d17e8db5a2bab966": 1,
     "d1a4a8e6a523b752": 1,
+    "d1e5c2961267399a": 1,
     "d2ed3d02dd6a2d8c": 1,
     "d4eec99f58906a63": 1,
     "d6157a86fea41907": 1,
@@ -233,7 +239,6 @@
     "eb9a70c2a21094ff": 1,
     "ebd08637a2d7bcf3": 1,
     "ebe03c5f8c2f5147": 1,
-    "edccf5a595ab439f": 1,
     "ee19c8b9b332ee98": 1,
     "eeca0ccf8d821f21": 1,
     "ef2fc2e92ac07c6e": 1,
@@ -244,6 +249,7 @@
     "f46509ed693574df": 1,
     "f4bb6f4c83950fcd": 1,
     "f4bfa7e503443cd1": 1,
+    "f6678d6748e9c902": 1,
     "f67a07a611f39cb2": 1,
     "f911821aa7dda47f": 1,
     "f97bf515bfd95829": 1,

package/CHANGELOG.md

@@ -1,11 +1,22 @@
 # Changelog
 
+## 0.17.1
+
+### Patch Changes
+
+- 43708ff: Make the release scripts fail when the commands they run fail.
+
+  `command-stream`'s `$` resolves rather than rejects on a non-zero exit, so every
+  `try/catch` around it in the release scripts was dead code. `loadCommandStream()`
+  now turns on `errexit`, the GitHub release tags are namespaced per language, and
+  the release job checks the formatting of the commit it is about to push.
+
 ## 0.17.0
 
 ### Minor Changes
 
 - Restore the release pipeline. `const { $ } = await use('command-stream')` returned `undefined` on the Node 24 the release jobs pin, because Node 23 added a synthetic `'module.exports'` named export for CommonJS namespaces that use-m's unwrapping does not recognise, so every JS and Rust release died on its first shell call with `TypeError: $ is not a function`. Dependencies now load through `scripts/use-module.mjs`, which detects that namespace shape and unwraps it. Manifest fields are read by TOML table through `scripts/read-manifest.mjs` instead of a line-anchored `grep`, which matched duplicate keys in other tables and wrote two lines into `$GITHUB_OUTPUT`. The duplication gate had `format` set to a reporter name, so jscpd scanned zero files and passed unconditionally; it now scans the tree against a recorded baseline.
-  
+
   Add the `fingerprint` subsystem, which removes the differences between a browser this library controls and one started by hand. `navigator.webdriver` stays false because the `AutomationControlled` Blink feature is disabled at launch, and `launchBrowser()` no longer passes the engine defaults a real Chrome does not carry. `resolveFingerprintProfile()` validates the 19 environment fields a page can read -- user agent and client hints, languages and locale, time zone, platform, cores, memory, screen, viewport, touch, WebGL strings, geolocation and the media preferences -- `createFingerprintPreset()` builds internally consistent Windows, macOS, Linux and Android machines, and `applyFingerprint()` installs a profile over CDP for both Playwright and Puppeteer. `FINGERPRINT_LIMITATIONS` documents what still cannot be made identical, and `relevantFingerprintLimitations()` narrows it to the entries a given profile and browser actually hit. The excluded defaults include Playwright's unconditional `--enable-unsafe-swiftshader`, which would otherwise give an automated browser a SwiftShader WebGL context on a machine where a hand-started Chrome has none.
 
 ## 0.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-commander",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Universal browser automation library that supports both Playwright and Puppeteer with a unified API",
   "main": "src/index.js",
   "type": "module",

package/scripts/check-release-format.mjs

@@ -0,0 +1,80 @@
+/**
+ * Guard the release commit against the formatting gate that never sees it.
+ *
+ * `version-and-commit.mjs` pushes the bump with `GITHUB_TOKEN`, and a push
+ * authenticated with `GITHUB_TOKEN` does not start a workflow run. Nothing
+ * therefore inspects the files the bump generated -- CHANGELOG.md,
+ * package.json, package-lock.json. When `changeset version` wrote a
+ * CHANGELOG.md that Prettier rejects, main's `format:check` went red and
+ * stayed red, because the only runs that could have reported it were the ones
+ * the push never triggered.
+ *
+ * This module has no side effects on import: the shell is passed in, so the
+ * behaviour is testable without running a release.
+ */
+
+export const FORMAT_CHECK_COMMAND = 'npm run format:check';
+
+export const FORMAT_FAILURE_TITLE = 'Release commit is not formatted';
+
+/**
+ * Build the annotation shown when the generated files fail the gate.
+ *
+ * A workflow command ends at the first newline, so the message is a single
+ * line and the captured output is printed separately.
+ * @returns {string}
+ */
+export function formatFailureAnnotation() {
+  return (
+    `::error title=${FORMAT_FAILURE_TITLE}::The version bump wrote files that ` +
+    'Prettier rejects. Pushing them would leave main failing format:check, ' +
+    'and the push does not trigger a run that would report it. Fix the ' +
+    'generator (see .changeset/config.json "format") rather than reformatting ' +
+    'by hand.'
+  );
+}
+
+/**
+ * Extract the reason a command-stream failure carries.
+ *
+ * With `errexit` on, `error.message` is only "Command failed with exit code
+ * N"; the diagnosis is in the captured streams.
+ * @param {unknown} error
+ * @returns {string}
+ */
+export function formatFailureDetails(error) {
+  const streams = error && typeof error === 'object' ? error : {};
+  return [streams.stdout, streams.stderr]
+    .map((stream) => String(stream ?? '').trim())
+    .filter(Boolean)
+    .join('\n');
+}
+
+/**
+ * Run the repository's formatting gate over the generated release commit.
+ *
+ * Rethrows on failure so the release stops before the push.
+ * @param {() => Promise<unknown>} runCheck
+ * @param {{log?: (message: string) => void, error?: (message: string) => void}} [console_]
+ * @returns {Promise<void>}
+ */
+export async function assertGeneratedFilesAreFormatted(
+  runCheck,
+  console_ = console
+) {
+  const log = console_.log ?? (() => {});
+  const error = console_.error ?? (() => {});
+
+  log('Checking that the release commit is formatted...');
+  try {
+    await runCheck();
+  } catch (failure) {
+    error(formatFailureAnnotation());
+    const details = formatFailureDetails(failure);
+    if (details) {
+      error(details);
+    }
+    throw failure;
+  }
+  log('Release commit is formatted');
+}

package/scripts/create-github-release.mjs

@@ -14,7 +14,9 @@
 
 import { readFileSync } from 'fs';
 
+import { releaseTag } from '../../scripts/release-tags.mjs';
 import {
+  commandErrorText,
   loadCommandStream,
   loadLinoArguments,
 } from '../../scripts/use-module.mjs';
@@ -49,7 +51,9 @@ if (!version || !repository) {
   process.exit(1);
 }
 
-const tag = `v${version}`;
+// `v<version>` is this package's namespace only; the crate uses `rust-v` and
+// the wheel `python-v`. See scripts/release-tags.mjs.
+const tag = releaseTag('js', version);
 
 console.log(`Creating GitHub release for ${tag}...`);
 
@@ -68,7 +72,14 @@ try {
     releaseNotes = match[0].replace(`## ${version}`, '').trim();
   }
 
+  // Falling back to a bare "Release <version>" body is a silent downgrade:
+  // the release still goes out and the job still passes, so this annotation is
+  // what makes an empty release body visible in the run summary.
   if (!releaseNotes) {
+    console.warn(
+      `::warning::Version ${version} has no "## ${version}" section in ` +
+        'CHANGELOG.md, releasing without notes'
+    );
     releaseNotes = `Release ${version}`;
   }
 
@@ -81,11 +92,21 @@ try {
     body: releaseNotes,
   });
 
-  await $`gh api repos/${repository}/releases -X POST --input -`.run({
-    stdin: payload,
-  });
-
-  console.log(`\u2705 Created GitHub release: ${tag}`);
+  try {
+    await $`gh api repos/${repository}/releases -X POST --input -`.run({
+      stdin: payload,
+    });
+    console.log(`\u2705 Created GitHub release: ${tag}`);
+  } catch (error) {
+    // Re-running a release over a tag that already has one is not a failure.
+    // The rust script has always tolerated it; the JS one did not need to
+    // while a failed `gh` call resolved instead of rejecting.
+    if (commandErrorText(error).includes('already exists')) {
+      console.log(`Release ${tag} already exists, skipping`);
+    } else {
+      throw error;
+    }
+  }
 } catch (error) {
   console.error('Error creating release:', error.message);
   process.exit(1);

package/scripts/version-and-commit.mjs

@@ -14,6 +14,8 @@
 
 import { readFileSync, appendFileSync, readdirSync } from 'fs';
 
+import { assertGeneratedFilesAreFormatted } from './check-release-format.mjs';
+
 import {
   loadCommandStream,
   loadLinoArguments,
@@ -205,6 +207,16 @@ async function main() {
     console.log(`New version: ${newVersion}`);
     setOutput('new_version', newVersion);
 
+    // Re-run the formatting gate over the files the bump just generated.
+    //
+    // The release commit is pushed with GITHUB_TOKEN, and a GITHUB_TOKEN push
+    // does not start a workflow run, so no job ever inspects what the bump
+    // wrote. `changeset version` once produced a CHANGELOG.md that Prettier
+    // rejects; main's format:check went red and stayed red, because the only
+    // runs that could have caught it were the ones the push never triggered.
+    // Checking here stops a malformed release commit before it lands.
+    await assertGeneratedFilesAreFormatted(() => $`npm run format:check`);
+
     // Check if there are changes to commit
     const statusResult = await $`git status --porcelain`.run({ capture: true });
     const status = statusResult.stdout.trim();

package/tests/unit/scripts/cargo-lock-sync.test.js

@@ -0,0 +1,110 @@
+/**
+ * Guard for the lockfile half of RC-C.
+ *
+ * `rust/scripts/version-and-commit.mjs` writes the new version into
+ * Cargo.toml. Cargo.lock carries the workspace member's own version too, so a
+ * bump that touches only the manifest leaves the two disagreeing, and every
+ * job that builds the release commit with `cargo build --locked` fails with
+ * "the lock file needs to be updated but --locked was passed".
+ *
+ * The drift was invisible while RC-C was live: the release commit was never
+ * pushed, so main kept a Cargo.toml and a Cargo.lock that still agreed.
+ * Fixing RC-C is what makes this reachable.
+ *
+ * Analysis: dev/log/issues/83/pulls/84/analysis/root-causes.md, RC-C
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it } from 'node:test';
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '../../../..');
+
+/**
+ * Read the version of a named package out of a Cargo.lock.
+ *
+ * The line separator is `\r?\n` because a Windows runner checks the file out
+ * with CRLF: `git config core.autocrlf` is `true` on GitHub's windows-latest
+ * image, so a pattern anchored on a bare `\n` matches nothing there and the
+ * lookup silently returns `undefined` -- a guard that passes on two operating
+ * systems and fails on the third for a reason that has nothing to do with what
+ * it guards.
+ *
+ * @param {string} lock
+ * @param {string} name
+ * @returns {string | undefined}
+ */
+function lockedVersion(lock, name) {
+  const pattern = new RegExp(
+    `\\[\\[package\\]\\]\\r?\\nname = "${name}"\\r?\\nversion = "([^"]+)"`
+  );
+  return pattern.exec(lock)?.[1];
+}
+
+describe('Cargo.lock stays in step with the release bump', () => {
+  const cargoToml = readFileSync(join(repoRoot, 'rust/Cargo.toml'), 'utf8');
+  const cargoLock = readFileSync(join(repoRoot, 'rust/Cargo.lock'), 'utf8');
+  const script = readFileSync(
+    join(repoRoot, 'rust/scripts/version-and-commit.mjs'),
+    'utf8'
+  );
+
+  it('records the manifest version in the lockfile today', () => {
+    const manifestVersion = /^\[package\][\s\S]*?^version = "([^"]+)"/m.exec(
+      cargoToml
+    )?.[1];
+    assert.ok(manifestVersion, 'Cargo.toml has no [package] version');
+    assert.equal(
+      lockedVersion(cargoLock, 'browser-commander'),
+      manifestVersion,
+      'a build with --locked would refuse this tree'
+    );
+  });
+
+  it('reads a lockfile that was checked out with CRLF line endings', () => {
+    const crlf = cargoLock.replace(/\r?\n/g, '\r\n');
+    assert.equal(
+      lockedVersion(crlf, 'browser-commander'),
+      lockedVersion(cargoLock, 'browser-commander'),
+      'the same lockfile must read the same on a Windows checkout'
+    );
+  });
+
+  it('refreshes the lockfile as part of the bump', () => {
+    assert.match(
+      script,
+      /cargo update --workspace/,
+      'bumping Cargo.toml without refreshing Cargo.lock breaks --locked builds'
+    );
+  });
+
+  it('refreshes the lockfile after the manifest, not before', () => {
+    const bump = script.indexOf('updateCargoToml(newVersion)');
+    const refresh = script.indexOf('cargo update --workspace');
+    assert.ok(bump > 0 && refresh > 0);
+    assert.ok(
+      bump < refresh,
+      'refreshing before the bump would re-lock the old version'
+    );
+  });
+
+  it('stages the lockfile in the release commit', () => {
+    const add = /git add -A ([^`]+)`/.exec(script)?.[1] ?? '';
+    assert.ok(
+      add.split(/\s+/).includes('Cargo.lock'),
+      `Cargo.lock is refreshed but never committed (staged: ${add.trim()})`
+    );
+  });
+
+  it('is what the release job later builds with --locked', () => {
+    // If the workflow stopped passing --locked the drift would go unnoticed
+    // again, so the guard is only meaningful while this flag is there.
+    const workflow = readFileSync(
+      join(repoRoot, '.github/workflows/rust.yml'),
+      'utf8'
+    );
+    assert.match(workflow, /cargo build --locked/);
+  });
+});

package/tests/unit/scripts/changelog-collection-order.test.js

@@ -0,0 +1,144 @@
+/**
+ * Guard for RC-I: collecting the changelog before the version bump.
+ *
+ * Both manual-release jobs used to collect fragments in a workflow step that
+ * ran ahead of the bump, and both named the section wrongly as a result:
+ *
+ *   rust.yml    `node scripts/collect-changelog.mjs` reads the version out of
+ *               Cargo.toml, which at that point still held the version that
+ *               was already released, so the notes were filed under it and
+ *               the version being released got none.
+ *   python.yml  `scriv collect --version "$BUMP_TYPE"`. `--version` names the
+ *               new changelog section rather than selecting a bump, so a
+ *               release wrote a section titled "patch".
+ *
+ * Either way the release notes went missing: create-github-release looks for
+ * the version it is releasing and falls back to a bare "Release <version>".
+ *
+ * Collection now happens inside the version-and-commit scripts, after the
+ * bump has computed the version. These assertions are on the workflows,
+ * because that is where the ordering lived.
+ *
+ * Analysis: dev/log/issues/83/pulls/84/analysis/root-causes.md
+ * Reproduction: experiments/scriv-collect-version/run.sh
+ */
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it } from 'node:test';
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '../../../..');
+
+/**
+ * Read a workflow with its comment lines removed.
+ *
+ * The comments explain the very mistakes these assertions look for, so
+ * matching against the raw file would find the explanation and report the bug
+ * as still present.
+ * @param {string} name
+ * @returns {string}
+ */
+function workflow(name) {
+  return readFileSync(join(repoRoot, '.github/workflows', name), 'utf8')
+    .split('\n')
+    .filter((line) => !/^\s*#/.test(line))
+    .join('\n');
+}
+
+describe('changelog fragments are collected after the version bump', () => {
+  it('never passes a bump type where a version name is expected', () => {
+    // `scriv collect --version` is documented as "The version name to use for
+    // this entry", so "$BUMP_TYPE" lands in the changelog verbatim.
+    assert.doesNotMatch(
+      workflow('python.yml'),
+      /scriv collect --version "\$BUMP_TYPE"/,
+      'scriv would head the release section with the word "patch"'
+    );
+  });
+
+  it('has no workflow step that collects ahead of the bump', () => {
+    for (const [name, collector] of [
+      ['rust.yml', 'collect-changelog.mjs'],
+      ['python.yml', 'scriv collect'],
+    ]) {
+      const content = workflow(name);
+      const collect = content.indexOf(collector);
+      if (collect < 0) {
+        continue;
+      }
+      const bump = content.indexOf('name: Version and commit');
+      assert.ok(
+        bump < 0 || collect > bump,
+        `${name} collects the changelog before the bump names the version`
+      );
+    }
+  });
+
+  it('collects inside the scripts that know the new version', () => {
+    const rust = readFileSync(
+      join(repoRoot, 'rust/scripts/version-and-commit.mjs'),
+      'utf8'
+    );
+    assert.match(rust, /updateChangelog\('\.', newVersion, fragments\)/);
+
+    const python = readFileSync(
+      join(repoRoot, 'python/scripts/version_and_commit.py'),
+      'utf8'
+    );
+    assert.match(python, /collect_changelog\(new_version, project_root\)/);
+  });
+
+  it('orders collection after the bump inside those scripts', () => {
+    const rust = readFileSync(
+      join(repoRoot, 'rust/scripts/version-and-commit.mjs'),
+      'utf8'
+    );
+    assert.ok(
+      rust.indexOf('const newVersion = await findNextAvailableVersion') <
+        rust.indexOf('collectFragments()')
+    );
+
+    const python = readFileSync(
+      join(repoRoot, 'python/scripts/version_and_commit.py'),
+      'utf8'
+    );
+    assert.ok(
+      python.indexOf('new_version = bump_version(') <
+        python.indexOf('collect_changelog(new_version')
+    );
+  });
+
+  it('writes headings at the level the release scripts read', () => {
+    // scriv defaults to level 1 while create_github_release.py extracts from
+    // `## <version>`, so the two could never meet.
+    const pyproject = readFileSync(
+      join(repoRoot, 'python/pyproject.toml'),
+      'utf8'
+    );
+    assert.match(pyproject, /^md_header_level = "2"$/m);
+
+    const release = readFileSync(
+      join(repoRoot, 'python/scripts/create_github_release.py'),
+      'utf8'
+    );
+    assert.match(release, /rf"\^## \{re\.escape\(version\)\}/);
+  });
+
+  it('says so in the run summary when the notes are missing anyway', () => {
+    // The fallback body is a silent downgrade: the release still goes out and
+    // the job still passes.
+    for (const path of [
+      'js/scripts/create-github-release.mjs',
+      'rust/scripts/create-github-release.mjs',
+      'python/scripts/create_github_release.py',
+    ]) {
+      assert.match(
+        readFileSync(join(repoRoot, path), 'utf8'),
+        /::warning::/,
+        `${path} drops the release notes without a word`
+      );
+    }
+  });
+});

package/tests/unit/scripts/changeset-formatter.test.js

@@ -0,0 +1,108 @@
+/**
+ * Guard for RC-G: `changeset version` aborting on a formatter that is not
+ * installed.
+ *
+ * @changesets/cli v3 formats the changelog it writes. With the default
+ * `"format": "auto"`, @changesets/format walks `defaultDetectOrder` --
+ * dprint, deno, oxfmt, biome, prettier -- and picks the first formatter whose
+ * config file it finds. `js/deno.json` existed -- orphaned configuration no
+ * workflow ever used -- so deno won over the prettier this package actually
+ * depends on. deno is the one entry in that table with
+ * no `packageName`, so it is spawned straight off PATH with no existence
+ * check and no npx fallback; GitHub's ubuntu-latest runner has no deno.
+ *
+ * `changeset version` therefore bumped package.json, wrote CHANGELOG.md, and
+ * then died with `spawn deno ENOENT` before deleting the changeset it had
+ * just consumed. The release still shipped -- 0.17.0 is on npm -- but
+ * `merged-loud-river.md` survived to be released a second time, and the
+ * half-written CHANGELOG.md kept trailing whitespace that fails
+ * `prettier --check`.
+ *
+ * Reproduction: experiments/ci-repro/repro-changeset-deno-formatter.mjs
+ * Analysis: dev/log/issues/83/pulls/84/analysis/root-causes.md, RC-G
+ */
+
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it } from 'node:test';
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '../../..');
+const require = createRequire(import.meta.url);
+
+const config = JSON.parse(
+  readFileSync(join(packageRoot, '.changeset/config.json'), 'utf-8')
+);
+
+describe('changesets formatter', () => {
+  it('pins a formatter instead of auto-detecting one', () => {
+    assert.notEqual(
+      config.format,
+      undefined,
+      'omitting `format` means "auto", which detects whichever formatter ' +
+        'config happens to sit beside package.json and then fails on a ' +
+        'runner that has no such binary'
+    );
+    assert.notEqual(config.format, 'auto', 'same as omitting it');
+  });
+
+  it('pins a formatter this package can actually run', () => {
+    // `false` disables formatting, which is also a safe answer.
+    if (config.format === false) {
+      return;
+    }
+
+    const { defaultDetectOrder } = require('@changesets/format');
+    assert.ok(
+      defaultDetectOrder.includes(config.format),
+      `unknown formatter ${JSON.stringify(config.format)}; expected one of ${defaultDetectOrder.join(
+        ', '
+      )}`
+    );
+
+    // @changesets/format keeps the formatter table private, so mirror the
+    // one fact this test needs: which formatters it resolves through
+    // node_modules and which it spawns straight off PATH. `deno` is the
+    // single entry with no package, which is why it cannot be relied on.
+    const packageNames = {
+      dprint: 'dprint',
+      deno: null,
+      oxfmt: 'oxfmt',
+      biome: '@biomejs/biome',
+      prettier: 'prettier',
+    };
+    const packageName = packageNames[config.format];
+    assert.ok(
+      packageName,
+      `${config.format} is spawned straight off PATH with no npx fallback, ` +
+        'so it cannot be relied on inside a release job'
+    );
+    assert.ok(
+      existsSync(join(packageRoot, 'node_modules', packageName)),
+      `${packageName} is not installed in this package`
+    );
+  });
+
+  it('leaves no consumed changeset behind', () => {
+    const changesetDir = join(packageRoot, '.changeset');
+    const pending = readdirSync(changesetDir).filter(
+      (file) => file.endsWith('.md') && file !== 'README.md'
+    );
+
+    const changelog = readFileSync(join(packageRoot, 'CHANGELOG.md'), 'utf-8');
+    for (const file of pending) {
+      const body = readFileSync(join(changesetDir, file), 'utf-8')
+        .replace(/^---\s*\n[\s\S]*?\n---\s*\n/, '')
+        .trim();
+      const firstLine = body.split('\n')[0].trim();
+      assert.ok(
+        firstLine.length === 0 || !changelog.includes(firstLine),
+        `.changeset/${file} describes a change that CHANGELOG.md already ` +
+          'records as released; `changeset version` consumed it but did not ' +
+          'delete it, so the next release will publish it again'
+      );
+    }
+  });
+});