browser-commander 0.31.2 → 0.32.1

package/tests/unit/scripts/preflight-credentials.test.js

@@ -90,6 +90,7 @@ function environment(overrides) {
     NPM_REGISTRY: `${stub.origin}/npm`,
     CRATES_API: `${stub.origin}/crates`,
     NPM_PACKAGE: '@link-foundation/probe',
+    CRATES_PACKAGE: 'probe-crate',
     CARGO_REGISTRY_TOKEN: '',
     CARGO_TOKEN: '',
     GITHUB_STEP_SUMMARY: '',
@@ -133,6 +134,13 @@ const EXCHANGE =
   'POST /npm/-/npm/v1/oidc/token/exchange/package/@link-foundation%2Fprobe';
 const CRATES_MINT = 'POST /crates/api/v1/trusted_publishing/tokens';
 const CRATES_REVOKE = 'DELETE /crates/api/v1/trusted_publishing/tokens';
+const CRATES_PUBLISH = 'PUT /crates/api/v1/crates/new';
+// What crates.io answers to an authorised publish that omits the archive.
+const TOKEN_ACCEPTED = [
+  400,
+  { errors: [{ detail: 'invalid tarball length' }] },
+];
+const TOKEN_REJECTED = [403, { errors: [{ detail: 'authentication failed' }] }];
 const INVALID_PUBLISHER = [
   422,
   {
@@ -157,6 +165,33 @@ function probeCrates(answer, overrides = {}) {
   return preflight({ PREFLIGHT_REGISTRIES: 'crates', ...overrides });
 }
 
+/**
+ * Refuse the crates.io OIDC exchange and answer the token publish probe with
+ * `answer`, so the outcome rests on the token fallback.
+ */
+function probeFallback(answer, overrides = {}) {
+  stub.routes[CRATES_PUBLISH] = answer;
+  return probeCrates([403, {}], { CARGO_TOKEN: CARGO_SECRET, ...overrides });
+}
+
+/** Run the crates.io probe in a job without `id-token: write`. */
+function preflightWithoutOidc(overrides = {}) {
+  return preflight({
+    PREFLIGHT_REGISTRIES: 'crates',
+    ACTIONS_ID_TOKEN_REQUEST_URL: '',
+    ACTIONS_ID_TOKEN_REQUEST_TOKEN: '',
+    ...overrides,
+  });
+}
+
+/** The metadata of a token publish probe: a u32 length, then JSON. */
+function probeMetadata(body) {
+  const bytes = Buffer.from(body, 'latin1');
+  const length = bytes.readUInt32LE(0);
+  assert.equal(bytes.length, 4 + length, 'the probe must carry no archive');
+  return JSON.parse(bytes.subarray(4).toString('utf8'));
+}
+
 describe('scripts/preflight-credentials.sh', scriptOptions, () => {
   before(async () => {
     stub.server = createServer(respond);
@@ -349,11 +384,11 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       assertNoSecrets(output);
     });
 
-    it('fails a release when no trusted publisher matches, even with a legacy secret', async () => {
-      const { status, output } = await probeCrates(
-        [403, { errors: [{ detail: 'no matching publisher' }] }],
-        { CARGO_TOKEN: CARGO_SECRET }
-      );
+    it('fails a release when no trusted publisher matches and no token is set', async () => {
+      const { status, output } = await probeCrates([
+        403,
+        { errors: [{ detail: 'no matching publisher' }] },
+      ]);
 
       assert.equal(status, 1, output);
       assert.match(
@@ -362,18 +397,80 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       );
       assert.match(output, /rust\.yml/);
       assert.match(output, /docs\/PUBLISHING\.md/);
+      assert.match(output, /neither CARGO_REGISTRY_TOKEN nor CARGO_TOKEN/);
       assert.equal(stub.requests.length, 2);
+    });
+
+    it('passes a release on the token fallback when no trusted publisher matches', async () => {
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED);
+
+      assert.equal(status, 0, output);
+      assert.match(output, /1 verified, 0 failed, 0 unknown/);
+      assert.match(
+        output,
+        /PASS: crates.io accepted the CARGO_REGISTRY_TOKEN\/CARGO_TOKEN fallback for probe-crate/
+      );
+      assert.match(
+        output,
+        /::warning::release-preflight: crates.io refused the OIDC token exchange \(403\).*falls back to the CARGO_REGISTRY_TOKEN\/CARGO_TOKEN secret/
+      );
+      assert.doesNotMatch(output, /::error::/);
+      const publish = stub.requests.at(-1);
+      assert.equal(publish.route, CRATES_PUBLISH);
+      assert.equal(publish.authorization, CARGO_SECRET);
+      assert.match(publish.userAgent, /^release-preflight /);
+      assert.deepEqual(probeMetadata(publish.body), {
+        name: 'probe-crate',
+        vers: '0.0.0-preflight',
+      });
+      assert.equal(stub.requests.length, 3);
       assertNoSecrets(output);
     });
 
-    it('fails when the job has no OIDC permission, with no secret fallback', async () => {
-      const { status, output } = await preflight({
-        PREFLIGHT_REGISTRIES: 'crates',
-        ACTIONS_ID_TOKEN_REQUEST_URL: '',
-        ACTIONS_ID_TOKEN_REQUEST_TOKEN: '',
+    it('prefers CARGO_REGISTRY_TOKEN over CARGO_TOKEN for the fallback', async () => {
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED, {
+        CARGO_REGISTRY_TOKEN: CARGO_SECRET,
+        CARGO_TOKEN: 'cio-other-token-must-not-be-used',
+      });
+
+      assert.equal(status, 0, output);
+      assert.equal(stub.requests.at(-1).authorization, CARGO_SECRET);
+    });
+
+    it('fails a release when trusted publishing and the token fallback are both refused', async () => {
+      const { status, output } = await probeFallback(TOKEN_REJECTED);
+
+      assert.equal(status, 1, output);
+      assert.match(output, /0 verified, 1 failed, 0 unknown/);
+      assert.match(
+        output,
+        /::error::release-preflight: crates.io refused the OIDC token exchange \(403\).*; crates.io rejected the CARGO_REGISTRY_TOKEN\/CARGO_TOKEN fallback for probe-crate \(403\)/
+      );
+      assert.equal(stub.requests.length, 3);
+      assertNoSecrets(output);
+    });
+
+    it('falls back to the token when the job has no OIDC permission', async () => {
+      stub.routes[CRATES_PUBLISH] = TOKEN_ACCEPTED;
+      const { status, output } = await preflightWithoutOidc({
         CARGO_REGISTRY_TOKEN: CARGO_SECRET,
       });
 
+      assert.equal(status, 0, output);
+      assert.match(
+        output,
+        /::warning::release-preflight: crates.io: no OIDC token available: .*id-token: write/
+      );
+      assert.deepEqual(
+        stub.requests.map(({ route }) => route),
+        [CRATES_PUBLISH]
+      );
+      assertNoSecrets(output);
+    });
+
+    it('fails when the job has no OIDC permission and no token is set', async () => {
+      const { status, output } = await preflightWithoutOidc();
+
       assert.equal(status, 1, output);
       assert.match(
         output,
@@ -382,6 +479,54 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       assert.equal(stub.requests.length, 0);
     });
 
+    it('treats an unproven token fallback as unknown, never as a pass', async () => {
+      for (const answer of [
+        [400, { errors: [{ detail: 'invalid upload request' }] }],
+        [429, {}],
+        [500, { token: CARGO_SECRET }],
+      ]) {
+        const { status, output } = await probeFallback(answer);
+        assert.equal(status, 1, output);
+        assert.match(output, /0 verified, 0 failed, 1 unknown/);
+        assert.match(output, /verified nothing/);
+        assertNoSecrets(output);
+      }
+    });
+
+    it('reads the crate name from Cargo.toml when CRATES_PACKAGE is unset', async () => {
+      writeFileSync(
+        path.join(workDir, 'Cargo.toml'),
+        [
+          '[package]',
+          'name = "from-manifest"',
+          'version = "1.2.3"',
+          '',
+          '[dependencies.serde]',
+          'name = "not-this-one"',
+          '',
+        ].join('\n')
+      );
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED, {
+        CRATES_PACKAGE: '',
+      });
+
+      assert.equal(status, 0, output);
+      assert.equal(
+        probeMetadata(stub.requests.at(-1).body).name,
+        'from-manifest'
+      );
+    });
+
+    it('cannot probe the token without a crate name', async () => {
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED, {
+        CRATES_PACKAGE: '',
+      });
+
+      assert.equal(status, 1, output);
+      assert.match(output, /cannot tell which crate to probe/);
+      assert.equal(stub.requests.length, 2);
+    });
+
     it('keeps missing publishers advisory on pull requests', async () => {
       const { status, output } = await probeCrates([403, {}], {
         PREFLIGHT_MODE: 'report',
@@ -429,6 +574,7 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       stub.routes[MINT] = INVALID_PUBLISHER;
       stub.routes[EXCHANGE] = [403, { message: 'forbidden' }];
       stub.routes[CRATES_MINT] = [401, { errors: [{ detail: 'bad token' }] }];
+      stub.routes[CRATES_PUBLISH] = TOKEN_REJECTED;
       const summary = path.join(workDir, 'summary.md');
       writeFileSync(summary, '');
 

package/tests/unit/scripts/trusted-publishing.test.js

@@ -7,8 +7,13 @@ import { readRepoText } from '../../helpers/repo.js';
 describe('trusted publishing configuration', () => {
   const rust = parse(readRepoText('.github/workflows/rust.yml'));
 
+  // Organization policy: trusted publishing (OIDC) first, the token secret
+  // only when OIDC is unavailable.
+  const FALLBACK =
+    '${{ steps.crates_auth.outputs.token || secrets.CARGO_REGISTRY_TOKEN || secrets.CARGO_TOKEN }}';
+
   for (const jobId of ['auto-release', 'manual-release']) {
-    it(`${jobId} uses a fresh OIDC token only when publishing`, () => {
+    it(`${jobId} publishes with a fresh OIDC token, falling back to the token secret`, () => {
       const job = rust.jobs[jobId];
       assert.equal(job.permissions['id-token'], 'write');
       const auth = job.steps.find((step) => step.id === 'crates_auth');
@@ -20,9 +25,11 @@ describe('trusted publishing configuration', () => {
       );
       assert.equal(auth.if, publish.if);
       assert.equal(
-        publish.env.CARGO_REGISTRY_TOKEN,
-        '${{ steps.crates_auth.outputs.token }}'
+        auth['continue-on-error'],
+        true,
+        'a trusted publishing failure must leave the token fallback reachable'
       );
+      assert.equal(publish.env.CARGO_REGISTRY_TOKEN, FALLBACK);
       assert.ok(job.steps.indexOf(auth) < job.steps.indexOf(publish));
       assert.ok(
         job.steps.indexOf(auth) >
@@ -31,13 +38,28 @@ describe('trusted publishing configuration', () => {
     });
   }
 
-  it('never reads the long-lived Cargo secret in the Rust workflow', () => {
-    assert.doesNotMatch(
-      readRepoText('.github/workflows/rust.yml'),
-      /secrets\.CARGO_TOKEN/
+  it('gives the release preflight the same token fallback', () => {
+    const probe = rust.jobs['release-preflight'].steps.find(
+      (step) => step.name === 'Probe crates.io trusted publishing'
+    );
+    assert.equal(
+      probe.env.CARGO_REGISTRY_TOKEN,
+      '${{ secrets.CARGO_REGISTRY_TOKEN || secrets.CARGO_TOKEN }}'
     );
   });
 
+  it('reads the Cargo secrets only as the trusted publishing fallback', () => {
+    const uses = readRepoText('.github/workflows/rust.yml')
+      .split('\n')
+      .filter((line) => /secrets\.CARGO_/.test(line))
+      .map((line) => line.trim());
+    assert.deepEqual(uses, [
+      'CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN || secrets.CARGO_TOKEN }}',
+      `CARGO_REGISTRY_TOKEN: ${FALLBACK}`,
+      `CARGO_REGISTRY_TOKEN: ${FALLBACK}`,
+    ]);
+  });
+
   it('keeps the registered PyPI identity identical across preflight and releases', () => {
     const python = parse(readRepoText('.github/workflows/python.yml'));
     for (const jobId of [

package/tests/unit/utilities/interruption.test.js

@@ -0,0 +1,182 @@
+import * as fs from 'node:fs/promises';
+import path from 'node:path';
+import { tmpdir } from 'node:os';
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+import {
+  interruptionMode,
+  startProcess,
+} from '../../../src/utilities/subprocess.js';
+import { repoPath } from '../../helpers/repo.js';
+import { waitForFileText } from '../../helpers/temp-directory.js';
+
+// feature-parity: process.interruption@native-typed
+
+const node = process.execPath;
+const delayedShutdown = repoPath(
+  'experiments',
+  'issue-172',
+  'delayed-shutdown.mjs'
+);
+const unixOnly = {
+  timeout: 15000,
+  skip:
+    process.platform === 'win32' &&
+    'Command Stream only creates separate process groups on Unix',
+};
+
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error.code === 'ESRCH') {
+      return false;
+    }
+    throw error;
+  }
+}
+
+function forceKill(pid) {
+  if (pid && isAlive(pid)) {
+    process.kill(pid, 'SIGKILL');
+  }
+}
+
+async function tempDirectory(t, prefix) {
+  const directory = await fs.mkdtemp(path.join(tmpdir(), prefix));
+  t.after(() => fs.rm(directory, { recursive: true, force: true }));
+  return directory;
+}
+
+/**
+ * Run an embedding supervisor that interrupts itself, keeps its child from
+ * its own SIGINT handler, and exits. Returns whether the child survived.
+ */
+async function childSurvivesSupervisorInterrupt(t, mode) {
+  const directory = await tempDirectory(t, 'bc-interrupt-174-');
+  const pidFile = path.join(directory, 'pid');
+  const supervisor = startProcess(node, [
+    repoPath('experiments', 'issue-174', 'sigint-supervisor.mjs'),
+    mode,
+    pidFile,
+  ]);
+  assert.equal(await supervisor.exited, 130, supervisor.stderrTail);
+  const pid = Number(await fs.readFile(pidFile, 'utf8'));
+  t.after(() => forceKill(pid));
+  assert.ok(pid > 0);
+  await new Promise((resolve) => setTimeout(resolve, 300));
+  return isAlive(pid);
+}
+
+describe('interruption ownership (issue #174)', unixOnly, () => {
+  it('forwards SIGINT to the child by default, before the embedder can keep it', async (t) => {
+    assert.equal(await childSurvivesSupervisorInterrupt(t, 'managed'), false);
+    assert.equal(
+      await childSurvivesSupervisorInterrupt(t, 'detach-in-handler'),
+      false
+    );
+  });
+
+  it("leaves SIGINT to the embedder's handler with interruption: 'caller'", async (t) => {
+    assert.equal(await childSurvivesSupervisorInterrupt(t, 'caller'), true);
+  });
+
+  it('keeps streaming output and reporting the exit code for a caller-owned child', async () => {
+    const child = startProcess(
+      node,
+      [
+        '-e',
+        'setTimeout(()=>{process.stderr.write("hello\\n");process.exit(4)},100)',
+      ],
+      { interruption: 'caller' }
+    );
+    assert.equal(child.interruption, 'caller');
+    let stderr = '';
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+    assert.equal(await child.exited, 4);
+    assert.equal(stderr, 'hello\n');
+    assert.equal(child.kill(), false);
+  });
+
+  it('kill() still awaits the actual exit of a caller-owned child', async (t) => {
+    const directory = await tempDirectory(t, 'bc-caller-kill-174-');
+    const marker = path.join(directory, 'flushed');
+    const child = startProcess(node, [delayedShutdown, marker], {
+      interruption: 'caller',
+      killGrace: 1000,
+    });
+    t.after(() => forceKill(child.pid));
+    await new Promise((resolve) => child.stdout.on('data', resolve));
+    assert.equal(child.kill(), true);
+    assert.equal(await child.exited, 0);
+    assert.equal(await fs.readFile(marker, 'utf8'), 'flushed');
+    assert.equal(isAlive(child.pid), false);
+  });
+
+  it('escalates to SIGKILL when a caller-owned child ignores SIGTERM', async (t) => {
+    const child = startProcess(
+      node,
+      [
+        '-e',
+        'process.on("SIGTERM",()=>{});process.stdout.write("ready");setInterval(()=>{},1000)',
+      ],
+      { interruption: 'caller', killGrace: 200 }
+    );
+    t.after(() => forceKill(child.pid));
+    await new Promise((resolve) => child.stdout.on('data', resolve));
+    child.kill();
+    assert.equal(await child.exited, 128 + 9);
+    assert.equal(child.signalCode, 'SIGKILL');
+  });
+
+  it('detach() lets the supervisor end while the exact child keeps running', async (t) => {
+    const directory = await tempDirectory(t, 'bc-detach-174-');
+    const marker = path.join(directory, 'survived');
+    const launcher = startProcess(node, [
+      repoPath('experiments', 'issue-174', 'detach-launcher.mjs'),
+      marker,
+    ]);
+    let output = '';
+    launcher.stdout.on('data', (chunk) => {
+      output += chunk;
+    });
+    assert.equal(await launcher.exited, 0, launcher.stderrTail);
+    const { pid, detached } = JSON.parse(output);
+    t.after(() => forceKill(pid));
+    assert.equal(detached, true);
+    assert.equal(isAlive(pid), true);
+    assert.equal(
+      await waitForFileText(marker, 'survived'),
+      true,
+      'detached child did not outlive its supervisor'
+    );
+  });
+
+  it('detach() is idempotent and a detached child can still be stopped', async () => {
+    const child = startProcess(node, ['-e', 'setInterval(()=>{},1000)'], {
+      killGrace: 200,
+    });
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    assert.equal(child.detach(), true);
+    assert.equal(child.detach(), true);
+    assert.equal(child.detached, true);
+    assert.equal(child.kill(), true);
+    assert.equal(await child.exited, 128 + 15);
+    assert.equal(child.detach(), false);
+  });
+});
+
+describe('interruptionMode', () => {
+  it('defaults to managed and rejects unknown modes', () => {
+    assert.equal(interruptionMode(), 'managed');
+    assert.equal(interruptionMode('caller'), 'caller');
+    assert.throws(() => interruptionMode('detached'), TypeError);
+    assert.throws(
+      () => startProcess(node, [], { interruption: 'none' }),
+      /interruption must be one of managed, caller/
+    );
+  });
+});

package/tests/unit/utilities/subprocess.test.js

@@ -9,6 +9,7 @@ import {
   startProcess,
 } from '../../../src/utilities/subprocess.js';
 import { repoPath } from '../../helpers/repo.js';
+import { waitForFileText } from '../../helpers/temp-directory.js';
 
 const node = process.execPath;
 
@@ -173,19 +174,11 @@ describe(
       assert.equal(await launcher.exited, 0, launcher.stderrTail);
       assert.ok(pid > 0);
       await assert.rejects(fs.readFile(marker), { code: 'ENOENT' });
-      const deadline = Date.now() + 5000;
-      while (Date.now() < deadline) {
-        try {
-          assert.equal(await fs.readFile(marker, 'utf8'), 'survived');
-          return;
-        } catch (error) {
-          if (error.code !== 'ENOENT') {
-            throw error;
-          }
-          await new Promise((resolve) => setTimeout(resolve, 50));
-        }
-      }
-      assert.fail('detached child did not survive the launcher exit');
+      assert.equal(
+        await waitForFileText(marker, 'survived'),
+        true,
+        'detached child did not survive the launcher exit'
+      );
     });
   }
 );