clearotron 0.3.0 → 0.3.1-beta.0

package/scripts/release-version.mjs

@@ -25,6 +25,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { findings, sentences } from "./changelog-plain-language.mjs";
 import { tagsHere } from "./release-cut-decision.mjs";
+import { preModeFrom } from "./release-dist-tag.mjs";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -41,6 +42,70 @@ export function alreadyOut({ version, tags = [], published = false }) {
   return where;
 }
 
+// ── THE CHANNEL DECIDES THE MODE, AND IT HAS TO BE DECIDED HERE ───────────────────────────────────
+//
+// `changeset version` computes a pre-release number or a stable one depending on whether the tree is in
+// pre-release mode when it runs. So something has to put the tree in the mode the chosen channel needs.
+//
+// THAT USED TO BE A STEP IN THE WORKFLOW, AND IT COULD NEVER HAVE WORKED. The step edited
+// `.changeset/pre.json` in the working tree, and the action that runs this script rebuilds that tree
+// before running it: `git checkout changeset-release/main`, then `git reset --hard` to the commit the
+// run was dispatched from. Read in the pinned action's own source, in this order — the rebuild, then
+// this script, then a commit made with `git add .` from the working tree, and nothing in between that
+// touches git. So an edit made before the action is discarded, and an edit made here is committed.
+//
+// The failure had two halves and only one of them was visible. A stable dispatch could not leave
+// pre-release mode, so it computed another beta and refused at the channel check — loud, and it cost a
+// cut. The other half is silent: a stable deletes `pre.json` rather than leaving it saying `exit`, so a
+// later beta dispatch finds no flag, cannot enter pre mode, and computes a STABLE version from a button
+// marked beta. Fixing only the direction that announces itself would leave that one live, and it would
+// surface weeks later as a release published to the wrong channel.
+//
+// Both directions are therefore driven from here, and both are no-ops when the tree is already right:
+// the mode a cut needs is a fact about the channel asked for, not about what the last cut happened to do.
+export const CUT_FLAG = "--cut=";
+
+/**
+ * PURE. What this cut must do to the tree's pre-release mode before the version is computed.
+ *
+ * `null` means leave the tree alone — a rehearsal, an ordinary push, or a tree already in the right
+ * mode. Anything else is the `changeset pre` arguments that put it there.
+ *
+ * An UNKNOWN channel leaves the tree alone rather than guessing. This runs on every push as well as on
+ * a dispatch, and a push carries no channel at all: changing the mode there would make an ordinary
+ * merge silently switch the line it is publishing on.
+ */
+export function modeTransition({ cut, mode }) {
+  const inPre = mode === "pre";
+  if (cut === "beta") return inPre ? null : ["pre", "enter", "beta"];
+  if (cut === "stable") return inPre ? ["pre", "exit"] : null;
+  return null;
+}
+
+/**
+ * The channel this run asked for, and the arguments to forward on without it.
+ *
+ * SPLIT RATHER THAN READ, because everything not consumed here is forwarded verbatim to
+ * `changeset version`, which refuses an argument it does not know. A flag added to this script that is
+ * not removed from that list stops the cut.
+ */
+export function splitCut(args = []) {
+  const flag = args.find((a) => a.startsWith(CUT_FLAG));
+  return { cut: flag ? flag.slice(CUT_FLAG.length) : "", rest: args.filter((a) => a !== flag) };
+}
+
+/**
+ * The tree's pre-release mode, or `"none"` when it carries no flag at all.
+ *
+ * `"none"` is a real state here rather than a missing reading: it is what a tree looks like after a
+ * stable, because `changeset version` DELETES the file rather than leaving it saying `exit`.
+ */
+export function preModeHere(root = ROOT) {
+  const p = join(root, ".changeset", "pre.json");
+  if (!existsSync(p)) return "none";
+  return preModeFrom(readFileSync(p, "utf8")) ? "pre" : "exit";
+}
+
 /**
  * Whether the registry already carries `name@version`: true, false, or null when it could not be asked.
  *
@@ -223,11 +288,23 @@ export function writeRootChangelog({ version, groups }, root = ROOT) {
 }
 
 function main() {
-  const args = process.argv.slice(2);
+  const { cut, rest } = splitCut(process.argv.slice(2));
   const run = (...a) => execFileSync(process.execPath,
     [join(ROOT, "node_modules/@changesets/cli/bin.js"), ...a], { cwd: ROOT, stdio: "inherit" });
 
-  run("version", ...args);
+  // BEFORE THE VERSION IS COMPUTED, because the mode is what decides the number. The header above says
+  // why this cannot live in the workflow. It is announced either way: a cut that did nothing to the mode
+  // and a cut whose mode change was lost look identical in a log that only speaks up when it acts.
+  const modeWas = preModeHere();
+  const transition = modeTransition({ cut, mode: modeWas });
+  console.log(`release-version: asked for ${cut || "no channel"}, tree is in pre-release mode ${modeWas}`
+    + ` — ${transition ? `running changeset ${transition.join(" ")}` : "nothing to change"}`);
+  if (transition) {
+    run(...transition);
+    console.log(`release-version: pre-release mode is now ${preModeHere()}`);
+  }
+
+  run("version", ...rest);
   const version = groupVersion();
 
   // ── A VERSION ALREADY OUT IS REFUSED HERE, BEFORE ANYTHING IS STAMPED ─────────────────────────────
@@ -258,8 +335,11 @@ function main() {
     console.error(`release-version: this cut computed ${version}, and that version is already out: `
       + `${out.join(" and ")}. Publishing it would fail after main is stamped and the notes are consumed.\n`
       + "  The pre-release line keeps no record of its last number: .changeset/pre.json holds only its mode "
-      + "and tag, and a stable release deletes it, so this was counted again from package.json. Put the "
-      + "line back where its last published version left it, then cut again.");
+      + "and tag, and a stable release deletes it, so this was counted again from package.json.\n"
+      + "  The MODE is not the thing to repair — this step sets it from the channel that was asked for, and "
+      + "the line above says which mode it found and what it did. What is wrong is the NUMBER the manifests "
+      + "count from: open an ordinary pull request setting them to the last published version, which "
+      + "publishes nothing, and cut again.");
     process.exitCode = 1;
     return;
   }

package/shared/trigger-lane.mjs

@@ -61,6 +61,27 @@ export const SUPERVISED = "supervised";
  * because a command printed without it is command-not-found in the terminal the reader is sitting in:
  * doctor's own guard runs every command doctor prints, and it caught this one.
  */
+/**
+ * Which credential did the door ask for when it refused? `"proxy"`, `"key"`, or null for "it did not say".
+ *
+ * THE DOOR'S OWN SENTENCE IS THE EVIDENCE, because the header is not. An identity-proxy door and a key
+ * door both answer an unauthenticated request with 401 and neither sends `www-authenticate`, so the only
+ * thing on the wire that distinguishes them is what the refusal says it wants.
+ *
+ * THIS MATCHES A SPELLING, AND A SPELLING CAN MOVE. The two sentences are written by the door
+ * (`mcp-server/lib/cf-access.mjs` for the proxy refusal, `mcp-server/lib/http-handler.mjs` for the key
+ * one). If either is reworded this stops recognising it and the verdict degrades to "did not say" — the
+ * reported state, not a wrong confident one, which is the right direction to fail in. A test pins both
+ * sentences against the doors that send them so the drift is named rather than silent.
+ */
+export function doorCredential(probe) {
+  const body = String(probe?.body ?? "");
+  if (!body) return null;
+  if (/auth-proxy jwt|jwt-assertion|access token/i.test(body)) return "proxy";
+  if (/access key|[?&]token=/i.test(body)) return "key";
+  return null;
+}
+
 export function triggerLaneVerdict({ url = null, hasToken = false, verbs = null, posture = SUPERVISED, probe = null, invoke = "" } = {}) {
   const startCmd = `${invoke}clearotron start`;
   const raw = String(url ?? "").trim();
@@ -131,6 +152,51 @@ export function triggerLaneVerdict({ url = null, hasToken = false, verbs = null,
   const challenge = challengeVerdict(probe);
   if (challenge.blocked) return { state: "fail", message: blockedByAccessChallenge(raw, probe.status) };
   if (probe.ok) {
+    // ── A 401 IS ANSWERED BY STATUS AND REFUSED IN SUBSTANCE ─────────────────────────────────────────
+    //
+    // `probe.ok` is `status < 500`, so a door REFUSING the caller lands here and was reported as a lane
+    // that answers. That is not a near miss: an identity-proxy door and a key door both refuse an
+    // unauthenticated GET with 401 and NEITHER sends `www-authenticate`, so the challenge test above
+    // cannot separate them and this line printed the same sentence for a deployment that works and one
+    // that cannot carry a Start. A line that is identical in both states carries no information about
+    // either, which is what makes it a defect rather than an optimistic guess.
+    //
+    // WHAT SEPARATES THEM IS THE DOOR'S OWN SENTENCE. Each mode says which credential it wants, in the
+    // body: the proxy door asks for a proxy assertion, the key door asks for an access key. This portal
+    // holds a key and cannot produce a proxy identity, so the first is unreachable to it no matter what
+    // the key is.
+    const wants = doorCredential(probe);
+    if (probe.status === 401 && wants === "proxy") {
+      return { state: "fail",
+        message: `${raw} is fronted by an identity proxy: it refused an unauthenticated request by asking `
+          + "for a proxy identity, and this portal presents an access key. The Start button will fail at "
+          + "the door with a 401 upstream and a 502 to the client, whatever the key is. Either put the "
+          + "portal behind the same proxy, or give it a door that accepts the key." };
+    }
+    if (probe.status === 401 && wants === "key") {
+      return { state: "pass",
+        message: `the trigger lane answers at ${raw} (401 to an unauthenticated check, asking for the `
+          + `access key this portal holds)${challengeNote(challenge)}` };
+    }
+    if (probe.status === 401) {
+      // THE BODY IS NEW EVIDENCE, NOT A REPLACEMENT FOR WHAT WE HAD. A door that challenges for a bearer
+      // token has said, in the header, that it takes the kind of credential this portal holds — that is
+      // the reading this verdict was built on and it stays. Only when the refusal names no credential in
+      // EITHER place is there nothing to go on.
+      if (/bearer|oauth/i.test(String(probe.challenge ?? ""))) {
+        return { state: "pass",
+          message: `the trigger lane answers at ${raw} (401 to an unauthenticated check, challenging for a `
+            + `token)${challengeNote(challenge)}` };
+      }
+      // REPORTED, NOT JUDGED — the doctrine this block already follows for an ambiguous challenge. A 401
+      // that names no credential in its body and offers no challenge may be a proxy we have not met or a
+      // door that changed its wording; claiming either way would be the original defect with the
+      // confidence pointed somewhere new.
+      return { state: "unsettled",
+        message: `${raw} refused an unauthenticated check with 401 and did not say which credential it `
+          + "wants, in its challenge or its body, so this cannot tell whether the portal's access key will "
+          + "be accepted. Present the key against it before relying on the Start button." };
+    }
     return { state: "pass",
       message: `the trigger lane answers at ${raw}${probe.status ? ` (${probe.status})` : ""}${challengeNote(challenge)}` };
   }

package/shared/wsl.mjs

@@ -4,7 +4,7 @@
 // Whether this is a Linux running under Windows. Shared because two readers need the one answer: the install
 // (which binaries on a Windows drive to pass over) and the connect lines (which must say to run them inside
 // WSL, where their paths exist).
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 
 /**
  * BOTH SIGNALS INJECTABLE, for the reason `platformEngineRefusal` gives: the readers this protects are the
@@ -15,9 +15,26 @@ import { readFileSync } from "node:fs";
  * resolution exactly as it was before this existed. Claiming WSL on a could-not-read would start refusing
  * candidates under /mnt on an ordinary Linux box with an ordinary mount.
  */
-export function isWsl({ env = process.env, procVersion = null } = {}) {
+// THE INTEROP REGISTRATION BOTH GENERATIONS INSTALL, and the reason this file no longer matches a vendor
+// string. The older generation's /proc/version carries a vendor name and NOT the token "wsl", so the only
+// thing catching it was that name — identifying a platform by a third party's name, on a public surface,
+// for want of another signal. This is the other signal, and it names the platform rather than a company.
+//
+// IT SHIPS ON REASONING, which is worth saying rather than implying. Neither generation runs on any box
+// here, so nothing in this suite can demonstrate that the older one registers this entry: the newer one
+// demonstrably does, the older one is documented to, and a walk through a real install is the test that
+// exists. If it turns out not to, the failure is the one this file already fails safe into — "not WSL",
+// which leaves the resolution exactly as it was, rather than claiming WSL on a box that is not one.
+export const WSL_INTEROP_ENTRY = "/proc/sys/fs/binfmt_misc/WSLInterop";
+
+export function isWsl({ env = process.env, procVersion = null, interopEntry = null } = {}) {
   if (String(env.WSL_DISTRO_NAME ?? "").trim()) return true;
   if (String(env.WSL_INTEROP ?? "").trim()) return true;
+  // Injectable like the other two, and for the same reason this file already gives: the readers this
+  // protects cannot run the suite to find out, so a Linux runner has to be able to drive both answers
+  // rather than read the source and agree with it.
+  const interop = interopEntry ?? (() => { try { return existsSync(WSL_INTEROP_ENTRY); } catch { return false; } })();
+  if (interop) return true;
   const v = procVersion ?? (() => { try { return readFileSync("/proc/version", "utf8"); } catch { return ""; } })();
-  return /microsoft|wsl/i.test(v);
+  return /wsl/i.test(v);
 }