cli-jaw 2.2.14 → 2.2.16

package/scripts/postinstall-guard.cjs

@@ -48,6 +48,41 @@ function ensurePackageBinExecutable(rootDir) {
 
 ensurePackageBinExecutable(root);
 
+// ─── 2.5 install state receipt ──────────────────────
+// This file records what the install actually did. Its ABSENCE is the signal
+// that npm/pnpm/bun blocked our lifecycle script (npm >= 12 blocks unreviewed
+// dependency scripts by default); its `state` distinguishes a real setup from
+// a safe-mode install that deliberately skipped it.
+//
+// It lives at the package root, NOT under dist/: scripts/atomic-build.sh
+// replaces dist/ wholesale on every build, which would erase the receipt and
+// make ordinary development look like a blocked install. The root path is
+// also outside the `files` allowlist, so it can never leak into the tarball.
+const INSTALL_STATE_FILE = '.jaw-install-state.json';
+
+/** @param {'completed'|'safe-mode'|'failed'} state */
+function writeInstallState(rootDir, state, extra) {
+    try {
+        // packageVersion is REQUIRED by the reader: a receipt whose version
+        // differs from the installed package is classified `stale`, so an
+        // upgrade whose scripts were blocked is never hidden by an old receipt.
+        const packageVersion = JSON.parse(
+            fs.readFileSync(path.join(rootDir, 'package.json'), 'utf8')).version;
+        fs.writeFileSync(path.join(rootDir, INSTALL_STATE_FILE), JSON.stringify({
+            schema: 1,
+            state,
+            packageVersion,
+            ranAt: new Date().toISOString(),
+            node: process.version,
+            platform: process.platform,
+            arch: process.arch,
+            ...extra,
+        }, null, 2));
+    } catch {
+        // A missing receipt only downgrades diagnostics; never fail the install.
+    }
+}
+
 // ─── 3. Safe mode: no build/install work ────────────
 const safeMode =
     process.env.JAW_SAFE === '1'
@@ -59,6 +94,7 @@ const safeMode =
 
 if (safeMode) {
     console.log('[jaw:init] safe mode — skipping postinstall build and installers');
+    writeInstallState(root, 'safe-mode');
     process.exit(0);
 }
 
@@ -103,8 +139,14 @@ if (!fs.existsSync(target)) {
     ensurePackageBinExecutable(root);
 }
 
-runCompiledPostinstall().catch((error) => {
+runCompiledPostinstall().then(() => {
+    writeInstallState(root, 'completed');
+}).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
     console.error('[jaw:init] ⚠️  postinstall error (non-fatal):');
-    console.error(error instanceof Error ? error.message : String(error));
+    console.error(message);
+    // Record the failure so `jaw doctor` can explain it later instead of the
+    // exit(0) silently swallowing it.
+    writeInstallState(root, 'failed', { error: message });
     process.exit(0);
 });

package/scripts/release-gates.mjs

@@ -82,7 +82,7 @@ const GATES = {
             ];
             const r = run('npx', args);
             if (r.status !== 0) {
-                return { ok: false, detail: `tests failed:\n${(r.stdout || r.stderr || '').slice(-2000)}` };
+                return { ok: false, detail: `tests failed:\n${[r.stdout, r.stderr].filter(Boolean).join('\n').slice(-2000)}` };
             }
             return { ok: true, detail: `passed ${targets.length} suite(s): ${targets.join(', ')}` };
         },
@@ -382,7 +382,7 @@ const GATES = {
             for (const s of steps) {
                 const r = run(s.cmd, s.args, { timeout: s.timeout });
                 if (r.status !== 0) {
-                    return { ok: false, detail: `${s.name} failed:\n${(r.stdout || r.stderr || '').slice(-1500)}` };
+                    return { ok: false, detail: `${s.name} failed:\n${[r.stdout, r.stderr].filter(Boolean).join('\n').slice(-1500)}` };
                 }
             }
             return { ok: true, detail: 'docs:check + check-doc-drift.sh clean' };
@@ -393,7 +393,7 @@ const GATES = {
         check() {
             const r = run('node', ['scripts/check-strict-baseline.mjs'], { timeout: 120_000 });
             if (r.status !== 0) {
-                return { ok: false, detail: `strict baseline regressed:\n${(r.stdout || r.stderr || '').slice(-1200)}` };
+                return { ok: false, detail: `strict baseline regressed:\n${[r.stdout, r.stderr].filter(Boolean).join('\n').slice(-1200)}` };
             }
             return { ok: true, detail: 'live any/debt/allow counts within frozen baseline' };
         },
@@ -403,7 +403,7 @@ const GATES = {
         check() {
             const r = run('node', ['scripts/check-redaction-sinks.mjs'], { timeout: 60_000 });
             if (r.status !== 0) {
-                return { ok: false, detail: `unmasked channel sink:\n${(r.stdout || r.stderr || '').slice(-1500)}` };
+                return { ok: false, detail: `unmasked channel sink:\n${[r.stdout, r.stderr].filter(Boolean).join('\n').slice(-1500)}` };
             }
             return { ok: true, detail: 'no unmasked sink in telegram/discord/slack/telegram-hub' };
         },
@@ -413,7 +413,7 @@ const GATES = {
         check() {
             const r = run('node', ['scripts/sync-electron-version.cjs', '--check'], { timeout: 60_000 });
             if (r.status !== 0) {
-                return { ok: false, detail: (r.stdout || r.stderr || '').trim().slice(-500) };
+                return { ok: false, detail: [r.stdout, r.stderr].filter(Boolean).join('\n').trim().slice(-500) };
             }
             return { ok: true, detail: 'desktop artifacts will carry the release version' };
         },
@@ -423,7 +423,7 @@ const GATES = {
         check() {
             const r = run('node', ['scripts/check-sidecar-prune-safety.mjs'], { timeout: 60_000 });
             if (r.status !== 0) {
-                return { ok: false, detail: (r.stdout || r.stderr || '').trim().slice(-800) };
+                return { ok: false, detail: [r.stdout, r.stderr].filter(Boolean).join('\n').trim().slice(-800) };
             }
             return { ok: true, detail: 'packaged sidecar keeps every runtime dependency' };
         },
@@ -439,7 +439,12 @@ const GATES = {
                 return { ok: true, detail: 'SKIPPED — electron/node_modules absent, nothing probed' };
             }
             if (r.status !== 0) {
-                return { ok: false, detail: (r.stdout || r.stderr || '').trim().slice(-800) };
+                // The probe prints its notes on stdout and its reasons on
+                // stderr. `stdout || stderr` therefore threw the reasons away
+                // whenever a single note had been printed, which is how a Linux
+                // failure reached CI showing only "prebuilds present" and
+                // "round-trip ok" with no stated cause.
+                return { ok: false, detail: [r.stdout, r.stderr].filter(Boolean).join('\n').trim().slice(-800) };
             }
             return { ok: true, detail: 'node-pty loads under this runtime' };
         },
@@ -452,11 +457,23 @@ const GATES = {
                 return { ok: true, detail: 'SKIPPED — sidecar not bundled, nothing imported' };
             }
             if (r.status !== 0) {
-                return { ok: false, detail: (r.stdout || r.stderr || '').trim().slice(-800) };
+                return { ok: false, detail: [r.stdout, r.stderr].filter(Boolean).join('\n').trim().slice(-800) };
             }
             return { ok: true, detail: 'bundled sidecar imports its critical entry surfaces' };
         },
     },
+    'install-integrity': {
+        description: 'scriptless install contract + allow-scripts recovery guidance stay pinned',
+        check() {
+            const r = run('npx', ['tsx', '--experimental-test-module-mocks', 'tests/run.mts',
+                'tests/unit/install-integrity.test.ts',
+                'tests/unit/scriptless-install-contract.test.ts'], { timeout: 180_000 });
+            if (r.status !== 0) {
+                return { ok: false, detail: [r.stdout, r.stderr].filter(Boolean).join('\n').trim().slice(-800) };
+            }
+            return { ok: true, detail: 'install-integrity + scriptless contract suites green' };
+        },
+    },
     'gate-docs': {
         description: 'structure/INDEX.md documents exactly the gates that exist, and each is npm-addressable',
         check() {