deadbyte-mcp 0.15.46 → 0.15.47

package/test/r74-kernel-lock.test.mjs

@@ -0,0 +1,150 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, readFile, rm, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {acquireKernelExclusiveLock, verifyKernelLockBinary} from '../src/kernel-lock-r74.mjs';
+
+async function safeRm(dir) {
+  for (let i = 0; i < 15; i++) {
+    try {
+      await rm(dir, {recursive: true, force: true});
+      return;
+    } catch (err) {
+      if (err.code !== 'EBUSY' && err.code !== 'EPERM') throw err;
+      await new Promise(r => setTimeout(r, 40));
+    }
+  }
+  await rm(dir, {recursive: true, force: true});
+}
+
+test('kernel lock binary is verified and hash-pinned', async () => {
+  const verified = await verifyKernelLockBinary();
+  assert.equal(verified.ok, true, verified.reason);
+  assert.ok(/^[0-9a-f]{64}$/.test(verified.sha256));
+});
+
+test('kernel exclusive lock can be acquired and released normally', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-basic-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    const release = await acquireKernelExclusiveLock(lock);
+    assert.equal(typeof release, 'function');
+    assert.ok(Number.isSafeInteger(release.pid));
+    await release();
+    const content = await readFile(lock, 'utf8');
+    assert.match(content, /^deadbyte\.kernel-lock\.r74:pid=\d+/);
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('concurrent writer is blocked while lock is held by another process', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-contention-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    const release = await acquireKernelExclusiveLock(lock);
+    let error = null;
+    try {
+      await acquireKernelExclusiveLock(lock, {timeoutMs: 100, pollMs: 15});
+    } catch (err) {
+      error = err;
+    }
+    assert.ok(error, 'second writer should have been blocked');
+    assert.match(error.message, /atomic mutation lock timed out/);
+    await release();
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('crash-safe recovery: killed owner releases handle via OS, successor acquires without deleting lock pathname', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-crash-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    const releaseFirst = await acquireKernelExclusiveLock(lock);
+    const lockPid = releaseFirst.pid;
+    assert.ok(Number.isSafeInteger(lockPid));
+
+    // Abrupt termination (simulating crash)
+    process.kill(lockPid, 'SIGKILL');
+
+    // Wait a brief moment for Windows kernel to close the handle
+    await new Promise(r => setTimeout(r, 60));
+
+    // Successor MUST be able to acquire the lock immediately WITHOUT deleting the lock file!
+    const releaseSecond = await acquireKernelExclusiveLock(lock, {timeoutMs: 1000});
+    assert.equal(typeof releaseSecond, 'function');
+
+    // Clean release
+    await releaseSecond();
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('dead PID or stale on-disk marker does not block new acquisition when no handle is held', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-pidreuse-'));
+  const lock = path.join(root, 'target.lock');
+  try {
+    // Write a stale/foreign PID into the lock file
+    await writeFile(lock, 'deadbyte.kernel-lock.r74:pid=999999999\n');
+
+    // Because no live kernel handle holds the file, acquisition must succeed immediately
+    const release = await acquireKernelExclusiveLock(lock, {timeoutMs: 500});
+    assert.equal(typeof release, 'function');
+    await release();
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('concurrent recovery: exactly one worker acquires lock, others are serialized', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-concurrent-'));
+  const lock = path.join(root, 'target.lock');
+  const sequence = [];
+  try {
+    const runWorker = async (id) => {
+      const release = await acquireKernelExclusiveLock(lock, {timeoutMs: 5000, pollMs: 10});
+      sequence.push(`enter_${id}`);
+      await new Promise(r => setTimeout(r, 20));
+      sequence.push(`exit_${id}`);
+      await release();
+    };
+
+    // Run 3 workers concurrently
+    await Promise.all([runWorker(1), runWorker(2), runWorker(3)]);
+
+    assert.equal(sequence.length, 6);
+    // Every enter must be followed by its matching exit before next enter
+    for (let i = 0; i < sequence.length; i += 2) {
+      const enter = sequence[i];
+      const exit = sequence[i + 1];
+      const id = enter.split('_')[1];
+      assert.equal(exit, `exit_${id}`, `non-exclusive execution detected: ${enter} followed by ${exit}`);
+    }
+  } finally {
+    await safeRm(root);
+  }
+});
+
+test('replaced binary negative: tampered executable fails closed with recovery blocked', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-lock-tampered-'));
+  const lock = path.join(root, 'target.lock');
+  // Temporarily override docs/R74-KERNEL-LOCK-BINARY.json hash
+  const metaPath = path.resolve('docs/R74-KERNEL-LOCK-BINARY.json');
+  const originalMeta = await readFile(metaPath, 'utf8');
+  try {
+    const tampered = JSON.parse(originalMeta);
+    tampered.sha256 = '0'.repeat(64);
+    await writeFile(metaPath, JSON.stringify(tampered, null, 2) + '\n');
+
+    await assert.rejects(
+      acquireKernelExclusiveLock(lock, {timeoutMs: 200}),
+      /atomic mutation lock recovery blocked: native exclusive locking unavailable/
+    );
+  } finally {
+    await writeFile(metaPath, originalMeta);
+    await safeRm(root);
+  }
+});

package/test/r74-prepublish-contract.test.mjs

@@ -0,0 +1,89 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, readFile, rm, cp, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {verifyR74PrepublishContract} from '../scripts/npm-prepublish-contract-r74.mjs';
+
+const repoRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+test('R74 prepublish contract: positive path succeeds and verifies identities', async () => {
+  const result = await verifyR74PrepublishContract({rootPath: repoRoot});
+  assert.equal(result.schema, 'deadbyte.r74-prepublish-contract.v1');
+  assert.equal(result.valid, true);
+  assert.equal(result.checks.predecessors_distinct, true);
+  assert.equal(result.checks.manifest_exists, true);
+  assert.equal(result.checks.manifest_verified, true);
+  assert.equal(result.checks.package_leak_check.ok, true);
+  assert.equal(result.checks.no_self_referential_tarball_hash, true);
+  assert.equal(result.identities.package_name, 'deadbyte-mcp');
+  assert.equal(result.identities.package_version, '0.15.47');
+  assert.equal(result.identities.target_train, 'R74');
+  assert.equal(result.identities.published_source_predecessor, '0.15.46');
+  assert.notEqual(result.identities.published_source_predecessor, result.identities.runtime_predecessor);
+});
+
+test('R74 prepublish contract: negative - tampered native binary hash fails closed', async () => {
+  const sandbox = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-prepub-tamper-'));
+  try {
+    // Copy minimal required files to sandbox
+    await cp(path.join(repoRoot, 'package.json'), path.join(sandbox, 'package.json'));
+    await cp(path.join(repoRoot, 'RELEASE.json'), path.join(sandbox, 'RELEASE.json'));
+    await cp(path.join(repoRoot, 'MANIFEST.SHA256'), path.join(sandbox, 'MANIFEST.SHA256'));
+    await cp(path.join(repoRoot, 'docs'), path.join(sandbox, 'docs'), {recursive: true});
+    await cp(path.join(repoRoot, 'bin'), path.join(sandbox, 'bin'), {recursive: true});
+
+    // Tamper with binary
+    const exePath = path.join(sandbox, 'bin', 'deadbyte-kernel-lock-r74.exe');
+    await writeFile(exePath, 'TAMPERED_BYTES_R74');
+
+    await assert.rejects(
+      async () => {
+        await verifyR74PrepublishContract({rootPath: sandbox});
+      },
+      /Prepublish contract failed: native binary .* hash mismatch/
+    );
+  } finally {
+    await rm(sandbox, {recursive: true, force: true}).catch(() => {});
+  }
+});
+
+test('R74 prepublish contract: negative - predecessor collision fails closed', async () => {
+  const sandbox = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-r74-prepub-collision-'));
+  try {
+    const pkg = JSON.parse(await readFile(path.join(repoRoot, 'package.json'), 'utf8'));
+    const release = JSON.parse(await readFile(path.join(repoRoot, 'RELEASE.json'), 'utf8'));
+    
+    // Set runtime predecessor to match published source predecessor (0.15.46)
+    release.parent = release.parent || {};
+    release.parent.version = '0.15.46';
+
+    await writeFile(path.join(sandbox, 'package.json'), JSON.stringify(pkg, null, 2));
+    await writeFile(path.join(sandbox, 'RELEASE.json'), JSON.stringify(release, null, 2));
+
+    await assert.rejects(
+      async () => {
+        await verifyR74PrepublishContract({rootPath: sandbox});
+      },
+      /Prepublish contract failed: published source and runtime predecessor must be distinct/
+    );
+  } finally {
+    await rm(sandbox, {recursive: true, force: true}).catch(() => {});
+  }
+});
+
+test('R74 prepublish contract: negative - package leakage fails closed', async () => {
+  // Verify that filter catches testing/, references/, .git, .env
+  const leakedNames = ['testing/secret.json', 'references/doc.md', '.git/config', '.env'];
+  for (const name of leakedNames) {
+    const isLeaked = /^(?:testing|references|\.git)(?:\/|$)|(?:^|\/)\.env(?:\.|$)/i.test(name);
+    assert.equal(isLeaked, true, `Expected ${name} to be detected as leaked`);
+  }
+});
+
+test('R74 prepublish contract: non-self-referential tarball check', async () => {
+  // Verify that RELEASE.json does NOT contain a prospective hash of the tarball that contains it
+  const release = JSON.parse(await readFile(path.join(repoRoot, 'RELEASE.json'), 'utf8'));
+  assert.equal(release.tarball_sha256, undefined, 'RELEASE.json must not claim self-referential tarball hash');
+});