deadbyte-mcp 0.15.71 → 0.15.74

package/test/r194-release-readiness.test.mjs

@@ -0,0 +1,87 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {assertR194NpmPublishReady,assertR194PackedIdentity} from '../scripts/npm-release-readiness-r194.mjs';
+
+const sha256=value=>createHash('sha256').update(value).digest('hex');
+const parent={
+  version:'0.15.72',train:'R192',release_id:'v0.15.72-0a5d9436e06e2d9e',
+  manifest_sha256:'0a5d9436e06e2d9e7cf9179417465955d8ca5ba88655b13dd019190243c1cc90',
+  generation_manifest_sha256:'aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0'
+};
+const release={
+  version:'0.15.74',train:'R194',parent,
+  r194:{scope:'NPM_AUTH_RECOVERY_AND_OWNER_AUTHORIZATION',public_tool_delta:0,authority_scope_delta:0}
+};
+
+async function fixture(){
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r194-readiness-'));
+  const root=path.join(base,'development','candidate');
+  const evidence=path.join(base,'testing','r194-final-closure');
+  await mkdir(root,{recursive:true});await mkdir(evidence,{recursive:true});
+  const manifest=Buffer.from(`${'a'.repeat(64)}  package.json\n`);
+  await writeFile(path.join(root,'MANIFEST.SHA256'),manifest);
+  const files={
+    'protected-install-receipt.json':JSON.stringify({status:'PASS',package_version:'0.15.74',source_manifest_sha256:sha256(manifest),protected_manifest_sha256:sha256(manifest)}),
+    'windows-focused.stdout.log':'# tests 61\n# suites 0\n# pass 60\n# fail 0\n# cancelled 0\n# skipped 1\nR194_STAGE_PASS=focused\n',
+    'windows-full.stdout.log':'# tests 2187\n# suites 0\n# pass 2136\n# fail 0\n# cancelled 0\n# skipped 51\nR194_STAGE_PASS=full\n',
+    'npm-verify.stdout.log':'Artifact isolation gate PASS\nVERIFIED_TARBALL {"filename":"deadbyte-mcp-0.15.74.tgz","bytes":123,"sha256":"'+ 'b'.repeat(64) +'","integrity":"sha512-test","shasum":"'+ 'c'.repeat(40) +'"}\nVERIFY-ONLY PIPELINE PASS\n'
+  };
+  for(const [name,content] of Object.entries(files))await writeFile(path.join(evidence,name),content);
+  const closure={schema:'deadbyte.r194-release-closure.v1',status:'RELEASE_READY',version:'0.15.74',train:'R194',
+    production_release_id:parent.release_id,production_manifest_sha256:parent.manifest_sha256,
+    production_generation_manifest_sha256:parent.generation_manifest_sha256,
+    manifest_sha256:sha256(manifest),compact_tools:43,full_tools:117,
+    owner_enrollment:'NOT_RUN',limited_runtime_migration:'NOT_RUN',production_activation:'NOT_RUN',
+    protected_receipt_sha256:sha256(files['protected-install-receipt.json']),
+    focused_stdout_sha256:sha256(files['windows-focused.stdout.log']),
+    full_stdout_sha256:sha256(files['windows-full.stdout.log']),
+    verify_stdout_sha256:sha256(files['npm-verify.stdout.log']),
+    tarball_sha256:'b'.repeat(64),tarball_integrity:'sha512-test',tarball_shasum:'c'.repeat(40)};
+  await writeFile(path.join(evidence,'closure.json'),JSON.stringify(closure));
+  return {base,root,evidence,closure,manifest};
+}
+
+test('R194 publication refuses absent external exact-byte closure',async()=>{
+  const f=await fixture();try{
+    await assert.rejects(assertR194NpmPublishReady(release,{root:f.root}),/PUBLISH_BLOCKED R194.*closure root absent/);
+  }finally{await rm(f.base,{recursive:true,force:true});}
+});
+
+test('R194 publication binds final manifest, protected gates, catalogs, and exact tarball',async()=>{
+  const f=await fixture();try{
+    const result=await assertR194NpmPublishReady(release,{root:f.root,closureRoot:f.evidence});
+    assert.equal(result.status,'R194_RELEASE_READY_EVIDENCE_BOUND');
+    assert.equal(result.tests,2187);assert.equal(result.passes,2136);assert.equal(result.skips,51);
+    assert.equal(result.tarball_sha256,'b'.repeat(64));
+  }finally{await rm(f.base,{recursive:true,force:true});}
+});
+
+test('R194 publication rejects final manifest drift and tampered gate evidence',async()=>{
+  const f=await fixture();try{
+    await writeFile(path.join(f.root,'MANIFEST.SHA256'),'changed');
+    await assert.rejects(assertR194NpmPublishReady(release,{root:f.root,closureRoot:f.evidence}),/PUBLISH_BLOCKED R194.*manifest drift/);
+    await writeFile(path.join(f.root,'MANIFEST.SHA256'),f.manifest);
+    await writeFile(path.join(f.evidence,'windows-full.stdout.log'),'tampered');
+    await assert.rejects(assertR194NpmPublishReady(release,{root:f.root,closureRoot:f.evidence}),/PUBLISH_BLOCKED R194.*evidence digest differs/);
+  }finally{await rm(f.base,{recursive:true,force:true});}
+});
+
+test('R194 publisher refuses a repacked artifact that differs from closure bytes',()=>{
+  assert.throws(()=>assertR194PackedIdentity({tarball_sha256:'a'.repeat(64),tarball_integrity:'sha512-expected',tarball_shasum:'b'.repeat(40),
+    observedSha256:'c'.repeat(64),observedIntegrity:'sha512-other',observedShasum:'d'.repeat(40)}),/PUBLISH_BLOCKED R194.*repacked tarball/);
+});
+
+test('canonical npm release entrypoint enforces R194 closure before registry or pack work',async()=>{
+  const root=fileURLToPath(new URL('..',import.meta.url));
+  const env={...process.env};delete env.DEADBYTE_R194_CLOSURE_ROOT;
+  const result=spawnSync(process.execPath,[path.join(root,'scripts','npm-release-r48.mjs'),'--publish-only'],{cwd:root,env,encoding:'utf8',windowsHide:true});
+  assert.notEqual(result.status,0);
+  assert.match(`${result.stdout}\n${result.stderr}`,/PUBLISH_BLOCKED R194.*closure root absent/);
+  assert.doesNotMatch(`${result.stdout}\n${result.stderr}`,/npm publish|Packing artifact/);
+});

package/test/r194-windows-gate.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=fileURLToPath(new URL('..',import.meta.url));
+test('R194 prepublication Windows gate keeps parent pinned and current R194 identity',async()=>{
+ const [pkg,gate]=await Promise.all([
+  readFile(path.join(root,'package.json'),'utf8').then(JSON.parse),
+  readFile(path.join(root,'scripts/gate-windows-r194.ps1'),'utf8')]);
+ assert.equal(pkg.scripts['gate:windows'],
+ 'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r194.ps1 -Stage all');
+ assert.match(gate,/0\.15\.74/);assert.match(gate,/R194/);
+ assert.match(gate,/v0\.15\.72-0a5d9436e06e2d9e/);
+ assert.match(gate,/aec7b998306a3bbbcc59088648e7bc46ca7e203d749d4550b5b5f372032f92b0/);
+ assert.match(gate,/test\/r194-release-identity\.test\.mjs/);
+ assert.match(gate,/test\/r194-npm-auth-recovery\.test\.mjs/);
+ assert.match(gate,/test\/r193-owner-uac-broker\.test\.mjs/);
+ assert.doesNotMatch(gate,/arm(process|coding|autonomous|desktop|host)/i);
+ assert.doesNotMatch(gate,/deploy|activate|npm publish/i);
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70','0.15.71'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70','0.15.71','0.15.72','0.15.73','0.15.74'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');