devrites 4.0.1 → 4.0.2

package/engine/internal/release/release_test.go

@@ -0,0 +1,167 @@
+package release
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
+	const tag = "v4.1.0"
+	bundleName := "devrites-" + tag + ".tar.gz"
+	bundle := testBundle(t, tag, map[string]string{
+		"package.json": `{"version":"4.1.0"}`,
+		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
+	})
+	binaryName, err := platformBinaryName()
+	if err != nil {
+		t.Skip(err)
+	}
+	assets := map[string][]byte{
+		bundleName: bundle,
+		binaryName: []byte("test engine"),
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/repos/owner/repo/releases/latest" {
+			_, _ = fmt.Fprintf(w, `{"tag_name":%q}`, tag)
+			return
+		}
+		name := filepath.Base(r.URL.Path)
+		if strings.HasSuffix(name, ".sha256") {
+			assetName := strings.TrimSuffix(name, ".sha256")
+			asset, ok := assets[assetName]
+			if !ok {
+				http.NotFound(w, r)
+				return
+			}
+			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
+			return
+		}
+		asset, ok := assets[name]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		_, _ = w.Write(asset)
+	}))
+	defer server.Close()
+	oldAPI, oldWeb := apiBaseURL, webBaseURL
+	apiBaseURL, webBaseURL = server.URL, server.URL
+	t.Cleanup(func() { apiBaseURL, webBaseURL = oldAPI, oldWeb })
+
+	gotTag, err := Latest(context.Background(), "owner/repo")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotTag != tag {
+		t.Fatalf("latest tag = %q, want %q", gotTag, tag)
+	}
+	candidate, cleanup, err := Acquire(context.Background(), "owner/repo", tag)
+	if err != nil {
+		t.Fatal(err)
+	}
+	root := filepath.Dir(candidate.SourceDir)
+	if _, err := os.Stat(filepath.Join(candidate.PayloadDir, "claude", "skills", "rite", "SKILL.md")); err != nil {
+		t.Fatalf("extracted payload: %v", err)
+	}
+	if got, err := os.ReadFile(candidate.EnginePath); err != nil || string(got) != "test engine" {
+		t.Fatalf("engine = %q, %v", got, err)
+	}
+	cleanup()
+	if _, err := os.Stat(root); !os.IsNotExist(err) {
+		t.Fatalf("cleanup kept %s: %v", root, err)
+	}
+}
+
+func TestValidTag(t *testing.T) {
+	for _, tc := range []struct {
+		tag  string
+		want bool
+	}{
+		{tag: "v4.1.0", want: true},
+		{tag: "v4.1.0-rc.1+build.2", want: true},
+		{tag: "4.1.0", want: false},
+		{tag: "v4.1.0-01", want: false},
+		{tag: "v4.1", want: false},
+	} {
+		if got := validTag(tc.tag); got != tc.want {
+			t.Errorf("validTag(%q) = %t, want %t", tc.tag, got, tc.want)
+		}
+	}
+}
+
+func TestAcquireRejectsChecksumMismatch(t *testing.T) {
+	const tag = "v4.1.0"
+	bundleName := "devrites-" + tag + ".tar.gz"
+	bundle := testBundle(t, tag, map[string]string{
+		"package.json": `{"version":"4.1.0"}`,
+		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
+	})
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, ".sha256") {
+			_, _ = fmt.Fprintf(w, "%064d  %s\n", 0, bundleName)
+			return
+		}
+		_, _ = w.Write(bundle)
+	}))
+	defer server.Close()
+	oldWeb := webBaseURL
+	webBaseURL = server.URL
+	t.Cleanup(func() { webBaseURL = oldWeb })
+
+	_, _, err := Acquire(context.Background(), "owner/repo", tag)
+	if err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
+		t.Fatalf("Acquire error = %v, want checksum mismatch", err)
+	}
+}
+
+func TestExtractBundleRejectsPathTraversal(t *testing.T) {
+	const tag = "v4.1.0"
+	archive := filepath.Join(t.TempDir(), "unsafe.tar.gz")
+	data := testBundle(t, tag, map[string]string{"../escape": "bad"})
+	if err := os.WriteFile(archive, data, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	_, err := extractBundle(archive, t.TempDir(), tag)
+	if err == nil || !strings.Contains(err.Error(), "unsafe path") {
+		t.Fatalf("extractBundle error = %v, want unsafe path", err)
+	}
+}
+
+func testBundle(t *testing.T, tag string, files map[string]string) []byte {
+	t.Helper()
+	var raw bytes.Buffer
+	gz := gzip.NewWriter(&raw)
+	tw := tar.NewWriter(gz)
+	for name, body := range files {
+		data := []byte(body)
+		header := &tar.Header{
+			Name:     "devrites-" + tag + "/" + name,
+			Mode:     0o644,
+			Size:     int64(len(data)),
+			Typeflag: tar.TypeReg,
+		}
+		if err := tw.WriteHeader(header); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := tw.Write(data); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return raw.Bytes()
+}

package/engine/tests/meta_test.go

@@ -1,6 +1,6 @@
 package main_test
 
-// Cross-cutting assertion: first-party packages do not import forbidden network packages.
+// Cross-cutting assertion: release acquisition is the only engine network boundary.
 
 import (
 	"os/exec"
@@ -8,10 +8,9 @@ import (
 	"testing"
 )
 
-// TestFirstPartyMakesNoNetworkCalls asserts that no first-party Go package imports
-// a forbidden network package. This keeps the engine a network-free control plane
-// that makes zero model/API calls (PRD: "zero API").
-func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
+// TestNetworkImportsStayInReleaseBoundary keeps update networking isolated from
+// workspace state, policy, proof, and installation logic.
+func TestNetworkImportsStayInReleaseBoundary(t *testing.T) {
 	if _, err := exec.LookPath("go"); err != nil {
 		t.Skip("go toolchain unavailable")
 	}
@@ -22,6 +21,7 @@ func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
 		t.Fatalf("go list: %v", err)
 	}
 	forbidden := map[string]bool{"net": true, "net/http": true, "net/rpc": true, "net/smtp": true}
+	allowed := map[string]bool{"github.com/devrites/devrites/internal/release": true}
 	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
 		fields := strings.Fields(line)
 		if len(fields) == 0 {
@@ -29,7 +29,7 @@ func TestFirstPartyMakesNoNetworkCalls(t *testing.T) {
 		}
 		pkg, imports := fields[0], fields[1:]
 		for _, imp := range imports {
-			if forbidden[imp] {
+			if forbidden[imp] && !allowed[pkg] {
 				t.Errorf("first-party package %s imports forbidden network package %q", pkg, imp)
 			}
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",