dsh-math-modeling-agent 0.3.1 → 0.4.1

package/skills/math-modeling-agent/scripts/distribution-parity.mjs

@@ -0,0 +1,123 @@
+import { createHash } from 'node:crypto'
+import { lstat, readFile, readdir, realpath } from 'node:fs/promises'
+import { isAbsolute, join, relative, resolve, sep } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const MAX_FILES = 10_000
+const MAX_FILE_BYTES = 20 * 1024 * 1024
+const MAX_TOTAL_BYTES = 100 * 1024 * 1024
+const MAX_DEPTH = 32
+
+function normalizeRelative(path) {
+  return path.split(sep).join('/')
+}
+
+function assertInside(root, path) {
+  const relativePath = relative(root, path)
+  if (isAbsolute(relativePath) || relativePath === '..' || relativePath.startsWith('..' + sep)) {
+    throw new Error('distribution entry escapes package root: ' + path)
+  }
+}
+
+async function collectFiles(root, entries, { allowMissing = false } = {}) {
+  const realRoot = await realpath(root)
+  const files = new Map()
+  let totalBytes = 0
+
+  const visit = async (path, depth) => {
+    if (depth > MAX_DEPTH) throw new Error('distribution tree exceeds maximum depth: ' + path)
+    let information
+    try {
+      information = await lstat(path)
+    } catch (error) {
+      if (allowMissing && error?.code === 'ENOENT') return
+      throw error
+    }
+    if (information.isSymbolicLink()) throw new Error('symbolic link is not allowed in distribution: ' + path)
+    const realPath = await realpath(path)
+    assertInside(realRoot, realPath)
+    if (information.isDirectory()) {
+      for (const entry of await readdir(path)) await visit(join(path, entry), depth + 1)
+      return
+    }
+    if (!information.isFile()) return
+    if (information.size > MAX_FILE_BYTES) throw new Error('distribution file exceeds maximum size: ' + path)
+    totalBytes += information.size
+    if (totalBytes > MAX_TOTAL_BYTES) throw new Error('distribution tree exceeds maximum size')
+    if (files.size >= MAX_FILES) throw new Error('distribution tree exceeds maximum file count')
+    const relativePath = normalizeRelative(relative(root, path))
+    const digest = createHash('sha256').update(await readFile(path)).digest('hex')
+    files.set(relativePath, digest)
+  }
+
+  for (const entry of entries) {
+    if (typeof entry !== 'string' || !entry.trim()) throw new Error('package files entries must be non-empty strings')
+    const path = resolve(root, entry)
+    assertInside(root, path)
+    await visit(path, 0)
+  }
+  return files
+}
+
+/** Compare the allowlisted package files of a source and distribution root. */
+export async function compareDistribution(sourceRoot, candidateRoot) {
+  const source = resolve(sourceRoot)
+  const candidate = resolve(candidateRoot)
+  const manifest = JSON.parse(await readFile(join(source, 'package.json'), 'utf8'))
+  if (!Array.isArray(manifest.files) || manifest.files.length === 0) {
+    throw new Error('source package.json must declare a non-empty files allowlist')
+  }
+  const entries = [...new Set(['package.json', ...manifest.files])]
+  const expected = await collectFiles(source, entries)
+  const actual = await collectFiles(candidate, entries, { allowMissing: true })
+  const missing = [...expected.keys()].filter(path => !actual.has(path)).sort()
+  const extra = [...actual.keys()].filter(path => !expected.has(path)).sort()
+  const mismatched = [...expected.keys()]
+    .filter(path => actual.has(path) && actual.get(path) !== expected.get(path))
+    .sort()
+  const metadataMismatches = []
+  try {
+    const candidateManifest = JSON.parse(await readFile(join(candidate, 'package.json'), 'utf8'))
+    for (const key of ['name', 'version']) {
+      if (candidateManifest[key] !== manifest[key]) {
+        metadataMismatches.push(`${key}: expected ${manifest[key]}, received ${candidateManifest[key]}`)
+      }
+    }
+  } catch (error) {
+    metadataMismatches.push('package.json: ' + (error instanceof Error ? error.message : String(error)))
+  }
+  return {
+    ok: missing.length === 0 && extra.length === 0 && mismatched.length === 0 && metadataMismatches.length === 0,
+    sourceRoot: source,
+    candidateRoot: candidate,
+    expectedFileCount: expected.size,
+    candidateFileCount: actual.size,
+    missing,
+    extra,
+    mismatched,
+    metadataMismatches,
+  }
+}
+
+function parseArguments(argv) {
+  if (argv.length !== 2 || argv.some(value => !value || value.startsWith('-'))) {
+    throw new Error('usage: node distribution-parity.mjs <source-root> <candidate-root>')
+  }
+  return { sourceRoot: argv[0], candidateRoot: argv[1] }
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  try {
+    const { sourceRoot, candidateRoot } = parseArguments(argv)
+    const result = await compareDistribution(sourceRoot, candidateRoot)
+    console.log(JSON.stringify(result, null, 2))
+    return result.ok ? 0 : 1
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error))
+    return 2
+  }
+}
+
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  process.exitCode = await main()
+}