dsh-vibe-math 2.7.3 → 2.8.1

package/scripts/clean-temp.mjs

@@ -0,0 +1,234 @@
+#!/usr/bin/env node
+/**
+ * TEMP HYGIENE (task-12) — sweep STALE test scratch directories and prefer a roomier temp root.
+ *
+ * WHY THIS EXISTS (measured, 2026-10 on this machine): the suites create their workspace with
+ * `mkdtempSync(join(tmpdir(), '<prefix>-…'))` and remove it in `finally` — but a suite KILLED by the
+ * runner's per-suite timeout cannot clean up, and some suites create many directories per run. After
+ * hundreds of sweeps `%TEMP%` had reached **248,737 top-level entries, 245,288 of them ours**
+ * (`vibe-*` 221,939, `v2-fix-*` 23,160, …), with 111,223 older than 24 h (oldest ~2 weeks).
+ *
+ * TWO RULES, both bounded:
+ *   1. SWEEP: delete only entries at the TOP LEVEL of the temp root, only whose name starts with a
+ *      prefix ACTUALLY USED BY THE SUITES (extracted from `tests/*.mjs`, never hand-written), and only
+ *      when older than `--age-hours` (default 6 h — a concurrently running gate's dirs stay safe).
+ *   2. PREFER D:: when `D:\_tmp` can be created, point TEMP/TMP/TMPDIR at it (the suites follow
+ *      `os.tmpdir()` automatically, so this needs NO product change). Never hard-fail: if the drive is
+ *      absent the ambient temp root is kept.
+ *
+ * Usage:
+ *   node scripts/clean-temp.mjs                     # sweep (age 6 h) and print counts
+ *   node scripts/clean-temp.mjs --dry-run           # print the plan, delete nothing
+ *   node scripts/clean-temp.mjs --age-hours=12      # change the threshold
+ *   node scripts/clean-temp.mjs --root=<dir>        # sweep another temp root (mainly for tests)
+ *   node scripts/clean-temp.mjs --self-test         # prove the guards below (fresh dirs are NEVER swept)
+ */
+import { execFileSync } from 'node:child_process'
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = resolve(HERE, '..')
+const TESTS = join(REPO, 'tests')
+
+/** Prefixes the suites really use — extracted from their own `mkdtempSync(join(tmpdir(), '<prefix>'))` calls. */
+export function suitePrefixes(testsDir = TESTS) {
+  const out = new Set()
+  let files = []
+  try { files = readdirSync(testsDir) } catch (e) { return [] }
+  for (const f of files) {
+    if (!f.endsWith('.mjs')) continue
+    let text = ''
+    try { text = readFileSync(join(testsDir, f), 'utf8') } catch (e) { continue }
+    for (const m of text.matchAll(/mkdtempSync\(\s*join\(\s*tmpdir\(\)\s*,\s*'([^']+)'/g)) out.add(m[1])
+    for (const m of text.matchAll(/mkdtempSync\(\s*join\(\s*tmpdir\(\)\s*,\s*"([^"]+)"/g)) out.add(m[1])
+  }
+  return [...out].sort()
+}
+
+/**
+ * PURE planner: which entries may be deleted. `entries` are `{name, mtimeMs}` already read from the
+ * temp root. An entry qualifies only if BOTH hold: its name starts with a suite prefix, and it is older
+ * than the threshold. (This is the function the mutant family attacks: replacing the age test with
+ * `true` must make the "a FRESH dir is never swept" check go red BY NAME.)
+ */
+export function planSweep(entries, { prefixes, ageHours = 6, now = Date.now() } = {}) {
+  const cut = now - ageHours * 3600 * 1000
+  return entries
+    .filter((e) => Array.isArray(prefixes) ? prefixes.some((p) => String(e.name).startsWith(p)) : false)
+    .filter((e) => Number(e.mtimeMs) < cut)
+    .map((e) => e.name)
+}
+
+/** Read the top level of a temp root into planner entries. Only DIRECTORIES are considered. */
+export function listTop(root) {
+  const out = []
+  let names = []
+  try { names = readdirSync(root, { withFileTypes: true }) } catch (e) { return out }
+  for (const d of names) {
+    if (!d.isDirectory()) continue
+    let mtimeMs = 0
+    try { mtimeMs = statSync(join(root, d.name)).mtimeMs } catch (e) { continue }
+    out.push({ name: d.name, mtimeMs })
+  }
+  return out
+}
+
+/** Delete the planned entries. Returns counts so callers can print a checkable summary. */
+export function sweep({ root = tmpdir(), prefixes, ageHours = 6, dryRun = false, log = () => {} } = {}) {
+  const all = listTop(root)
+  const doomed = planSweep(all, { prefixes, ageHours })
+  if (dryRun) return { root, scanned: all.length, planned: doomed.length, deleted: 0, failed: 0, dryRun: true }
+  let deleted = 0
+  let failed = 0
+  for (const name of doomed) {
+    try { rmSync(join(root, name), { recursive: true, force: true }); deleted++ } catch (e) { failed++ }
+  }
+  log('temp-hygiene: root=' + root + ' scanned=' + all.length + ' stale=' + doomed.length + ' deleted=' + deleted + ' failed=' + failed + ' ageHours=' + ageHours)
+  return { root, scanned: all.length, planned: doomed.length, deleted, failed }
+}
+
+/** `D:\_tmp` when the D: drive is usable; otherwise null (keep the ambient temp root). Never throws. */
+export function preferredTempRoot(candidate = 'D:\\_tmp') {
+  try {
+    if (!existsSync(candidate)) mkdirSync(candidate, { recursive: true })
+    return existsSync(candidate) ? candidate : null
+  } catch (e) { return null }
+}
+
+/** Point TEMP/TMP/TMPDIR at `root` (children inherit; `os.tmpdir()` follows). No-op when root is falsy. */
+export function useTempRoot(root) {
+  if (!root) return false
+  process.env.TEMP = root
+  process.env.TMP = root
+  process.env.TMPDIR = root
+  return true
+}
+
+/**
+ * Leftover-PROCESS detector (task-15). Measured motivation: a leftover DSH host (`--profile vmfix7`,
+ * started two days earlier, its parent gone) had burned **197,410 s of CPU** on this 4-core machine - a
+ * full core, permanently. With it, whole-gate `sum of suite times` went 2822 s -> 7875 s (x2.8) and
+ * individual suites ran 1.3x-4.5x slower, so honest suites reported failures that never reproduced
+ * standalone. The rule is deliberately NARROW: flag a process only when its command line matches THIS
+ * project/team AND its parent is gone (a process the running gate spawned has a live parent, so a healthy
+ * gate is never flagged - that property is asserted in `--self-test` and mutated by the family).
+ */
+export const DEFAULT_PROCESS_PATTERNS = [
+  /--profile\s+\S+/,              // a DSH host started against any profile (including our clones)
+  /[\\/]review[\\/][^\\/]*\.mjs/, // the dev-only harness scripts kept under _oneoff/review
+  /[\\/]tests[\\/][^\\/]*\.mjs/,  // a test/probe script (gates, mutant families)
+  /--temp-dry-run/,               // another gate run
+]
+
+export function suspectProcesses(entries, { selfPids = [], patterns = DEFAULT_PROCESS_PATTERNS } = {}) {
+  const self = new Set((selfPids || []).map((p) => String(p)))
+  return (entries || []).filter((e) => {
+    if (!e || self.has(String(e.pid))) return false
+    if (!patterns.some((re) => re.test(String(e.cmd || '')))) return false
+    return e.parentGone === true          // the safety property: a live parent means something owns it
+  })
+}
+
+/**
+ * List node processes with a `parentGone` flag. Windows-only in practice (PowerShell JSON); other
+ * platforms return [] rather than pretending. `exec` is injectable so the self-test can feed fixtures.
+ */
+export function listProcesses({ exec = null } = {}) {
+  if (process.platform !== 'win32' && !exec) return []
+  const ps = "$live=@{}; Get-Process | ForEach-Object { $live[[int]$_.Id]=1 }; " +
+    "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'node.exe' } | ForEach-Object { " +
+    "[pscustomobject]@{ pid=[int]$_.ProcessId; parent=[int]$_.ParentProcessId; cmd=[string]$_.CommandLine; " +
+    "parentGone=(-not $live.ContainsKey([int]$_.ParentProcessId)); created=[string]$_.CreationDate } } | ConvertTo-Json -Compress"
+  try {
+    const run = exec || ((args) => execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', args], { encoding: 'utf8', timeout: 30000 }))
+    const raw = String(run(ps) || '').trim()
+    if (!raw) return []
+    const parsed = JSON.parse(raw)
+    return Array.isArray(parsed) ? parsed : [parsed]
+  } catch (e) { return [] }
+}
+
+export function formatSuspect(s) {
+  const cmd = String(s.cmd || '')
+  return '  pid=' + s.pid + '  parent=' + s.parent + (s.parentGone ? ' (GONE)' : '') + '  ' + (s.created || '') + '  ' + cmd.slice(0, 120)
+}
+
+const argv = process.argv.slice(2)
+const has = (n) => argv.includes('--' + n)
+const val = (n, d) => { const a = argv.find((x) => x.startsWith('--' + n + '=')); return a ? a.split('=').slice(1).join('=') : d }
+
+if (has('self-test')) {
+  // The GUARD: these three checks fail BY NAME if the planner's prefix test or age test is broken.
+  const now = Date.now()
+  const prefixes = ['vibe-', 'v2-fix-']
+  const entries = [
+    { name: 'vibe-fresh-abc', mtimeMs: now - 60 * 1000 },              // fresh  ⇒ must NOT be planned
+    { name: 'vibe-stale-abc', mtimeMs: now - 48 * 3600 * 1000 },       // stale  ⇒ MUST be planned
+    { name: 'v2-fix-stale', mtimeMs: now - 48 * 3600 * 1000 },         // stale  ⇒ MUST be planned
+    { name: 'unrelated-stale', mtimeMs: now - 48 * 3600 * 1000 },      // foreign⇒ must NOT be planned
+    { name: 'vibestale-nodash', mtimeMs: now - 48 * 3600 * 1000 },     // prefix must match exactly
+  ]
+  const planned = planSweep(entries, { prefixes, ageHours: 6, now })
+  const failures = []
+  const check = (cond, label) => { console.log((cond ? 'PASS ' : 'FAIL - ') + label); if (!cond) failures.push(label) }
+  check(!planned.includes('vibe-fresh-abc'), 'TEMP-HYGIENE: a FRESH suite dir is never swept (age threshold respected)')
+  check(planned.includes('vibe-stale-abc') && planned.includes('v2-fix-stale'), 'TEMP-HYGIENE: STALE dirs with a suite prefix ARE swept')
+  check(!planned.includes('unrelated-stale') && !planned.includes('vibestale-nodash'), 'TEMP-HYGIENE: only exact suite prefixes are swept (no glob-like overreach)')
+  const live = suitePrefixes()
+  check(live.length >= 3, 'TEMP-HYGIENE: the prefix table is EXTRACTED from the suites (found ' + live.length + ': ' + live.slice(0, 4).join(', ') + ' …)')
+  // task-15: the leftover-PROCESS predicate, tested on fixtures so the property is checkable and mutable.
+  const procs = [
+    { pid: 1, parent: 999, parentGone: true, cmd: 'node tests/run-tests.mjs --temp-dry-run' },  // excluded via selfPids ONLY
+    { pid: 5, parent: 995, parentGone: false, cmd: 'node tests/run-tests.mjs --temp-dry-run' }, // LIVE parent -> never suspect
+    { pid: 2, parent: 998, parentGone: true, cmd: 'node tests/run-tests.mjs --temp-dry-run' },  // an ORPHANED gate
+    { pid: 3, parent: 997, parentGone: true, cmd: 'node bin.js --profile vmfix7 --port 7791' }, // the measured leftover
+    { pid: 4, parent: 996, parentGone: true, cmd: 'C:/apps/editor/editor.exe --open notes.md' },// unrelated program
+  ]
+  const susp = suspectProcesses(procs, { selfPids: [1] })
+  check(!susp.some((s) => s.pid === 1), 'TEMP-HYGIENE: an explicitly excluded pid (self / own parent) is never reported')
+  // This one is what the "parent-gone" mutation attacks: pid 5 is NOT excluded by selfPids, so only the
+  // live-parent property keeps it out of the report.
+  check(!susp.some((s) => s.pid === 5), 'TEMP-HYGIENE: a process with a LIVE parent (our running gate) is never called a leftover')
+  check(susp.some((s) => s.pid === 2) && susp.some((s) => s.pid === 3), 'TEMP-HYGIENE: ORPHANED project/team processes are reported (incl. a DSH host started against a clone profile)')
+  check(!susp.some((s) => s.pid === 4), 'TEMP-HYGIENE: an unrelated program is never reported (the command-line gate holds)')
+  console.log('temp-hygiene self-test: ' + (failures.length ? failures.length + ' failure(s)' : 'all checks passed'))
+  process.exit(failures.length ? 1 : 0)
+}
+
+// CLI entry detection must survive being IMPORTED (then `process.argv[1]` is undefined — the naive
+// `process.argv[1].replace(...)` form threw a TypeError for every importer).
+const isCli = (() => {
+  try { return !!process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url) } catch (e) { return false }
+})()
+
+if (isCli) {
+  // task-15: read-only leftover-process report. `--kill` must be asked for explicitly, and the current
+  // process + its parent are always excluded (a running gate must never kill itself).
+  if (has('ps')) {
+    const procs = listProcesses()
+    const susp = suspectProcesses(procs, { selfPids: [process.pid, process.ppid] })
+    console.log('temp-hygiene --ps: scanned ' + procs.length + ' node process(es); suspects=' + susp.length)
+    for (const s of susp) console.log(formatSuspect(s))
+    if (has('kill')) {
+      let killed = 0
+      for (const s of susp) { try { process.kill(Number(s.pid), 'SIGKILL'); killed++ } catch (e) { /* already gone */ } }
+      console.log('temp-hygiene --ps --kill: killed=' + killed)
+    } else if (susp.length) {
+      console.log('temp-hygiene --ps: read-only. Re-run with --kill to stop them (each one steals CPU from the gate).')
+    }
+    process.exit(0)
+  }
+  const root = val('root', null)
+  if (!root) { const pref = preferredTempRoot(); if (useTempRoot(pref)) console.log('temp-hygiene: using temp root ' + pref) }
+  const res = sweep({
+    root: val('root', tmpdir()),
+    prefixes: suitePrefixes(),
+    ageHours: Number(val('age-hours', '6')),
+    dryRun: has('dry-run'),
+    log: (m) => console.log(m),
+  })
+  console.log('temp-hygiene: ' + JSON.stringify(res))
+}

package/scripts/release-check.mjs

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+/**
+ * RELEASE CHECK (task-8 follow-up) — the checks a maintainer had to run BY HAND for 2.8.0, in one command.
+ *
+ * `docs/release-playbook.md` lists them as prose across §1/§2/§6; this script makes them mechanical, so the
+ * next release cannot ship a drifted version, a missing release note, an unregistered note, a manifest that
+ * lies about the tarball, or CRLF line endings inside the package.
+ *
+ * Usage:
+ *   node scripts/release-check.mjs                # static checks + a real `npm pack` + tarball EOL scan
+ *   node scripts/release-check.mjs --skip-pack    # static checks only (no packing, no temp extraction)
+ *   node scripts/release-check.mjs --registry     # ALSO compare the published shasum (post-publish only)
+ *   node scripts/release-check.mjs --self-test    # prove the predicates below are not vacuous
+ *
+ * Exit 0 = every check passed. Exit 1 = at least one FAIL (printed with a `FAIL ` prefix).
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const REPO = join(HERE, '..')
+const TMP = process.env.RELEASE_CHECK_TMP || join(process.env.TEMP || process.env.TMPDIR || '/tmp', 'release-check')
+
+// ---------------------------------------------------------------- pure predicates (fixture-testable)
+/** The version must agree in all three places the market guard reads (playbook §1). */
+export function versionProblems({ pkgVersion, lockTop, lockEmpty }) {
+  const out = []
+  if (!pkgVersion) out.push('package.json has no version')
+  if (lockTop !== pkgVersion) out.push('package-lock.json top-level version ' + lockTop + ' != package.json ' + pkgVersion)
+  if (lockEmpty !== pkgVersion) out.push('package-lock.json packages[""].version ' + lockEmpty + ' != package.json ' + pkgVersion)
+  return out
+}
+
+/** Release notes must carry the template's sections, in the template's order (playbook §1 / TEMPLATE.md). */
+export const SECTIONS = {
+  zh: ['## 概述', '## 新增', '## 变更', '## 修复', '## 兼容性与迁移', '## 已知限制', '## 验证方式', '## 依赖'],
+  en: ['## Overview', '## Added', '## Changed', '## Fixed', '## Compatibility & Migration', '## Known Limitations', '## Verification', '## Dependencies'],
+}
+export function sectionProblems(headings, lang) {
+  const want = SECTIONS[lang]
+  if (!want) return ['unknown language ' + lang]
+  const got = (headings || []).map((h) => String(h).trim())
+  const out = []
+  if (got.length !== want.length) out.push('expected ' + want.length + ' sections, found ' + got.length)
+  for (let i = 0; i < want.length; i++) if (got[i] !== want[i]) out.push('section ' + (i + 1) + ' is ' + JSON.stringify(got[i]) + ', expected ' + JSON.stringify(want[i]))
+  return out
+}
+
+/** Every declared file must exist in the packed tarball (playbook §2/§6.2). */
+export function manifestProblems(declared, packed) {
+  const have = new Set(packed || [])
+  return (declared || []).filter((f) => !have.has(f)).map((f) => 'declared but missing from the tarball: ' + f)
+}
+
+/** Nothing may ship that is repository-only tooling (playbook §6.4). */
+export function devOnlyProblems(packed, devOnly = ['.gitattributes']) {
+  const have = new Set(packed || [])
+  return devOnly.filter((f) => have.has(f)).map((f) => 'repository-only file shipped in the tarball: ' + f)
+}
+
+/** Packaged text must be LF-only so the tarball is byte-reproducible (playbook §7). */
+export function crlfProblems(files) {
+  const out = []
+  for (const { path, crlf } of files || []) if (Number(crlf) > 0) out.push('CRLF in the packaged file: ' + path + ' (' + crlf + ' lines)')
+  return out
+}
+
+/** `compatNote` is user-visible and must name the version being released (playbook §2). */
+export function compatNoteProblems(compatNote, version) {
+  if (!compatNote) return ['dsh.compatNote is missing']
+  return String(compatNote).includes(version) ? [] : ['dsh.compatNote does not mention the current version ' + version]
+}
+
+// ---------------------------------------------------------------- self-test (the family mutates these)
+if (process.argv.includes('--self-test')) {
+  const failures = []
+  const check = (cond, label) => { console.log((cond ? 'PASS ' : 'FAIL - ') + label); if (!cond) failures.push(label) }
+
+  check(versionProblems({ pkgVersion: '9.9.9', lockTop: '9.9.9', lockEmpty: '9.9.9' }).length === 0,
+    'RELEASE-CHECK: a consistent version triple passes')
+  check(versionProblems({ pkgVersion: '9.9.9', lockTop: '9.9.8', lockEmpty: '9.9.9' }).some((p) => /top-level/.test(p)),
+    'RELEASE-CHECK: a drifted lock top-level version is caught')
+  check(versionProblems({ pkgVersion: '9.9.9', lockTop: '9.9.9', lockEmpty: '9.9.8' }).some((p) => /packages/.test(p)),
+    'RELEASE-CHECK: a drifted packages[""] version is caught')
+
+  check(sectionProblems(SECTIONS.zh, 'zh').length === 0 && sectionProblems(SECTIONS.en, 'en').length === 0,
+    'RELEASE-CHECK: the canonical section lists pass their own check')
+  check(sectionProblems(['## 概述', '## 新增'], 'zh').some((p) => /expected 8 sections/.test(p)),
+    'RELEASE-CHECK: a truncated note is caught by its section count')
+  check(sectionProblems([...SECTIONS.en].reverse(), 'en').length > 0, 'RELEASE-CHECK: a reordered note is caught')
+
+  check(manifestProblems(['a.js', 'b.md'], ['a.js', 'b.md', 'package.json']).length === 0, 'RELEASE-CHECK: a fully packed manifest passes')
+  check(manifestProblems(['a.js', 'gone.md'], ['a.js']).length === 1, 'RELEASE-CHECK: a declared-but-missing file is caught')
+
+  check(devOnlyProblems(['README.md'], ['.gitattributes']).length === 0, 'RELEASE-CHECK: repository-only tooling stays out')
+  check(devOnlyProblems(['.gitattributes'], ['.gitattributes']).length === 1, 'RELEASE-CHECK: a shipped repository-only file is caught')
+
+  check(crlfProblems([{ path: 'a.js', crlf: 0 }]).length === 0, 'RELEASE-CHECK: LF-only content passes')
+  check(crlfProblems([{ path: 'a.js', crlf: 3 }]).length === 1, 'RELEASE-CHECK: CRLF inside the package is caught')
+
+  check(compatNoteProblems('v9.9.9 功能版：…', '9.9.9').length === 0, 'RELEASE-CHECK: a compatNote naming the version passes')
+  check(compatNoteProblems('v9.9.8 补丁版：…', '9.9.9').length === 1, 'RELEASE-CHECK: a stale compatNote is caught')
+
+  console.log('release-check self-test: ' + (failures.length ? failures.length + ' failure(s)' : 'all checks passed'))
+  process.exit(failures.length ? 1 : 0)
+}
+
+// ---------------------------------------------------------------- the real run
+const argv = process.argv.slice(2)
+const has = (n) => argv.includes('--' + n)
+const problems = []
+const fail = (p) => { for (const x of p) problems.push(x) }
+const readJson = (rel) => JSON.parse(readFileSync(join(REPO, rel), 'utf8'))
+
+const pkg = readJson('package.json')
+const lock = readJson('package-lock.json')
+const version = pkg.version
+console.log('release-check: ' + pkg.name + '@' + version)
+
+fail(versionProblems({ pkgVersion: version, lockTop: lock.version, lockEmpty: ((lock.packages || {})[''] || {}).version }))
+fail(compatNoteProblems((pkg.dsh || {}).compatNote, version))
+
+const notes = { zh: 'docs/release-notes/RELEASE-NOTES-' + version + '.md', en: 'docs/release-notes/RELEASE-NOTES-' + version + '.en.md' }
+for (const [lang, rel] of Object.entries(notes)) {
+  if (!existsSync(join(REPO, rel))) { problems.push('missing release note (' + lang + '): ' + rel); continue }
+  const text = readFileSync(join(REPO, rel), 'utf8')
+  fail(sectionProblems((text.match(/^## .*$/gm) || []), lang).map((p) => rel + ': ' + p))
+  if (!(pkg.files || []).includes(rel)) problems.push('release note not listed in package.json#files: ' + rel)
+}
+
+if (has('skip-pack')) {
+  console.log('release-check: --skip-pack, skipping the tarball checks')
+} else {
+  rmSync(TMP, { recursive: true, force: true })
+  mkdirSync(TMP, { recursive: true })
+  const out = execFileSync('npm', ['pack', '--dry-run', '--json'], { cwd: REPO, encoding: 'utf8', shell: true })
+  const packed = JSON.parse(out)[0].files.map((f) => f.path)
+  console.log('release-check: tarball would contain ' + packed.length + ' files; declared ' + (pkg.files || []).length)
+  fail(manifestProblems(pkg.files, packed))
+  fail(devOnlyProblems(packed, ['.gitattributes']))
+
+  // Real pack + extract, so the EOL check reads the bytes a user would download.
+  const tgzName = String(execFileSync('npm', ['pack', '--pack-destination', TMP], { cwd: REPO, encoding: 'utf8', shell: true })).trim().split(/\r?\n/).pop()
+  const tgz = join(TMP, tgzName)
+  if (!existsSync(tgz)) {
+    problems.push('npm pack produced no tarball at ' + tgz)
+  } else {
+    execFileSync('tar', ['-xzf', tgz, '-C', TMP], { stdio: 'pipe' })
+    const root = join(TMP, 'package')
+    const eol = []
+    const walk = (d, prefix) => {
+      for (const e of readdirSync(d, { withFileTypes: true })) {
+        const p = join(d, e.name)
+        if (e.isDirectory()) { walk(p, prefix + e.name + '/'); continue }
+        if (!/\.(js|mjs|cjs|json|md|yml|yaml|txt|svg)$/.test(e.name)) continue      // binaries are not text
+        const text = readFileSync(p, 'utf8')
+        eol.push({ path: prefix + e.name, crlf: (text.match(/\r\n/g) || []).length })
+      }
+    }
+    walk(root, '')
+    fail(crlfProblems(eol))
+    const sha1 = createHash('sha1').update(readFileSync(tgz)).digest('hex')
+    console.log('release-check: local tarball sha1 = ' + sha1 + ' (' + eol.length + ' text files scanned for CRLF)')
+    if (has('registry')) {
+      try {
+        const published = String(execFileSync('npm', ['view', pkg.name + '@' + version, 'dist.shasum'], { cwd: REPO, encoding: 'utf8', shell: true })).trim()
+        if (published !== sha1) problems.push('registry dist.shasum ' + published + ' != local tarball sha1 ' + sha1)
+        else console.log('release-check: registry shasum matches the local tarball (byte-reproducible)')
+      } catch (e) { problems.push('registry lookup failed: ' + String((e && e.message) || e).slice(0, 120)) }
+    }
+    rmSync(TMP, { recursive: true, force: true })
+  }
+}
+
+console.log('')
+for (const p of problems) console.log('FAIL ' + p)
+console.log(problems.length ? 'release-check: ' + problems.length + ' problem(s)' : 'release-check: ALL CHECKS PASSED')
+process.exit(problems.length ? 1 : 0)