fallow 3.17.0 → 3.19.0

package/scripts/lazy-verify.test.js

@@ -16,6 +16,9 @@ const { _verifyWithKey, SKIP_ENV } = require("./verify-binary");
 
 // ---- shared fixtures ------------------------------------------------------
 
+const DEFAULT_PLATFORM = "linux";
+const DEFAULT_PACKAGE_NAME = "@fallow-cli/test-platform";
+
 function makeKeypair() {
   const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
   const spki = publicKey.export({ format: "der", type: "spki" });
@@ -23,18 +26,18 @@ function makeKeypair() {
   return { privateKey, rawPub };
 }
 
-function ext() {
-  return process.platform === "win32" ? ".exe" : "";
+function packageNameForPlatform(platform) {
+  return platform === "win32" ? "@fallow-cli/win32-x64-msvc" : DEFAULT_PACKAGE_NAME;
 }
 
-function binaryNames() {
-  // Platform packages ship a single multicall `fallow` binary.
-  return [`fallow${ext()}`];
+function binaryNames(platform) {
+  const ext = platform === "win32" ? ".exe" : "";
+  return [`fallow${ext}`, `fallow-similar-code${ext}`];
 }
 
-function computeDigestsForDir(dir) {
+function computeDigestsForDir(dir, platform) {
   const out = {};
-  for (const base of binaryNames()) {
+  for (const base of binaryNames(platform)) {
     const full = path.join(dir, base);
     out[base] = "sha256:" + crypto.createHash("sha256").update(fs.readFileSync(full)).digest("hex");
   }
@@ -43,8 +46,9 @@ function computeDigestsForDir(dir) {
 
 function mkPlatformDir(privateKey, options) {
   const opts = options || {};
+  const platform = opts.platform || DEFAULT_PLATFORM;
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fallow-lazy-test-"));
-  for (const base of binaryNames()) {
+  for (const base of binaryNames(platform)) {
     const binaryPath = path.join(dir, base);
     const content = Buffer.from(`mock ${base}`);
     fs.writeFileSync(binaryPath, content);
@@ -56,9 +60,9 @@ function mkPlatformDir(privateKey, options) {
   fs.writeFileSync(
     path.join(dir, "package.json"),
     JSON.stringify({
-      name: opts.packageName || "@fallow-cli/test-platform",
+      name: opts.packageName || packageNameForPlatform(platform),
       version: opts.version || "2.81.0",
-      fallowDigests: opts.skipDigests ? undefined : computeDigestsForDir(dir),
+      fallowDigests: opts.skipDigests ? undefined : computeDigestsForDir(dir, platform),
     }),
   );
   return dir;
@@ -88,13 +92,15 @@ function setupCacheRoot(t) {
 }
 
 function baseInput(dir, verifyFn, extras) {
+  const manifestPath = path.join(dir, "package.json");
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
   return {
     platformPkgDir: dir,
-    packageName: "@fallow-cli/test-platform",
-    manifestPath: path.join(dir, "package.json"),
+    packageName: manifest.name,
+    manifestPath,
     verifyFn,
     env: {},
-    platform: process.platform,
+    platform: DEFAULT_PLATFORM,
     ...extras,
   };
 }
@@ -117,7 +123,30 @@ test("ensureVerified verifies on cache miss and writes the sentinel", (t) => {
   assert.equal(sentinel.schemaVersion, SENTINEL_SCHEMA_VERSION);
   assert.equal(sentinel.packageVersion, "2.81.0");
   assert.equal(sentinel.packageName, "@fallow-cli/test-platform");
-  assert.equal(Object.keys(sentinel.binaries).length, 1);
+  assert.equal(Object.keys(sentinel.binaries).length, 2);
+});
+
+test("ensureVerified verifies and caches a win32 executable on any host", (t) => {
+  _resetWarningState();
+  const { privateKey, rawPub } = makeKeypair();
+  const dir = mkPlatformDir(privateKey, { platform: "win32" });
+  t.after(() => cleanup(dir));
+  const input = baseInput(dir, (binaryPath) => _verifyWithKey(binaryPath, rawPub), {
+    platform: "win32",
+  });
+
+  const verified = ensureVerified(input);
+  assert.equal(verified.ok, true);
+  assert.equal(verified.cached, false);
+  const sentinel = JSON.parse(fs.readFileSync(verified.sentinelPath, "utf8"));
+  assert.deepEqual(Object.keys(sentinel.binaries), ["fallow.exe", "fallow-similar-code.exe"]);
+
+  const cached = ensureVerified({
+    ...input,
+    verifyFn: () => assert.fail("signature verification must not run on a cache hit"),
+  });
+  assert.equal(cached.ok, true);
+  assert.equal(cached.cached, true);
 });
 
 test("ensureVerified returns cached:true on a valid sentinel", (t) => {
@@ -154,7 +183,7 @@ test("ensureVerified invalidates sentinel on mtime drift", (t) => {
 
   // Bump the mtime of one binary; sentinel should now be stale.
   const newTime = new Date(Date.now() + 10_000);
-  fs.utimesSync(path.join(dir, `fallow${ext()}`), newTime, newTime);
+  fs.utimesSync(path.join(dir, binaryNames(DEFAULT_PLATFORM)[0]), newTime, newTime);
 
   let verifyCallCount = 0;
   const result = ensureVerified(
@@ -165,7 +194,11 @@ test("ensureVerified invalidates sentinel on mtime drift", (t) => {
   );
   assert.equal(result.ok, true);
   assert.equal(result.cached, false);
-  assert.equal(verifyCallCount, 1, "verify should rerun for the single binary");
+  assert.equal(
+    verifyCallCount,
+    binaryNames(DEFAULT_PLATFORM).length,
+    "verify should rerun for every shipped binary",
+  );
 });
 
 test("ensureVerified invalidates sentinel on packageVersion drift", (t) => {
@@ -215,7 +248,9 @@ test("ensureVerified invalidates sentinel on packageName drift", (t) => {
       packageVersion: "2.81.0",
       packageName: "@fallow-cli/wrong-name",
       binaries: {
-        [`fallow${ext()}`]: { mtimeMs: fs.statSync(path.join(dir, `fallow${ext()}`)).mtimeMs },
+        [binaryNames(DEFAULT_PLATFORM)[0]]: {
+          mtimeMs: fs.statSync(path.join(dir, binaryNames(DEFAULT_PLATFORM)[0])).mtimeMs,
+        },
       },
     }),
   );
@@ -261,7 +296,7 @@ test("ensureVerified invalidates sentinel on schemaVersion drift", (t) => {
 test("ensureVerified returns sig-invalid on a tampered signature", (t) => {
   _resetWarningState();
   const { privateKey, rawPub } = makeKeypair();
-  const dir = mkPlatformDir(privateKey, { corruptSigFor: `fallow${ext()}` });
+  const dir = mkPlatformDir(privateKey, { corruptSigFor: binaryNames(DEFAULT_PLATFORM)[0] });
   t.after(() => cleanup(dir));
 
   const result = ensureVerified(baseInput(dir, (p) => _verifyWithKey(p, rawPub)));
@@ -289,89 +324,43 @@ test("ensureVerified returns digest-unavailable on a pre-#597 manifest", (t) =>
 
 test("ensureVerified honors FALLOW_VERIFY_CACHE_DIR when platform pkg dir is non-writable", (t) => {
   _resetWarningState();
-  if (process.platform === "win32") {
-    t.skip("Windows ACL chmod is not portable; covered by sentinel-path tests");
-    return;
-  }
   const { privateKey, rawPub } = makeKeypair();
   const dir = mkPlatformDir(privateKey);
   const cacheRoot = setupCacheRoot(t);
+  t.after(() => cleanup(dir));
 
-  fs.chmodSync(dir, 0o555);
-  try {
-    const result = ensureVerified({
-      ...baseInput(dir, (p) => _verifyWithKey(p, rawPub)),
-      env: { FALLOW_VERIFY_CACHE_DIR: cacheRoot },
-    });
-    assert.equal(result.ok, true);
-    assert.equal(result.cached, false);
-    assert.match(result.sentinelPath, new RegExp(cacheRoot.replace(/\\/g, "\\\\")));
-  } finally {
-    fs.chmodSync(dir, 0o755);
-    cleanup(dir);
-  }
+  const result = ensureVerified({
+    ...baseInput(dir, (p) => _verifyWithKey(p, rawPub)),
+    env: { FALLOW_VERIFY_CACHE_DIR: cacheRoot },
+    isWritable: (candidate) => candidate !== dir,
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.cached, false);
+  assert.match(result.sentinelPath, new RegExp(cacheRoot.replace(/\\/g, "\\\\")));
 });
 
-test("ensureVerified emits a single warning when sentinel write fails", (t) => {
+test("ensureVerified emits a single warning when no sentinel location is writable", (t) => {
   _resetWarningState();
-  if (process.platform === "win32") {
-    t.skip("Windows ACL chmod is not portable");
-    return;
-  }
   const { privateKey, rawPub } = makeKeypair();
   const dir = mkPlatformDir(privateKey);
   const stderr = captureStderr(t);
+  t.after(() => cleanup(dir));
+  const input = {
+    ...baseInput(dir, (p) => _verifyWithKey(p, rawPub)),
+    homedir: undefined,
+    isWritable: () => false,
+  };
 
-  // Make platform pkg dir non-writable AND point FALLOW_VERIFY_CACHE_DIR at
-  // a non-existent path. resolveSentinelPath will still find the XDG / home
-  // fallback, but we can simulate "every cache location read-only" by giving
-  // it a writable dir that we then chmod down right before ensureVerified
-  // runs writeSentinel. Simpler: instead of fighting the cascade in env,
-  // simulate write failure via a non-writable FALLOW_VERIFY_CACHE_DIR that
-  // PASSES isWritable() but then has its perms revoked between resolve and
-  // write. Since that race is hard to script, we test the warn-once helper
-  // via a synthetic path that fails the rename atomically: pass a sentinel-
-  // chmod-locked dir.
-  //
-  // The portable shape: chmod the platform pkg dir read-only AND pass a
-  // FALLOW_VERIFY_CACHE_DIR that is a regular file (not a dir). isWritable
-  // returns false for both, so resolveSentinelPath falls through to XDG. If
-  // the user has no HOME (synthetic env), the cascade returns null. We can
-  // achieve this only by injecting both env.HOME='' AND env.XDG_CACHE_HOME=''
-  // AND ensuring os.homedir() is not consulted; ensureVerified does not
-  // accept a homedir override, so the warn-once path is unreachable via env
-  // alone on a machine with a real HOME. Skip this test on machines with a
-  // real homedir; the warn-once helper is otherwise covered by the
-  // "no-writable-location" branch in sentinel-path tests.
-  if (os.homedir() && os.homedir().length > 0) {
-    t.skip(
-      "warn-once-on-no-writable-cache requires homedir-override knob (covered by sentinel-path unit test)",
-    );
-    cleanup(dir);
-    return;
-  }
+  const result = ensureVerified(input);
+  assert.equal(result.sentinelPath, null);
+  const warnings = stderr.lines.filter((line) => line.includes("no writable cache location"));
+  assert.equal(warnings.length, 1);
 
-  fs.chmodSync(dir, 0o555);
-  try {
-    const env = { HOME: "", XDG_CACHE_HOME: "" };
-    const result = ensureVerified({
-      ...baseInput(dir, (p) => _verifyWithKey(p, rawPub)),
-      env,
-    });
-    if (result.sentinelPath !== null) {
-      t.diagnostic(`sentinel landed at ${result.sentinelPath} despite empty HOME; skipping`);
-      return;
-    }
-    const warnings = stderr.lines.filter((l) => l.includes("no writable cache location"));
-    assert.equal(warnings.length, 1);
-    // Second call: no new warning.
-    ensureVerified({ ...baseInput(dir, (p) => _verifyWithKey(p, rawPub)), env });
-    const warnings2 = stderr.lines.filter((l) => l.includes("no writable cache location"));
-    assert.equal(warnings2.length, 1);
-  } finally {
-    fs.chmodSync(dir, 0o755);
-    cleanup(dir);
-  }
+  ensureVerified(input);
+  const repeatedWarnings = stderr.lines.filter((line) =>
+    line.includes("no writable cache location"),
+  );
+  assert.equal(repeatedWarnings.length, 1);
 });
 
 // ---- FALLOW_SKIP_BINARY_VERIFY -------------------------------------------
@@ -457,10 +446,6 @@ test("ensureVerified is idempotent under concurrent first-runs", async (t) => {
 
 test("ensureVerified rejects a sentinel written for a different install dir", (t) => {
   _resetWarningState();
-  if (process.platform === "win32") {
-    t.skip("chmod-based read-only platform pkg dir is not portable on Windows");
-    return;
-  }
   // Two installs of the same package + version. install A is clean and writes
   // a sentinel to a shared cache; install B has a tampered binary at the same
   // package name + version. B must NOT trust A's sentinel via cache hit even
@@ -471,17 +456,14 @@ test("ensureVerified rejects a sentinel written for a different install dir", (t
   // Tamper install B's fallow binary AFTER mkPlatformDir wrote a valid sig
   // for the original bytes (mkPlatformDir does not expose a corrupt-binary
   // option, so simulate the attack by overwriting bytes here).
-  fs.writeFileSync(path.join(installB, `fallow${ext()}`), Buffer.from("tampered bytes"));
+  fs.writeFileSync(
+    path.join(installB, binaryNames(DEFAULT_PLATFORM)[0]),
+    Buffer.from("tampered bytes"),
+  );
   const sharedCache = fs.mkdtempSync(path.join(os.tmpdir(), "fallow-shared-cache-"));
+  const isWritable = (candidate) => candidate !== installA && candidate !== installB;
 
-  // Force the shared-cache cascade by making both platform pkg dirs
-  // non-writable (simulates yarn PnP / Docker layered images / pnpm
-  // verify-store invariants).
-  fs.chmodSync(installA, 0o555);
-  fs.chmodSync(installB, 0o555);
   t.after(() => {
-    fs.chmodSync(installA, 0o755);
-    fs.chmodSync(installB, 0o755);
     cleanup(installA);
     cleanup(installB);
     cleanup(sharedCache);
@@ -492,6 +474,7 @@ test("ensureVerified rejects a sentinel written for a different install dir", (t
   const resultA = ensureVerified({
     ...baseInput(installA, (p) => _verifyWithKey(p, rawPub)),
     env: { FALLOW_VERIFY_CACHE_DIR: sharedCache },
+    isWritable,
   });
   assert.equal(resultA.ok, true);
   assert.match(resultA.sentinelPath, new RegExp(sharedCache.replace(/\\/g, "\\\\")));
@@ -502,7 +485,6 @@ test("ensureVerified rejects a sentinel written for a different install dir", (t
   // + SHA-256 binding must prevent that.
   for (const name of binaryNames()) {
     const aStat = fs.statSync(path.join(installA, name));
-    fs.chmodSync(path.join(installB, name), 0o644);
     fs.utimesSync(path.join(installB, name), aStat.atime, aStat.mtime);
   }
 
@@ -513,6 +495,7 @@ test("ensureVerified rejects a sentinel written for a different install dir", (t
       return _verifyWithKey(p, rawPub);
     }),
     env: { FALLOW_VERIFY_CACHE_DIR: sharedCache },
+    isWritable,
   });
   assert.equal(resultB.ok, false);
   assert.equal(resultB.code, "sig-invalid");
@@ -530,7 +513,7 @@ test("ensureVerified rejects a sentinel where bytes drift but mtime stays", (t)
 
   // Tamper the binary in place AND restore the prior mtime, so the mtime
   // pre-filter matches but the bytes do not.
-  const binPath = path.join(dir, `fallow${ext()}`);
+  const binPath = path.join(dir, binaryNames(DEFAULT_PLATFORM)[0]);
   const before = fs.statSync(binPath);
   fs.writeFileSync(binPath, Buffer.from("tampered"));
   fs.utimesSync(binPath, before.atime, before.mtime);

package/scripts/sentinel-path.test.js

@@ -77,7 +77,7 @@ test("resolveSentinelPath falls back to FALLOW_VERIFY_CACHE_DIR when platform pk
   const cacheDir = mkTmp();
   try {
     const result = resolveSentinelPath({
-      platformPkgDir: "/dev/null/not-a-dir",
+      platformPkgDir: path.join(cacheDir, "missing-platform-package"),
       packageName: "@fallow-cli/darwin-arm64",
       env: { FALLOW_VERIFY_CACHE_DIR: cacheDir },
     });
@@ -220,12 +220,19 @@ test("resolveSentinelPath honors injected isWritable + ensureDir for full test i
 test("resolveSentinelPath skips cache-dir-env when ensureDir fails for it", () => {
   // FALLOW_VERIFY_CACHE_DIR points at a non-creatable path, XDG points at a
   // creatable one. Confirm the resolver moves past the env override.
+  //
+  // A directory nested under a regular FILE is the portable way to make mkdir
+  // fail: `/dev/null/inside/a/file` only refuses on POSIX, and on Windows the
+  // recursive mkdir succeeds against the current drive, which both defeats the
+  // assertion and creates C:\dev outside any temp directory.
   const homeDir = mkTmp();
+  const blocker = path.join(homeDir, "not-a-directory");
+  fs.writeFileSync(blocker, "");
   try {
     const result = resolveSentinelPath({
       platformPkgDir: undefined,
       packageName: "@fallow-cli/darwin-arm64",
-      env: { FALLOW_VERIFY_CACHE_DIR: "/dev/null/inside/a/file" },
+      env: { FALLOW_VERIFY_CACHE_DIR: path.join(blocker, "inside", "a", "file") },
       homedir: homeDir,
       platform: "darwin",
     });

package/scripts/verify-binary.js

@@ -293,15 +293,16 @@ function binaryTargetsForPlatform(platformId) {
   // and tests can synthesize a Windows verify without running on Windows.
   const isWindows = typeof platformId === "string" && platformId.startsWith("win32");
   const ext = isWindows ? ".exe" : "";
-  // Platform packages ship ONE binary now: the multicall `fallow` (CLI + LSP +
-  // MCP in one engine). The bundled `fallow-lsp` / `fallow-mcp` launchers live
-  // in the wrapper and spawn `fallow lsp-server` / `fallow mcp-server`. The
-  // authoritative digest is the `fallowDigests.fallow` field the release
-  // pipeline embeds for every bundled package; the `asset` below is only the
-  // legacy GitHub-release fallback for pre-embedded-digest packages, which
-  // never shipped this bundled binary, so it is inert for bundled installs and
-  // fails closed (digest-mismatch) in the impossible case it is ever reached.
-  return [{ binary: `fallow${ext}`, asset: `fallow-${platformId}${ext}` }];
+  // The platform package ships the multicall CLI plus the local-only
+  // similar-code provider. Both are signed and digest-pinned. Verifying them
+  // together keeps the Rust sibling lookup free of project or PATH overrides.
+  return [
+    { binary: `fallow${ext}`, asset: `fallow-${platformId}${ext}` },
+    {
+      binary: `fallow-similar-code${ext}`,
+      asset: `fallow-similar-code-${platformId}${ext}`,
+    },
+  ];
 }
 
 function isSkipRequested() {

package/scripts/verify-binary.test.js

@@ -239,11 +239,21 @@ test("verifyBinaryAt uses the embedded production public key", () => {
   }
 });
 
+// Mirror binaryTargetsForPlatform: the suffix comes from the platformId under
+// test, never from the live process.platform. A `dirOverride` run without an
+// explicit platformId is labelled "test-platform" by
+// resolvePlatformPackageForVerify, so the binary it looks for is plain `fallow`
+// on every host -- a fixture keyed off process.platform writes `fallow.exe` on a
+// Windows host and the verify then finds nothing.
+function extForPlatformId(platformId) {
+  return typeof platformId === "string" && platformId.startsWith("win32") ? ".exe" : "";
+}
+
 function makePlatformDir(privateKey, options) {
   const opts = options || {};
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fallow-vbtest-"));
-  const ext = process.platform === "win32" ? ".exe" : "";
-  for (const base of ["fallow"]) {
+  const ext = extForPlatformId(opts.platformId);
+  for (const base of ["fallow", "fallow-similar-code"]) {
     const binaryPath = path.join(dir, `${base}${ext}`);
     const content = Buffer.from(`mock ${base} contents`);
     fs.writeFileSync(binaryPath, content);
@@ -328,6 +338,42 @@ test("verifyInstalled with dirOverride returns ok when every binary verifies", a
   assert.equal(result.package, "<override>");
 });
 
+// binaryTargetsForPlatform reads windows-ness off the platformId so a Windows
+// verify can be synthesized anywhere. Nothing exercised that, which left the
+// `.exe` target unverified on Linux CI and unverified on Windows too.
+test("verifyInstalled verifies the .exe target for a win32 platformId on any host", async (t) => {
+  const { privateKey, rawPub } = makeKeypair();
+  const platformId = "win32-x64-msvc";
+  const dir = makePlatformDir(privateKey, { platformId });
+  t.after(() => cleanup(dir));
+  assert.ok(fs.existsSync(path.join(dir, "fallow.exe")), "fixture must write the .exe target");
+
+  const result = await verifyInstalled({
+    dirOverride: dir,
+    platformId,
+    verifyFn: (p) => _verifyWithKey(p, rawPub),
+    digestProvider: makeDigestProvider(dir),
+  });
+  assert.equal(result.ok, true);
+});
+
+test("verifyInstalled reports the .exe name when a win32 signature is absent", async (t) => {
+  const { privateKey, rawPub } = makeKeypair();
+  const platformId = "win32-arm64-msvc";
+  const dir = makePlatformDir(privateKey, { platformId, skipSigFor: "fallow" });
+  t.after(() => cleanup(dir));
+
+  const result = await verifyInstalled({
+    dirOverride: dir,
+    platformId,
+    verifyFn: (p) => _verifyWithKey(p, rawPub),
+    digestProvider: makeDigestProvider(dir),
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.code, "sig-missing");
+  assert.match(result.message, /fallow\.exe/);
+});
+
 test("verifyInstalled resolves a global npm install from the fallow package directory", async (t) => {
   const pkg = currentPlatformPackage();
   if (!pkg) {
@@ -349,7 +395,7 @@ test("verifyInstalled resolves a global npm install from the fallow package dire
   );
 
   const ext = process.platform === "win32" ? ".exe" : "";
-  for (const base of ["fallow"]) {
+  for (const base of ["fallow", "fallow-similar-code"]) {
     const binaryPath = path.join(platformDir, `${base}${ext}`);
     const content = Buffer.from(`global install ${base}`);
     fs.writeFileSync(binaryPath, content);
@@ -460,10 +506,10 @@ test("verifyInstalled honors FALLOW_SKIP_BINARY_VERIFY", async (t) => {
   assert.equal(result.skipped, true);
 });
 
-function computeDigestsForDir(dir) {
-  const ext = process.platform === "win32" ? ".exe" : "";
+function computeDigestsForDir(dir, platformId) {
+  const ext = extForPlatformId(platformId);
   const out = {};
-  for (const base of ["fallow"]) {
+  for (const base of ["fallow", "fallow-similar-code"]) {
     const fileName = `${base}${ext}`;
     const full = path.join(dir, fileName);
     out[fileName] =
@@ -549,7 +595,7 @@ test("verifyInstalled falls back to the provider when the embedded digest is mis
     },
   });
   assert.equal(result.ok, true);
-  assert.equal(providerCalls, 1);
+  assert.equal(providerCalls, 2);
 });
 
 test("verifyInstalled falls back to the provider when fallowDigests is partial / malformed", async (t) => {
@@ -573,15 +619,15 @@ test("verifyInstalled falls back to the provider when fallowDigests is partial /
     },
   });
   assert.equal(result.ok, true);
-  // One call for the single shipped binary because its entry fails to normalize.
-  assert.equal(providerCalls, 1);
+  // Both shipped binaries fall back because their embedded entries are absent or malformed.
+  assert.equal(providerCalls, 2);
 });
 
 test("verifyInstalled returns digest-mismatch when the embedded digest disagrees with the binary", async (t) => {
   const { privateKey, rawPub } = makeKeypair();
   const dir = makePlatformDir(privateKey);
   t.after(() => cleanup(dir));
-  const ext = process.platform === "win32" ? ".exe" : "";
+  const ext = extForPlatformId();
   writeManifest(dir, {
     name: "@fallow-cli/x",
     version: "1.0.0",