gina 0.3.9 → 0.3.10

package/script/check_no_local_leak.js

@@ -23,39 +23,47 @@
  *      contributors, scaffolding template, framework AUTHORS, framework
  *      plugin package.json authors) — see ATTRIBUTION_PATHS.
  *
+ * Plus a third gate that fires BEFORE the scan starts:
+ *
+ *   3. Stable-publish gate: if `npm_command=publish` AND `npm_config_tag=latest`
+ *      (i.e. `npm publish` without `--tag alpha`) AND the maintainer-local
+ *      sidecar `script/.private-tokens.json` is missing, fail closed before
+ *      the scan starts. This prevents a fresh-clone or restored-machine
+ *      stable publish from silently shipping with content-level scanning
+ *      disabled. Alpha publish, npm pack, and contributor `npm install`
+ *      flows continue to no-op silently — path-level scanning still runs.
+ *      See llms.txt §92 for the rationale.
+ *
  * `--ignore-scripts` prevents recursion into the `prepare` script (which
  * would otherwise re-invoke `prepare_version.js` and commit a "Prerelease
  * update").
  *
  * Exit codes:
  *   0  — pack listing and contents are clean
- *   1  — leakage detected OR check itself errored (fail closed)
+ *   1  — leakage detected, check itself errored (fail closed), OR
+ *        stable-publish gate triggered (sidecar missing on `npm publish`
+ *        without `--tag alpha`)
  */
 
 var execSync = require('child_process').execSync;
 var fs       = require('fs');
+var path     = require('path');
+
+var loadPrivateTokens = require('./_load_private_tokens');
 
 var PATH_PATTERN = /(^|\/)(CLAUDE\.md|\.claude[a-z]*)/i;
 
-// Authoring/contributing context — files where the co-author's legal name
-// is allowed (public attribution: README, AUTHORS, GOVERNANCE, CONTRIBUTING,
-// package.json contributors, scaffolding template, framework AUTHORS,
-// framework plugin package.json authors).
+// Authoring/contributing context — files where a token marked
+// allowInAttribution is permitted (public attribution: README, AUTHORS,
+// GOVERNANCE, CONTRIBUTING, package.json contributors, scaffolding
+// template, framework AUTHORS, framework plugin package.json authors).
 var ATTRIBUTION_PATHS = /^(AUTHORS|CONTRIBUTING\.md|GOVERNANCE\.md|README\.md|package\.json|resources\/package\.json\.template|framework\/v[^/]+\/AUTHORS|framework\/v[^/]+\/core\/plugins\/lib\/[^/]+\/package\.json)$/;
 
 // Private tokens that must not appear in published tarball contents.
-// Keep patterns narrow — bare words like "Freelancer" are too broad and
-// produce false positives on legitimate content; the domain form
-// `example.com` catches the leak-relevant variant.
-var CONTENT_TOKENS = [
-    { name: 'private phone',   pattern: /0618178647/ },
-    { name: 'private email',   pattern: /[\w.+-]*etouman@rhinostone/i },
-    { name: 'private address', pattern: /Boulevard\s+Arago/i },
-    { name: 'private domain',  pattern: /freelancer\.app/i },
-    { name: 'co-author legal name',
-                               pattern: /Fabrice\s+Delaneau/i,
-                               allowIn: ATTRIBUTION_PATHS }
-];
+// Patterns load from `script/.private-tokens.json` (gitignored,
+// maintainer-local). If the sidecar is absent, content-level scanning
+// is a no-op; path-level scanning still runs unchanged.
+var CONTENT_TOKENS = loadPrivateTokens(ATTRIBUTION_PATHS);
 
 // Heuristic: only read files that are likely text. Saves time on binary
 // assets (images, compiled JARs, compressed .br/.gz) and prevents
@@ -80,17 +88,17 @@ function isTextPath(p) {
     return false;
 }
 
-function scanContent(path) {
+function scanContent(filePath) {
     var stat;
-    try { stat = fs.statSync(path); } catch (e) { return []; }
+    try { stat = fs.statSync(filePath); } catch (e) { return []; }
     if (!stat.isFile() || stat.size > MAX_SCAN_BYTES) return [];
 
     var content;
-    try { content = fs.readFileSync(path, 'utf8'); } catch (e) { return []; }
+    try { content = fs.readFileSync(filePath, 'utf8'); } catch (e) { return []; }
 
     var hits = [];
     for (var i = 0; i < CONTENT_TOKENS.length; i++) {
-        if (CONTENT_TOKENS[i].allowIn && CONTENT_TOKENS[i].allowIn.test(path)) continue;
+        if (CONTENT_TOKENS[i].allowIn && CONTENT_TOKENS[i].allowIn.test(filePath)) continue;
         if (CONTENT_TOKENS[i].pattern.test(content)) {
             hits.push(CONTENT_TOKENS[i].name);
         }
@@ -98,6 +106,26 @@ function scanContent(path) {
     return hits;
 }
 
+// Stable-publish gate (§92 follow-up (a)). Fires BEFORE the scan starts.
+// `npm publish` without `--tag alpha` (i.e. tag=latest) requires the
+// maintainer-local sidecar to be present; otherwise the content-level
+// scan would be silently disabled, and the publish could ship leaked
+// tokens. Alpha publish, npm pack, and contributor flows are unaffected
+// — path-level scanning still runs in those cases.
+var sidecarPath = path.join(__dirname, '.private-tokens.json');
+if (
+    process.env.npm_command === 'publish'
+    && (process.env.npm_config_tag === 'latest' || !process.env.npm_config_tag)
+    && !fs.existsSync(sidecarPath)
+) {
+    console.error('[prepack] STABLE PUBLISH BLOCKED: ' + sidecarPath + ' missing.');
+    console.error('[prepack] The maintainer-local sidecar is required for stable publish.');
+    console.error('[prepack] Recreate from a personal backup outside the repo, or rebuild');
+    console.error('[prepack] from the schema documented in script/_load_private_tokens.js.');
+    console.error('[prepack] (Alpha publish, npm pack, and contributor flows are not affected.)');
+    process.exit(1);
+}
+
 try {
     var raw = execSync('npm pack --dry-run --json --ignore-scripts', {
         stdio: ['ignore', 'pipe', 'pipe']

package/script/retry_lockfile_sync.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+
+/*
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * @file script/retry_lockfile_sync.js
+ *
+ * Retry-with-backoff wrapper used by `script/post_publish.js → syncDocs`
+ * to absorb the npm registry's eventual-consistency window after a stable
+ * publish. Without this, intermittent
+ * "package-lock.json: gina@<old> does not satisfy gina@<new>" failures
+ * commit a stale lockfile alongside the bumped package.json, breaking the
+ * next Vercel docs deploy.
+ *
+ * Background: the failure mode hit `gina@0.3.7` and `gina@0.3.9` stable
+ * publishes (the second occurrence proved it was a recurring deterministic
+ * ordering bug, not transient registry lag — see `llms.txt §87`).
+ *
+ * Helpers exported via `module.exports` for unit testing with injected
+ * `execDriver` / `sleepDriver` / `logger` — no real-repo or registry
+ * fixtures needed.
+ */
+
+'use strict';
+
+var execSync = require('child_process').execSync;
+
+
+/**
+ * Retry a shell command with backoff. Returns the first successful
+ * invocation, or a failure result after all attempts are exhausted.
+ *
+ * @param {object}   opts
+ * @param {string}   opts.cmd               shell command to run
+ * @param {number[]} [opts.delaysSec]       sleep seconds between attempts (default [5, 15, 30, 30] — ~80s ceiling)
+ * @param {function} [opts.execDriver]      injected execSync replacement (test-only)
+ * @param {function} [opts.sleepDriver]     injected sleep(seconds) (test-only)
+ * @param {object}   [opts.logger]          injected `{ info }` logger (test-only)
+ * @returns {{ ok: boolean, attempts: number, lastErr: (Error|null) }}
+ *
+ * @example
+ *   var retry = require('./retry_lockfile_sync');
+ *   var result = retry.retryWithBackoff({
+ *       cmd: '$(which npm) install --package-lock-only --ignore-scripts'
+ *   });
+ *   if (!result.ok) {
+ *       console.warn('lockfile sync failed after ' + result.attempts + ' attempts');
+ *   }
+ */
+function retryWithBackoff(opts) {
+    opts = opts || {};
+    if (!opts.cmd) throw new Error('retryWithBackoff: opts.cmd is required');
+    var delays = opts.delaysSec || [5, 15, 30, 30];
+    var exec   = opts.execDriver  || function (c) { return execSync(c, { stdio: 'pipe' }); };
+    var sleep  = opts.sleepDriver || function (s) { execSync('sleep ' + s); };
+    var log    = opts.logger      || console;
+
+    var lastErr = null;
+    var totalAttempts = delays.length;
+    for (var i = 0; i < totalAttempts; i++) {
+        try {
+            exec(opts.cmd);
+            return { ok: true, attempts: i + 1, lastErr: null };
+        } catch (err) {
+            lastErr = err;
+            if (i + 1 < totalAttempts) {
+                var brief = (err && err.message) ? err.message.split('\n')[0] : String(err);
+                log.info('[retry] attempt ' + (i + 1) + '/' + totalAttempts + ' failed (' + brief + '), retrying in ' + delays[i] + 's');
+                sleep(delays[i]);
+            }
+        }
+    }
+    return { ok: false, attempts: totalAttempts, lastErr: lastErr };
+}
+
+
+module.exports = {
+    retryWithBackoff: retryWithBackoff
+};

package/framework/v0.3.9/VERSION

@@ -1 +0,0 @@
-0.3.9