harness-everything 0.35.0 → 0.36.0

package/ci/portability-lint.js

@@ -0,0 +1,288 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Test-Source Portability Lint
+ *
+ * The Windows CI matrix has failed on fixture paths that macOS/Linux never
+ * reject: a filename containing ':' and '"' (mechanism-2ay, run 39043848220)
+ * and a Windows device-namespace path (mechanism-2au, run 38760213406).
+ * This lint moves that failure class from "after push" to this local gate.
+ *
+ * Scanned: every .js file under ci/ (fixture creators, check scripts, tests).
+ *
+ * Rules, all requiring a whitespace-free single-token literal so prose,
+ * regex sources and message templates stay out of the net:
+ *   WIN_DEVICE_PATH     the literal begins with the \\.\ or \\?\ device
+ *                       namespace prefix
+ *   WIN_RESERVED_NAME   the literal, or a path segment of it, is CON PRN
+ *                       AUX NUL COM1-9 LPT1-9, with or without an extension
+ *   WIN_INVALID_CHAR    a path-like literal contains one of : * ? " < > |
+ *                       (clock-like 12:34 fragments are not counted; only
+ *                       verified URL/Node-specifier schemes with a value
+ *                       after the colon and wildcard-led glob segments are
+ *                       exempt, so bad:name.md and bad*name.md are flagged)
+ *
+ * The exemptions are contextual, and ci/mechanism-37-portability-lint.test.js
+ * holds the positive/negative corpus that locks them down.
+ *
+ * Known limits, kept deliberately narrow over noisy coverage: it does not
+ * flag spaced fixture names, trailing dots/spaces, bare single tokens
+ * without a path separator or extension (except reserved names), or
+ * invalid characters inside prose-like strings. Those still rely on review
+ * and the Windows CI matrix. A finding here is a tripwire, not proof of a
+ * Windows failure.
+ *
+ * Remedy: use a portable fixture name, platform-guard the code path, or mark
+ * one deliberate case with `portability-lint: allow <reason>` on its line.
+ *
+ * Usage: node ci/portability-lint.js
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const SELF = path.resolve(__filename);
+const SCAN_ROOT = path.resolve(__dirname);
+const SKIP_DIRS = new Set(['fixtures', 'node_modules', '__pycache__']);
+const EXTENSIONS = new Set(['.js', '.cjs', '.mjs']);
+const PRAGMA = /portability-lint:\s*allow/;
+const RESERVED_NAME = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+const INVALID_CHARS = /[:*?"<>|]/;
+const WILDCARD_CHARS = /[*?]/g;
+const CLOCK_FRAGMENT = /\d{1,2}:\d{2}(?::\d{2}(?:\.\d+)?)?/g;
+const DEVICE_NAMESPACE = /^(\\\\|\\)[.?](\\|$)/;
+// A scheme is only exempt with a real authority (`https://...`) or as a
+// known Node/tooling/repo-data specifier (`node:assert/strict`,
+// `pkg:npm/...`, `HEAD:refs/heads/main`, `legacy:GRAPH-1@docs/x.md`). A bare
+// word before the colon (`bad:name.md`) is a filename, not a scheme.
+const URL_WITH_AUTHORITY = /^[a-z][a-z0-9+.-]*:\/\//i;
+const SPECIFIER_SCHEME = /^(node|pkg|https?|git\+https?|ssh|file|mailto|data|github|fallback-task|HEAD|legacy|human):/i;
+const DRIVE_PREFIX = /^[A-Za-z]:/;
+// Strings that open like regex sources rather than filenames: a char-class
+// or inline-group opener after a leading slash, a leading inline group, or a
+// leading backslash escape such as \s or \d.
+const REGEX_SOURCE = /^(?:\(\?[:=!]|\/\[|\/\(\?|\\[sSdDwWbB])/;
+// Markup tags, <placeholder> roots, desync tails, and `${...}` templates are
+// data under test, never fixture names.
+const DATAISH_PREFIX = /^[<>{}\[\]$]/;
+// A wildcard-led segment (`*.md`, `**`) marks the token as a glob pattern.
+const GLOB_SEGMENT = /^[*?]/;
+const REGEX_PREFIX_CHARS = '([{,;:=!&|?+-*%<>~^';
+const REGEX_KEYWORDS = /(?:^|[^\w$])(return|typeof|case|in|of|new|delete|void|instanceof)\s*$/;
+
+function extractLiterals(source) {
+  const literals = [];
+  let line = 1;
+  let i = 0;
+  const n = source.length;
+  while (i < n) {
+    const ch = source[i];
+    if (ch === '\n') {
+      line += 1;
+      i += 1;
+      continue;
+    }
+    if (ch === '/' && source[i + 1] === '/') {
+      const next = source.indexOf('\n', i);
+      i = next === -1 ? n : next;
+      continue;
+    }
+    if (ch === '/' && source[i + 1] === '*') {
+      let j = i + 2;
+      while (j < n && !(source[j] === '*' && source[j + 1] === '/')) {
+        if (source[j] === '\n') line += 1;
+        j += 1;
+      }
+      i = j + 2;
+      continue;
+    }
+    if (ch === '/' && regexPosition(source, i)) {
+      // Skip regex literals so quotes and brackets inside them never desync
+      // the scanner into reading code as a string.
+      let j = i + 1;
+      let inClass = false;
+      while (j < n) {
+        const c = source[j];
+        if (c === '\n') break;
+        if (c === '\\') {
+          j += 2;
+          continue;
+        }
+        if (c === '[') inClass = true;
+        else if (c === ']') inClass = false;
+        else if (c === '/' && !inClass) {
+          j += 1;
+          break;
+        }
+        j += 1;
+      }
+      i = j;
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === '`') {
+      const quote = ch;
+      const startLine = line;
+      let value = '';
+      let j = i + 1;
+      let closed = false;
+      while (j < n) {
+        const c = source[j];
+        if (c === '\n') break;
+        if (c === '\\') {
+          if (j + 1 >= n) break;
+          value += source[j + 1];
+          j += 2;
+          continue;
+        }
+        if (c === quote) {
+          closed = true;
+          break;
+        }
+        value += c;
+        j += 1;
+      }
+      if (closed) {
+        literals.push({ line: startLine, value });
+        i = j + 1;
+        continue;
+      }
+      // Unterminated on this line: treat the quote as plain text, rescan.
+      i += 1;
+      continue;
+    }
+    i += 1;
+  }
+  return literals;
+}
+
+function regexPosition(source, i) {
+  let k = i - 1;
+  while (k >= 0 && (source[k] === ' ' || source[k] === '\t')) k -= 1;
+  if (k < 0 || source[k] === '\n') return true;
+  if (REGEX_PREFIX_CHARS.includes(source[k])) return true;
+  return REGEX_KEYWORDS.test(source.slice(Math.max(0, k - 12), k + 1));
+}
+
+function looksPathLike(value) {
+  const s = value.trim();
+  if (!s || s.length > 300) return false;
+  if (/[\\/]/.test(s)) return true;
+  return /\.[A-Za-z0-9]{1,8}$/.test(s); // bare filename with extension
+}
+
+function pathSegments(value) {
+  const body = DRIVE_PREFIX.test(value) ? value.slice(2) : value;
+  return body.split(/[\\/]+/).filter(Boolean);
+}
+
+function analyzeLiteral(literal) {
+  const findings = [];
+  const value = literal.value.trim();
+  if (!value) return findings;
+  if (DEVICE_NAMESPACE.test(value)) {
+    findings.push({
+      rule: 'WIN_DEVICE_PATH',
+      detail: `literal begins with the ${value.slice(0, 3)} device-namespace prefix`,
+    });
+    return findings;
+  }
+  if (DATAISH_PREFIX.test(value)) return findings;
+  if (/\s/.test(value)) return findings; // prose, templates, patch bodies
+
+  const segments = pathSegments(value);
+  const glob = segments.some((segment) => GLOB_SEGMENT.test(segment));
+
+  if (RESERVED_NAME.test(value)) {
+    findings.push({
+      rule: 'WIN_RESERVED_NAME',
+      detail: `literal "${value}" is a reserved Windows name`,
+    });
+  } else if (looksPathLike(value)) {
+    for (const segment of segments) {
+      if (RESERVED_NAME.test(segment)) {
+        findings.push({
+          rule: 'WIN_RESERVED_NAME',
+          detail: `segment "${segment}" is a reserved Windows name`,
+        });
+      }
+    }
+  }
+
+  if (
+    looksPathLike(value) &&
+    !URL_WITH_AUTHORITY.test(value) &&
+    !SPECIFIER_SCHEME.test(value) &&
+    !REGEX_SOURCE.test(value)
+  ) {
+    // The drive-letter colon is portable; everything after it is not.
+    const withoutDrive = DRIVE_PREFIX.test(value) ? value.slice(2) : value;
+    const withoutClocks = withoutDrive.replace(CLOCK_FRAGMENT, '');
+    const scanned = glob ? withoutClocks.replace(WILDCARD_CHARS, '') : withoutClocks;
+    const invalid = scanned.match(INVALID_CHARS);
+    if (invalid) {
+      findings.push({
+        rule: 'WIN_INVALID_CHAR',
+        detail: `literal "${value}" contains '${invalid[0]}'`,
+      });
+    }
+  }
+  return findings;
+}
+
+function collectFiles(dir, out) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name) || entry.name.startsWith('.')) continue;
+      collectFiles(path.join(dir, entry.name), out);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    if (!EXTENSIONS.has(path.extname(entry.name))) continue;
+    const full = path.join(dir, entry.name);
+    if (full === SELF) continue;
+    out.push(full);
+  }
+  return out;
+}
+
+function main() {
+  console.log('=== 🧭 Harness test-source portability lint ===');
+
+  const files = collectFiles(SCAN_ROOT, []);
+  let literalCount = 0;
+  let findings = 0;
+
+  for (const file of files) {
+    const text = fs.readFileSync(file, 'utf8');
+    const lines = text.split('\n');
+    for (const literal of extractLiterals(text)) {
+      literalCount += 1;
+      const allowed =
+        PRAGMA.test(lines[literal.line - 1] || '') ||
+        PRAGMA.test(lines[literal.line - 2] || '');
+      if (allowed) continue;
+      for (const finding of analyzeLiteral(literal)) {
+        findings += 1;
+        const shown = literal.value.length > 80 ? `${literal.value.slice(0, 77)}...` : literal.value;
+        const rel = path.relative(path.resolve(SCAN_ROOT, '..'), file);
+        console.error(`❌ ${rel}:${literal.line} [${finding.rule}] ${finding.detail}`);
+        console.error(`   literal: ${shown}`);
+        console.error('   fix: portable fixture name, platform guard, or `portability-lint: allow <reason>`');
+      }
+    }
+  }
+
+  console.log(`Scanned ${files.length} file(s), ${literalCount} single-line literal(s).`);
+  if (findings > 0) {
+    console.error(`❌ portability lint found ${findings} finding(s) in the Windows-hostile class.`);
+    process.exit(1);
+  }
+  console.log('✅ no Windows-hostile paths in scanned test sources.');
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { extractLiterals, analyzeLiteral, looksPathLike, pathSegments };

package/docs/repository-contract.md

@@ -19,7 +19,7 @@ This page is generated from checked-in runtime and workflow sources. Do not edit
 | Workflow | Node.js versions | Explicit triggers | npm quality gates |
 | --- | --- | --- | --- |
 | `behavioral-evals.yml` | 24 | schedule, workflow_dispatch | n/a |
-| `ci.yml` | 22, 24 | workflow_call | `test`, `test:mutations`, `test:release:semantics`, `waza:check`, `test:consistency`, `test:references`, `test:release`, `test:collision`, `test:plugin:openai`, `test:plugin:submission`, `test:platform:compatibility` |
+| `ci.yml` | 22, 24 | workflow_call | `test`, `test:mutations`, `test:release:semantics`, `waza:check`, `test:consistency`, `test:references`, `test:release`, `test:collision`, `test:plugin:openai`, `test:plugin:submission`, `test:platform:compatibility`, `test:portability` |
 | `release.yml` | 24 | workflow_dispatch | n/a |
 
 ## Drift prevention

package/opencode-plugin/README.md

@@ -52,11 +52,42 @@ and on failure calls `client.session.prompt()` to push a synthetic follow-up
 message into the session - forcing the agent to keep working instead of
 actually stopping.
 
+The verification run has a budget, not a fixed 60s cap: a healthy self-regression
+suite takes around two minutes, so the default is 10 minutes and
+`HARNESS_VERIFY_TIMEOUT_MS` overrides it. Every run is classified as `pass`
+(exit 0), `test_failure` (a real non-zero exit), `timeout` (the budget actually
+expired: `ETIMEDOUT`, or a kill with no exit status once the budget elapsed) or
+`execution_error` (a spawn-level failure such as `ENOBUFS`/`ENOENT`, or an
+external signal such as `SIGTERM`/`SIGINT` before the budget - a signal alone
+is not a budget expiry).
+Only `test_failure` confirms a failing check and advances the Rule-of-3
+counter; `timeout` and `execution_error` are reported as uncompleted
+verifications and never impersonate repeated failures. A timeout is reported as
+`timed out after <n>s (set HARNESS_VERIFY_TIMEOUT_MS to raise it); last
+output: ...`, a spawn-level failure as `could not run to completion (execution
+error: ENOBUFS); output: ...` (an external signal names the signal).
+
+Known operational limits of the synchronous runner: `execSync` blocks the
+plugin's event loop for the duration of each script (worst case one budget per
+script), and captured output is buffered up to 16 MiB. A run whose output
+exceeds that buffer is classified as an `execution_error`, never as a failed
+check, so buffer pressure cannot flip the circuit breaker. Moving verification
+to an async `spawn` with streaming, bounded diagnostics is tracked as a
+follow-up in issue #338.
+
 ### 3. Rule-of-3 zoom-out boundary (`tool.execute.before` + the verification observer above)
 
 Enforces Rule of 3 on repeated verification failures (same failing command +
-truncated error, not arbitrary tool failures - `tool.execute.after` has no
-normalized success/failure field to key a signature on for tools in general):
+normalized failure evidence: the first test-level failing marker - TAP
+`not ok`, node:test/jest symbols, Jest test blocks, assertion lines - over the
+full captured stdout **and** stderr, with a preceding suite header such as
+Jest's `FAIL <file>` carried as context so different tests in one file stay
+distinct; without a test-level marker the signature falls back to a digest of
+that full evidence, never to a suite header alone; the 2 KiB bound applies
+only to the user-visible diagnostic excerpt, never to signature analysis; not
+arbitrary tool failures, since
+`tool.execute.after` has no normalized success/failure field to key a
+signature on for tools in general):
 - 3rd failure on the same signature forces a reflection message instead of a
   retry nudge
 - the follow-up asks for a tokenized `zoom-out-report.md` artifact with the

package/opencode-plugin/hooks/verify.js

@@ -105,19 +105,91 @@ function getAvailableScripts() {
   }
 }
 
+// Mirrors ../index.mjs's verification budget and outcome classification so
+// the manual CLI cannot drift from the plugin. A 60s cap killed healthy
+// ~2 minute self-regression runs. Only `test_failure` (a real non-zero exit)
+// is a confirmed failing check; `timeout` and `execution_error` mean the run
+// produced no verdict. A signal alone is not a budget timeout - only expiry
+// (ETIMEDOUT, or a kill with no exit status once the budget elapsed) is.
+const VERIFY_TIMEOUT_ENV = 'HARNESS_VERIFY_TIMEOUT_MS';
+const DEFAULT_VERIFY_TIMEOUT_MS = 600000;
+const VERIFY_MAX_BUFFER = 16 * 1024 * 1024;
+const VERIFY_OUTPUT_LIMIT = 2000;
+
+function verifyTimeoutMs() {
+  const raw = Number(process.env[VERIFY_TIMEOUT_ENV]);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_VERIFY_TIMEOUT_MS;
+}
+
+// Full failure evidence for signature analysis (stdout and stderr both, in
+// full) - kept identical to ../index.mjs's inlined copy.
+function verificationEvidence(stdout, stderr) {
+  const out = String(stdout || '');
+  const err = String(stderr || '');
+  if (out && err) return `${out}\nstderr:\n${err}`;
+  return out || err;
+}
+
+// Bounded excerpt that keeps both ends (npm banner plus failure tail).
+function boundedDiagnostic(text, limit) {
+  const value = String(text || '');
+  if (value.length <= limit) return value;
+  const half = Math.floor(limit / 2);
+  return `${value.slice(0, half)}\n... [${value.length - half * 2} chars omitted] ...\n${value.slice(-half)}`;
+}
+
+// User-visible diagnostic: both streams get their own budget; a single
+// non-empty stream stays label-free.
+function verificationDiagnostic(stdout, stderr) {
+  const out = String(stdout || '');
+  const err = String(stderr || '');
+  if (out && err) {
+    const share = Math.floor(VERIFY_OUTPUT_LIMIT / 2);
+    return `stdout:\n${boundedDiagnostic(out, share)}\nstderr:\n${boundedDiagnostic(err, share)}`;
+  }
+  return boundedDiagnostic(out || err, VERIFY_OUTPUT_LIMIT);
+}
+
+function classifyVerificationError(error, startedAt, timeout) {
+  const code = String((error && error.code) || '');
+  const signal = String((error && error.signal) || '');
+  const exitCode = error && Number.isInteger(error.status) ? error.status : null;
+  const budgetExpired =
+    code === 'ETIMEDOUT' || (exitCode === null && Date.now() - startedAt >= timeout);
+  if (budgetExpired) return { outcome: 'timeout', exitCode, signal, timedOut: true };
+  if (exitCode === null || ['ENOBUFS', 'ENOENT', 'EACCES', 'EAGAIN', 'ENOMEM'].includes(code)) {
+    return { outcome: 'execution_error', exitCode, signal, timedOut: false };
+  }
+  return { outcome: 'test_failure', exitCode, signal, timedOut: false };
+}
+
 function runVerification(command) {
+  const timeout = verifyTimeoutMs();
+  const startedAt = Date.now();
   try {
-    execSync(command, { 
+    execSync(command, {
       stdio: 'pipe',
-      timeout: 60000 // 60 second timeout
+      timeout,
+      maxBuffer: VERIFY_MAX_BUFFER
     });
-    return { success: true, command };
+    return { success: true, command, outcome: 'pass', exitCode: 0, signal: null, timedOut: false };
   } catch (e) {
-    return { 
-      success: false, 
-      command,
-      error: e.message.slice(0, 200)
-    };
+    const stdout = (e.stdout || '').toString();
+    const stderr = (e.stderr || '').toString();
+    const output = verificationEvidence(stdout, stderr) || String((e && e.message) || '');
+    const { outcome, exitCode, signal, timedOut } = classifyVerificationError(e, startedAt, timeout);
+    let error;
+    if (outcome === 'timeout') {
+      error = `timed out after ${Math.round(timeout / 1000)}s (set ${VERIFY_TIMEOUT_ENV} to raise it)`;
+    } else if (outcome === 'execution_error') {
+      const reason = String((e && e.code) || (signal ? `signal ${signal}` : 'no exit status'));
+      error = `could not run to completion (execution error: ${reason}); output: ${output.slice(0, 200).replace(/\s+/g, ' ').trim() || '(none)'}`;
+    } else {
+      error = verificationDiagnostic(stdout, stderr) || String((e && e.message) || '');
+    }
+    const result = { success: false, command, outcome, exitCode, signal, timedOut, error };
+    if (outcome === 'test_failure' && output) result.evidence = output;
+    return result;
   }
 }
 
@@ -164,11 +236,13 @@ function main() {
     }
   }
   
-  // Update state
+  // Update state. The full `evidence` strings are analysis-only (they can
+  // approach VERIFY_MAX_BUFFER); persist just the bounded diagnostic so
+  // edit-state.json stays small.
   state.verificationPending = !allPassed;
   state.editsSinceVerification = allPassed ? 0 : state.editsSinceVerification;
   state.lastVerificationTime = Date.now();
-  state.verificationResults = results;
+  state.verificationResults = results.map(({ evidence, ...rest }) => rest);
   
   saveState(state);
   
@@ -179,7 +253,9 @@ function main() {
     allPassed,
     results: results.map(r => ({
       command: r.command,
-      success: r.success
+      success: r.success,
+      outcome: r.outcome,
+      timedOut: r.timedOut === true
     })),
     message: allPassed 
       ? 'All available verification passed. You can now complete.'