machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/scripts/generate-worker-types.mjs

@@ -1,19 +1,29 @@
-import { spawnSync } from "node:child_process";
-import { mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
+import { runCompletedWranglerCommand } from "./wrangler-command-lifecycle.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const target = resolve(root, ".wrangler", "worker-configuration.d.ts");
 const wrangler = resolve(root, "node_modules", "wrangler", "bin", "wrangler.js");
+export const WRANGLER_TYPES_COMPLETION_MARKER = "Remember to rerun 'wrangler types' after you change your ";
 
-mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
-const result = spawnSync(process.execPath, [wrangler, "types", target], {
-  cwd: root,
-  env: process.env,
-  stdio: "inherit",
-  windowsHide: true,
-});
-if (result.error) throw result.error;
-if (result.status !== 0) process.exit(result.status ?? 1);
+export async function runWranglerTypes(options = {}) {
+  const cwd = options.cwd || root;
+  const targetPath = options.targetPath || target;
+  const wranglerPath = options.wranglerPath || wrangler;
+  mkdirSync(dirname(targetPath), { recursive: true, mode: 0o700 });
+  rmSync(targetPath, { force: true });
+  await runCompletedWranglerCommand({
+    ...options,
+    cwd,
+    wranglerPath,
+    args: ["types", targetPath],
+    label: "wrangler types",
+    completionMarker: WRANGLER_TYPES_COMPLETION_MARKER,
+    completionCheck: () => existsSync(targetPath),
+  });
+}
+
+if (resolve(process.argv[1] || "") === fileURLToPath(import.meta.url)) await runWranglerTypes();

package/scripts/github-backlog.mjs

@@ -3,6 +3,9 @@
 import { spawnSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveTrustedGitExecutable } from "../src/local/trusted-git-executable.mjs";
+import { resolveTrustedGithubCli } from "../src/local/trusted-github-cli.mjs";
+import { releaseCommandFailure, releaseDiagnosticEvent } from "./release-diagnostic.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -27,13 +30,15 @@ export function backlogBlockers({ issues = [], pullRequests = [], branch = "", c
 export function assertGitHubBacklogReady(options = {}) {
   const run = options.run || runCommand;
   const cwd = options.cwd || root;
-  const branch = options.branch || output(run, "git", ["branch", "--show-current"], cwd);
+  const git = options.git || resolveTrustedGitExecutable({ workspace: cwd });
+  const gh = options.gh || resolveTrustedGithubCli({ workspace: cwd });
+  const branch = options.branch || output(run, git, ["branch", "--show-current"], cwd);
   if (!branch) throw new Error("cannot inspect GitHub backlog from a detached HEAD");
-  const commitMessages = output(run, "git", ["log", "--format=%B%x00", "origin/main..HEAD"], cwd);
-  const issueRows = pagedJson(output(run, "gh", [
+  const commitMessages = output(run, git, ["log", "--format=%B%x00", "origin/main..HEAD"], cwd);
+  const issueRows = pagedJson(output(run, gh, [
     "api", "--paginate", "--slurp", "repos/{owner}/{repo}/issues?state=open&per_page=100",
   ], cwd), "open GitHub issues");
-  const pullRows = pagedJson(output(run, "gh", [
+  const pullRows = pagedJson(output(run, gh, [
     "api", "--paginate", "--slurp", "repos/{owner}/{repo}/pulls?state=open&per_page=100",
   ], cwd), "open GitHub pull requests");
   const issues = issueRows
@@ -97,11 +102,7 @@ function runCommand(command, args, cwd) {
     windowsHide: true,
     shell: false,
   });
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    const detail = String(result.stderr || result.stdout || "").trim();
-    throw new Error(`${command} ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
-  }
+  if (result.error || result.status !== 0) throw new Error(releaseCommandFailure(command, args, result));
   return result;
 }
 
@@ -110,7 +111,7 @@ if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.ur
     const result = assertGitHubBacklogReady();
     console.log(result.message);
   } catch (error) {
-    console.error(`GitHub backlog gate failed: ${error?.message || error}`);
+    console.error(JSON.stringify(releaseDiagnosticEvent("github.backlog.failed", error?.message || error, 1200)));
     process.exit(1);
   }
 }

package/scripts/github-push.mjs

@@ -1,34 +1,65 @@
 #!/usr/bin/env node
 
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { verifyCurrentReleaseAcceptance } from "./release-acceptance.mjs";
 import { assertGitHubBacklogReady } from "./github-backlog.mjs";
+import { parseReleaseVersion, requiresSoakForStable } from "./release-channel.mjs";
+import { verifyCurrentStableSoak } from "./release-soak.mjs";
+import { resolveTrustedGitExecutable } from "../src/local/trusted-git-executable.mjs";
+import { resolveTrustedGithubCli } from "../src/local/trusted-github-cli.mjs";
+import { createHardenedNpmSession } from "./hardened-npm-session.mjs";
+import { runNetworkCommand } from "./network-retry.mjs";
+import { releaseCommandFailure, releaseDiagnostic, releaseDiagnosticEvent } from "./release-diagnostic.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const git = resolveTrustedGitExecutable({ workspace: root });
+const gh = resolveTrustedGithubCli({ workspace: root });
 
 try {
-  const status = output("git", ["status", "--porcelain"]);
-  if (status) throw new Error(`working tree is not clean:\n${status}`);
-  const branch = output("git", ["branch", "--show-current"]);
+  const status = output(git, ["status", "--porcelain"]);
+  if (status) throw new Error(`working tree is not clean: ${releaseDiagnostic(status, 1000)}`);
+  const branch = output(git, ["branch", "--show-current"]);
   if (!branch) throw new Error("cannot push from a detached HEAD");
   if (branch === "main") throw new Error("direct pushes to main are prohibited; push a reviewed branch and merge through a pull request");
-  run("git", ["fetch", "origin", "main", "--prune"]);
-  const backlog = assertGitHubBacklogReady({ cwd: root, branch });
+  runNetwork(git, ["fetch", "origin", "main", "--prune"]);
+  const backlog = assertGitHubBacklogReady({ cwd: root, branch, git, gh, run: runBacklogCommand });
   console.log(backlog.message);
 
-  const acceptance = verifyCurrentReleaseAcceptance(root);
-  if (acceptance.required) {
-    const path = `release-acceptance/v${acceptance.metadata.package_version}.json`;
-    run("git", ["ls-files", "--error-unmatch", path], { capture: true });
-    console.log(`Verified interactive local candidate acceptance for ${acceptance.metadata.filename}.`);
+  const npmSession = await createHardenedNpmSession();
+  let verificationError = null;
+  try {
+    const acceptance = verifyCurrentReleaseAcceptance(root, { npmCli: npmSession.cli, env: process.env });
+    if (acceptance.required) {
+      const path = `release-acceptance/v${acceptance.metadata.package_version}.json`;
+      run(git, ["ls-files", "--error-unmatch", path], { capture: true });
+      console.log(`Verified local candidate acceptance for ${acceptance.metadata.filename}.`);
+    }
+
+    const releaseVersion = parseReleaseVersion(JSON.parse(readFileSync(resolve(root, "package.json"), "utf8")).version);
+    if (!releaseVersion.prerelease && requiresSoakForStable(releaseVersion.raw)) {
+      const soak = verifyCurrentStableSoak(root, { npmCli: npmSession.cli });
+      const path = `release-soak/v${releaseVersion.raw}.json`;
+      run(git, ["ls-files", "--error-unmatch", path], { capture: true });
+      console.log(`Verified stable promotion from soaked ${soak.record.prerelease_version}.`);
+    }
+  } catch (error) {
+    verificationError = error;
+  }
+  let npmCleanupError = null;
+  try { npmSession.dispose(); } catch (error) { npmCleanupError = error; }
+  if (verificationError && npmCleanupError) {
+    throw new AggregateError([verificationError, npmCleanupError], "GitHub push verification failed and hardened npm cleanup was incomplete");
   }
+  if (verificationError) throw verificationError;
+  if (npmCleanupError) throw npmCleanupError;
 
-  run("git", ["push", "--set-upstream", "origin", "HEAD"]);
+  runNetwork(git, ["push", "--set-upstream", "origin", "HEAD"]);
   console.log(`Pushed accepted branch ${branch} to origin.`);
 } catch (error) {
-  console.error(`GitHub push blocked: ${error?.message || error}`);
+  console.error(JSON.stringify(releaseDiagnosticEvent("github.push.blocked", error?.message || error, 1200)));
   process.exit(1);
 }
 
@@ -42,12 +73,27 @@ function run(command, args, options = {}) {
     encoding: "utf8",
     env: process.env,
     stdio: options.capture ? "pipe" : "inherit",
+    timeout: 30_000,
+    killSignal: "SIGKILL",
+    maxBuffer: 8 * 1024 * 1024,
     windowsHide: true,
   });
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    const detail = options.capture ? String(result.stderr || result.stdout).trim() : "";
-    throw new Error(`${command} ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  if (result.error || result.status !== 0) {
+    throw new Error(releaseCommandFailure(command, args, options.capture ? result : { ...result, stdout: "", stderr: "" }));
   }
   return result;
 }
+
+function runNetwork(command, args) {
+  const result = runNetworkCommand(command, args, { cwd: root, env: process.env, timeoutMs: 120_000 });
+  if (result.error || result.status !== 0) throw new Error(releaseCommandFailure(command, args, result));
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  return result;
+}
+
+function runBacklogCommand(command, args, cwd) {
+  const result = runNetworkCommand(command, args, { cwd, env: process.env, timeoutMs: 120_000 });
+  if (result.error || result.status !== 0) throw new Error(releaseCommandFailure(command, args, result));
+  return result;
+}

package/scripts/github-release-asset.mjs

@@ -0,0 +1,58 @@
+export function githubReleaseByTagEndpoint(tag) {
+  const value = String(tag || "");
+  if (!/^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value)) {
+    throw new Error("GitHub release asset lookup requires a valid version tag");
+  }
+  return `repos/{owner}/{repo}/releases/tags/${encodeURIComponent(value)}`;
+}
+
+export function normalizeGithubReleaseAsset(value, options = {}) {
+  const tag = String(options.tag || "");
+  const assetName = String(options.assetName || "");
+  const expectedSha256 = String(options.expectedSha256 || "");
+  if (!tag || !assetName || !/^[0-9a-f]{64}$/.test(expectedSha256)) {
+    throw new Error("GitHub release asset verification requires tag, asset name, and SHA-256");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("GitHub release asset response is invalid");
+  }
+  if (String(value.tag_name || "") !== tag) throw new Error(`GitHub release response does not match ${tag}`);
+  if (!Array.isArray(value.assets)) throw new Error("GitHub release asset inventory is unavailable");
+  const matches = value.assets.filter((entry) => entry && typeof entry === "object" && entry.name === assetName);
+  if (matches.length !== 1) throw new Error(`GitHub release must contain exactly one ${assetName} asset`);
+  const asset = matches[0];
+  const size = Number(asset.size);
+  if (!Number.isSafeInteger(size) || size < 1) throw new Error("GitHub release package asset size is invalid");
+  const digest = String(asset.digest || "");
+  const expectedDigest = `sha256:${expectedSha256}`;
+  if (digest !== expectedDigest) throw new Error("GitHub release package asset SHA-256 does not match the accepted candidate");
+  return Object.freeze({
+    name: assetName,
+    size,
+    digest,
+    sha256: expectedSha256,
+  });
+}
+
+export async function waitForGithubReleaseAsset(readRelease, options = {}) {
+  if (typeof readRelease !== "function") throw new TypeError("GitHub release asset convergence requires a release reader");
+  const attempts = Number.isSafeInteger(Number(options.attempts))
+    ? Math.min(Math.max(Number(options.attempts), 1), 10)
+    : 5;
+  const wait = typeof options.wait === "function" ? options.wait : defaultAssetWait;
+  let lastError = null;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      const release = await readRelease();
+      return normalizeGithubReleaseAsset(release, options);
+    } catch (error) {
+      lastError = error;
+    }
+    if (attempt < attempts) await wait(attempt);
+  }
+  throw lastError || new Error("GitHub release asset did not converge");
+}
+
+function defaultAssetWait(attempt) {
+  return new Promise((resolvePromise) => { setTimeout(resolvePromise, Math.min(4_000, attempt * 1_000)); });
+}