mandrel-platform 1.2.0 → 1.4.0

package/scripts/audit-check.test.mjs

@@ -30,7 +30,7 @@
 
 import assert from "node:assert/strict";
 import { test } from "node:test";
-import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -43,6 +43,9 @@ import {
   parseArgs,
   loadAllowlist,
   runCli,
+  isBoundedOverride,
+  findUnboundedOverrides,
+  lintOverrides,
 } from "./audit-check.mjs";
 
 const TODAY = "2026-07-02";
@@ -456,3 +459,381 @@ test("loadAllowlist: non-array throws", () => {
     rmSync(dir, { recursive: true, force: true });
   }
 });
+
+// ---------------------------------------------------------------------------
+// Unbounded dependency overrides (Story #365)
+//
+// The failure these close: nothing lints for an unbounded override. Written as
+// a bare lower bound it rewrites a dependent's range open-endedly, leaving the
+// committed lockfile as the only pin — so any fresh resolution re-picks the
+// newest release and can cross a major. Two consumers derived this rule
+// independently after a major jump silently emptied a test suite, and both
+// then found further already-escaped overrides.
+// ---------------------------------------------------------------------------
+
+test("isBoundedOverride: a bare lower bound is unbounded; a capped range is not", () => {
+  for (const unbounded of [">=1.2.3", "> 1.2.3", ">=0", "*", "x", "latest", "", "   "]) {
+    assert.equal(isBoundedOverride(unbounded), false, `${JSON.stringify(unbounded)} is unbounded`);
+  }
+  for (const bounded of ["1.2.3", "^1.2.3", "~1.2.3", "1.2.x", ">=1.2.3 <2.0.0", "<2.0.0"]) {
+    assert.equal(isBoundedOverride(bounded), true, `${JSON.stringify(bounded)} is bounded`);
+  }
+});
+
+// The wildcard truth table (Story #375).
+//
+// The shipped regex enumerated only some wildcard spellings, so `x.x.x` and
+// `x.x` — the exact shape the lint exists to catch, and what npm reads as
+// plain `*` — fell through the catch-all and were reported bounded. The
+// deciding question is the MAJOR position: a wildcard there is open to every
+// future release, while a wildcard below it (`1.2.x`, `1.*`) stays inside its
+// major and is genuinely bounded. Every spelling is enumerated so the next
+// regex tweak has to keep answering all of them.
+const WILDCARD_TRUTH_TABLE = [
+  ["*", false],
+  ["x", false],
+  ["X", false],
+  ["*.*", false],
+  ["x.x", false],
+  ["X.X", false],
+  ["*.*.*", false],
+  ["x.x.x", false],
+  ["X.X.X", false],
+  ["x.*", false],
+  ["*.x.x", false],
+  ["x.2.3", false],
+  ["*.x", false],
+  ["latest", false],
+  ["next", false],
+  ["LATEST", false],
+  ["NEXT", false],
+  ["1.x", true],
+  ["1.X", true],
+  ["1.*", true],
+  ["1.2.x", true],
+  ["1.2.*", true],
+];
+
+test("AC-1/AC-4: every wildcard spelling is judged on its major position", () => {
+  for (const [spec, expected] of WILDCARD_TRUTH_TABLE) {
+    assert.equal(
+      isBoundedOverride(spec),
+      expected,
+      `${JSON.stringify(spec)} should be bounded=${expected}`,
+    );
+  }
+});
+
+test("AC-2: a non-registry specifier expresses no upper bound", () => {
+  // Each of these re-resolves to whatever the source holds at install time —
+  // a branch head, a workspace sibling, a path — so none of them is a range
+  // the lint can call bounded.
+  for (const spec of [
+    "github:owner/repo",
+    "github:owner/repo#v1.2.3",
+    "git+https://github.com/owner/repo.git",
+    "git+ssh://git@github.com/owner/repo.git#main",
+    "git://github.com/owner/repo.git",
+    "workspace:*",
+    "workspace:^",
+    "file:../local-pkg",
+    "link:../local-pkg",
+    "https://example.com/pkg-1.2.3.tgz",
+  ]) {
+    assert.equal(
+      isBoundedOverride(spec),
+      false,
+      `${JSON.stringify(spec)} pins nothing`,
+    );
+  }
+});
+
+test("AC-2: a git specifier carrying #semver: is judged on that range", () => {
+  assert.equal(
+    isBoundedOverride("git+https://github.com/owner/repo.git#semver:^1.2.3"),
+    true,
+  );
+  assert.equal(isBoundedOverride("github:owner/repo#semver:>=1.2.3"), false);
+});
+
+test("AC-3: a range carrying an explicit upper bound stays bounded", () => {
+  for (const bounded of [
+    "1.2.3",
+    "=1.2.3",
+    "^1.2.3",
+    "~1.2.3",
+    ">=1.2.3 <2.0.0",
+    "<2.0.0",
+    "1.2.3 - 2.0.0",
+  ]) {
+    assert.equal(
+      isBoundedOverride(bounded),
+      true,
+      `${JSON.stringify(bounded)} is bounded`,
+    );
+  }
+});
+
+test("AC-3: a wildcard LOWER end still counts as bounded when the range caps it", () => {
+  // The wildcard test asks about the major position, so it may only be applied
+  // to a single bare token. Applied to a compound range it read the first
+  // dot-segment of the whole string and called `x.x <2.0.0` unbounded — a
+  // range that plainly carries an upper bound — while the equivalent
+  // `* <2.0.0` passed, because its first segment is `* <2`. That
+  // self-inconsistency is the tell: it was an artifact of check ordering.
+  for (const bounded of [
+    "x.x <2.0.0",
+    "x.x.x <2.0.0",
+    "* <2.0.0",
+    "x.x.x - 2.0.0",
+    "x - 2.0.0",
+    "* - 2.0.0",
+  ]) {
+    assert.equal(
+      isBoundedOverride(bounded),
+      true,
+      `${JSON.stringify(bounded)} is bounded`,
+    );
+  }
+});
+
+// Residual fail-opens left open by the dotted-wildcard fix. Both classes reach
+// the catch-all `return true` and so read as bounded while pinning nothing.
+//
+// Class 1 — an operator in front of the wildcard. The wildcard test is gated on
+// a single BARE token, so any leading range operator defeats it: `^x.x.x` is
+// `^` applied to "any version", which is still any version.
+const OPERATOR_PREFIXED_WILDCARDS = [
+  ["^x.x.x", false],
+  ["^x.x", false],
+  ["^x", false],
+  ["^*", false],
+  ["~*", false],
+  ["~x.x.x", false],
+  ["=x.x.x", false],
+  ["=*", false],
+  ["=X.X", false],
+  ["^latest", false],
+  // The same operators over a real version are untouched — this is the
+  // near-miss the fix must not break.
+  ["^1.2.3", true],
+  ["~1.2.3", true],
+  ["=1.2.3", true],
+  ["^1.x", true],
+  ["~1.2.x", true],
+];
+
+test("operator-prefixed wildcards are unbounded, real versions unaffected", () => {
+  for (const [spec, expected] of OPERATOR_PREFIXED_WILDCARDS) {
+    assert.equal(
+      isBoundedOverride(spec),
+      expected,
+      `${JSON.stringify(spec)} should be bounded=${expected}`,
+    );
+  }
+});
+
+test("a compound whose every term is a wildcard or bare lower bound is unbounded", () => {
+  // Class 2 — a wildcard lower with no upper bound anywhere. `x.x >=1.0.0`
+  // reads as a range only because it is spelled like one; both terms are open
+  // above, so the resolved set is still "every future release".
+  for (const unbounded of [
+    "x.x >=1.0.0",
+    "x.x.x >=1.0.0",
+    "* >=1.0.0",
+    "x.x >1.0.0",
+    ">=1.0.0 x.x",
+    "x.x - x.x",
+    "x.x.x - *",
+    "* - x",
+    "1.0.0 - x.x.x",
+  ]) {
+    assert.equal(
+      isBoundedOverride(unbounded),
+      false,
+      `${JSON.stringify(unbounded)} carries no upper bound`,
+    );
+  }
+});
+
+test("a malformed hyphen range carrying a comparator still fails closed", () => {
+  // A real hyphen range takes plain versions on both sides. Reading the
+  // right-hand side of `>=1.0.0 - 2.0.0` as the cap answers a range npm never
+  // agreed to parse, and turns a spec that failed closed into one that passes
+  // — the exact fail-open direction this lint exists to prevent.
+  for (const unbounded of [">=1.0.0 - 2.0.0", ">=1.0.0 - ^2.0.0", ">1.0.0 - 2.0.0"]) {
+    assert.equal(
+      isBoundedOverride(unbounded),
+      false,
+      `${JSON.stringify(unbounded)} is not a hyphen range and must fail closed`,
+    );
+  }
+});
+
+test("a real upper bound still closes a range with a wildcard lower", () => {
+  // The regression guard for the trap the dotted-wildcard fix already hit once:
+  // testing the wildcard against the whole specifier called these unbounded.
+  // An upper bound is an upper bound regardless of how loose the lower end is.
+  for (const bounded of [
+    "x.x <2.0.0",
+    "x.x.x - 2.0.0",
+    "* <=2.0.0",
+    "x.x >=1.0.0 <2.0.0",
+    "^x.x.x - 2.0.0",
+  ]) {
+    assert.equal(
+      isBoundedOverride(bounded),
+      true,
+      `${JSON.stringify(bounded)} carries a real upper bound`,
+    );
+  }
+});
+
+test("isBoundedOverride: a || union is only as bounded as its loosest arm", () => {
+  assert.equal(isBoundedOverride("^1.0.0 || ^2.0.0"), true);
+  assert.equal(isBoundedOverride("^1.0.0 || >=2.0.0"), false);
+});
+
+test("isBoundedOverride: an npm: alias is judged on the range it carries", () => {
+  assert.equal(isBoundedOverride("npm:other-pkg@^1.2.3"), true);
+  assert.equal(isBoundedOverride("npm:@scope/other@^1.2.3"), true);
+  assert.equal(isBoundedOverride("npm:other-pkg@>=1.2.3"), false);
+  // An alias with no range at all pins nothing.
+  assert.equal(isBoundedOverride("npm:other-pkg"), false);
+});
+
+test("AC-5: findUnboundedOverrides names the package and the bound", () => {
+  const findings = findUnboundedOverrides({
+    pnpm: { overrides: { "left-pad": ">=1.3.0", semver: "^7.5.2" } },
+  });
+  assert.equal(findings.length, 1);
+  assert.equal(findings[0].package, "left-pad");
+  assert.equal(findings[0].bound, ">=1.3.0");
+  assert.equal(findings[0].field, "pnpm.overrides");
+});
+
+test("AC-5: every override field is checked, npm and pnpm and yarn alike", () => {
+  const findings = findUnboundedOverrides({
+    overrides: { a: ">=1.0.0" },
+    resolutions: { b: "*" },
+    pnpm: { overrides: { c: ">2" } },
+  });
+  assert.deepEqual(
+    findings.map((f) => `${f.field}.${f.package}`).sort(),
+    ["overrides.a", "pnpm.overrides.c", "resolutions.b"],
+  );
+});
+
+test("AC-5: a nested (dependent-scoped) override is named by its full path", () => {
+  const findings = findUnboundedOverrides({
+    overrides: { "some-dep": { "left-pad": ">=1.3.0" } },
+  });
+  assert.equal(findings.length, 1);
+  assert.equal(findings[0].package, "some-dep.left-pad");
+  assert.equal(findings[0].bound, ">=1.3.0");
+});
+
+test("AC-6: an override that pins a bounded range passes", () => {
+  assert.deepEqual(
+    findUnboundedOverrides({
+      overrides: { a: "^1.2.3", b: "~2.0.0", c: "3.1.4", d: ">=1.0.0 <2.0.0" },
+      pnpm: { overrides: { e: "1.2.x" } },
+    }),
+    [],
+  );
+});
+
+test("findUnboundedOverrides: a package.json with no overrides at all is clean", () => {
+  assert.deepEqual(findUnboundedOverrides({ name: "x", dependencies: { a: ">=1.0.0" } }), []);
+  assert.deepEqual(findUnboundedOverrides(null), []);
+  assert.deepEqual(findUnboundedOverrides("not-an-object"), []);
+});
+
+test("AC-5: runCli fails on an unbounded override before pnpm ever runs", () => {
+  const dir = mkdtempSync(join(tmpdir(), "audit-check-override-"));
+  try {
+    const packageJsonPath = join(dir, "package.json");
+    writeFileSync(
+      packageJsonPath,
+      JSON.stringify({ name: "fixture", pnpm: { overrides: { "left-pad": ">=1.3.0" } } }),
+    );
+    // An absent allowlist keeps this case about the override and nothing else.
+    const exit = runCli([
+      "--package-json",
+      packageJsonPath,
+      "--allowlist",
+      join(dir, "no-such-allowlist.json"),
+    ]);
+    assert.equal(exit, 1);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("AC-6: the override gate passes a bounded override, reaching the audit", () => {
+  // Executes the clean path rather than asserting around it. lintOverrides is
+  // the gate runCli delegates to, split out precisely so a PASS is provable
+  // without `pnpm audit` (which needs a real lockfile and a network).
+  const dir = mkdtempSync(join(tmpdir(), "audit-check-bounded-"));
+  try {
+    const packageJsonPath = join(dir, "package.json");
+    writeFileSync(
+      packageJsonPath,
+      JSON.stringify({
+        name: "fixture",
+        overrides: { a: "^1.3.0", b: ">=1.0.0 <2.0.0" },
+        pnpm: { overrides: { "left-pad": "~1.3.0" } },
+      }),
+    );
+    assert.equal(lintOverrides(packageJsonPath), 0);
+    assert.equal(parseArgs(["--package-json", packageJsonPath]).packageJsonPath, packageJsonPath);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("AC-5: the override gate blocks an unbounded override", () => {
+  const dir = mkdtempSync(join(tmpdir(), "audit-check-lint-"));
+  try {
+    const packageJsonPath = join(dir, "package.json");
+    writeFileSync(packageJsonPath, JSON.stringify({ overrides: { "left-pad": ">=1.3.0" } }));
+    assert.equal(lintOverrides(packageJsonPath), 1);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("the override gate is a no-op when there is no package.json to read", () => {
+  assert.equal(lintOverrides(join(tmpdir(), "audit-check-absent-xyz", "package.json")), 0);
+});
+
+test("this repo's own package.json passes the override gate", () => {
+  // The lint ships enabled by default; a false positive here would red the
+  // platform's own required check on every PR.
+  assert.deepEqual(findUnboundedOverrides(JSON.parse(readFileSync("package.json", "utf8"))), []);
+});
+
+test("runCli: an unparseable package.json is a hard error, not a skipped check", () => {
+  const dir = mkdtempSync(join(tmpdir(), "audit-check-badpkg-"));
+  try {
+    const packageJsonPath = join(dir, "package.json");
+    writeFileSync(packageJsonPath, "{ not json");
+    assert.equal(
+      runCli([
+        "--package-json",
+        packageJsonPath,
+        "--allowlist",
+        join(dir, "no-such-allowlist.json"),
+      ]),
+      1,
+    );
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("parseArgs defaults the package.json path alongside the allowlist path", () => {
+  const { allowlistPath, packageJsonPath } = parseArgs([], "/tmp/proj");
+  assert.equal(allowlistPath, "/tmp/proj/audit-allowlist.json");
+  assert.equal(packageJsonPath, "/tmp/proj/package.json");
+});

package/scripts/check-affected-mode.test.mjs

@@ -40,45 +40,18 @@ import { join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { tmpdir } from "node:os";
 
+import { stepByName, runScript } from "./lib/yaml-step.mjs";
+
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const WORKFLOW = ".github/workflows/pr-quality.yml";
 const content = readFileSync(join(repoRoot, WORKFLOW), "utf8");
 
 // ---------------------------------------------------------------------------
-// Minimal indentation-based extraction (dependency-free, mirrors
-// check-ci-required-aggregator.test.mjs). A step spans from its `- ` bullet to
-// the next sibling bullet at the same indent (or a dedent below it).
+// Local extraction helper. Step-block and `run:` extraction are shared via
+// scripts/lib/yaml-step.mjs; only the `if:` reader is specific to this suite,
+// which is the only one asserting on step gating.
 // ---------------------------------------------------------------------------
 
-function stepByName(text, name) {
-  const lines = text.split("\n");
-  const nameIdx = lines.findIndex((l) => /^\s+(- )?name:\s/.test(l) && l.includes(name));
-  assert.notEqual(nameIdx, -1, `step "${name}" not found`);
-  let start = -1;
-  for (let i = nameIdx; i >= 0; i--) {
-    if (/^\s*-\s/.test(lines[i])) {
-      start = i;
-      break;
-    }
-  }
-  assert.notEqual(start, -1, `opening bullet for step "${name}" not found`);
-  const bulletIndent = lines[start].match(/^(\s*)/)[1].length;
-  let end = lines.length;
-  for (let i = start + 1; i < lines.length; i++) {
-    if (/^\s*$/.test(lines[i])) continue;
-    const indent = lines[i].match(/^(\s*)/)[1].length;
-    if (indent < bulletIndent) {
-      end = i;
-      break;
-    }
-    if (indent === bulletIndent && /^\s*-\s/.test(lines[i])) {
-      end = i;
-      break;
-    }
-  }
-  return lines.slice(start, end).join("\n");
-}
-
 /** The (first) `if:` expression on a step block, trimmed. */
 function ifCondition(stepBlock) {
   const m = stepBlock.match(/^\s+if:\s*(.+?)\s*$/m);
@@ -86,25 +59,6 @@ function ifCondition(stepBlock) {
   return m[1].trim();
 }
 
-/** The dedented body of the step's `run: |` block scalar. */
-function runScript(stepBlock) {
-  const lines = stepBlock.split("\n");
-  const start = lines.findIndex((l) => /^\s+run:\s*\|\s*$/.test(l));
-  assert.notEqual(start, -1, "`run: |` block not found");
-  const runIndent = lines[start].match(/^(\s*)/)[1].length;
-  const body = [];
-  for (let i = start + 1; i < lines.length; i++) {
-    if (/^\s*$/.test(lines[i])) {
-      body.push("");
-      continue;
-    }
-    const indent = lines[i].match(/^(\s*)/)[1].length;
-    if (indent <= runIndent) break;
-    body.push(lines[i].slice(runIndent + 2));
-  }
-  return body.join("\n");
-}
-
 // ---------------------------------------------------------------------------
 // 1. GATING — coverage-gate steps gated OUT of affected mode; bypass step gated IN
 // ---------------------------------------------------------------------------