pan-wizard 3.27.0 → 3.28.0

package/scripts/release-check.js

@@ -3,7 +3,7 @@
  * release-check.js — Pre-publish validation gate.
  *
  * Wired into `prepublishOnly` so `npm publish` fails BEFORE upload if any
- * gate is red. Runs seven checks in order; first failure aborts.
+ * gate is red. Runs eight checks in order; first failure aborts.
  *
  *   1. build:hooks      — hook scripts copy/build cleanly
  *   2. test:all         — full test suite (unit + scenario) passes
@@ -57,7 +57,7 @@ function run(cmd, args, opts = {}) {
 }
 
 // Gate 1: build:hooks
-process.stderr.write('\n[release-check] Gate 1/7: build:hooks\n');
+process.stderr.write('\n[release-check] Gate 1/8: build:hooks\n');
 {
   const r = run('npm', ['run', 'build:hooks']);
   logGate('build:hooks', r.status === 0, r.status !== 0 ? `exit ${r.status}` : '');
@@ -65,7 +65,7 @@ process.stderr.write('\n[release-check] Gate 1/7: build:hooks\n');
 }
 
 // Gate 2: test:all
-process.stderr.write('\n[release-check] Gate 2/7: test:all\n');
+process.stderr.write('\n[release-check] Gate 2/8: test:all\n');
 {
   const r = run('npm', ['run', 'test:all']);
   logGate('test:all', r.status === 0, r.status !== 0 ? `exit ${r.status}` : '');
@@ -74,9 +74,9 @@ process.stderr.write('\n[release-check] Gate 2/7: test:all\n');
 
 // Gate 3: npm audit (production deps only)
 if (SKIP_AUDIT) {
-  process.stderr.write('\n[release-check] Gate 3/7: npm audit (SKIPPED)\n');
+  process.stderr.write('\n[release-check] Gate 3/8: npm audit (SKIPPED)\n');
 } else {
-  process.stderr.write('\n[release-check] Gate 3/7: npm audit --omit=dev\n');
+  process.stderr.write('\n[release-check] Gate 3/8: npm audit --omit=dev\n');
   const r = run('npm', ['audit', '--omit=dev', '--audit-level=high'], { capture: true });
   // npm audit exits non-zero on findings. We tolerate moderate; fail on high+.
   const ok = r.status === 0;
@@ -88,7 +88,7 @@ if (SKIP_AUDIT) {
 }
 
 // Gate 4: doc-lint counts on user-facing docs (count-SSoT enforcement)
-process.stderr.write('\n[release-check] Gate 4/7: doc-lint counts docs/\n');
+process.stderr.write('\n[release-check] Gate 4/8: doc-lint counts docs/\n');
 {
   const tools = path.join(REPO_ROOT, 'pan-wizard-core', 'bin', 'pan-tools.cjs');
   const docsDir = path.join(REPO_ROOT, 'docs');
@@ -103,7 +103,7 @@ process.stderr.write('\n[release-check] Gate 4/7: doc-lint counts docs/\n');
 
 // Gate 5: doc↔code link graph resolves (anti-fake — a doc cannot reference a
 // code anchor that doesn't exist; deterministic, self-enforcing exit 1).
-process.stderr.write('\n[release-check] Gate 5/7: links validate\n');
+process.stderr.write('\n[release-check] Gate 5/8: links validate\n');
 {
   const tools = path.join(REPO_ROOT, 'pan-wizard-core', 'bin', 'pan-tools.cjs');
   const r = run('node', [tools, 'links', 'validate', '--raw'], { capture: true });
@@ -125,16 +125,21 @@ process.stderr.write('\n[release-check] Gate 5/7: links validate\n');
 
 // Gate 6: npm pack — produces a non-empty, sanely-sized tarball (read the file,
 // never parse stdout)
-process.stderr.write('\n[release-check] Gate 6/7: npm pack (size sanity)\n');
+process.stderr.write('\n[release-check] Gate 6/8: npm pack (size sanity)\n');
 {
   const tmp6 = fs.mkdtempSync(path.join(os.tmpdir(), 'pan-release-pack-'));
   const r = run('npm', ['pack', '--pack-destination', tmp6], { capture: true });
   const tgz = r.status === 0 ? fs.readdirSync(tmp6).find(f => f.endsWith('.tgz')) : null;
   const size = tgz ? fs.statSync(path.join(tmp6, tgz)).size : 0;
   const sizeMB = (size / 1024 / 1024).toFixed(2);
+  // R8: "zero runtime dependencies" is a headline claim (README, COMPARISON.md); a
+  // dependency added by accident must turn the release red before it ships. The unit
+  // pin is tests/package-contract.test.cjs; this is the publish-time backstop.
+  const deps = Object.keys(require(path.join(REPO_ROOT, 'package.json')).dependencies || {});
+  const zeroDeps = deps.length === 0;
   // Sane = a non-empty tarball under 50MB (large for a zero-runtime-dep tool)
-  const ok = r.status === 0 && !!tgz && size > 0 && size < 50 * 1024 * 1024;
-  logGate('npm pack', ok, tgz ? `${sizeMB}MB tarball` : `no tarball (exit ${r.status})`);
+  const ok = r.status === 0 && !!tgz && size > 0 && size < 50 * 1024 * 1024 && zeroDeps;
+  logGate('npm pack', ok, (tgz ? `${sizeMB}MB tarball` : `no tarball (exit ${r.status})`) + (zeroDeps ? '' : `; runtime dependencies present: ${deps.join(', ')}`));
   fs.rmSync(tmp6, { recursive: true, force: true });
   if (!ok) {
     process.stderr.write((r.stderr || '') + '\n');
@@ -144,9 +149,9 @@ process.stderr.write('\n[release-check] Gate 6/7: npm pack (size sanity)\n');
 
 // Gate 7: smoke install — pack and install into temp dir, run pan-tools
 if (SKIP_SMOKE) {
-  process.stderr.write('\n[release-check] Gate 7/7: smoke install (SKIPPED)\n');
+  process.stderr.write('\n[release-check] Gate 7/8: smoke install (SKIPPED)\n');
 } else {
-  process.stderr.write('\n[release-check] Gate 7/7: smoke install (npm pack + install + sanity)\n');
+  process.stderr.write('\n[release-check] Gate 7/8: smoke install (npm pack + install + sanity)\n');
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pan-release-smoke-'));
   try {
     // Pack — read the .tgz npm writes to tmpDir; never parse its stdout (see note).
@@ -192,6 +197,47 @@ if (SKIP_SMOKE) {
   }
 }
 
+// Gate 8: distribution bundles — both plugin builders produce a manifest. Built into
+// temp dirs (never dist/) so the gate cannot race a concurrently running test and
+// leaves the checkout untouched. A bundle that fails to build is a release that
+// ships a broken marketplace entry.
+process.stderr.write('\n[release-check] Gate 8/8: distribution bundles (build:plugin + build:agent-plugin)\n');
+{
+  const tmp8 = fs.mkdtempSync(path.join(os.tmpdir(), 'pan-release-bundles-'));
+  try {
+    const claudeOut = path.join(tmp8, 'claude');
+    const agentOut = path.join(tmp8, 'agent');
+    const a = run('node', [path.join(REPO_ROOT, 'scripts', 'build-plugin.js')], { capture: true, env: { ...process.env, PAN_PLUGIN_OUT: claudeOut } });
+    const b = run('node', [path.join(REPO_ROOT, 'scripts', 'build-agent-plugin.js')], { capture: true, env: { ...process.env, PAN_AGENT_PLUGIN_OUT: agentOut } });
+    const okA = a.status === 0 && fs.existsSync(path.join(claudeOut, '.claude-plugin', 'plugin.json'));
+    const okB = b.status === 0 && fs.existsSync(path.join(agentOut, 'plugin.json')) && fs.existsSync(path.join(agentOut, 'mcp.json'));
+    // R10: .agents/plugins/marketplace.json (Codex) and .github/plugin/marketplace.json
+    // (Copilot) resolve to ./dist/pan-agent-plugin with no rebuild-on-resolve — unlike
+    // the Claude `command` source. A stale dist/ shipped silently on 2026-09-10 (built
+    // before the vendor-directory commit). Compare it with the fresh build when it
+    // exists; the gate stays read-only and never writes dist/.
+    let staleDetail = '';
+    const distAgent = path.join(REPO_ROOT, 'dist', 'pan-agent-plugin');
+    if (okB && fs.existsSync(distAgent)) {
+      const { dirDigest } = require(path.join(REPO_ROOT, 'bin', 'install-lib.cjs'));
+      if (dirDigest(distAgent) !== dirDigest(agentOut)) {
+        staleDetail = 'dist/pan-agent-plugin is STALE — run `npm run build:agent-plugin` (the Codex and Copilot marketplaces install from it)';
+      }
+    }
+    const ok8 = okA && okB && !staleDetail;
+    const detail = ok8
+      ? 'Claude plugin + Agent Plugins bundle built' + (fs.existsSync(distAgent) ? '; dist/pan-agent-plugin matches the fresh build' : '')
+      : staleDetail || `claude:${okA ? 'ok' : 'FAIL exit ' + a.status} agent-plugins:${okB ? 'ok' : 'FAIL exit ' + b.status}`;
+    logGate('distribution bundles', ok8, detail);
+    if (!ok8) {
+      process.stderr.write((a.stderr || '') + (b.stderr || '') + '\n');
+      process.exit(1);
+    }
+  } finally {
+    try { fs.rmSync(tmp8, { recursive: true, force: true }); } catch { /* best-effort */ }
+  }
+}
+
 // Summary
 process.stderr.write('\n[release-check] Summary:\n');
 for (const c of checks) {