pantheon-opencode 1.5.0-beta.2 → 1.5.0-beta.3

package/scripts/package-evidence.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+/** Build and verify the single immutable npm package evidence artifact. */
+
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import { validateInventory } from './manifest-inventory.mjs'
+
+const CI_ARGS = ['ci', '--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund']
+const REQUIRED_PAYLOAD = [
+  'package/package.json',
+  'package/plugin.json',
+  'package/pyproject.toml',
+  'package/src/plugins/tui/package.json',
+  'package/src/plugins/tui/package-lock.json',
+  'package/src/plugin.ts',
+  'package/src/plugin-v2.ts',
+  'package/src/pantheon/v2-bridge.ts',
+  'package/src/plugins/tui/dist/tui.js',
+  'package/src/plugins/tui/dist/server.js',
+  'package/bin/pantheon-init.mjs',
+  'package/scripts/doctor.mjs',
+  'package/.pantheon/code-mode/compress-inline.py',
+]
+
+function fail(message) {
+  throw new Error(message)
+}
+
+function resolveTargetSha(root, supplied) {
+  const raw =
+    supplied ?? execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' })
+  const sha = String(raw).trim().toLowerCase()
+  if (!/^[0-9a-f]{40}$/.test(sha))
+    fail('target SHA must be a full lowercase 40-character hexadecimal SHA')
+  return sha
+}
+
+function createOutputDirectory(outputDir) {
+  const directory = outputDir ?? mkdtempSync(join(tmpdir(), 'pantheon-package-evidence-'))
+  mkdirSync(directory, { recursive: true })
+  if (readdirSync(directory).length !== 0) fail(`output directory must be empty: ${directory}`)
+  return { directory }
+}
+
+function packOnce(root, outputDir) {
+  const raw = execFileSync(
+    'npm',
+    ['pack', '--ignore-scripts', '--json', '--pack-destination', outputDir],
+    { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 },
+  )
+  let result
+  try {
+    result = JSON.parse(raw)
+  } catch (error) {
+    fail(`npm pack returned malformed JSON: ${error.message}`)
+  }
+  if (!Array.isArray(result) || result.length !== 1 || typeof result[0]?.filename !== 'string') {
+    fail('npm pack must produce exactly one JSON result')
+  }
+  const tgzFiles = readdirSync(outputDir).filter((name) => name.endsWith('.tgz'))
+  if (tgzFiles.length !== 1)
+    fail(`package evidence requires exactly one .tgz, found ${tgzFiles.length}`)
+  if (tgzFiles[0] !== result[0].filename)
+    fail('npm pack result does not identify the sole .tgz artifact')
+  return join(outputDir, tgzFiles[0])
+}
+
+function validateArchiveEntries(tarball) {
+  const listing = execFileSync('tar', ['-tzf', tarball], { encoding: 'utf8' })
+  const entries = listing.split('\n').filter(Boolean)
+  if (entries.length === 0) fail('package tarball is empty')
+  for (const entry of entries) {
+    const normalized = entry.replace(/\/$/, '')
+    const parts = normalized.split('/')
+    if (
+      isAbsolute(normalized) ||
+      normalized.includes('\\') ||
+      parts.includes('..') ||
+      (!normalized.startsWith('package/') && normalized !== 'package')
+    ) {
+      fail(`unsafe package archive entry: ${entry}`)
+    }
+  }
+  const detailed = execFileSync('tar', ['-tvzf', tarball], { encoding: 'utf8' })
+  for (const line of detailed.split('\n').filter(Boolean)) {
+    if (/^[lh]/i.test(line)) fail(`package archive contains a link entry: ${line}`)
+  }
+  return new Set(entries)
+}
+
+function extractSafely(tarball, workDir) {
+  const extractionRoot = join(workDir, 'extract')
+  mkdirSync(extractionRoot)
+  validateArchiveEntries(tarball)
+  execFileSync(
+    'tar',
+    ['-xzf', tarball, '--directory', extractionRoot, '--no-same-owner', '--no-same-permissions'],
+    { encoding: 'utf8' },
+  )
+  const realRoot = realpathSync(extractionRoot)
+  const walk = (current) => {
+    const stat = lstatSync(current)
+    if (stat.isSymbolicLink()) fail(`package archive extraction contains a symlink: ${current}`)
+    const resolved = realpathSync(current)
+    if (resolved !== realRoot && !resolved.startsWith(`${realRoot}/`)) {
+      fail(`package archive extraction escaped its temporary directory: ${current}`)
+    }
+    if (stat.isDirectory()) for (const name of readdirSync(current)) walk(join(current, name))
+  }
+  walk(extractionRoot)
+  return join(extractionRoot, 'package')
+}
+
+function validatePayload(packageRoot, inventory) {
+  for (const relativePath of REQUIRED_PAYLOAD) {
+    const path = join(packageRoot, relativePath.replace(/^package\//, ''))
+    if (!existsSync(path) || !lstatSync(path).isFile())
+      fail(`required package payload is missing: ${relativePath}`)
+  }
+  for (const document of inventory.documents) {
+    const { entry, path: sourcePath } = document
+    const packagedPath = join(packageRoot, entry.file)
+    if (entry.role === 'lock' && entry.file === 'package-lock.json' && !existsSync(packagedPath)) {
+      // npm-packlist excludes the package root lockfile by policy. It remains
+      // validated below as source evidence, but is not fabricated in the tgz.
+      continue
+    }
+    if (!existsSync(packagedPath) || !lstatSync(packagedPath).isFile())
+      fail(`versioned package payload is missing: package/${entry.file}`)
+    if (sha256(sourcePath) !== sha256(packagedPath))
+      fail(`published package payload differs from source: ${entry.file}`)
+  }
+}
+
+function collectLockfileEvidence(inventory, entries, packageRoot) {
+  return inventory.documents
+    .filter(({ entry }) => entry.role === 'lock')
+    .map(({ entry, data, path: sourcePath }) => {
+      const archivePath = `package/${entry.file}`
+      const packagedPath = join(packageRoot, entry.file)
+      const publishedInTarball = entries.has(archivePath)
+      return {
+        file: entry.file,
+        sourceSha256: sha256(sourcePath),
+        publishedSha256: publishedInTarball ? sha256(packagedPath) : null,
+        sourceName: data.name,
+        sourceVersion: data.version,
+        lockfileVersion: data.lockfileVersion,
+        parity: 'validated-against-manifest',
+        publishedInTarball,
+      }
+    })
+}
+
+function installProductionDependencies(root) {
+  // The root package-lock.json is source evidence only: npm-packlist omits it
+  // from the root of an npm package, so root ci must validate the source tree.
+  execFileSync('npm', CI_ARGS, { cwd: root, stdio: 'inherit' })
+  execFileSync('npm', CI_ARGS, {
+    cwd: join(root, 'src', 'plugins', 'tui'),
+    stdio: 'inherit',
+  })
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+export function createPackageEvidence(root, { outputDir, targetSha } = {}) {
+  const inventory = validateInventory(root)
+  const sha = resolveTargetSha(root, targetSha)
+  const output = createOutputDirectory(outputDir)
+  let workDir
+  try {
+    const tarball = packOnce(root, output.directory)
+    workDir = mkdtempSync(join(tmpdir(), 'pantheon-package-evidence-check-'))
+    const entries = validateArchiveEntries(tarball)
+    const packageRoot = extractSafely(tarball, workDir)
+    validatePayload(packageRoot, inventory)
+    installProductionDependencies(root)
+    const digest = sha256(tarball)
+    if (!/^[0-9a-f]{64}$/.test(digest)) fail('tarball SHA-256 is not lowercase 64-hex')
+    const metadata = {
+      version: inventory.sourceVersion,
+      targetSha: sha,
+      tarballSha256: digest,
+      tarball: tarball.split('/').at(-1),
+      lockfilePolicy: {
+        rootPackageLockfile: entries.has('package/package-lock.json')
+          ? 'published-by-npm-pack'
+          : 'omitted-by-npm-pack',
+        note: entries.has('package/package-lock.json')
+          ? 'npm pack published the root package-lock.json; lockfile parity is validated and recorded as source evidence, while tarball validation covers only the payload npm pack publishes.'
+          : 'npm pack omits the package root package-lock.json by policy; lockfile parity is validated and recorded as source evidence, while tarball validation covers only the payload npm pack publishes.',
+      },
+      lockfileEvidence: collectLockfileEvidence(inventory, entries, packageRoot),
+    }
+    writeFileSync(join(output.directory, 'metadata.json'), `${JSON.stringify(metadata, null, 2)}\n`)
+    writeFileSync(join(output.directory, 'version'), `${metadata.version}\n`)
+    writeFileSync(join(output.directory, 'target-sha'), `${metadata.targetSha}\n`)
+    writeFileSync(join(output.directory, 'tarball-sha256'), `${metadata.tarballSha256}\n`)
+    return { ...metadata, outputDir: output.directory, tarball }
+  } catch (error) {
+    rmSync(output.directory, { recursive: true, force: true })
+    throw error
+  } finally {
+    if (workDir) rmSync(workDir, { recursive: true, force: true })
+  }
+}
+
+function parseOptions(args) {
+  const options = {}
+  for (const arg of args) {
+    const match = /^--(output-dir|target-sha)=(.*)$/.exec(arg)
+    if (!match) fail(`unsupported package evidence option: ${arg}`)
+    options[match[1] === 'output-dir' ? 'outputDir' : 'targetSha'] = match[2]
+  }
+  return options
+}
+
+if (process.argv[1]?.endsWith('package-evidence.mjs')) {
+  try {
+    const evidence = createPackageEvidence(process.cwd(), parseOptions(process.argv.slice(2)))
+    console.log(JSON.stringify(evidence))
+  } catch (error) {
+    console.error(`package-evidence: ${error.message}`)
+    process.exit(1)
+  }
+}

package/scripts/release-beta-version.mjs

@@ -1,80 +1,81 @@
 #!/usr/bin/env node
-/** Compute and optionally apply the beta version for a release PR. */
+/**
+ * release-beta-version.mjs — beta version helpers.
+ *
+ * The beta version is committed in the manifests (package.json) and never
+ * computed at release time. `nextBetaVersion` advances the committed version:
+ *
+ *   X.Y.Z-beta.N  ->  X.Y.Z-beta.(N+1)     (stay on the current beta line)
+ *   X.Y.Z         ->  X.Y.(Z+1)-beta.1     (start a fresh beta line)
+ *
+ * `applyBetaVersion` writes an already-decided beta version into every
+ * manifest and is retained for recovery tooling. The legacy PR+SHA scheme
+ * (`X.Y.Z-beta.<pr>.<sha7>`) is accepted by validation for backward
+ * compatibility only; it is no longer generated.
+ */
 
-import { readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import {
+  SEMVER_PATTERN,
+  validateInventory,
+  writeInventoryVersion,
+} from './manifest-inventory.mjs'
 
-export const MANIFESTS = [
-  { file: 'package.json', kind: 'json' },
-  { file: 'pyproject.toml', kind: 'toml' },
-  { file: 'plugin.json', kind: 'json' },
-  { file: 'src/plugins/tui/package.json', kind: 'json' },
-]
-
-const STABLE = /^(\d+)\.(\d+)\.(\d+)$/
+const STABLE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
+// Current committed sequential beta line.
+const BETA_LINE = /^(\d+\.\d+\.\d+)-beta\.(\d+)$/
+// Legacy PR+SHA beta scheme, accepted for recovery only.
+const LEGACY_BETA =
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-beta\.[1-9]\d*\.[0-9a-f]{7}$/
+const BETA_RELEASE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-beta\.[1-9]\d*$/
 
 export function nextStableVersion(latest, intent = 'patch') {
-  const match = STABLE.exec(String(latest))
-  if (!match) throw new Error(`npm latest is not a stable semver: "${latest}"`)
-  const [major, minor, patch] = match.slice(1).map(Number)
+  const match = STABLE.exec(String(latest).trim())
+  if (!match) throw new Error(`latest is not a stable semver: "${latest}"`)
   if (!['patch', 'minor', 'major'].includes(intent)) {
     throw new Error(`release intent must be patch, minor, or major: "${intent}"`)
   }
+  const [major, minor, patch] = match.slice(1).map(Number)
   if (intent === 'major') return `${major + 1}.0.0`
   if (intent === 'minor') return `${major}.${minor + 1}.0`
   return `${major}.${minor}.${patch + 1}`
 }
 
-export function betaVersion(latest, intent, pr, sha) {
-  if (!/^\d+$/.test(String(pr)) || Number(pr) < 1) throw new Error(`invalid PR number: "${pr}"`)
-  const shortSha = String(sha).slice(0, 7)
-  if (!/^[0-9a-f]{7,}$/i.test(shortSha)) throw new Error(`invalid commit SHA: "${sha}"`)
-  return `${nextStableVersion(latest, intent)}-beta.${pr}.${shortSha}`
-}
+/**
+ * Next beta version derived from the committed manifest version.
+ *
+ * @param {string} current committed version (e.g. "1.5.0-beta.2")
+ * @returns {string} the next sequential beta (e.g. "1.5.0-beta.3")
+ */
+export function nextBetaVersion(current) {
+  const value = String(current).trim()
+  const line = BETA_LINE.exec(value)
+  if (line) return `${line[1]}-beta.${Number(line[2]) + 1}`
 
-function writeVersion(root, { file, kind }, version) {
-  const path = join(root, file)
-  const raw = readFileSync(path, 'utf8')
-  if (kind === 'toml') {
-    const updated = raw.replace(/^(version\s*=\s*")[^"]+("\s*)$/m, `$1${version}$2`)
-    if (updated === raw) throw new Error(`no version field in ${file}`)
-    writeFileSync(path, updated)
-    return
-  }
-  const content = JSON.parse(raw)
-  content.version = version
-  writeFileSync(path, `${JSON.stringify(content, null, 2)}\n`)
-}
+  const stable = STABLE.exec(value)
+  if (stable) return `${nextStableVersion(value, 'patch')}-beta.1`
 
-export function applyBetaVersion(root, version) {
-  for (const manifest of MANIFESTS) writeVersion(root, manifest, version)
-  // Keep npm's lockfile metadata consistent without changing dependency data.
-  const lockPath = join(root, 'package-lock.json')
-  const lock = JSON.parse(readFileSync(lockPath, 'utf8'))
-  lock.version = version
-  if (lock.packages?.['']) lock.packages[''].version = version
-  writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`)
+  // Any other prerelease (e.g. 1.5.0-rc.1): beta the next patch of its base.
+  const base = /^(\d+\.\d+\.\d+)-[0-9A-Za-z.-]+$/.exec(value)
+  if (!base) throw new Error(`cannot derive a beta version from: "${current}"`)
+  return `${nextStableVersion(base[1], 'patch')}-beta.1`
 }
 
-const args = new Map(
-  process.argv.slice(2).map((arg) => {
-    const [key, ...value] = arg.split('=')
-    return [key.replace(/^--/, ''), value.join('=')]
-  }),
-)
-
-if (args.has('latest')) {
-  try {
-    const version = betaVersion(
-      args.get('latest'),
-      args.get('intent') || 'patch',
-      args.get('pr'),
-      args.get('sha'),
+function validateReleaseVersion(version) {
+  if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {
+    throw new Error(`invalid release semver: "${version}"`)
+  }
+  if (!BETA_RELEASE.test(version) && !LEGACY_BETA.test(version)) {
+    throw new Error(
+      `release version must be <base>-beta.<N> or legacy <base>-beta.<pr>.<7-char-sha>: "${version}"`,
     )
-    if (args.has('apply')) applyBetaVersion(process.cwd(), version)
-    console.log(version)
-  } catch (error) {
-    console.error(`release-beta-version: ${error.message}`)
-    process.exit(1)
   }
 }
+
+/** Preflight all six entries, then update metadata only. */
+export function applyBetaVersion(root, version) {
+  validateReleaseVersion(version)
+  const inventory = validateInventory(root, { allowVersionDivergence: true })
+  writeInventoryVersion(inventory, version)
+  const after = validateInventory(root)
+  if (after.sourceVersion !== version) throw new Error('beta version post-write validation failed')
+}

package/scripts/sync-tui.mjs

@@ -124,8 +124,7 @@ try {
   // Source: TUI plugin inside the installed package
   const tuiSrcDir = join(ROOT, 'src', 'plugins', 'tui')
   if (!existsSync(tuiSrcDir)) {
-    // Source not found (shouldn't happen in a proper install)
-    process.exit(0)
+    throw new Error(`TUI plugin source not found: ${tuiSrcDir}`)
   }
 
   // Compare versions before copy
@@ -135,28 +134,8 @@ try {
   // Copy fresh files
   const { created } = copyPluginFiles(tuiSrcDir, tuiCopyDir)
 
-  // Refresh dependencies in the copy. npm install is only allowed when the
-  // operator explicitly opts into the non-deterministic legacy fallback.
-  try {
-    execSync('npm ci --omit=dev --no-audit --no-fund', { cwd: tuiCopyDir, stdio: 'pipe' })
-  } catch (err) {
-    if (process.env.PANTHEON_ALLOW_NPM_INSTALL_FALLBACK === '1') {
-      console.warn(`⚠️  npm ci failed; explicit fallback enabled: ${err.message}`)
-      try {
-        execSync('npm install --omit=dev --no-audit --no-fund --package-lock=false', {
-          cwd: tuiCopyDir,
-          stdio: 'pipe',
-        })
-      } catch (fallbackError) {
-        console.warn(`⚠️  TUI dependency refresh skipped: ${fallbackError.message}`)
-      }
-    } else {
-      console.warn(
-        `⚠️  TUI dependency refresh skipped after npm ci failure. Set ` +
-          `PANTHEON_ALLOW_NPM_INSTALL_FALLBACK=1 to explicitly allow npm install: ${err.message}`,
-      )
-    }
-  }
+  // Lockfile installation is the only accepted dependency path.
+  execSync('npm ci --omit=dev --no-audit --no-fund', { cwd: tuiCopyDir, stdio: 'pipe' })
 
   // Log result
   if (installedVersion && sourceVersion && installedVersion === sourceVersion && created === 0) {
@@ -167,7 +146,6 @@ try {
     )
   }
 } catch (err) {
-  // Postinstall scripts must never break npm install
-  console.warn(`⚠️  TUI sync skipped: ${err.message}`)
-  process.exit(0)
+  console.error(`❌ TUI sync failed: ${err.message}`)
+  process.exitCode = 1
 }