pi-harness-runtime 1.1.435 → 1.1.437

package/scripts/guard-scan.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# Scan the whole checkout for a client name.
+#
+# The checks that run in CI look at what a pull request changes. This one
+# looks at everything: the files of the working tree, the paths of every
+# ref of the repository, and the commit messages of every ref. It is the
+# check to run when the question is "is this repository clean right now",
+# and the check to run before a release that was prepared outside of a
+# pull request.
+#
+# The list of terms comes from PI_SENSITIVE_TERMS_FILE or from
+# SENSITIVE_TERMS. Without a list the script says so and stops - a
+# machine that does not know the names cannot check for them, and a scan
+# that found nothing is not a scan that passed.
+#
+# The report names the file and the line and never the term.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+SCANNER="scripts/check-sensitive-terms.mjs"
+
+if [ ! -f "$SCANNER" ]; then
+	echo "guard: the scanner is missing at $SCANNER" >&2
+	exit 2
+fi
+
+# The list of terms, without printing it.
+if [ -n "${PI_SENSITIVE_TERMS_FILE:-}" ] && [ -f "${PI_SENSITIVE_TERMS_FILE:-}" ]; then
+	TERMS="$(cat "$PI_SENSITIVE_TERMS_FILE")"
+elif [ -n "${SENSITIVE_TERMS:-}" ]; then
+	TERMS="$SENSITIVE_TERMS"
+else
+	echo "guard: no list of terms. Set PI_SENSITIVE_TERMS_FILE or SENSITIVE_TERMS."
+	echo "guard: the scan did not run, so nothing was checked."
+	exit 2
+fi
+
+if [ -z "$TERMS" ]; then
+	echo "guard: the list of terms is empty. The scan did not run."
+	exit 2
+fi
+
+COUNT="$(node --input-type=module -e '
+import { readTermsFile, termsFromEnv } from "./scripts/check-sensitive-terms.mjs";
+const terms = process.env.PI_SENSITIVE_TERMS_FILE
+	? readTermsFile(process.env.PI_SENSITIVE_TERMS_FILE)
+	: termsFromEnv();
+console.log(terms.length);
+')"
+echo "guard: a list of ${COUNT} term(s)"
+
+STATUS=0
+
+# The working tree: the files and their paths.
+echo "guard: the files and the paths of the working tree"
+if ! node "$SCANNER" --tree .; then
+	STATUS=1
+fi
+
+# The commit messages of every ref. A message is public the moment the
+# commit is pushed, and GitHub builds the release notes from them.
+echo "guard: the commit messages of every ref"
+if ! node "$SCANNER" --commits --all; then
+	STATUS=1
+fi
+
+# The paths of every ref. A name in a path is a name in a link to the
+# repository, and the history of a path outlives the file.
+echo "guard: the paths of every ref"
+if ! node --input-type=module -e '
+import { execFileSync } from "node:child_process";
+import { pathHasTerm, termsFromEnv, redactTerms } from "./scripts/check-sensitive-terms.mjs";
+
+const terms = termsFromEnv();
+if (terms.length === 0) {
+	console.error("guard: no list of terms, so the paths were not checked.");
+	process.exit(2);
+}
+const output = execFileSync("git", ["log", "--all", "--name-only", "--pretty=format:"], {
+	encoding: "utf8",
+	maxBuffer: 64 * 1024 * 1024,
+});
+const paths = [...new Set(output.split("\n").map((line) => line.trim()).filter(Boolean))];
+const hits = paths.filter((path) => pathHasTerm(path, terms));
+for (const path of hits) {
+	console.log(`a path of the history holds a client name: ${redactTerms(path, terms)}`);
+}
+console.log(`guard: ${paths.length} path(s) of the history were checked`);
+process.exit(hits.length > 0 ? 1 : 0);
+'; then
+	STATUS=1
+fi
+
+if [ "$STATUS" -eq 0 ]; then
+	echo "guard: the repository holds no client name"
+else
+	echo "guard: a client name is in the repository. See the places above."
+fi
+exit "$STATUS"

package/scripts/release/adapters/node-workspace.ts

@@ -105,9 +105,7 @@ export const nodeWorkspaceAdapter: ReleaseAdapter = {
 
 		// Must have workspaces field
 		try {
-			const raw = JSON.parse(
-				readFileSync(rootPkg, "utf-8") as unknown as string,
-			);
+			const raw = JSON.parse(readFileSync(rootPkg, "utf-8"));
 			if (raw.workspaces) return 0.9;
 		} catch {
 			// ignore

package/scripts/release/orchestrator.ts

@@ -12,14 +12,20 @@
  * The orchestrator handles the git/npm plumbing.
  */
 
+// The imports below carry a `pi-lens-ignore` marker for TS5097. The language
+// server that reads this file still holds a project configuration that no
+// longer exists, and it reports the .ts specifiers as an error. The compiler
+// does not - `npx tsc -p scripts/release/tsconfig.json` is clean - and Node
+// needs the literal .ts specifiers, because its type stripping does not remap
+// a .js specifier to a .ts file.
 import { execSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve } from "path";
-import { detectStacks, formatProfile } from "./adapters/detector.ts";
-import { nodeWorkspaceAdapter } from "./adapters/node-workspace.ts";
-import { tauriAdapter } from "./adapters/tauri.ts";
-import { rustAdapter } from "./adapters/rust.ts";
-import { pythonAdapter } from "./adapters/python.ts";
+import { detectStacks, formatProfile } from "./adapters/detector.ts"; // pi-lens-ignore: ts:5097
+import { nodeWorkspaceAdapter } from "./adapters/node-workspace.ts"; // pi-lens-ignore: ts:5097
+import { tauriAdapter } from "./adapters/tauri.ts"; // pi-lens-ignore: ts:5097
+import { rustAdapter } from "./adapters/rust.ts"; // pi-lens-ignore: ts:5097
+import { pythonAdapter } from "./adapters/python.ts"; // pi-lens-ignore: ts:5097
 import type { AdapterContext, ReleaseAdapter } from "./adapters/base.ts";
 
 const ADAPTERS: ReleaseAdapter[] = [

package/scripts/release/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "types": ["node"],
+    "noEmit": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": ["./**/*.ts"]
+}

package/scripts/typecheck-packages.mjs

@@ -36,7 +36,8 @@ const BASELINES = new Map([
 	["voice-api", 16],
 	["worktree", 0],
 	["harness", 20],
-	["scripts", 15],
+	["scripts", 9],
+	["scripts/release", 0],
 	["root", 2],
 	["new-modules", 0],
 ]);
@@ -67,11 +68,16 @@ for (const name of readdirSync(packagesDir).sort()) {
 	const project = join(packagesDir, name, "tsconfig.json");
 	if (existsSync(project)) projects.push(relative(root, project));
 }
-for (const extra of ["harness", "scripts"]) {
+for (const extra of ["harness", "scripts/release"]) {
 	if (existsSync(join(root, extra, "tsconfig.json"))) {
 		projects.push(join(extra, "tsconfig.json"));
 	}
 }
+// The scripts of the repository are their own project, with a config
+// of their own at the root of the repository.
+if (existsSync(join(root, "tsconfig.scripts.json"))) {
+	projects.push("tsconfig.scripts.json");
+}
 // The root extension (index.ts) has no project of its own - it is the entry
 // point of the extension and was never type checked.
 if (existsSync(join(root, "tsconfig.root.json"))) {
@@ -92,9 +98,16 @@ function ownerOf(projectPath) {
 	const normalized = projectPath.split("\\").join("/");
 	if (normalized === "tsconfig.root.json") return "root";
 	if (normalized === "tsconfig.new-modules.json") return "new-modules";
+	if (normalized === "tsconfig.scripts.json") return "scripts";
 	if (normalized.startsWith("packages/")) {
 		return normalized.split("/")[1];
 	}
+	// A project in a folder of its own (the release sources in
+	// scripts/release) is a project of its own, and not the project of
+	// the folder that holds it.
+	if (normalized.endsWith("/tsconfig.json")) {
+		return normalized.slice(0, -"/tsconfig.json".length);
+	}
 	return normalized.split("/")[0];
 }
 

package/scripts/verify-package-contents.ts

@@ -36,6 +36,12 @@ import {
 	packageNameOf,
 	resolveRelativeImport,
 } from "./lib/runtime-imports.js";
+import {
+	readTermsFile,
+	redactTerms,
+	scanText,
+	termsFromEnv,
+} from "./check-sensitive-terms.mjs";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const verifyTarball = process.argv.includes("--pack");
@@ -48,7 +54,8 @@ interface Problem {
 		| "missing-tarball"
 		| "missing-package"
 		| "forbidden-path"
-		| "missing-plugin";
+		| "missing-plugin"
+		| "sensitive-content";
 	detail: string;
 }
 
@@ -221,6 +228,66 @@ function checkPackageLayout(): void {
 	}
 }
 
+/**
+ * The terms of the list, and where they came from.
+ *
+ * The list is the repository secret, or the local file. A run without a
+ * list scans nothing - and says so, because "no name was found" and
+ * "nothing was looked at" are not the same statement.
+ */
+function sensitiveTerms(): { terms: string[]; source: string } {
+	const fromEnv = termsFromEnv(process.env);
+	if (fromEnv.length > 0) return { terms: fromEnv, source: "the environment" };
+	const file = process.env.PI_SENSITIVE_TERMS_FILE;
+	if (file) {
+		const terms = readTermsFile(file);
+		if (terms.length > 0) return { terms, source: file };
+	}
+	return { terms: [], source: "none" };
+}
+
+/**
+ * The published files must not hold a client name.
+ *
+ * The other checks look at the paths of the published files. This one
+ * looks at what is inside them: a name in a comment, in a doc or in a
+ * string is published like any other byte, and npm keeps a published
+ * version for a long time - long enough that the removal of one becomes
+ * a support ticket.
+ *
+ * The report names the file and the line and never the term, and the
+ * path is printed with the terms hidden because a path is often the
+ * place the term is in.
+ */
+function checkSensitiveContent(files: string[]): void {
+	const { terms, source } = sensitiveTerms();
+	if (terms.length === 0) {
+		// Nothing was checked. The release workflow runs this check on
+		// its own, with the secret, and it fails closed.
+		console.log(
+			"[verify-package-contents] the sensitive content scan was skipped: no term list is configured",
+		);
+		return;
+	}
+	for (const file of files) {
+		let content: string;
+		try {
+			content = readFileSync(join(ROOT, file), "utf8");
+		} catch {
+			continue;
+		}
+		for (const found of scanText(content, file, terms)) {
+			problems.push({
+				kind: "sensitive-content",
+				detail: `${redactTerms(found.path, terms)}:${found.line} holds a term from the sensitive list`,
+			});
+		}
+	}
+	console.log(
+		`[verify-package-contents] the sensitive content scan looked at ${files.length} published file(s) with the list of ${source}`,
+	);
+}
+
 /**
  * The postinstall copies the plugin from the package root.
  *
@@ -596,6 +663,7 @@ if (publishedFiles.length === 0) {
 	});
 } else {
 	checkRelativeImports(publishedFiles);
+	checkSensitiveContent(publishedFiles);
 	if (verifyTarball) inspectTarball(publishedFiles);
 }
 

package/scripts/tsconfig.json

@@ -1,9 +0,0 @@
-{
-  "extends": "../tsconfig.base.json",
-  "compilerOptions": {
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "types": ["node"]
-  },
-  "include": ["./**/*.ts"]
-}