pm-ops 2026.8.31 → 2026.9.2

package/CHANGELOG.md

@@ -1,11 +1,59 @@
 # Changelog
 
+## Unreleased
+
+### Fixed
+
+- Repaired the ops-5jp6 history drift that had blocked two stacked release pull requests ([ops-yxej](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-yxej.toon))
+
+### Security
+
+- Four more fail modes in the canonical gate: an arm pattern read as an opener, an escaped run key read as data, a sequence marker missing from the indent, and composite actions unscanned ([ops-cxrx](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-cxrx.toon))
+- Attributing a case arm label by presence rather than position refused an attested publish, and a quoted key hid a phantom one ([ops-setc](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-setc.toon))
+- An arm that opens a nested case skipped the sibling reset, so a publish could borrow a flag from a mutually exclusive arm ([ops-rsbn](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-rsbn.toon))
+
+## 2026.9.2 - 2026-09-02
+
+### Added
+
+- Publish the canonical attestation scanner as pm-ops exports ([ops-4b34](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/features/ops-4b34.toon))
+- A release-completeness gate that requires every release tag to have a matching npm version and GitHub Release ([ops-i8yp](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/features/ops-i8yp.toon))
+
+### Fixed
+
+- A case opener sharing its first arm cleared the outer scope and refused a genuinely attested publish ([ops-cout](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-cout.toon))
+- Three shell-scope and quoting fail-opens attest unproven npm publishes ([ops-p9lb](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-p9lb.toon))
+- A malformed npm reply crashed the release audit, and the docstring already promised it would not ([ops-f5m7](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-f5m7.toon))
+- The revert-proof test read its vulnerable fixture from origin/main, so merging it would have turned it red ([ops-9ktn](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-9ktn.toon))
+- The paginated release listing was posted rather than fetched, because gh api switches to POST as soon as a parameter is present ([ops-eugo](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-eugo.toon))
+- P2: GitHub Release history truncated by gh release list -L 500 (a capped read misses older releases) ([ops-ud1m](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-ud1m.toon))
+- P2: exit 0 inside the retry loop instead of returning status to loop-level termination ([ops-emii](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-emii.toon))
+- P1: Completeness gate makes a partial release permanent (release:check blocks repair) ([ops-94me](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-94me.toon))
+- The bun install verification retried a cached negative manifest, so published versions were never observed ([ops-i3ie](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-i3ie.toon))
+
+### Security
+
+- Skipping the sibling-arm reset for any depth-increasing segment let a later arm borrow the previous arm's binding ([ops-narm](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-narm.toon))
+- A tracked executable whose name merely ends in package.json has its publish hidden from the audit ([ops-fnbd](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-fnbd.toon))
+- A case opener sharing a segment with its first arm leaks that arm's binding past esac ([ops-csop](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-csop.toon))
+- Branch-local and compound-line publish bindings let an unattested npm publish pass the attestation gate ([ops-brsc](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-brsc.toon))
+- Security: repository-host check matches too loosely (notgithub.com accepted as GitHub) ([ops-042o](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-042o.toon))
+
+### Other
+
+- Converge the pinned pm-cli on 2026.8.31 and repair history hashes ([ops-uulf](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/chores/ops-uulf.toon))
+
 ## 2026.8.31 - 2026-08-31
 
 ### Fixed
 
+- Finish shell-accurate heredoc and unset handling in publish attestation ([ops-62d1](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-62d1.toon))
 - The release changelog remained Unreleased after the release tag was created ([ops-3ete](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-3ete.toon))
 
+### Security
+
+- A heredoc body and a discarded binding both let an unattested publish pass the attestation gate ([ops-5jp6](https://github.com/unbraind/pm-ops/blob/main/.agents/pm/issues/ops-5jp6.toon))
+
 ## 2026.8.29 - 2026-08-29
 
 ### Fixed

package/dist/attestation.d.ts

@@ -0,0 +1,177 @@
+import { type ShellCommand, type SourceFile, type VerifierResult } from "./shell-scan.ts";
+/** The flag that attaches a build attestation to the published tarball. */
+export declare const ATTESTATION_FLAG = "--provenance";
+/** Whether the auditor recognized any publish command at all. */
+export type PublishRecognition = {
+    readonly kind: "none";
+} | {
+    readonly kind: "recognized";
+    readonly count: number;
+};
+/** Publish-attestation outcome with non-vacuity preserved as structured data. */
+export interface PublishAttestationResult extends VerifierResult {
+    /** Recognition cannot be inferred from an empty failure list. */
+    readonly recognition: PublishRecognition;
+}
+/** One publish invocation found in a tracked file. */
+export interface PublishInvocation {
+    /** File the invocation was found in. */
+    file: string;
+    /** The program the invocation runs, reduced to its basename. */
+    program: string;
+    /** The invocation's tokens, quoting resolved. */
+    command: ShellCommand;
+}
+/** Publishers other than npm, which this repository has no attested path for. */
+export declare const FOREIGN_PUBLISHERS: Set<string>;
+/**
+ * Join manifest script bodies for legacy text consumers without continuations.
+ *
+ * The auditor itself analyzes each returned body in a fresh scope; this text
+ * form remains for callers that need the earlier newline-joined contract.
+ *
+ * @param text - The manifest's contents.
+ * @returns One sanitized line per script body, newline joined.
+ */
+export declare function manifestCommandLines(text: string): string;
+/**
+ * Decide whether one command is a direct `npm publish`.
+ *
+ * `publish` does not have to follow `npm` immediately: npm accepts its
+ * configuration flags anywhere on the line, so `npm --access public publish` is
+ * a real publish that an adjacency test discards silently, leaving an attested
+ * sibling elsewhere in the file to carry the audit to a pass.
+ *
+ * Reading the first non-flag word as the subcommand does not work either,
+ * because npm has flags that take a separate value (`--access public`) and
+ * flags that do not (`--ignore-scripts`), and telling them apart needs npm's
+ * own option table. So the word is looked for anywhere in the arguments, and
+ * only a preceding runner subcommand rules it out -- `npm run publish` runs a
+ * package script whose body is scanned from the manifest, and requiring the
+ * flag on the runner would report a defect that is not there.
+ *
+ * The residual imprecision is `npm --tag publish ...`, a dist-tag named after
+ * the subcommand, which this reads as a publish. That direction is deliberate:
+ * a false positive is a report line to argue with, a false negative is an
+ * unattested artifact on the registry.
+ *
+ * The program is checked in command position by the caller, so `echo npm
+ * publish` and `notnpm publish` never reach here.
+ *
+ * @param command - One simple command's tokens.
+ * @returns True when the command publishes.
+ */
+export declare function isPublishCommand(command: ShellCommand): boolean;
+/**
+ * Decide whether one publish command actually enables the attestation.
+ *
+ * A substring test is not enough. `--provenance=false`, `--provenance false` and
+ * `--no-provenance` all contain the flag's spelling and all turn the
+ * attestation off, so a containment check accepts precisely the regression this
+ * gate exists to catch -- while reporting the file as attested. `--provenance-file`
+ * is a different flag entirely and must not be read as this one.
+ *
+ * Tokens are judged in order and the last one wins, which is how npm resolves a
+ * flag given more than once: `--provenance --no-provenance` publishes without an
+ * attestation, so this must answer false for it.
+ *
+ * Quoting is irrelevant to the shell and so is irrelevant here: `npm publish
+ * "--provenance"` is attested, and the scan this replaces read it as bare.
+ *
+ * @param command - One simple command's tokens.
+ * @returns True when the command publishes with an attestation.
+ */
+export declare function attestationEnabled(command: ShellCommand): boolean;
+/**
+ * Find every publish invocation in one source, isolating package scripts.
+ *
+ * npm launches every manifest script in a fresh shell, so scalar evidence from
+ * one body can never attest a publish in another body. A workflow file's `run:`
+ * blocks are dedented first — before {@link joinContinuations} and heredoc
+ * detection — because that is what happens to them before bash sees the text:
+ * YAML strips the block indentation when it delivers the value. The order
+ * matters: `dedentRunBlocks` reads the raw YAML line structure to find block
+ * headers and strip their indentation, and `joinContinuations` would merge a
+ * `run:` header with the next line when a backslash continuation sits between
+ * them, destroying the header the dedent needs to see. Heredoc detection runs
+ * after both, because a heredoc terminator must match at the start of the line
+ * bash receives — which is the dedented, continuation-joined text. The one
+ * scanner rule that is whitespace-sensitive is the heredoc terminator, so
+ * dedenting before that rule runs is what makes a `run: |2` block's heredoc
+ * terminator match instead of swallowing the rest of the file.
+ *
+ * @param source - The file's path and contents.
+ * @returns The publish invocations found, in file and script order.
+ */
+export declare function publishInvocationsIn(source: SourceFile): PublishInvocation[];
+/**
+ * Render an invocation back to a readable command for a report line.
+ *
+ * @param command - The invocation's tokens.
+ * @returns The command as a single space-separated string.
+ */
+export declare function renderCommand(command: ShellCommand): string;
+/**
+ * Audit every publish invocation across the given files.
+ *
+ * An absent invocation is a failure rather than a pass: a scan that finds
+ * nothing has either been pointed at the wrong files or outlived the workflow
+ * it guards, and both look identical to a clean result unless said out loud.
+ *
+ * A publisher other than npm fails outright rather than being checked for a
+ * flag. This repository's attested path is npm's `--provenance`; no equivalent
+ * is configured for yarn, pnpm or bun, so such an invocation is an unattested
+ * publish path regardless of the flags it carries, and guessing at another
+ * tool's spelling would be a gate that only looked strict.
+ *
+ * @param sources - The tracked files to scan.
+ * @returns Failures and per-file notes.
+ */
+export declare function auditPublishAttestation(sources: SourceFile[]): PublishAttestationResult;
+/**
+ * Decide whether a tracked path can run a command.
+ *
+ * The previous enumeration named two paths -- `.github/workflows` and
+ * `package.json` -- which meant a publish added to any tracked script was never
+ * audited, and because the workflow's own attested publish satisfied the
+ * non-vacuity check the gate still reported that every invocation was attested.
+ * Auditing every shape that can execute closes that, and a shebang is honoured
+ * so an extensionless tracked script is not a blind spot either.
+ *
+ * Build output is excluded. `dist/` is generated from sources this scan already
+ * reads, it is regenerated and compared byte-for-byte on the release path, and
+ * including it would audit a bundled copy of a command rather than the command.
+ *
+ * @param path - Repository-relative path.
+ * @param firstLine - The file's first line, for shebang detection.
+ * @returns True when the file should be scanned.
+ */
+export declare function isExecutableSource(path: string, firstLine: string): boolean;
+/**
+ * List the tracked files that can run a publish.
+ *
+ * Git is asked rather than the filesystem walked, so an untracked scratch copy
+ * of a workflow cannot satisfy or fail the gate. `-z` is used because a tracked
+ * path may legally contain a newline, and splitting such a listing on newlines
+ * invents two paths that do not exist and drops the one that does.
+ *
+ * @param root - Repository root.
+ * @returns Repository-relative paths of every tracked file that can execute.
+ */
+export declare function trackedPublishSources(root: string): string[];
+/**
+ * Read the tracked sources and audit them.
+ *
+ * @param root - Repository root to verify.
+ * @returns Failures and notes for the whole repository.
+ */
+export declare function verify(root: string): PublishAttestationResult;
+/**
+ * Print a result and set a failing exit code when it failed.
+ *
+ * @param result - The audit outcome.
+ * @param write - Sink for the report lines.
+ * @param exit - Called with the process exit code when there were failures.
+ */
+export declare function report(result: VerifierResult, write: (line: string) => void, exit: (code: number) => void): void;
+//# sourceMappingURL=attestation.d.ts.map

package/dist/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../attestation.ts"],"names":[],"mappings":"AAuBA,OAAO,EAeL,KAAK,YAAY,EACjB,KAAK,UAAU,EAIf,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,iFAAiF;AACjF,MAAM,WAAW,wBAAyB,SAAQ,cAAc;IAC9D,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;CAC1C;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,aAAmC,CAAC;AA2EnE;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMzD;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAe/D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAwBjE;AAsKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,EAAE,CAO5E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,wBAAwB,CAqCvF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAI3E;AAiCD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU5D;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAM7D;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC7B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B,IAAI,CASN"}