scip-query 0.19.5 → 0.19.8

package/docs/schemas/windows-sidecar-provenance.schema.json

@@ -0,0 +1,137 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/PlunderStruck/scip-query/blob/main/docs/schemas/windows-sidecar-provenance.schema.json",
+  "title": "scip-query Windows sidecar provenance",
+  "type": "object",
+  "required": ["kind", "schemaVersion", "package", "source", "toolchain", "build", "binaries"],
+  "properties": {
+    "kind": {
+      "const": "scip-query-windows-sidecar-provenance"
+    },
+    "schemaVersion": {
+      "const": 1
+    },
+    "package": {
+      "type": "object",
+      "required": ["name", "version"],
+      "properties": {
+        "name": {
+          "const": "scip-query-scip-windows"
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "additionalProperties": true
+    },
+    "source": {
+      "type": "object",
+      "required": ["repository", "tag", "commit"],
+      "properties": {
+        "repository": {
+          "type": "string",
+          "minLength": 1
+        },
+        "tag": {
+          "type": "string",
+          "minLength": 1
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{40}$"
+        }
+      },
+      "additionalProperties": true
+    },
+    "toolchain": {
+      "type": "object",
+      "required": ["goVersion"],
+      "properties": {
+        "goVersion": {
+          "type": "string",
+          "pattern": "^go[0-9]+\\.[0-9]+"
+        }
+      },
+      "additionalProperties": true
+    },
+    "build": {
+      "type": "object",
+      "required": ["command", "package", "flags", "environment"],
+      "properties": {
+        "command": {
+          "const": "go build"
+        },
+        "package": {
+          "const": "./cmd/scip"
+        },
+        "flags": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "environment": {
+          "type": "object",
+          "required": ["CGO_ENABLED", "GOOS"],
+          "properties": {
+            "CGO_ENABLED": {
+              "const": "0"
+            },
+            "GOOS": {
+              "const": "windows"
+            }
+          },
+          "additionalProperties": true
+        }
+      },
+      "additionalProperties": true
+    },
+    "binaries": {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 2,
+      "items": {
+        "type": "object",
+        "required": ["filename", "target", "size", "sha256", "peMachine", "peMachineCode"],
+        "properties": {
+          "filename": {
+            "enum": ["scip-win32-x64.exe", "scip-win32-arm64.exe"]
+          },
+          "target": {
+            "type": "object",
+            "required": ["goos", "goarch", "packageArch"],
+            "properties": {
+              "goos": {
+                "const": "windows"
+              },
+              "goarch": {
+                "enum": ["amd64", "arm64"]
+              },
+              "packageArch": {
+                "enum": ["x64", "arm64"]
+              }
+            },
+            "additionalProperties": true
+          },
+          "size": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "sha256": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "peMachine": {
+            "enum": ["AMD64", "ARM64"]
+          },
+          "peMachineCode": {
+            "enum": ["0x8664", "0xaa64"]
+          }
+        },
+        "additionalProperties": true
+      }
+    }
+  },
+  "additionalProperties": true
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scip-query",
-  "version": "0.19.5",
+  "version": "0.19.8",
   "description": "Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.",
   "type": "module",
   "main": "dist/index.js",
@@ -13,9 +13,12 @@
     "dist/**/*.js",
     "dist/**/*.d.ts",
     "docs/assets/**/*",
+    "docs/schemas/**/*",
     "docs/*.md",
     "scripts/build-scip-windows.mjs",
     "scripts/evidence-product-contract.mjs",
+    "scripts/scip-windows-provenance.mjs",
+    "scripts/verify-scip-windows.mjs",
     "skills/**/*.md",
     "skills/**/agents/*.yaml"
   ],
@@ -318,15 +321,23 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
-    "lint": "npm run format:check && eslint src tests tsup.config.ts && node scripts/check-skill-links.mjs",
+    "audit:prod": "node scripts/audit-production-dependencies.mjs",
+    "api:report": "node scripts/api-surface-contract.mjs report",
+    "api:check": "npm run build && node scripts/api-surface-contract.mjs check && tsc -p tests/fixtures/public-api-consumer/tsconfig.json",
+    "api:update": "npm run build && node scripts/api-surface-contract.mjs update",
+    "lint": "npm run format:check && eslint src tests tsup.config.ts scripts/api-surface-contract.mjs scripts/audit-production-dependencies.mjs scripts/build-scip-windows.mjs scripts/npm-release-state.ts scripts/npm-release.ts scripts/publish-scip-windows.ts scripts/release-npm-guard.ts scripts/release-npm.ts scripts/scip-windows-package-identity.ts scripts/scip-windows-provenance.mjs scripts/scip-windows-release.ts scripts/verify-scip-windows.mjs scripts/verify-scip-windows-registry.ts && npm run api:check && node scripts/check-skill-links.mjs",
     "build:scip-windows": "node scripts/build-scip-windows.mjs",
+    "verify:scip-windows": "node scripts/verify-scip-windows.mjs",
+    "verify:scip-windows-registry": "vite-node scripts/verify-scip-windows-registry.ts",
     "bench:evidence-products": "node scripts/evidence-product-contract.mjs",
     "bench:native-symbol-leaf": "node scripts/bench-native-symbol-leaf.mjs",
     "calibrate": "node scripts/accuracy-calibration.mjs",
     "docs:commands": "vite-node scripts/render-command-reference.ts --write",
-    "prepublishOnly": "vite-node scripts/publish-scip-windows.ts && npm run build",
+    "prepublishOnly": "vite-node scripts/release-npm-guard.ts",
     "postinstall": "node dist/postinstall.js || true",
-    "publish:scip-windows": "vite-node scripts/publish-scip-windows.ts"
+    "publish:scip-windows": "vite-node scripts/publish-scip-windows.ts",
+    "release:npm": "vite-node scripts/release-npm.ts",
+    "release:npm:dry-run": "vite-node scripts/release-npm.ts --dry-run"
   },
   "keywords": [
     "scip",
@@ -352,8 +363,8 @@
   "dependencies": {
     "@bufbuild/protobuf": "^2.11.0",
     "@c4312/scip": "^0.1.0",
-    "@vue/compiler-dom": "^3.5.38",
-    "@vue/compiler-sfc": "^3.5.38",
+    "@vue/compiler-dom": "^3.5.40",
+    "@vue/compiler-sfc": "^3.5.40",
     "better-sqlite3": "^12.9.0",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
@@ -362,9 +373,9 @@
   },
   "//optionalDependencies": "Native parsers and bundled SCIP indexers go in optionalDependencies so a failed install (missing build tools, restricted registry, incompatible platform) downgrades scip-query gracefully — the affected language falls back to regex parsing or asks the user to install its indexer manually — instead of blocking npm install.",
   "optionalDependencies": {
-    "@sourcegraph/scip-typescript": "^0.4.0",
-    "scip-python-plus": "^0.7.4",
-    "scip-query-scip-windows": "0.13.0",
+    "@sourcegraph/scip-typescript": "0.4.0",
+    "scip-python-plus": "0.7.5",
+    "scip-query-scip-windows": "0.13.1",
     "tree-sitter": "0.21.1",
     "tree-sitter-c": "0.23.2",
     "tree-sitter-c-sharp": "0.23.1",
@@ -389,7 +400,7 @@
     "tsup": "^8.3.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.58.1",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.7"
   },
   "allowScripts": {
     "better-sqlite3@12.9.0": true,

package/scripts/build-scip-windows.mjs

@@ -1,78 +1,197 @@
 #!/usr/bin/env node
 import { execFileSync } from 'node:child_process';
-import { copyFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import {
+  createWindowsSidecarProvenance,
+  DEFAULT_SCIP_REPOSITORY,
+  DEFAULT_SCIP_TAG,
+  PINNED_GO_VERSION,
+  verifyWindowsSidecarProvenance,
+  WINDOWS_SIDECAR_BUILD,
+  WINDOWS_SIDECAR_PROVENANCE_FILE,
+  WINDOWS_SIDECAR_TARGETS,
+} from './scip-windows-provenance.mjs';
 
-const SCIP_VERSION = process.env.SCIP_VERSION ?? 'v0.8.1';
-const SCIP_REPO_URL = process.env.SCIP_REPO_URL ?? 'https://github.com/scip-code/scip.git';
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const VENDOR_DIR = join(ROOT, 'packages', 'scip-windows');
 
-const TARGETS = [
-  { goarch: 'amd64', packageArch: 'x64' },
-  { goarch: 'arm64', packageArch: 'arm64' },
-];
+export function buildScipWindowsSidecar(
+  {
+    root = ROOT,
+    sourceRepository = process.env.SCIP_REPO_URL ?? DEFAULT_SCIP_REPOSITORY,
+    sourceTag = process.env.SCIP_VERSION ?? DEFAULT_SCIP_TAG,
+    expectedGoVersion = process.env.SCIP_GO_VERSION ?? PINNED_GO_VERSION,
+  } = {},
+  runtime = createBuildRuntime(),
+) {
+  const sidecarDir = join(root, 'packages', 'scip-windows');
+  const sidecarPackage = JSON.parse(runtime.readFile(join(sidecarDir, 'package.json'), 'utf8'));
+  runtime.assertAvailable('git');
+  runtime.assertAvailable('go');
 
-function run(binary, args, options = {}) {
-  console.log(`$ ${binary} ${args.join(' ')}`);
-  execFileSync(binary, args, {
-    stdio: 'inherit',
-    ...options,
-  });
-}
-
-function assertAvailable(binary) {
-  const probe = process.platform === 'win32' ? 'where' : 'which';
+  const workDir = runtime.makeTempDirectory(join(runtime.tempDirectory(), 'scip-query-scip-'));
   try {
-    execFileSync(probe, [binary], { stdio: 'ignore' });
-  } catch {
-    throw new Error(`Required command not found on PATH: ${binary}`);
-  }
-}
+    const checkoutDir = join(workDir, 'scip');
+    const artifactDir = join(workDir, 'artifacts');
+    runtime.mkdir(artifactDir);
+
+    const goVersion = parseGoVersion(
+      runtime.run('go', ['version'], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }),
+    );
+    if (goVersion !== expectedGoVersion) {
+      throw new Error(
+        `Go toolchain mismatch: expected ${expectedGoVersion}, received ${goVersion}. ` +
+          `Install the pinned toolchain or intentionally update the provenance contract.`,
+      );
+    }
 
-assertAvailable('git');
-assertAvailable('go');
+    runtime.run('git', ['clone', '--depth', '1', '--branch', sourceTag, sourceRepository, checkoutDir], {
+      stdio: 'inherit',
+    });
+    const sourceCommit = runtime
+      .run('git', ['rev-parse', 'HEAD'], {
+        cwd: checkoutDir,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      })
+      .trim();
+
+    runtime.copyFile(join(checkoutDir, 'LICENSE'), join(artifactDir, 'LICENSE.scip'));
+    runtime.writeFile(
+      join(artifactDir, 'README.md'),
+      renderSidecarReadme({ sourceRepository, sourceTag, sourceCommit, goVersion }),
+    );
 
-const workDir = mkdtempSync(join(tmpdir(), 'scip-query-scip-'));
+    for (const target of WINDOWS_SIDECAR_TARGETS) {
+      const outputPath = join(artifactDir, target.filename);
+      runtime.run('go', ['build', ...WINDOWS_SIDECAR_BUILD.flags, '-o', outputPath, WINDOWS_SIDECAR_BUILD.package], {
+        cwd: checkoutDir,
+        env: {
+          ...process.env,
+          ...WINDOWS_SIDECAR_BUILD.environment,
+          GOARCH: target.goarch,
+        },
+        stdio: 'inherit',
+      });
+    }
 
-try {
-  const checkoutDir = join(workDir, 'scip');
-  run('git', ['clone', '--depth', '1', '--branch', SCIP_VERSION, SCIP_REPO_URL, checkoutDir]);
-  mkdirSync(VENDOR_DIR, { recursive: true });
-  copyFileSync(join(checkoutDir, 'LICENSE'), join(VENDOR_DIR, 'LICENSE.scip'));
-  writeFileSync(
-    join(VENDOR_DIR, 'README.md'),
-    [
-      '# Windows scip.exe npm sidecar',
-      '',
-      `These binaries are built from ${SCIP_REPO_URL} at ${SCIP_VERSION}.`,
-      'They are bundled in the OS-gated `scip-query-scip-windows` npm package. The main',
-      '`scip-query` package declares that sidecar as an optional dependency, so npm',
-      'installs it automatically on Windows and `reindex` works without Go or WSL.',
-      '',
-      'Run `npm run build:scip-windows` to rebuild the binaries. Publishing the main',
-      'package verifies the version pin, builds missing binaries, and publishes the',
-      'matching sidecar first.',
-      '',
-    ].join('\n'),
-  );
+    const manifest = createWindowsSidecarProvenance({
+      sidecarDir: artifactDir,
+      packageName: sidecarPackage.name,
+      packageVersion: sidecarPackage.version,
+      sourceRepository,
+      sourceTag,
+      sourceCommit,
+      goVersion,
+      readFile: runtime.readFile,
+    });
+    runtime.writeFile(join(artifactDir, WINDOWS_SIDECAR_PROVENANCE_FILE), `${JSON.stringify(manifest, null, 2)}\n`);
 
-  for (const target of TARGETS) {
-    const outputPath = join(VENDOR_DIR, `scip-win32-${target.packageArch}.exe`);
-    mkdirSync(VENDOR_DIR, { recursive: true });
+    for (const file of [
+      'LICENSE.scip',
+      'README.md',
+      ...WINDOWS_SIDECAR_TARGETS.map((target) => target.filename),
+      WINDOWS_SIDECAR_PROVENANCE_FILE,
+    ]) {
+      runtime.promoteFile(join(artifactDir, file), join(sidecarDir, file));
+    }
 
-    run('go', ['build', '-trimpath', '-ldflags=-s -w', '-o', outputPath, './cmd/scip'], {
-      cwd: checkoutDir,
-      env: {
-        ...process.env,
-        CGO_ENABLED: '0',
-        GOOS: 'windows',
-        GOARCH: target.goarch,
-      },
+    const verified = verifyWindowsSidecarProvenance({
+      sidecarDir,
+      expectedSourceRepository: sourceRepository,
+      expectedSourceTag: sourceTag,
+      expectedGoVersion,
+      readFile: runtime.readFile,
     });
+    runtime.log(
+      `Built and verified ${verified.package.name}@${verified.package.version} from ${sourceTag} (${sourceCommit.slice(0, 12)}).`,
+    );
+    return verified;
+  } finally {
+    runtime.removeTree(workDir);
+  }
+}
+
+export function createBuildRuntime() {
+  return {
+    assertAvailable(binary) {
+      const probe = process.platform === 'win32' ? 'where' : 'which';
+      try {
+        execFileSync(probe, [binary], { stdio: 'ignore' });
+      } catch {
+        throw new Error(`Required command not found on PATH: ${binary}`);
+      }
+    },
+    copyFile: copyFileSync,
+    log: console.log,
+    makeTempDirectory: mkdtempSync,
+    mkdir(path) {
+      mkdirSync(path, { recursive: true });
+    },
+    promoteFile(source, destination) {
+      mkdirSync(dirname(destination), { recursive: true });
+      const staging = join(dirname(destination), `.${basename(destination)}.${process.pid}.tmp`);
+      try {
+        copyFileSync(source, staging);
+        renameSync(staging, destination);
+      } finally {
+        rmSync(staging, { force: true });
+      }
+    },
+    readFile: readFileSync,
+    removeTree(path) {
+      rmSync(path, { recursive: true, force: true });
+    },
+    run(binary, args, options = {}) {
+      console.log(`$ ${binary} ${args.join(' ')}`);
+      return execFileSync(binary, args, options);
+    },
+    tempDirectory: tmpdir,
+    writeFile: writeFileSync,
+  };
+}
+
+export function parseGoVersion(output) {
+  const match = /\b(go\d+(?:\.\d+){1,2}(?:[a-z0-9.-]*)?)\b/.exec(String(output));
+  if (!match) {
+    throw new Error(`Could not parse Go toolchain version from: ${String(output).trim()}`);
+  }
+  return match[1];
+}
+
+export function renderSidecarReadme({ sourceRepository, sourceTag, sourceCommit, goVersion }) {
+  return [
+    '# Windows scip.exe npm sidecar',
+    '',
+    `These binaries are built from ${sourceRepository} at ${sourceTag}`,
+    `(${sourceCommit}) with ${goVersion}.`,
+    'They are bundled in the OS-gated `scip-query-scip-windows` npm package. The main',
+    '`scip-query` package declares that sidecar as an optional dependency, so npm',
+    'installs it automatically on Windows and `reindex` works without Go or WSL.',
+    '',
+    `\`${WINDOWS_SIDECAR_PROVENANCE_FILE}\` binds the package version and exact source,`,
+    'toolchain, build flags, target machine, file size, and SHA-256 for both binaries.',
+    'Build, pack, and publish checks reject missing or mismatched evidence.',
+    '',
+    'Run `npm run build:scip-windows` to rebuild the binaries and provenance manifest.',
+    'Review and commit the manifest change before release. Publishing the main package',
+    'verifies the version pin and the complete sidecar provenance before any registry',
+    'decision.',
+    '',
+  ].join('\n');
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : null;
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  try {
+    buildScipWindowsSidecar();
+  } catch (error) {
+    console.error(`Windows sidecar build FAILED:\n  - ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
   }
-} finally {
-  rmSync(workDir, { recursive: true, force: true });
 }