a9a7a328e6
Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD across contents and paths, upstream package/repo coordinates -> @golem15/msd-core and golem15com/msd-core. Deep links into upstream history, sibling upstream packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is. Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line, package/plugin identity, regenerated lockfile, install-tree fixtures, derived registries and benchmark baseline; migration checksum baseline re-locked (MSD keeps its own install state, so no install had applied the old sums); sort-order and regex-escaped expectations in tests adjusted.
63 lines
1.9 KiB
JavaScript
63 lines
1.9 KiB
JavaScript
#!/usr/bin/env node
|
|
'use strict';
|
|
|
|
/**
|
|
* Focused drift guard for issue #3442:
|
|
* prevent installer-owned inline shim/wrapper text builders from bypassing the
|
|
* Shell Command Projection Module seam.
|
|
*
|
|
* Scope intentionally excludes subprocess execution helpers (spawnSync /
|
|
* execFileSync) because those are safe internal execution primitives, not
|
|
* serialized shell-command rendering.
|
|
*/
|
|
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const { ExitError, runMain } = require('./lib/cli-exit.cjs');
|
|
|
|
const ROOT = path.resolve(__dirname, '..');
|
|
|
|
const forbidden = [
|
|
{
|
|
label: 'inline cmd shim builder',
|
|
pattern: /@ECHO OFF\\r\\n@SETLOCAL\\r\\n@node /,
|
|
},
|
|
{
|
|
label: 'inline pwsh shim builder',
|
|
pattern: /#!\/usr\/bin\/env pwsh\\n& node /,
|
|
},
|
|
{
|
|
label: 'inline sh shim builder',
|
|
pattern: /#!\/usr\/bin\/env sh\\nexec node /,
|
|
},
|
|
];
|
|
|
|
function main() {
|
|
const targetArg = process.argv[2] || path.join(ROOT, 'bin', 'install.js');
|
|
const target = path.resolve(targetArg);
|
|
const rel = path.relative(ROOT, target);
|
|
|
|
let content;
|
|
try {
|
|
content = fs.readFileSync(target, 'utf8');
|
|
} catch (error) {
|
|
throw new ExitError(1, `lint-shell-command-projection-drift: failed to read ${target}: ${error.message}`);
|
|
}
|
|
|
|
const matches = forbidden.filter((rule) => rule.pattern.test(content));
|
|
if (matches.length === 0) {
|
|
process.stdout.write(`ok shell-projection-drift: ${rel}\n`);
|
|
return 0;
|
|
}
|
|
|
|
process.stderr.write(`ERROR shell-projection-drift: inline serialized shim builders found in ${rel}\n`);
|
|
for (const match of matches) {
|
|
process.stderr.write(` - ${match.label}\n`);
|
|
}
|
|
process.stderr.write('Route shim/wrapper rendering through msd-core/bin/lib/shell-command-projection.cjs\n');
|
|
process.stderr.write('Safe subprocess execution via spawnSync/execFileSync is intentionally allowed.\n');
|
|
return 1;
|
|
}
|
|
|
|
runMain(main);
|