* enhance(#2872): record scope and runtime in the install manifest gsd-file-manifest.json gains manifestVersion, runtime and scope, and a new read-only Installed Surface Resolver Module reads both install scopes for a runtime in one call -- the first code path in the repo that does. Phase 3 of epic #2866 (ADR-2866). Blocks Phase 4 (#2873), which resolves #2218: the resolver's shadowedBy field is that defect expressed as a value for the first time. It ships computed-and-unread here. Installed-ness is decided by manifest PRESENCE, never by the new fields, so a manifest written by an older GSD stays fully functional and no user needs to reinstall. Recorded runtime/scope are corroboration: a disagreement with the probed config dir is reported as declaredScopeMatchesProbe: false, never silently corrected. readInstallManifest is widened additively -- version/timestamp/mode/files keep their exact names, types and meanings for all four existing callers. manifestVersion is a new field rather than a reinterpretation of version, which holds the package version and is read by the golden-parity fixtures. Stems are derived from the installed manifest's own file keys, the inverse of Phase 2's filename composition, guarded by a fast-check round-trip property plus a kebab-case charset check so a crafted manifest key cannot put a traversal segment, control character or ANSI escape into a trigger that Phase 4 renders back to the user. Also fixes two defects found while working: - bin/install.js hardcoded manifestVersion: 2 while the reader owned MANIFEST_SCHEMA_VERSION = 2. Now single-sourced, with a parity test. - docs/installer-migrations.md documented an install-state schema of five snake_case fields that have never been written; InstallState has only ever been { schemaVersion, appliedMigrations }. Corrected with a dated note. Verification runs on the remote runner. * fix(#2872): fold review findings from three independent engines Standards axis: - convert the manifest-schema suite from a hybrid setup(t) closure to beforeEach/afterEach (CONTRIBUTING.md:319-354 Pattern 1). The hybrid was neither approved pattern and a new test forgetting the call got no warning. - SCOPE_ORDER was declared twice with no parity test -- this repo's recorded generative-fix-divergence class. Give the ordering one owner: install-scope exports it frozen, the layout module and the resolver both import it, and a test locks it against scopeRank so the constant and the ranks cannot drift. - drop the defaultReadManifest passthrough (Middle Man). Spec axis: - add the VOLATILE_FILES exclusion test and source comment the acceptance table promised and did not deliver. gsd-file-manifest.json stays excluded: the new fields are deterministic, but timestamp -- the original reason -- is unchanged. Security axis: - bound the reported manifest runtime at 64 chars, matching the truncatePostureValue convention already used in this subsystem. It reached declaredRuntime unbounded while the adjacent stems were gated by SAFE_STEM; an inconsistent posture on the same attacker-influenceable document. The charset stays ungated on purpose -- declaredRuntimeMatchesProbe needs to see the real value -- so Phase 4 must sanitize before rendering, recorded in the design's Known limits. Both new parity tests were verified to FAIL when the two sides are made to disagree, then pass again on revert. Verification runs on the remote runner. * chore(#2872): backfill changeset pr number to 3323 * fix(#2872): give git fixture construction its own timeout class PR #3323's full test (windows-latest, 22, shard 2/3) failed with gitOrThrow: 'git init' failed -- outcome=timed_out exitCode=null gitOrThrow: 'git commit --allow-empty' failed -- outcome=timed_out from drift-detection.test.cjs's beforeEach, a file this branch never touched. Every other lane passed the same commit, including windows-latest node 24 on all three shards, and next is green. Root cause is a bound sized for the wrong class. DEFAULT_GIT_TIMEOUT_MS is 15000 and its own comment scopes it to plumbing READS -- rev-parse, branch, log -- against an existing repo. createFixture uses it for six sequential repo-CONSTRUCTION spawns: init, three config writes, add -A, commit. init and commit each write dozens of files, and on Windows every spawn is Defender-scanned. Sibling tests in the failing block took 15.6-22.0s against a 15000ms bound. This repo already diagnosed this exact shape once: timeouts.cjs's HOOK_FANOUT_TIMEOUT_MS records PR #3285 failing in the SAME job with the SAME outcome=timed_out exitCode=null signature at the SAME bound while every other lane passed, and concludes 'a bound sized for the wrong class, not a slow machine'. It was fixed by splitting out a heavier class-norm at 60000. Same remedy here: GIT_FIXTURE_TIMEOUT_MS = 60000, 4x the bound that failed and half INSTALL_TIMEOUT_MS. DEFAULT_GIT_TIMEOUT_MS deliberately stays at 15000 -- a blanket raise would stop a genuinely hung plumbing read from surfacing fast. Verified the value reaches the spawn rather than being an ignored option: spawnSync was monkeypatched before requiring the fixture module, and all six git construction calls were captured carrying timeout: 60000. This branch's two new test files shift shard composition, which is how a pre-existing fragility landed in the heaviest shard on the slowest lane. Fixed here rather than deferred, per the no-defer rule. Verification runs on the remote runner. --------- Co-authored-by: sim <sim@local>
113 lines
5.3 KiB
JavaScript
113 lines
5.3 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* golden-parity-single-source.test.cjs — anti-divergence guard (#2266, carried
|
|
* forward by #2724 / ADR-2719 Phase 4).
|
|
*
|
|
* tests/golden-install-parity.test.cjs and scripts/gen-golden-install-parity-zcode.cjs
|
|
* used to each carry their OWN inline copy of buildParityManifest plus its 4
|
|
* exclusion constants (VOLATILE_FILES, HOOK_CONFIG_FILES,
|
|
* HOOK_CONFIG_RELATIVE_PATHS, EXCLUDED_PREFIXES). The two copies drifted —
|
|
* the generator's copy was missing the realpath/`<HOME>` normalization the
|
|
* test harness's copy had — and shipped broken fixtures three times (#2086,
|
|
* #2095, #2100). Phase 1 of the golden-install-parity redesign (#2266)
|
|
* consolidated both call sites onto a single canonical implementation in
|
|
* tests/helpers/install-shared.cjs. ADR-2264 Phase 1 (that consolidation) is
|
|
* explicitly RETAINED by ADR-2719 — #2724 deletes the two ORIGINAL consumers
|
|
* (golden-install-parity.test.cjs, gen-golden-install-parity-zcode.cjs), but
|
|
* their two REPLACEMENTS (tests/helpers/emitted-runtime.cjs's currentManifests
|
|
* and tests/helpers/emitted-provenance.cjs's loadManifests) import
|
|
* buildParityManifest the exact same way, so the divergence risk this guard
|
|
* exists for is unchanged — only the consumer names moved.
|
|
*
|
|
* This guard (mirrors the ADR-2121 anti-divergence pattern) enforces that
|
|
* consolidation stays consolidated:
|
|
* 1. install-shared.cjs actually exports a working buildParityManifest +
|
|
* the 4 exclusion constants with the expected shapes.
|
|
* 2. No downstream consumer re-declares its own inline copy of the builder
|
|
* function or the exclusion constants.
|
|
*/
|
|
|
|
const { test } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
|
|
const ROOT = path.join(__dirname, '..');
|
|
|
|
test('install-shared.cjs exports the canonical buildParityManifest + exclusion constants (#2266)', () => {
|
|
const installShared = require('./helpers/install-shared.cjs');
|
|
|
|
assert.equal(
|
|
typeof installShared.buildParityManifest,
|
|
'function',
|
|
'install-shared.cjs must export buildParityManifest as the single source of truth'
|
|
);
|
|
|
|
assert.ok(
|
|
installShared.VOLATILE_FILES instanceof Set,
|
|
'VOLATILE_FILES must be a Set'
|
|
);
|
|
assert.ok(
|
|
installShared.VOLATILE_FILES.has('gsd-file-manifest.json'),
|
|
"VOLATILE_FILES must keep 'gsd-file-manifest.json' excluded (#2872 acceptance " +
|
|
'criterion: the manifest gained manifestVersion/runtime/scope, but its `timestamp` ' +
|
|
'field is unchanged and still varies per install — if this ever stops being true, ' +
|
|
'the golden fixtures start hashing a per-install timestamp)'
|
|
);
|
|
assert.ok(
|
|
installShared.HOOK_CONFIG_FILES instanceof Set,
|
|
'HOOK_CONFIG_FILES must be a Set'
|
|
);
|
|
assert.ok(
|
|
installShared.HOOK_CONFIG_RELATIVE_PATHS instanceof Set,
|
|
'HOOK_CONFIG_RELATIVE_PATHS must be a Set'
|
|
);
|
|
assert.ok(
|
|
Array.isArray(installShared.EXCLUDED_PREFIXES),
|
|
'EXCLUDED_PREFIXES must be an array'
|
|
);
|
|
assert.ok(
|
|
installShared.EXCLUDED_PREFIXES.includes('gsd-core/bin/lib/'),
|
|
"EXCLUDED_PREFIXES must include 'gsd-core/bin/lib/' (compiled runtime artifacts, build-environment-dependent)"
|
|
);
|
|
});
|
|
|
|
// The anti-divergence check below reads the two downstream .cjs source files
|
|
// as plain text to prove they no longer re-declare the builder/constants
|
|
// inline — the runtime-contract-under-test IS the source text (whether a
|
|
// second inline copy exists), not behavior a require() could exercise.
|
|
//
|
|
// ALL FIVE identifiers are guarded, not just buildParityManifest + VOLATILE_FILES:
|
|
// the drift that shipped broken fixtures was a MISSING exclusion-constant entry
|
|
// (#2100 = generator's HOOK_CONFIG_FILES copy lacked settings.local.json; #2095 =
|
|
// kimi's HOOK_CONFIG_RELATIVE_PATHS entry), so a re-declared HOOK_CONFIG_FILES /
|
|
// HOOK_CONFIG_RELATIVE_PATHS / EXCLUDED_PREFIXES is exactly the failure class this
|
|
// guard exists to prevent — checking only two of four would leave that gap open.
|
|
const FORBIDDEN_INLINE = [
|
|
{ label: 'buildParityManifest', re: /function\s+buildParityManifest/ },
|
|
{ label: 'VOLATILE_FILES', re: /const\s+VOLATILE_FILES\s*=\s*new\s+Set/ },
|
|
{ label: 'HOOK_CONFIG_FILES', re: /const\s+HOOK_CONFIG_FILES\s*=\s*new\s+Set/ },
|
|
{ label: 'HOOK_CONFIG_RELATIVE_PATHS', re: /const\s+HOOK_CONFIG_RELATIVE_PATHS\s*=\s*new\s+Set/ },
|
|
{ label: 'EXCLUDED_PREFIXES', re: /const\s+EXCLUDED_PREFIXES\s*=\s*\[/ },
|
|
];
|
|
|
|
const CONSUMERS = [
|
|
{ name: 'tests/helpers/emitted-runtime.cjs', rel: ['tests', 'helpers', 'emitted-runtime.cjs'], from: './install-shared.cjs' },
|
|
{ name: 'tests/helpers/emitted-provenance.cjs', rel: ['tests', 'helpers', 'emitted-provenance.cjs'], from: './install-shared.cjs' },
|
|
];
|
|
|
|
for (const consumer of CONSUMERS) {
|
|
test(`${consumer.name} does not re-declare an inline buildParityManifest or any exclusion constant (#2266)`, () => {
|
|
// allow-test-rule: source-text-is-the-product (see #2266)
|
|
// Source text is the product for this anti-divergence check.
|
|
const content = fs.readFileSync(path.join(ROOT, ...consumer.rel), 'utf8');
|
|
for (const { label, re } of FORBIDDEN_INLINE) {
|
|
assert.ok(
|
|
!re.test(content),
|
|
`${consumer.name} must import ${label} from ${consumer.from}, not re-declare it inline`
|
|
);
|
|
}
|
|
});
|
|
}
|