Mert Koseoglu 43b2477575 fix(integrity): algorithmic Algo-D4 — derive required siblings from scripts.bundle (closes #558 partial — 3 of 4) ...

v1.0.126 shipped Algo-D4 with a hardcoded REQUIRED_RUNTIME_SIBLINGS
array that omitted `hooks/security.bundle.mjs` (the bundle didn't
ship until v1.0.127, but the algorithmic intent was already
documented). The hardcoded list silently passed integrity checks on
v1.0.126 marketplace installs even when the security regression
was active — Algo-D4 reported `{ ok: true }` while permissions.deny
was fail-open. The same trap would have re-bitten the next bundle.

Algorithmic redesign:

- Replace `REQUIRED_RUNTIME_SIBLINGS` const with
  `getRequiredRuntimeSiblings(pluginRoot)` exported function.
- Algorithm: union of LEGACY_FALLBACK (the v1.0.126 contract,
  preserved verbatim) plus every esbuild outfile parsed from
  `package.json scripts.bundle` minus an explicit
  SOFT_FALLBACK_BUNDLES whitelist (session-* bundles, which have
  bundle-first/build-fallback in session-loaders.mjs and don't need
  to fail-fast).
- Source of truth: `scripts.bundle` `--outfile=` arguments. Adding
  a new bundle to that script auto-extends the integrity check —
  no parallel hardcoded list to maintain.
- Safety net: if package.json is unreadable, fall back to the
  legacy hardcoded set so the boot gate never goes silent.
- `assertPluginCacheIntegrity` now calls the new function. Public
  signature unchanged. start.mjs + the doctor surface are
  zero-touch — both consume the same algorithmically-derived set.

Tests (extend tests/core/cli.test.ts per CONTRIBUTING):
- "Algo-D4 algorithmically requires hooks/security.bundle.mjs" —
  the headline #558 regression: with security bundle missing on a
  fakeRoot, integrity must report ok=false (pre-558 hardcoded check
  vacuously passed).
- "Algo-D4 derivation reads scripts.bundle outfiles" — synthetic
  package.json proves a future hooks/foo.bundle.mjs is auto-gated,
  while soft-fallback session-db.bundle.mjs is correctly excluded.
- "Algo-D4 preserves the legacy hardcoded contract" — anti-
  regression pin: every entry in v1.0.126's hardcoded list is still
  in the algorithmic set. Strictly additive refactor.

Verified: 152/152 cli.test.ts tests pass (4 new Algo-D4 + 4
pre-existing plugin-cache + 144 unrelated). typecheck clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-14 00:30:50 +03:00

9.2 KiB

Raw Permalink Blame History

View Raw