Lines 7055-7097javascript
7055 console.log("[smoke] agent_instruction_rename_history_test: PASS");
7058 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));
7059 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");
7060 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");
7061 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");
7062 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");
7063 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");
7064 assert.ok(verifyScript.includes("AbortSignal.timeout(") && verifyScript.includes("FETCH_TIMEOUT_MS"), "v4.0.7 / F2: verify-registry-dist.mjs must bound the npm registry fetch with an explicit AbortSignal.timeout so a slow registry surfaces as a deterministic abort instead of hanging the workflow.");
7065 assert.ok(!verifyScript.includes("readFileSync") &&
7066 !verifyScript.includes("readFile(") &&
7067 verifyScript.includes("npm_package_name") &&
7068 verifyScript.includes("npm_package_version"), "v4.0.8 / F3: verify-registry-dist.mjs must not read package.json from disk; PACKAGE_NAME/PACKAGE_VERSION come from env (or npm-script-injected npm_package_name/version). Removing the file-data → fetch flow kills the recurring js/file-access-to-http CodeQL false positive at the source.");
7069 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN
7070 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-
7071 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated
7072 // mid-key. Empirical regression test:
7074 const { redact } = await import("../src/security/redact.js");
7075 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;
CriticalCritical Secret
Package contains a critical-looking secret pattern.
dist/scripts/smoke.jsView on unpkg · L7075 7076 const redacted = redact(truncatedKey);
7077 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");
7078 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");
7079 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");
7080 console.log("[smoke] redact_unterminated_private_key_test: PASS");
7082 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be
7083 // async AND no source file under src/ may contain the
7084 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.
7085 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms
7086 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session
7087 // 059b0093 asked for repo-wide grep (the original pin only covered
7088 // session-store.ts and missed cache-manifest.ts:47).
7090 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");
7091 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");
7092 assert.ok(/new\s+Promise[\s\S]{0,80}?setTimeout/.test(storeSrc), "v4.1.0 / F5: writeJson must use a Promise-based async delay (`new Promise(r => setTimeout(r, wait))`) for retry backoff so the event loop remains responsive.");
7093 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");
7094 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");
7095 // Repo-wide invariant: scan every .ts under src/ for executable
7096 // busy-wait patterns. Strip block comments so the pin only checks
7097 // executable code (comments may reference the removed pattern).