Lines 7122-7164javascript
7122 console.log("[smoke] agent_instruction_rename_history_test: PASS");
7125 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));
7126 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");
7127 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");
7128 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");
7129 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");
7130 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");
7131 assert.ok(verifyScript.includes("AbortSignal.timeout(") && verifyScript.includes("FETCH_TIMEOUT_MS"), "v4.0.7 / F2: verify-registry-dist.mjs must bound the npm registry fetch with an explicit AbortSignal.timeout so a slow registry surfaces as a deterministic abort instead of hanging the workflow.");
7132 assert.ok(!verifyScript.includes("readFileSync") &&
7133 !verifyScript.includes("readFile(") &&
7134 verifyScript.includes("npm_package_name") &&
7135 verifyScript.includes("npm_package_version"), "v4.0.8 / F3: verify-registry-dist.mjs must not read package.json from disk; PACKAGE_NAME/PACKAGE_VERSION come from env (or npm-script-injected npm_package_name/version). Removing the file-data → fetch flow kills the recurring js/file-access-to-http CodeQL false positive at the source.");
7136 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN
7137 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-
7138 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated
7139 // mid-key. Empirical regression test:
7141 const { redact } = await import("../src/security/redact.js");
7142 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;
CriticalCritical Secret
Package contains a critical-looking secret pattern.
dist/scripts/smoke.jsView on unpkg · L7142 7143 const redacted = redact(truncatedKey);
7144 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");
7145 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");
7146 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");
7147 console.log("[smoke] redact_unterminated_private_key_test: PASS");
7149 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be
7150 // async AND no source file under src/ may contain the
7151 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.
7152 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms
7153 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session
7154 // 059b0093 asked for repo-wide grep (the original pin only covered
7155 // session-store.ts and missed cache-manifest.ts:47).
7157 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");
7158 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");
7159 assert.ok(/new\s+Promise[\s\S]{0,80}?setTimeout/.test(storeSrc), "v4.1.0 / F5: writeJson must use a Promise-based async delay (`new Promise(r => setTimeout(r, wait))`) for retry backoff so the event loop remains responsive.");
7160 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");
7161 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");
7162 // Repo-wide invariant: scan every .ts under src/ for executable
7163 // busy-wait patterns. Strip block comments so the pin only checks
7164 // executable code (comments may reference the removed pattern).