From a3d402d07e850f112ef422fd99e021e98bb8994c Mon Sep 17 00:00:00 2001 From: garrytan Date: Mon, 26 Oct 2026 00:54:12 +0000 Subject: [PATCH] fix: pre-landing review fixes (GSTA-97) - setup/gstack-browser-ensure: Bun treats --production as frozen, so the old fallback could never recover a stale lockfile; refresh it with --lockfile-only, then install production-only again. - gstack-browser-ensure failure line and the README tip no longer suggest a full bun install to users. - Tests: real-Bun stale-lockfile and keep-devDeps contracts, behavioral browser-ensure install tests, relative-import closure scan, multi-line and re-export negative controls; CHANGELOG matches. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- CHANGELOG.md | 7 +- README.md | 2 +- bin/gstack-browser-ensure | 2 +- setup | 4 +- test/gstack-browser-ensure.test.ts | 47 ++++++++++ test/setup-production-deps.test.ts | 141 +++++++++++++++++++++++++++-- 6 files changed, 189 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f07b9f618..171ff3357 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ **A fresh install is about 520 MB smaller: `./setup` installs production dependencies only.** Setup ran `bun install` without `--production`, so every user also got the test and eval toolchain from `devDependencies`, mostly the Claude Agent SDK's native binaries (both the glibc and musl builds on Linux, ~440 MB). Measured on a clean Ubuntu 24.04 container with a cold Bun cache (4 vCPU, two runs each): `node_modules` goes from 1,094 MB to 572 MB, the checkout from 1.74 GB to 1.22 GB, and the whole install with Chromium from 2.42 GB to 1.90 GB. `./setup` took 24.6 s and 20.0 s before, 21.1 s and 18.9 s after. ### Changed -- **`setup`**: every dependency install (before the build, the Codex render and each host render) goes through one `install_runtime_deps` function: `bun install --production --frozen-lockfile`, falling back to `bun install --production`. **`bin/gstack-browser-ensure`** installs the same way when `node_modules` is missing. +- **`setup`**: every dependency install (before the build, the Codex render and each host render) goes through one `install_runtime_deps` function: `bun install --production --frozen-lockfile`. Bun treats `--production` as frozen, so when `bun.lock` is behind `package.json` (a fork or a local edit) it refreshes the lockfile with `bun install --lockfile-only` and installs production-only again. **`bin/gstack-browser-ensure`** installs the same way when `node_modules` is missing, and its failure line now points to `./setup`. - **`package.json`**: `@anthropic-ai/sdk` (loaded by `gstack-distill-free-text`, /plan-tune's dream cycle) and `xterm` and `xterm-addon-fit` (copied into the browser extension by `bun run build`) move to `dependencies`, because a user install runs them. The Claude Agent SDK, TypeScript, Prettier and `@types/bun` stay dev-only. - **Contributors and CI keep the full install.** Bun never removes packages that are already installed, so a full `bun install` survives any later `./setup`. `bin/dev-setup` now always runs `bun install` (it skipped it when `node_modules` existed, which would have left a checkout first set up by `./setup` without the dev toolchain). CI workflows already run `bun install --frozen-lockfile` themselves. CONTRIBUTING.md says which command installs what. @@ -13,11 +13,12 @@ - An existing install keeps its dev dependencies, because `./setup` never removes packages. To get the space back: `cd ~/.claude/skills/gstack && rm -rf node_modules && bun install --production --frozen-lockfile`. Don't do this in a checkout you develop gstack in. ### Tests -- `test/setup-production-deps.test.ts`: `install_runtime_deps`, sliced out of `setup` and run against a recording `bun`, passes `--production` on the frozen-lockfile call and on the fallback. No other line in `setup` calls `bun install` (the pre-change line is the negative control). `bin/dev-setup`'s install block, run over an existing `node_modules`, still calls plain `bun install`. A scan of every shipped file (`bin`, `lib`, `browse/src`, `design/src`, `make-pdf/src`, `hosts`, `extension`, the resolvers, and the scripts `setup` and the build call by path) finds no import or `require` of a package outside `dependencies`. Negative controls: a planted Agent SDK import is caught, a type-only import is not, and moving `@anthropic-ai/sdk` back to dev flags `gstack-distill-free-text`. The packages `bun run build` copies out of `node_modules` are production dependencies. +- `test/setup-production-deps.test.ts`: `install_runtime_deps`, sliced out of `setup` and run against a recording `bun` that models Bun's frozen `--production`, passes `--production` on the frozen-lockfile call, refreshes a stale lockfile before retrying, and stops setup when the refresh fails. Run with the real Bun on local `file:` packages: a fresh install leaves out devDependencies, a later production install keeps the ones a full install added, and a stale lockfile is refreshed while the install stays production-only. No other line in `setup` calls `bun install` (the pre-change line is the negative control). `bin/dev-setup`'s install block, run over an existing `node_modules`, still calls plain `bun install`. A scan of every shipped file (`bin`, `lib`, `browse/src`, `design/src`, `make-pdf/src`, `hosts`, `extension`, the resolvers, and the scripts `setup` and the build call by path) finds no import or `require` of a package outside `dependencies`. Modules the shipped code reaches by relative import (gen-skill-docs' `scripts/` helpers) are scanned too. Negative controls: a planted Agent SDK import is caught, including one split over several lines and a re-export; a type-only import is not; and moving `@anthropic-ai/sdk` back to dev flags `gstack-distill-free-text`. The packages `bun run build` copies out of `node_modules` are production dependencies. +- `test/gstack-browser-ensure.test.ts`: with `node_modules` missing, the preflight runs the frozen production install, refreshes a stale lockfile before retrying, and ends a failed install in `BROWSER_UNAVAILABLE` with the `./setup` fix line. - The install fixtures' stub `bun` (`test/helpers/install-fixture.ts`, `test/helpers/claude-overlay-fixture.ts`, `test/team-mode.test.ts`) now matches `install --production --frozen-lockfile`, so a setup that dropped the flag would reach the real `bun` instead of the stub. ### Gate integrity -- No threshold, budget, timeout, trial count, case kind or assertion was weakened. The three stub patterns changed to the new argv only. +- No threshold, budget, timeout, trial count, case kind or assertion was weakened. The four stub patterns (in three files) changed to the new argv only. ## [1.91.221.0] - 2026-10-25 diff --git a/README.md b/README.md index 213da088e..3210451af 100644 --- a/README.md +++ b/README.md @@ -790,7 +790,7 @@ A project install lives in the project's `.claude/skills/gstack` or **`/browse` (or `/qa`, `/design-review`) says `NEEDS_ASIDE` or `ASIDE_NOT_RUNNING`?** That's the probe telling you it's about to use the fallback browser. Want Aside? Open the app and sign in — `aside --version` should print a version and `aside repl 'console.log("ok")'` should print `ok` — then re-run. gstack never installs it for you. Want the fallback on purpose while Aside is open? `GSTACK_SKIP_ASIDE=1` makes every skill, the renderer, and `./setup` treat Aside as absent. When Aside is absent the probe prints `NEEDS_ASIDE: ` and skills trust that line for the macOS-only download pitch; `GSTACK_PLATFORM` overrides the OS it names, for tests and unusual hosts (set it in your shell — gstack never reads it from a project `.env`). -**`/browse` fails on the fallback browser?** `cd ~/.claude/skills/gstack && bun install && bun run build` +**`/browse` fails on the fallback browser?** `cd ~/.claude/skills/gstack && bun install --production && bun run build` **`/make-pdf` or `/diagram` can't render?** Same two paths: with Aside open they print through Aside (`bun run ~/.claude/skills/gstack/bin/gstack-render.ts some.html --screenshot /tmp/out.png` tests it directly, and its first line, `ENGINE=aside` or `ENGINE=browse`, names the browser that actually rendered); without it they use the bundled browser, so `bun run build` is the fix. diff --git a/bin/gstack-browser-ensure b/bin/gstack-browser-ensure index 90037fd6d..5b786c2a7 100755 --- a/bin/gstack-browser-ensure +++ b/bin/gstack-browser-ensure @@ -73,7 +73,7 @@ if [ ! -d "$ROOT/node_modules/playwright" ]; then [ "$CHECK" -eq 1 ] && fail "playwright is not installed under $ROOT/node_modules" "cd $ROOT && ./setup" command -v bun >/dev/null 2>&1 || fail "playwright is not installed under $ROOT/node_modules and bun is not on PATH" "install Bun, then cd $ROOT && ./setup" log "gstack-browser-ensure: installing node modules (bun install)..." - (cd "$ROOT" && { bun install --production --frozen-lockfile >/dev/null 2>&1 || bun install --production >/dev/null; }) || fail "bun install failed under $ROOT" "cd $ROOT && bun install, then re-run $0" + (cd "$ROOT" && { bun install --production --frozen-lockfile >/dev/null 2>&1 || { bun install --lockfile-only >/dev/null && bun install --production --frozen-lockfile >/dev/null; }; }) || fail "bun install failed under $ROOT" "cd $ROOT && ./setup, then re-run $0" fi probe diff --git a/setup b/setup index db0244fee..f17816684 100755 --- a/setup +++ b/setup @@ -1716,8 +1716,10 @@ bun_cmd() { # nothing setup, the build or an installed skill runs needs them. Bun never # prunes packages that are already installed, so a contributor's full # `bun install` (CONTRIBUTING.md, bin/dev-setup, CI) survives a later ./setup. +# Bun's --production implies a frozen lockfile, so when bun.lock is out of date +# (a fork or a local edit) refresh it first, then install production-only again. install_runtime_deps() { - bun_cmd install --production --frozen-lockfile 2>/dev/null || bun_cmd install --production + bun_cmd install --production --frozen-lockfile 2>/dev/null || { bun_cmd install --lockfile-only && bun_cmd install --production --frozen-lockfile; } } cleanup_copied_bun() { diff --git a/test/gstack-browser-ensure.test.ts b/test/gstack-browser-ensure.test.ts index 8a03c0299..04bb8d0af 100644 --- a/test/gstack-browser-ensure.test.ts +++ b/test/gstack-browser-ensure.test.ts @@ -136,6 +136,53 @@ describe('gstack-browser-ensure with a winget-shaped Bun (#3131)', () => { }); }); +// Generated by /ship Step 7 coverage audit (GSTA-97). +// Value: protects=a missing node_modules is installed production-only, a stale lockfile is refreshed before the retry, and a failed install ends in BROWSER_UNAVAILABLE; +// fails_when=--production leaves either install, the lockfile refresh is lost, or a failed install no longer reports the fix line; +// why_new=setup-production-deps.test.ts matches the line's text only, and the --check case never installs; +// seam=none; no_claim=a real bun install (a stub bun records argv, models Bun's frozen --production rule and restores a stub playwright) +describe('gstack-browser-ensure installs a missing node_modules production-only (GSTA-97)', () => { + function installing(frozenRc: number, fallbackRc: number) { + const f = fixture(); + fs.writeFileSync(f.marker, ''); + fs.renameSync(path.join(f.root, 'node_modules/playwright'), path.join(f.base, 'playwright-stub')); + fs.writeFileSync(path.join(f.base, 'stub/bun'), [ + '#!/usr/bin/env bash', + '[ "$1" = install ] || exit 9', + `echo "$*" >> ${JSON.stringify(path.join(f.base, 'install-calls'))}`, + `refreshed=${JSON.stringify(path.join(f.base, 'lockfile-refreshed'))}`, + `case "$*" in\n *--lockfile-only*) rc=${fallbackRc}; [ "$rc" -eq 0 ] && : > "$refreshed"; exit "$rc" ;;\n *--frozen-lockfile*) rc=${frozenRc}; [ -f "$refreshed" ] && rc=0 ;;\n *) exit 9 ;;\nesac`, + `[ "$rc" -eq 0 ] && mkdir -p node_modules && cp -R ${JSON.stringify(path.join(f.base, 'playwright-stub'))} node_modules/playwright`, + 'exit "$rc"', + ].join('\n') + '\n', { mode: 0o755 }); + const r = f.run(); + const calls = fs.existsSync(path.join(f.base, 'install-calls')) ? fs.readFileSync(path.join(f.base, 'install-calls'), 'utf8').trim().split('\n') : []; + return { f, r, calls }; + } + + test('the frozen production install, then BROWSER_OK', () => { + const { r, calls } = installing(0, 0); + expect(r.status, r.stdout + r.stderr).toBe(0); + expect(calls).toEqual(['install --production --frozen-lockfile']); + expect(lastLine(r.stdout)).toBe('BROWSER_OK node 141.0.7390.37'); + }); + + test('a stale lockfile is refreshed, then installed production-only again', () => { + const { r, calls } = installing(1, 0); + expect(r.status, r.stdout + r.stderr).toBe(0); + expect(calls).toEqual(['install --production --frozen-lockfile', 'install --lockfile-only', 'install --production --frozen-lockfile']); + expect(lastLine(r.stdout)).toBe('BROWSER_OK node 141.0.7390.37'); + }); + + test('a failed install is BROWSER_UNAVAILABLE with the fix line', () => { + const { f, r, calls } = installing(1, 1); + expect(r.status).toBe(1); + expect(calls).toEqual(['install --production --frozen-lockfile', 'install --lockfile-only']); + expect(lastLine(r.stdout)).toBe(`BROWSER_UNAVAILABLE bun install failed under ${f.root}`); + expect(r.stderr).toContain(`fix: cd ${f.root} && ./setup, then re-run`); + }); +}); + describe('browse preflight wiring (scripts/resolvers/browse.ts)', () => { test('every browser skill\'s $B detection runs gstack-browser-ensure from the install root before READY', () => { for (const host of ['claude', 'codex'] as const) { diff --git a/test/setup-production-deps.test.ts b/test/setup-production-deps.test.ts index cdcfdac31..ef8e5ff3e 100644 --- a/test/setup-production-deps.test.ts +++ b/test/setup-production-deps.test.ts @@ -33,11 +33,16 @@ function sliceFunction(source: string, name: string): string { return source.slice(start + 1, end + 3); } -/** A bun that records each argv line; `install` with --frozen-lockfile exits $FROZEN_RC. */ +/** + * A bun that records each argv line. Like Bun, a --frozen-lockfile install fails + * ($FROZEN_RC) until `install --lockfile-only` has refreshed the lockfile; any other + * call exits $FALLBACK_RC. + */ function stubBun(base: string): { bun: string; calls: () => string[] } { const log = path.join(base, 'calls'); const bun = path.join(base, 'bun'); - fs.writeFileSync(bun, `#!/usr/bin/env bash\necho "$*" >> ${JSON.stringify(log)}\ncase "$*" in *--frozen-lockfile*) exit "\${FROZEN_RC:-0}" ;; esac\nexit 0\n`, { mode: 0o755 }); + const fresh = path.join(base, 'lockfile-refreshed'); + fs.writeFileSync(bun, `#!/usr/bin/env bash\necho "$*" >> ${JSON.stringify(log)}\ncase "$*" in\n *--frozen-lockfile*) [ -f ${JSON.stringify(fresh)} ] && exit 0; exit "\${FROZEN_RC:-0}" ;;\n *--lockfile-only*) rc="\${FALLBACK_RC:-0}"; [ "$rc" -eq 0 ] && : > ${JSON.stringify(fresh)}; exit "$rc" ;;\nesac\nexit "\${FALLBACK_RC:-0}"\n`, { mode: 0o755 }); return { bun, calls: () => (fs.existsSync(log) ? fs.readFileSync(log, 'utf-8').trim().split('\n') : []) }; } @@ -46,7 +51,7 @@ describe.skipIf(process.platform === 'win32')('setup installs production depende const script = (bun: string, call: string) => `set -e\nBUN_CMD=${JSON.stringify(bun)}\n${sliceFunction(setup, 'bun_cmd')}\n${sliceFunction(setup, 'install_runtime_deps')}\n${call}\n`; - test('install_runtime_deps passes --production with the frozen lockfile, and keeps it on the fallback', () => { + test('install_runtime_deps passes --production with the frozen lockfile, and refreshes a stale lockfile before installing production-only again', () => { const base = tempBase(); const { bun, calls } = stubBun(base); expect(runBashScript(script(bun, 'install_runtime_deps'), { env: { ...process.env, FROZEN_RC: '0' } }).status).toBe(0); @@ -55,7 +60,18 @@ describe.skipIf(process.platform === 'win32')('setup installs production depende const base2 = tempBase(); const stub2 = stubBun(base2); expect(runBashScript(script(stub2.bun, 'install_runtime_deps'), { env: { ...process.env, FROZEN_RC: '1' } }).status).toBe(0); - expect(stub2.calls()).toEqual(['install --production --frozen-lockfile', 'install --production']); + expect(stub2.calls()).toEqual(['install --production --frozen-lockfile', 'install --lockfile-only', 'install --production --frozen-lockfile']); + + // Generated by /ship Step 7 coverage audit (GSTA-97). + // Value: protects=a failed fallback install stops setup's install step instead of building on a missing node_modules; + // fails_when=install_runtime_deps swallows the fallback's failure (an added `|| true` or a trailing command); + // why_new=both rows above end in a successful install; seam=none; no_claim=setup's own subshell wiring around the call + const base3 = tempBase(); + const stub3 = stubBun(base3); + const failed = runBashScript(script(stub3.bun, 'install_runtime_deps\necho AFTER'), { env: { ...process.env, FROZEN_RC: '1', FALLBACK_RC: '3' } }); + expect(failed.status).toBe(3); + expect(failed.stdout).not.toContain('AFTER'); + expect(stub3.calls()).toEqual(['install --production --frozen-lockfile', 'install --lockfile-only']); }); test('every bun install in setup goes through install_runtime_deps', () => { @@ -71,7 +87,7 @@ describe.skipIf(process.platform === 'win32')('setup installs production depende test('gstack-browser-ensure installs production dependencies too', () => { const line = read('bin/gstack-browser-ensure').split('\n').find((l) => /bun install/.test(l) && !l.trim().startsWith('#') && !/log /.test(l))!; expect(line).toContain('bun install --production --frozen-lockfile'); - expect(line).toContain('|| bun install --production >/dev/null'); + expect(line).toContain('|| { bun install --lockfile-only >/dev/null && bun install --production --frozen-lockfile >/dev/null; }'); }); test('bin/dev-setup installs the full set even over a production-only node_modules', () => { @@ -87,11 +103,87 @@ describe.skipIf(process.platform === 'win32')('setup installs production depende }); }); +// Generated by /ship Step 7 coverage audit (GSTA-97). +// Value: protects=with the real Bun, install_runtime_deps omits devDependencies on a fresh install and keeps the ones a full install already put there; +// fails_when=Bun starts pruning devDependencies on --production (a later ./setup strips a contributor's toolchain) or --production stops excluding them; +// why_new=every other test here stubs bun, so the CHANGELOG and CONTRIBUTING claim that ./setup never removes packages was untested; +// seam=none; no_claim=registry packages or the repo's own bun.lock (two local file: packages stand in; offline) +describe.skipIf(process.platform === 'win32')('install_runtime_deps with the real Bun', () => { + test('a fresh install leaves out devDependencies; a later production install keeps the ones a full install added', () => { + const base = tempBase(); + const project = path.join(base, 'project'); + for (const name of ['runtime-pkg', 'dev-pkg']) { + fs.mkdirSync(path.join(project, 'pkgs', name), { recursive: true }); + fs.writeFileSync(path.join(project, 'pkgs', name, 'package.json'), JSON.stringify({ name, version: '1.0.0' })); + } + fs.writeFileSync(path.join(project, 'package.json'), JSON.stringify({ + name: 'prod-deps-fixture', version: '0.0.0', + dependencies: { 'runtime-pkg': 'file:./pkgs/runtime-pkg' }, + devDependencies: { 'dev-pkg': 'file:./pkgs/dev-pkg' }, + })); + const env = { ...process.env, BUN_INSTALL_CACHE_DIR: path.join(base, 'cache') }; + const setup = read('setup'); + const run = (call: string) => runBashScript( + `set -e\nBUN_CMD=${JSON.stringify(process.execPath)}\n${sliceFunction(setup, 'bun_cmd')}\n${sliceFunction(setup, 'install_runtime_deps')}\n${call}\n`, + { cwd: project, env, timeout: 90_000 }); + const has = (name: string) => fs.existsSync(path.join(project, 'node_modules', name, 'package.json')); + + const lockfile = run('bun_cmd install'); + expect(lockfile.status, lockfile.stderr).toBe(0); + const lock = fs.readFileSync(path.join(project, 'bun.lock'), 'utf-8'); + fs.rmSync(path.join(project, 'node_modules'), { recursive: true, force: true }); + + const fresh = run('install_runtime_deps'); + expect(fresh.status, fresh.stderr).toBe(0); + expect([has('runtime-pkg'), has('dev-pkg')]).toEqual([true, false]); + + const full = run('bun_cmd install'); + expect(full.status, full.stderr).toBe(0); + expect(has('dev-pkg')).toBe(true); + + const later = run('install_runtime_deps'); + expect(later.status, later.stderr).toBe(0); + expect([has('runtime-pkg'), has('dev-pkg')]).toEqual([true, true]); + expect(fs.readFileSync(path.join(project, 'bun.lock'), 'utf-8')).toBe(lock); + }); + + // Value: protects=a checkout whose bun.lock is behind package.json (a fork, a local edit) still installs, production-only; + // fails_when=the fallback reruns a --production install, which Bun treats as frozen, so setup aborts on the stale lockfile; + // why_new=the stub-bun rows cannot model Bun's rule that --production implies a frozen lockfile; + // seam=none; no_claim=registry resolution (local file: packages; offline) + test('a stale lockfile is refreshed, then the install stays production-only', () => { + const base = tempBase(); + const project = path.join(base, 'project'); + for (const name of ['runtime-pkg', 'late-pkg', 'dev-pkg']) { + fs.mkdirSync(path.join(project, 'pkgs', name), { recursive: true }); + fs.writeFileSync(path.join(project, 'pkgs', name, 'package.json'), JSON.stringify({ name, version: '1.0.0' })); + } + const manifest = (deps: Record) => fs.writeFileSync(path.join(project, 'package.json'), JSON.stringify({ + name: 'prod-deps-fixture', version: '0.0.0', dependencies: deps, devDependencies: { 'dev-pkg': 'file:./pkgs/dev-pkg' }, + })); + const env = { ...process.env, BUN_INSTALL_CACHE_DIR: path.join(base, 'cache') }; + const setup = read('setup'); + const run = (call: string) => runBashScript( + `set -e\nBUN_CMD=${JSON.stringify(process.execPath)}\n${sliceFunction(setup, 'bun_cmd')}\n${sliceFunction(setup, 'install_runtime_deps')}\n${call}\n`, + { cwd: project, env, timeout: 90_000 }); + const has = (name: string) => fs.existsSync(path.join(project, 'node_modules', name, 'package.json')); + + manifest({ 'runtime-pkg': 'file:./pkgs/runtime-pkg' }); + expect(run('bun_cmd install --lockfile-only').status).toBe(0); + manifest({ 'runtime-pkg': 'file:./pkgs/runtime-pkg', 'late-pkg': 'file:./pkgs/late-pkg' }); + + const stale = run('install_runtime_deps'); + expect(stale.status, stale.stderr).toBe(0); + expect([has('runtime-pkg'), has('late-pkg'), has('dev-pkg')]).toEqual([true, true, false]); + expect(fs.readFileSync(path.join(project, 'bun.lock'), 'utf-8')).toContain('late-pkg'); + }); +}); + /** Bare package names a source file loads (import/require/dynamic import), type-only imports excluded. */ -export function importedPackages(text: string): string[] { +function importedPackages(text: string): string[] { const out = new Set(); const patterns = [ - /^\s*import\s+(?!type\b)[^'"\n]*?from\s+['"]([^'"]+)['"]/gm, + /^\s*(?:import|export)\s+(?!type\b)[^'";]*?from\s+['"]([^'"]+)['"]/gm, /^\s*import\s+['"]([^'"]+)['"]/gm, /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g, /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g, @@ -109,7 +201,7 @@ export function importedPackages(text: string): string[] { } /** Every shipped-runtime file that loads a package which is not a production dependency. */ -export function nonProductionImports(pkg: { dependencies?: Record }, files: Record): string[] { +function nonProductionImports(pkg: { dependencies?: Record }, files: Record): string[] { const deps = pkg.dependencies ?? {}; const bad: string[] = []; for (const [file, text] of Object.entries(files)) { @@ -145,9 +237,42 @@ describe('setup and runtime need only production dependencies', () => { expect(nonProductionImports(PKG, files)).toEqual([]); }); + // Generated by /ship Step 7 coverage audit (GSTA-97). + // Value: protects=modules the shipped entry points load by relative import (gen-skill-docs' scripts/ helpers) use production dependencies only; + // fails_when=a scripts/ module gen-skill-docs imports adds a devDependency import, breaking every user render; + // why_new=runtimeFiles() scans fixed roots, and scripts/discover-skills.ts, gen-agents-digest.ts and the rest are outside them; + // seam=none; no_claim=dynamic import paths built at runtime, or packages loaded by a spawned subprocess + test('every module the shipped code reaches by relative import loads only production dependencies', () => { + const files = runtimeFiles(); + const reached: Record = {}; + const queue = Object.keys(files); + const relSpec = /^\s*(?:import|export)\s+(?!type\b)[^'";]*?from\s+['"](\.\.?\/[^'"]+)['"]|\b(?:import|require)\(\s*['"](\.\.?\/[^'"]+)['"]\s*\)/gm; + while (queue.length) { + const rel = queue.pop()!; + const text = files[rel] ?? reached[rel]; + for (const m of text.matchAll(relSpec)) { + const spec = path.posix.normalize(path.posix.join(path.posix.dirname(rel), m[1] ?? m[2])); + const target = [spec, `${spec}.ts`, `${spec}.js`, `${spec}/index.ts`].find((c) => fs.existsSync(path.join(ROOT, c)) && fs.statSync(path.join(ROOT, c)).isFile()); + if (!target || target.startsWith('..') || target in files || target in reached || /(^|\/)(test|node_modules)\//.test(target) || !/\.(ts|js|mjs)$/.test(target)) continue; + reached[target] = fs.readFileSync(path.join(ROOT, target), 'utf-8'); + queue.push(target); + } + } + expect(Object.keys(reached)).toContain('scripts/discover-skills.ts'); + expect(nonProductionImports(PKG, reached)).toEqual([]); + }); + test('negative controls: a devDependency import and a moved-back runtime package are caught', () => { expect(nonProductionImports(PKG, { 'bin/x': "import { query } from '@anthropic-ai/claude-agent-sdk';" })).toEqual(['bin/x: @anthropic-ai/claude-agent-sdk']); expect(nonProductionImports(PKG, { 'bin/x': "import type { Q } from '@anthropic-ai/claude-agent-sdk';\nimport fs from 'node:fs';" })).toEqual([]); + expect(nonProductionImports(PKG, { 'lib/x.ts': "export { query } from '@anthropic-ai/claude-agent-sdk';" })).toEqual(['lib/x.ts: @anthropic-ai/claude-agent-sdk']); + expect(nonProductionImports(PKG, { 'lib/x.ts': "export * from 'typescript';" })).toEqual(['lib/x.ts: typescript']); + expect(nonProductionImports(PKG, { 'lib/x.ts': "export type { Q } from '@anthropic-ai/claude-agent-sdk';" })).toEqual([]); + // Generated by /ship Step 7 coverage audit (GSTA-97). + // Value: protects=the scan sees an import statement split over several lines; + // fails_when=importedPackages only matches one-line imports, so a multi-line devDependency import ships unflagged; + // why_new=both existing controls are one-line imports; seam=none; no_claim=none beyond protects + expect(nonProductionImports(PKG, { 'bin/x': "import {\n query,\n type SDKMessage,\n} from '@anthropic-ai/claude-agent-sdk';" })).toEqual(['bin/x: @anthropic-ai/claude-agent-sdk']); const { ['@anthropic-ai/sdk']: _sdk, ...rest } = PKG.dependencies; const files = runtimeFiles(); expect(nonProductionImports({ dependencies: rest }, files)).toContain('bin/gstack-distill-free-text: @anthropic-ai/sdk');