源码快照 @ 2026-09-01 (source-only, 剔除非源码素材)

2026-09-01 19:05:14 +08:00
commit 7be535059e
3358 changed files with 1306357 additions and 0 deletions
@@ -0,0 +1,830 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { access, chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import test from 'node:test';
+import { promisify } from 'node:util';
+import { parse as parseYaml } from 'yaml';
+import { resolveDesktopBuilderConfig } from '../apps/desktop/electron-builder.config.mjs';
+import {
+  parseAsfSourceReferenceTag,
+  resolveProductManifestIdentity,
+  resolveProductReleaseIdentity,
+} from './product-release-identity.mjs';
+import {
+  assertExpectedAppleTeam,
+  createSigningKeychain,
+  decodeSigningCertificate,
+  DISTRIBUTION_NODE_RUNTIME_ENTITLEMENTS,
+  distributionNodeEntitlements,
+  extractDistributionNodeEntitlements,
+  extractOfficialNodeEntitlements,
+  macosArm64MachOAction,
+  macosArm64CliWrapper,
+  parseDeveloperIdApplicationIdentity,
+  pruneThirdPartyDevelopmentArtifacts,
+  resolveCliWorkspacePackages,
+  runCommand,
+  stageWorkspacePackages,
+  standaloneInstallEnvironment,
+  standaloneInstallRootManifest,
+} from './package-macos-arm64-cli.mjs';
+import { resolveWorkspaceReleaseFiles } from './release-cli-file-policy.mjs';
+import { isTuiReadyOutput, verifyQuarantinedExecution } from './verify-macos-arm64-cli.mjs';
+import { makePtyProbe } from './verify-packaged-app.mjs';
+import { ensureProductTag } from './product-release-tag.mjs';
+
+const execFileAsync = promisify(execFile);
+const repoRoot = join(import.meta.dirname, '..');
+const desktopBuilderConfig = resolveDesktopBuilderConfig({});
+
+const rootManifest = {
+  version: '1.2.3',
+  packageManager: 'npm@11.19.0',
+  releaseToolchain: {
+    appleTeamIdentifier: 'FABM2QUA8Q',
+    node: '24.18.1',
+    nodeDarwinArm64Sha256: '1'.repeat(64),
+  },
+};
+
+test('one root version defines every product artifact from one source commit', () => {
+  const identity = resolveProductReleaseIdentity({
+    rootManifest,
+    desktopManifest: { version: '1.2.3' },
+    cliManifest: { version: '1.2.3', bin: { maka: './dist/cli.js' } },
+    sha: 'a'.repeat(40),
+    sourceReferenceTag: 'v1.2.3-incubating-rc2',
+  });
+
+  assert.equal(identity.version, '1.2.3');
+  assert.equal(identity.tag, 'v1.2.3');
+  assert.equal(identity.sourceCommit, 'a'.repeat(40));
+  assert.equal(identity.sourceReferenceTag, 'v1.2.3-incubating-rc2');
+  assert.equal(identity.runtimeHostSetupPackage, 'maka-agent@1.2.3');
+  assert.deepEqual(identity.publicCommands, ['maka']);
+  assert.equal(identity.appleTeamIdentifier, 'FABM2QUA8Q');
+  assert.equal(identity.nodeVersion, '24.18.1');
+  assert.equal(identity.nodeArchive, 'node-v24.18.1-darwin-arm64.tar.xz');
+  assert.equal(identity.nodeArchiveSha256, '1'.repeat(64));
+  assert.equal(
+    identity.nodeSourceUrl,
+    'https://nodejs.org/download/release/v24.18.1/node-v24.18.1-darwin-arm64.tar.xz',
+  );
+  assert.equal(identity.npmVersion, '11.19.0');
+  assert.equal(identity.dmg, 'Maka-1.2.3-mac-arm64.dmg');
+  assert.equal(identity.exe, 'Maka-1.2.3-win-x64.exe');
+  assert.equal(identity.cliArchive, 'Maka-1.2.3-cli-mac-arm64.zip');
+  assert.equal(Object.hasOwn(identity, 'sourceArchive'), false);
+  assert.deepEqual(identity.artifacts, {
+    'desktop-macos': [
+      'Maka-1.2.3-mac-arm64.dmg',
+      'Maka-1.2.3-mac-arm64.dmg.sha256',
+      'Maka-1.2.3-mac-arm64.zip',
+      'Maka-1.2.3-mac-arm64.zip.blockmap',
+      'latest-mac.yml',
+    ],
+    'desktop-windows': [
+      'Maka-1.2.3-win-x64.exe',
+      'Maka-1.2.3-win-x64.exe.blockmap',
+      'Maka-1.2.3-win-x64.exe.sha256',
+      'Maka-1.2.3-win-x64.zip',
+      'Maka-1.2.3-win-x64.zip.sha256',
+      'latest.yml',
+    ],
+    'cli-macos-arm64': ['Maka-1.2.3-cli-mac-arm64.zip', 'Maka-1.2.3-cli-mac-arm64.zip.sha256'],
+  });
+});
+
+test('the standalone launcher identifies its installed Eval bundle root', async (t) => {
+  const archiveRoot = await mkdtemp(join(tmpdir(), 'maka-standalone-launcher-'));
+  t.after(() => rm(archiveRoot, { recursive: true, force: true }));
+  const launcher = join(archiveRoot, 'bin', 'maka');
+  const node = join(archiveRoot, 'libexec', 'node', 'bin', 'node');
+  await Promise.all([
+    mkdir(join(archiveRoot, 'bin'), { recursive: true }),
+    mkdir(join(archiveRoot, 'libexec', 'node', 'bin'), { recursive: true }),
+  ]);
+  await Promise.all([
+    writeFile(launcher, macosArm64CliWrapper()),
+    writeFile(
+      node,
+      `#!/bin/sh
+expected=$(CDPATH= cd -P "$(dirname "$0")/../.." && pwd)
+[ "$MAKA_EVAL_MAKA_BUNDLE_PATH" = "$expected" ]
+printf verified
+`,
+    ),
+  ]);
+  await Promise.all([chmod(launcher, 0o755), chmod(node, 0o755)]);
+
+  const { stdout } = await execFileAsync('bash', [launcher]);
+
+  assert.equal(stdout, 'verified');
+});
+
+test('formal product identity rejects every prerelease channel', () => {
+  for (const version of ['1.2.3-alpha.1', '1.2.3-beta.2', '1.2.3-rc.1', '1.2.3-dev.1']) {
+    assert.throws(
+      () =>
+        resolveProductManifestIdentity({
+          rootManifest: { ...rootManifest, version },
+          desktopManifest: { version },
+          cliManifest: { version, bin: { maka: './dist/cli.js' } },
+        }),
+      /require a stable version/u,
+    );
+  }
+});
+
+test('Desktop packaging derives the Runtime Host setup package from product manifests', async () => {
+  const manifestIdentity = resolveProductManifestIdentity({
+    rootManifest,
+    desktopManifest: { version: '1.2.3' },
+    cliManifest: { version: '1.2.3', bin: { maka: './dist/cli.js' } },
+  });
+  assert.equal(manifestIdentity.runtimeHostSetupPackage, 'maka-agent@1.2.3');
+
+  const checkedRootManifest = JSON.parse(await readFile(join(repoRoot, 'package.json'), 'utf8'));
+  assert.deepEqual(desktopBuilderConfig.extraMetadata, {
+    runtimeHostSetupPackage: `maka-agent@${checkedRootManifest.version}`,
+    makaUpdateChannel: 'release',
+  });
+  assert.deepEqual(desktopBuilderConfig.publish, [
+    { provider: 'github', owner: 'apache', repo: 'maka' },
+  ]);
+});
+
+test('Desktop stages release manifests before electron-builder builds the archive', async (t) => {
+  const stage = await mkdtemp(join(tmpdir(), 'maka-desktop-release-manifests-'));
+  t.after(() => rm(stage, { recursive: true, force: true }));
+  const files = [{ filter: [...desktopBuilderConfig.files] }];
+
+  await desktopBuilderConfig.beforePack({
+    packager: {
+      config: { files },
+      info: { tempDirManager: { createTempDir: async () => stage } },
+    },
+  });
+
+  assert.equal(files.length, 2);
+  assert.ok(
+    files[0].filter.includes('!node_modules/@maka/{mcp,runtime,runtime-host}/package.json'),
+  );
+  assert.deepEqual(files.at(-1), { from: stage, to: 'node_modules/@maka' });
+  for (const name of ['mcp', 'runtime', 'runtime-host']) {
+    const projected = JSON.parse(await readFile(join(stage, name, 'package.json')));
+    assert.equal(
+      Object.keys(projected.exports).some((subpath) => subpath.startsWith('./test-only/')),
+      false,
+    );
+  }
+});
+
+test('Desktop packaging does not distribute the retired bundled Git runtime', () => {
+  const resources = desktopBuilderConfig.extraResources.map(({ from, to }) => ({ from, to }));
+  assert.equal(
+    resources.some(({ from }) => from.includes('dugite')),
+    false,
+  );
+  assert.equal(
+    resources.some(({ to }) => to === 'git' || to.startsWith('licenses/git')),
+    false,
+  );
+  assert.equal(
+    resources.some(({ to }) => to === 'bundled-git.json'),
+    false,
+  );
+  assert.equal(
+    resources.some(({ to }) => to.startsWith('licenses/dugite')),
+    false,
+  );
+});
+
+test('packaged third-party license sources are resolved, not assumed hoisted', () => {
+  // electron and @fontsource-variable/geist* are declared by apps/desktop, so
+  // `../../node_modules/<pkg>` only resolves when the installer hoists them to
+  // the workspace root. electron-builder logs a warning and still exits 0 on a
+  // missing `extraResources` source, so a non-hoisting layout would silently
+  // drop these notices. The config resolves each package instead; assert the
+  // sources are absolute paths that end at the intended in-package file.
+  const expectedSuffixes = new Map([
+    ['licenses/electron/LICENSE', join('electron', 'dist', 'LICENSE')],
+    [
+      'licenses/electron/LICENSES.chromium.html',
+      join('electron', 'dist', 'LICENSES.chromium.html'),
+    ],
+    ['licenses/renderer/GEIST_LICENSE.txt', join('@fontsource-variable', 'geist', 'LICENSE')],
+    [
+      'licenses/renderer/GEIST_MONO_LICENSE.txt',
+      join('@fontsource-variable', 'geist-mono', 'LICENSE'),
+    ],
+  ]);
+  const byTarget = new Map(desktopBuilderConfig.extraResources.map(({ from, to }) => [to, from]));
+  for (const [to, suffix] of expectedSuffixes) {
+    const from = byTarget.get(to);
+    assert.ok(from, `missing extraResources entry for ${to}`);
+    assert.ok(
+      isAbsolute(from),
+      `${to} source must be a resolved absolute path, not a '../../node_modules' hoisting assumption`,
+    );
+    assert.ok(from.endsWith(suffix), `${to} source must resolve to ${suffix}, got ${from}`);
+  }
+});
+
+test('macOS DMG ships correctly sized background assets', async () => {
+  const backgroundDirectory = join(repoRoot, 'apps', 'desktop', 'build');
+  const pngSignature = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+  for (const [name, dimensions] of [
+    ['background.png', { width: 540, height: 380 }],
+    ['background@2x.png', { width: 1080, height: 760 }],
+  ]) {
+    const data = await readFile(join(backgroundDirectory, name));
+    assert.deepEqual(data.subarray(0, pngSignature.length), pngSignature, `${name} must be a PNG`);
+    assert.deepEqual({ width: data.readUInt32BE(16), height: data.readUInt32BE(20) }, dimensions);
+  }
+});
+
+test('a successful Windows upgrade invalidates stale backup authority before best-effort cleanup', async () => {
+  const source = await readFile(
+    join(repoRoot, 'apps', 'desktop', 'build', 'installer.nsh'),
+    'utf8',
+  );
+  const macroStart = source.indexOf('!macro customInstall');
+  const macroEnd = source.indexOf('!macroend', macroStart);
+  assert.ok(macroStart >= 0 && macroEnd > macroStart);
+  const cleanup = source.slice(macroStart, macroEnd);
+  const markerInvalidation = cleanup.indexOf('Delete "$makaBackupDir\\${MAKA_BACKUP_MARKER}"');
+  const backupRemoval = cleanup.indexOf('RMDir /r "$makaBackupDir"');
+  const snapshotRemoval = cleanup.indexOf('DeleteRegKey SHELL_CONTEXT "${MAKA_SNAPSHOT_REG_KEY}"');
+
+  assert.ok(markerInvalidation >= 0);
+  assert.ok(backupRemoval > markerInvalidation);
+  assert.ok(snapshotRemoval > markerInvalidation);
+});
+
+test('platform package verifiers keep Git checks out of every artifact', async () => {
+  const windowsSource = await readFile(join(repoRoot, 'scripts', 'verify-windows-x64.mjs'), 'utf8');
+  assert.doesNotMatch(windowsSource, /bundledGitContract/u);
+  assert.doesNotMatch(windowsSource, /requirePath\(join\(resources, ['"]git['"]/u);
+  assert.match(
+    windowsSource,
+    /if \(requiresCurrentContract\) \{\s*await assertPackagedUpdateConfiguration\(resources, \{\s*channel: environment\.MAKA_DESKTOP_NIGHTLY_VERSION \? ['"]nightly['"] : ['"]release['"],\s*\}\);\s*await assertPackagedDependencyClosure\(resources\);\s*\}/u,
+  );
+
+  const macosSource = await readFile(
+    join(repoRoot, 'scripts', 'verify-macos-arm64-dmg.mjs'),
+    'utf8',
+  );
+  assert.doesNotMatch(macosSource, /requirePath\(join\(resources, ['"]git['"]/u);
+});
+
+test('the packaged-app probe rejects a mismatched Runtime Host setup package', async () => {
+  const fixture = await mkdtemp(join(tmpdir(), 'maka-packaged-manifest-'));
+  try {
+    const manifestPath = join(fixture, 'package.json');
+    const ptyDirectory = join(fixture, 'node_modules', 'node-pty');
+    await mkdir(ptyDirectory, { recursive: true });
+    await Promise.all([
+      writeFile(manifestPath, JSON.stringify({ runtimeHostSetupPackage: 'maka-agent@1.2.3' })),
+      writeFile(
+        join(ptyDirectory, 'index.js'),
+        `module.exports = { spawn() { return {
+  onData(listener) { queueMicrotask(() => listener('maka-node-pty-ok')); },
+  onExit(listener) { setImmediate(() => listener({ exitCode: 0 })); },
+}; } };\n`,
+      ),
+    ]);
+    await execFileAsync(process.execPath, [
+      '-e',
+      makePtyProbe('/bin/echo', ['maka-node-pty-ok'], 'maka-agent@1.2.3'),
+      manifestPath,
+    ]);
+    await assert.rejects(
+      execFileAsync(process.execPath, [
+        '-e',
+        makePtyProbe('/bin/echo', ['maka-node-pty-ok'], 'maka-agent@1.2.4'),
+        manifestPath,
+      ]),
+      /Packaged Runtime Host setup package mismatch/u,
+    );
+  } finally {
+    await rm(fixture, { recursive: true, force: true });
+  }
+});
+
+test('product releases accept only an exact same-version ASF source reference', () => {
+  assert.deepEqual(parseAsfSourceReferenceTag('v1.2.3-incubating-rc2'), {
+    rcNumber: '2',
+    tag: 'v1.2.3-incubating-rc2',
+    version: '1.2.3',
+  });
+  for (const tag of ['v1.2.3-incubating-rc0', 'v1.2.3-incubating-rc01', 'v1.2.3-rc1']) {
+    assert.throws(() => parseAsfSourceReferenceTag(tag), /ASF source reference must match/u);
+  }
+  assert.throws(
+    () =>
+      resolveProductReleaseIdentity({
+        rootManifest,
+        desktopManifest: { version: '1.2.3' },
+        cliManifest: { version: '1.2.3', bin: { maka: './dist/cli.js' } },
+        sha: 'a'.repeat(40),
+        sourceReferenceTag: 'v1.2.4-incubating-rc1',
+      }),
+    /source reference version 1\.2\.4 does not match product 1\.2\.3/u,
+  );
+});
+
+test('the product identity CLI uses the checked-out commit outside GitHub Actions', async () => {
+  const env = { ...process.env };
+  delete env.GITHUB_SHA;
+  delete env.GITHUB_OUTPUT;
+  const [{ stdout }, { stdout: head }, manifest] = await Promise.all([
+    execFileAsync(process.execPath, [join(repoRoot, 'scripts/product-release-identity.mjs')], {
+      cwd: repoRoot,
+      env,
+    }),
+    execFileAsync('git', ['rev-parse', 'HEAD'], { cwd: repoRoot }),
+    readFile(join(repoRoot, 'package.json'), 'utf8').then(JSON.parse),
+  ]);
+
+  assert.equal(stdout.trim(), `Product release v${manifest.version} from ${head.trim()}`);
+  await assert.rejects(
+    execFileAsync(process.execPath, [join(repoRoot, 'scripts/product-release-identity.mjs')], {
+      cwd: repoRoot,
+      env: { ...env, EXPECTED_PRODUCT_VERSION: '9.9.9' },
+    }),
+    /does not match requested release/u,
+  );
+});
+
+test('product release identity rejects a non-canonical version at its boundary', () => {
+  const version = '01.2.3';
+  assert.throws(
+    () =>
+      resolveProductReleaseIdentity({
+        rootManifest: { ...rootManifest, version },
+        desktopManifest: { version },
+        cliManifest: { version, bin: { maka: './dist/cli.js' } },
+        sha: 'a'.repeat(40),
+      }),
+    /valid product release version/u,
+  );
+});
+
+test('product tag creation is exact and idempotent but rejects a conflicting commit', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-product-tag-'));
+  const remote = join(root, 'remote.git');
+  const source = join(root, 'source');
+  try {
+    await execFileAsync('git', ['init', '--bare', remote]);
+    await mkdir(source);
+    await execFileAsync('git', ['init'], { cwd: source });
+    await execFileAsync('git', ['config', 'user.name', 'Maka release test'], { cwd: source });
+    await execFileAsync('git', ['config', 'user.email', 'release-test@example.invalid'], {
+      cwd: source,
+    });
+    await writeFile(join(source, 'source.txt'), 'one\n');
+    await execFileAsync('git', ['add', 'source.txt'], { cwd: source });
+    await execFileAsync('git', ['commit', '-m', 'first'], { cwd: source });
+    const first = (
+      await execFileAsync('git', ['rev-parse', 'HEAD'], { cwd: source })
+    ).stdout.trim();
+
+    assert.equal(
+      await ensureProductTag({ cwd: source, remote, tag: 'v1.2.3', source: first }),
+      'created',
+    );
+    assert.equal(
+      await ensureProductTag({ cwd: source, remote, tag: 'v1.2.3', source: first }),
+      'existing',
+    );
+
+    await writeFile(join(source, 'source.txt'), 'two\n');
+    await execFileAsync('git', ['commit', '-am', 'second'], { cwd: source });
+    const second = (
+      await execFileAsync('git', ['rev-parse', 'HEAD'], { cwd: source })
+    ).stdout.trim();
+    await assert.rejects(
+      ensureProductTag({ cwd: source, remote, tag: 'v1.2.3', source: second }),
+      /points to .* instead of/u,
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('standalone verification recognizes the current TUI status line through ANSI output', () => {
+  assert.equal(
+    isTuiReadyOutput(
+      '\u001b[1mMaka\u001b[22m\u001b[2m · \u001b[22m\u001b[2mAuto\u001b[22m\u001b[2m · model · provider\u001b[0m',
+    ),
+    true,
+  );
+});
+
+test('standalone verification assesses the downloaded quarantine state', async () => {
+  const commands = [];
+
+  await verifyQuarantinedExecution(
+    '/artifact/Maka',
+    '/artifact/Maka/libexec/node/bin/node',
+    async (command) => {
+      commands.push(command);
+    },
+  );
+
+  assert.deepEqual(commands, ['xattr', 'spctl']);
+});
+
+test('standalone packaging keeps or thins arm64 Mach-O files instead of deleting them', () => {
+  const macos = 'platform MACOS\n';
+  assert.equal(macosArm64MachOAction('arm64', macos), 'keep');
+  assert.equal(macosArm64MachOAction('x86_64 arm64', macos), 'thin');
+  assert.equal(macosArm64MachOAction('x86_64', macos), 'remove');
+  assert.equal(macosArm64MachOAction('arm64', 'platform IOS\n'), 'remove');
+});
+
+test('CLI signing accepts one base64 PKCS12 and one isolated Developer ID identity', () => {
+  const certificate = Buffer.from('pkcs12');
+  const encodedCertificate = certificate.toString('base64');
+  assert.deepEqual(decodeSigningCertificate(encodedCertificate), {
+    bytes: Buffer.from('pkcs12'),
+  });
+  assert.deepEqual(
+    decodeSigningCertificate(`${encodedCertificate.slice(0, 4)}\n${encodedCertificate.slice(4)}`),
+    {
+      bytes: certificate,
+    },
+  );
+  assert.throws(() => decodeSigningCertificate('not base64!'), /base64-encoded/u);
+  assert.deepEqual(
+    parseDeveloperIdApplicationIdentity(
+      '  1) ABCDEF0123456789ABCDEF0123456789ABCDEF01 "Developer ID Application: Maka Test (FABM2QUA8Q)"\n     1 valid identities found\n',
+    ),
+    {
+      hash: 'ABCDEF0123456789ABCDEF0123456789ABCDEF01',
+      name: 'Developer ID Application: Maka Test (FABM2QUA8Q)',
+      teamIdentifier: 'FABM2QUA8Q',
+    },
+  );
+  assert.throws(
+    () =>
+      parseDeveloperIdApplicationIdentity(
+        '  1) ABCDEF0123456789ABCDEF0123456789ABCDEF01 "Apple Development: Test"\n',
+      ),
+    /one Developer ID Application/u,
+  );
+  assert.throws(
+    () =>
+      assertExpectedAppleTeam(
+        { teamIdentifier: 'ABCDEFGHIJ' },
+        rootManifest.releaseToolchain.appleTeamIdentifier,
+      ),
+    /belongs to Apple team ABCDEFGHIJ, expected FABM2QUA8Q/u,
+  );
+});
+
+test('CLI signing removes temporary credentials when keychain deletion fails', async () => {
+  const signing = await createSigningKeychain({
+    env: { CSC_LINK: Buffer.from('pkcs12').toString('base64') },
+    expectedTeamIdentifier: 'FABM2QUA8Q',
+    run: async (command, args) => {
+      if (command === 'openssl') {
+        await writeFile(args[args.indexOf('-out') + 1], 'temporary private key');
+      }
+      if (command === 'security' && args[0] === 'delete-keychain') {
+        throw new Error('simulated keychain deletion failure');
+      }
+    },
+    inspect: async () => ({
+      stdout:
+        '  1) ABCDEF0123456789ABCDEF0123456789ABCDEF01 "Developer ID Application: Maka Test (FABM2QUA8Q)"\n     1 valid identities found\n',
+    }),
+  });
+
+  await assert.rejects(signing.cleanup(), /simulated keychain deletion failure/u);
+  await assert.rejects(access(signing.directory), { code: 'ENOENT' });
+});
+
+test('CLI signing command failures do not disclose credential arguments', async () => {
+  const secret = 'temporary-keychain-password';
+  await assert.rejects(
+    runCommand(process.execPath, ['-e', 'process.exit(9)', secret], {
+      displayArgs: ['-e', '<script>', '<redacted>'],
+    }),
+    (error) => {
+      assert.doesNotMatch(error.message, new RegExp(secret, 'u'));
+      assert.match(error.message, /<redacted>/u);
+      return true;
+    },
+  );
+});
+
+test('CLI signing removes development-only access from the official Node entitlements', () => {
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1.0"><dict>
+<key>com.apple.security.cs.allow-jit</key><true/>
+<key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
+<key>com.apple.security.cs.disable-executable-page-protection</key><true/>
+<key>com.apple.security.cs.allow-dyld-environment-variables</key><true/>
+<key>com.apple.security.cs.disable-library-validation</key><true/>
+<key>com.apple.security.get-task-allow</key><true/>
+</dict></plist>`;
+
+  assert.equal(extractOfficialNodeEntitlements(`Executable=/node\n${plist}`), plist);
+  const distributionPlist = distributionNodeEntitlements(plist);
+  assert.deepEqual(DISTRIBUTION_NODE_RUNTIME_ENTITLEMENTS, [
+    'com.apple.security.cs.allow-dyld-environment-variables',
+    'com.apple.security.cs.allow-jit',
+    'com.apple.security.cs.allow-unsigned-executable-memory',
+    'com.apple.security.cs.disable-executable-page-protection',
+    'com.apple.security.cs.disable-library-validation',
+  ]);
+  assert.doesNotMatch(distributionPlist, /get-task-allow/u);
+  assert.equal(extractDistributionNodeEntitlements(distributionPlist), distributionPlist);
+  assert.throws(
+    () =>
+      extractOfficialNodeEntitlements(
+        plist.replace(/<key>com\.apple\.security\.cs\.allow-jit<\/key><true\/>/u, ''),
+      ),
+    /entitlements do not match/u,
+  );
+  assert.throws(() => extractDistributionNodeEntitlements(plist), /entitlements do not match/u);
+});
+
+test('the Eval workspace owns the complete runtime asset declaration', async () => {
+  const workspaces = await resolveCliWorkspacePackages();
+  const evalWorkspace = workspaces.find(({ name }) => name === '@maka/eval');
+  assert.ok(evalWorkspace);
+  const releaseFiles = resolveWorkspaceReleaseFiles(
+    evalWorkspace.directory,
+    evalWorkspace.manifest,
+  );
+  assert.equal(releaseFiles.includes('dist'), true);
+  assert.equal(
+    releaseFiles.some((path) =>
+      path.split('/').some((segment) => ['src', 'test', 'tests', '__tests__'].includes(segment)),
+    ),
+    false,
+  );
+});
+
+test('standalone packaging applies the shared CLI file policy to dependencies', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-standalone-policy-'));
+  try {
+    await mkdir(join(root, 'test'), { recursive: true });
+    await mkdir(join(root, 'src'), { recursive: true });
+    await writeFile(join(root, 'test/fixture.js'), 'development');
+    await writeFile(join(root, 'src/index.js'), 'runtime');
+    await writeFile(join(root, 'src/index.ts'), 'development');
+
+    await pruneThirdPartyDevelopmentArtifacts(root);
+
+    assert.equal(await readFile(join(root, 'src/index.js'), 'utf8'), 'runtime');
+    await assert.rejects(readFile(join(root, 'test/fixture.js')), { code: 'ENOENT' });
+    await assert.rejects(readFile(join(root, 'src/index.ts')), { code: 'ENOENT' });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('standalone workspace staging keeps manifests consistent with copied files', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-standalone-workspace-'));
+  const workspace = join(root, 'workspace');
+  const install = join(root, 'install');
+  try {
+    const manifest = {
+      name: '@maka/example',
+      exports: {
+        '.': './dist/index.js',
+        './test-only/fixture': './dist/__tests__/fixture.js',
+      },
+      scripts: { build: 'tsc' },
+    };
+    await mkdir(join(workspace, 'dist', '__tests__'), { recursive: true });
+    await mkdir(install);
+    await writeFile(join(workspace, 'package.json'), `${JSON.stringify(manifest)}\n`);
+    await writeFile(join(workspace, 'dist', 'index.js'), 'runtime\n');
+    await writeFile(join(workspace, 'dist', 'dev-cli.js'), 'development\n');
+    await writeFile(join(workspace, 'dist', 'index.d.ts'), 'development\n');
+    await writeFile(join(workspace, 'dist', 'index.js.map'), 'development\n');
+    await writeFile(join(workspace, 'dist', '__tests__', 'fixture.js'), 'development\n');
+
+    await stageWorkspacePackages(install, [
+      {
+        directory: workspace,
+        manifest,
+        workspacePath: 'packages/example',
+      },
+    ]);
+
+    assert.deepEqual(JSON.parse(await readFile(join(install, 'packages/example/package.json'))), {
+      name: '@maka/example',
+      exports: { '.': './dist/index.js' },
+    });
+    const staged = join(install, 'packages', 'example', 'dist');
+    assert.equal(await readFile(join(staged, 'index.js'), 'utf8'), 'runtime\n');
+    for (const path of ['dev-cli.js', 'index.d.ts', 'index.js.map', '__tests__/fixture.js']) {
+      await assert.rejects(readFile(join(staged, path)), { code: 'ENOENT' });
+    }
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('standalone dependency installation removes host script policy and unrelated workspaces', () => {
+  const staged = standaloneInstallRootManifest(
+    {
+      private: true,
+      workspaces: ['packages/cli', 'apps/desktop'],
+      allowScripts: { electron: true },
+      overrides: { dependency: '1.0.0' },
+    },
+    [{ workspacePath: 'packages/cli' }],
+  );
+  assert.deepEqual(staged.workspaces, ['packages/cli']);
+  assert.equal(Object.hasOwn(staged, 'allowScripts'), false);
+  assert.deepEqual(staged.overrides, { dependency: '1.0.0' });
+});
+
+test('standalone dependency installation ignores caller-specific npm script policy', () => {
+  const environment = standaloneInstallEnvironment({
+    PATH: '/usr/bin',
+    npm_config_allow_scripts: '@opencode-ai/cli',
+  });
+  assert.deepEqual(environment, {
+    PATH: '/usr/bin',
+    npm_config_userconfig: join(process.cwd(), '.npmrc'),
+  });
+});
+
+test('one product workflow gates one draft release on every required artifact', async () => {
+  const source = await readFile(
+    new URL('../.github/workflows/release.yml', import.meta.url),
+    'utf8',
+  );
+  const workflow = parseYaml(source);
+  const jobs = workflow.jobs;
+
+  assert.equal(workflow.permissions.contents, 'read');
+  assert.equal(jobs.publish.permissions.contents, 'write');
+  assert.deepEqual(jobs.publish.needs, ['release-identity', 'desktop', 'cli-macos-arm64']);
+  assert.equal(jobs.publish.if, undefined);
+  assert.equal(Object.hasOwn(jobs, 'npm'), false);
+  assert.equal(workflow.on.workflow_dispatch.inputs.source_reference_tag.required, true);
+  assert.equal(jobs['release-identity'].steps[0].with.ref, '${{ github.sha }}');
+  const sourceAuthority = jobs['release-identity'].steps.find(
+    (step) => step.name === 'Require the exact ASF source reference',
+  ).run;
+  assert.match(sourceAuthority, /RELEASE_REPOSITORY.*apache\/maka/su);
+  assert.match(sourceAuthority, /refs\/tags\/\$SOURCE_REFERENCE_TAG/u);
+  assert.match(sourceAuthority, /git cat-file -t/u);
+  assert.match(sourceAuthority, /git rev-parse.*\^\{commit\}/u);
+  assert.match(sourceAuthority, /git merge-base --is-ancestor/u);
+  const liveSourceAuthority = jobs.publish.steps.find(
+    (step) => step.name === 'Revalidate the live ASF source reference',
+  ).run;
+  assert.match(liveSourceAuthority, /git fetch --force --no-tags origin/u);
+  assert.match(liveSourceAuthority, /git rev-parse.*\^\{commit\}/u);
+  assert.match(liveSourceAuthority, /git merge-base --is-ancestor/u);
+  assert.equal(Object.hasOwn(jobs, 'source'), false);
+  for (const name of ['desktop', 'cli-macos-arm64', 'publish']) {
+    const checkout = jobs[name].steps.find((step) =>
+      String(step.uses).startsWith('actions/checkout@'),
+    );
+    assert.equal(checkout.with.ref, '${{ needs.release-identity.outputs.source_commit }}');
+  }
+
+  const desktopStepNames = jobs.desktop.steps.map((step) => step.name);
+  const uploadIndex = desktopStepNames.indexOf('Upload the verified release assets');
+  assert.ok(uploadIndex >= 0);
+  for (const verifier of [
+    'Verify the final DMG',
+    'Verify the Windows release',
+    'Prove deterministic mid-install failure rollback',
+  ]) {
+    const verifierIndex = desktopStepNames.indexOf(verifier);
+    assert.ok(verifierIndex >= 0 && verifierIndex < uploadIndex);
+  }
+  for (const [jobName, group] of [
+    ['desktop', 'desktop-${{ matrix.platform }}'],
+    ['cli-macos-arm64', 'cli-macos-arm64'],
+  ]) {
+    const stage = jobs[jobName].steps.find(
+      (step) => step.name === 'Stage the exact product artifact group',
+    );
+    assert.ok(stage.run.includes(`product-release-artifacts.mjs stage "${group}"`));
+    const upload = jobs[jobName].steps.find((step) =>
+      String(step.uses).startsWith('actions/upload-artifact@'),
+    );
+    assert.equal(upload.with.path, '${{ runner.temp }}/release-assets');
+  }
+  const verifyArtifacts = jobs.publish.steps.find(
+    (step) => step.name === 'Verify the exact product artifact manifest',
+  ).run;
+  assert.match(verifyArtifacts, /product-release-artifacts\.mjs verify release-assets/u);
+  assert.doesNotMatch(verifyArtifacts, /required=\(|Maka-\*|latest\*\.yml/u);
+  const commands = Object.values(jobs)
+    .flatMap((job) => job.steps ?? [])
+    .map((step) => step.run)
+    .filter((run) => typeof run === 'string')
+    .join('\n');
+  assert.equal((commands.match(/gh release create/gu) ?? []).length, 1);
+  assert.equal(jobs.desktop['timeout-minutes'], 75);
+  assert.match(commands, /npm run package:windows-autoupdate-next/u);
+  assert.match(commands, /npm run verify:windows-autoupdate/u);
+  assert.match(commands, /npm run verify:windows-installer-rollback/u);
+  assert.match(commands, /product-release-tag\.mjs ensure/u);
+  assert.doesNotMatch(commands, /RECOVERY_SOURCE|inputs\.source_commit/u);
+  assert.match(commands, /if gh release view "\$TAG"/u);
+  assert.match(commands, /--json isDraft/u);
+  assert.match(commands, /gh release create[\s\S]*--verify-tag/u);
+  const publishRelease = jobs.publish.steps.find(
+    (step) => step.name === 'Create or update the draft GitHub Release',
+  ).run;
+  assert.equal(Object.hasOwn(jobs['release-identity'].outputs, 'is_prerelease'), false);
+  assert.equal(
+    Object.hasOwn(
+      jobs.publish.steps.find((step) => step.name === 'Create or update the draft GitHub Release')
+        .env,
+      'IS_PRERELEASE',
+    ),
+    false,
+  );
+  assert.match(publishRelease, /--prerelease=false/u);
+  assert.doesNotMatch(publishRelease, /--latest(?:\s|\\|$)/u);
+  assert.match(publishRelease, /--json isPrerelease/u);
+  assert.doesNotMatch(publishRelease, /gh release delete-asset/u);
+  assert.match(publishRelease, /gh release download/u);
+  assert.match(publishRelease, /cmp -s/u);
+  assert.match(publishRelease, /gh release upload/u);
+  assert.doesNotMatch(publishRelease, /--clobber/u);
+  const listAssets = publishRelease.indexOf('asset_names="$(gh release view');
+  const compareAssets = publishRelease.indexOf('cmp -s');
+  const uploadAssets = publishRelease.indexOf('gh release upload');
+  assert.ok(listAssets >= 0 && listAssets < compareAssets && compareAssets < uploadAssets);
+  assert.doesNotMatch(commands, /gh release create[\s\S]*--target/u);
+  assert.doesNotMatch(commands, /cli-v|npm (?:stage )?publish/u);
+});
+
+test('repository control plane admits only each release phase owner ref', async () => {
+  const config = parseYaml(await readFile(new URL('../.asf.yaml', import.meta.url), 'utf8'));
+  assert.deepEqual(config.github.protected_branches.main.required_status_checks.contexts, ['test']);
+  const environments = config.github.environments;
+  for (const [name, pattern, type] of [
+    ['release', 'v*-incubating-rc*', 'tag'],
+    ['product-release', 'main', 'branch'],
+  ]) {
+    assert.deepEqual(environments[name], {
+      required_reviewers: [{ id: 'M4n5ter', type: 'User' }],
+      wait_timer: 0,
+      prevent_self_review: true,
+      deployment_branch_policy: {
+        protected_branches: false,
+        policies: [{ name: pattern, type }],
+      },
+    });
+  }
+  for (const name of ['npm-publication', 'nightly']) {
+    assert.deepEqual(environments[name], {
+      required_reviewers: [],
+      wait_timer: 0,
+      prevent_self_review: false,
+      deployment_branch_policy: {
+        protected_branches: false,
+        policies: [{ name: 'main', type: 'branch' }],
+      },
+    });
+  }
+  assert.deepEqual(
+    config.github.rulesets.find((ruleset) => ruleset.name === 'Immutable release tags'),
+    {
+      name: 'Immutable release tags',
+      type: 'tag',
+      branches: { includes: ['v*'], excludes: [] },
+      restrict_deletion: true,
+      restrict_force_push: true,
+    },
+  );
+});