fix: stabilize npm publish checks

Author: benym

package.json

@@ -16,7 +16,7 @@
     "access": "public"
   },
   "bin": {
-    "comet": "./bin/comet.js"
+    "comet": "bin/comet.js"
   },
   "files": [
     "dist",
@@ -45,8 +45,8 @@
     "benchmark:execution": "node scripts/benchmark/context-execution-benchmark.mjs",
     "benchmark:classic": "node scripts/benchmark/classic-baseline-regression.mjs",
     "benchmark:bundle": "pnpm build && node scripts/benchmark/comet-bundle-compatibility-benchmark.mjs",
-    "prepare": "husky && pnpm run build",
-    "prepublishOnly": "node scripts/release/prepublish-check.js && pnpm run build",
+    "prepare": "node scripts/release/prepare.js",
+    "prepublishOnly": "node scripts/release/prepublish-check.js && node build.js",
     "postinstall": "node scripts/install/postinstall.js"
   },
   "lint-staged": {

scripts/release/prepare.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+
+import { execFileSync } from 'child_process';
+
+const npmCommand = process.env.npm_command ?? process.env.NPM_COMMAND;
+
+if (npmCommand === 'publish') {
+  console.log('[PREPARE] skipped during npm publish; prepublishOnly already runs build.');
+  process.exit(0);
+}
+
+execFileSync('husky', { stdio: 'inherit', shell: true });
+execFileSync(process.execPath, ['build.js'], { stdio: 'inherit' });

scripts/release/prepublish-check.js

@@ -5,40 +5,118 @@
  * Checks for common secret patterns in files that would be published.
  */
 
-import { readFileSync, readdirSync, statSync } from 'fs';
-import { join, extname } from 'path';
+import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
+import { extname, join } from 'path';
 
 const SECRET_PATTERNS = [
   { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]/i, name: 'API key' },
-  { pattern: /(?:secret|token|password|passwd|pwd)\s*[:=]\s*['"][^\s'"]{8,}['"]/i, name: 'Secret/token' },
+  {
+    pattern: /(?:secret|token|password|passwd|pwd)\s*[:=]\s*['"][^\s'"]{8,}['"]/i,
+    name: 'Secret/token',
+  },
   { pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/, name: 'Private key' },
   { pattern: /ghp_[A-Za-z0-9]{36}/, name: 'GitHub token' },
   { pattern: /sk-[A-Za-z0-9]{20,}/, name: 'OpenAI key' },
   { pattern: /xoxb-[0-9]+-[A-Za-z0-9]+/, name: 'Slack token' },
   { pattern: /AKIA[0-9A-Z]{16}/, name: 'AWS access key' },
 ];
 
-const SKIP_DIRS = new Set(['node_modules', '.git', 'dist']);
-const TEXT_EXTENSIONS = new Set(['.js', '.ts', '.json', '.md', '.txt', '.yml', '.yaml', '.toml']);
+const TEXT_EXTENSIONS = new Set([
+  '.cjs',
+  '.js',
+  '.jsx',
+  '.mjs',
+  '.ts',
+  '.tsx',
+  '.json',
+  '.md',
+  '.txt',
+  '.yml',
+  '.yaml',
+  '.toml',
+]);
 const README_IMAGE_PATTERN = /\b(?:src|srcset)=["'](?:\.\/)?img\//;
 
-function* walkFiles(dir) {
-  for (const entry of readdirSync(dir)) {
-    const full = join(dir, entry);
-    const stat = statSync(full);
-    if (stat.isDirectory()) {
-      if (!SKIP_DIRS.has(entry)) {
-        yield* walkFiles(full);
+function normalized(value) {
+  return value.replaceAll('\\', '/').replace(/^\.\//u, '').replace(/\/+/gu, '/');
+}
+
+function* walkIncludedPath(relativePath) {
+  const stat = statSync(relativePath);
+  if (stat.isFile()) {
+    yield normalized(relativePath);
+    return;
+  }
+  if (!stat.isDirectory()) return;
+
+  for (const entry of readdirSync(relativePath)) {
+    yield* walkIncludedPath(join(relativePath, entry));
+  }
+}
+
+function readPackageFileList() {
+  const packageJson = JSON.parse(readFileSync('package.json', 'utf-8'));
+  const files = Array.isArray(packageJson.files) ? packageJson.files : [];
+  const includes = files.filter((entry) => typeof entry === 'string' && !entry.startsWith('!'));
+  const excludes = files
+    .filter((entry) => typeof entry === 'string' && entry.startsWith('!'))
+    .map((entry) => normalized(entry.slice(1)));
+  return { includes, excludes };
+}
+
+function isExcludedFromPackage(filePath, excludes) {
+  const path = normalized(filePath);
+  for (const pattern of excludes) {
+    if (pattern === 'dist/**/*.test.js' && path.startsWith('dist/') && path.endsWith('.test.js')) {
+      return true;
+    }
+    if (
+      pattern === 'dist/**/__tests__' &&
+      path.startsWith('dist/') &&
+      path.split('/').includes('__tests__')
+    ) {
+      return true;
+    }
+    if (path === pattern || path.startsWith(`${pattern}/`)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function alwaysIncludedPackageFiles() {
+  const entries = readdirSync('.');
+  return entries.filter((entry) => {
+    const lower = entry.toLowerCase();
+    return (
+      lower === 'package.json' ||
+      lower.startsWith('readme') ||
+      lower.startsWith('license') ||
+      lower.startsWith('licence')
+    );
+  });
+}
+
+function publishedFiles() {
+  const { includes, excludes } = readPackageFileList();
+  const paths = new Set();
+
+  for (const entry of [...alwaysIncludedPackageFiles(), ...includes]) {
+    const relativePath = normalized(entry);
+    if (!relativePath || relativePath.startsWith('!') || !existsSync(relativePath)) continue;
+    for (const filePath of walkIncludedPath(relativePath)) {
+      if (!isExcludedFromPackage(filePath, excludes)) {
+        paths.add(filePath);
       }
-    } else if (stat.isFile()) {
-      yield full;
     }
   }
+
+  return [...paths].sort();
 }
 
 let found = 0;
 
-for (const filePath of walkFiles('.')) {
+for (const filePath of publishedFiles()) {
   const ext = extname(filePath);
   if (!TEXT_EXTENSIONS.has(ext)) continue;
 

test/repository/package-scripts.test.ts

@@ -0,0 +1,23 @@
+import { promises as fs } from 'fs';
+import { describe, expect, it } from 'vitest';
+
+describe('package scripts', () => {
+  it('runs the prepublish build without invoking pnpm from the npm lifecycle', async () => {
+    const packageJson = JSON.parse(await fs.readFile('package.json', 'utf-8')) as {
+      scripts?: Record<string, string>;
+    };
+
+    const prepublishOnly = packageJson.scripts?.prepublishOnly;
+
+    expect(prepublishOnly).toBe('node scripts/release/prepublish-check.js && node build.js');
+    expect(prepublishOnly).not.toContain('pnpm');
+  });
+
+  it('routes prepare through the release prepare helper', async () => {
+    const packageJson = JSON.parse(await fs.readFile('package.json', 'utf-8')) as {
+      scripts?: Record<string, string>;
+    };
+
+    expect(packageJson.scripts?.prepare).toBe('node scripts/release/prepare.js');
+  });
+});

test/scripts/prepublish-check.test.ts

@@ -0,0 +1,66 @@
+import { spawnSync } from 'child_process';
+import { promises as fs } from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+
+const temporary: string[] = [];
+const prepublishCheck = path.resolve('scripts/release/prepublish-check.js');
+
+afterEach(async () => {
+  await Promise.all(temporary.splice(0).map((dir) => fs.rm(dir, { recursive: true, force: true })));
+});
+
+async function writeFile(root: string, relativePath: string, content: string): Promise<void> {
+  const target = path.join(root, relativePath);
+  await fs.mkdir(path.dirname(target), { recursive: true });
+  await fs.writeFile(target, content, 'utf-8');
+}
+
+async function makePackageFixture(): Promise<string> {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'comet-prepublish-check-'));
+  temporary.push(root);
+
+  await writeFile(
+    root,
+    'package.json',
+    JSON.stringify(
+      {
+        name: 'comet-prepublish-check-fixture',
+        version: '1.0.0',
+        files: ['index.js', 'README.md'],
+      },
+      null,
+      2,
+    ),
+  );
+  await writeFile(root, 'README.md', '# Fixture\n');
+  await writeFile(root, 'index.js', 'export const ok = true;\n');
+  await writeFile(root, '.gitignore', ['eval/.cache/', 'eval/.pytest-basetemp-*/', ''].join('\n'));
+
+  return root;
+}
+
+describe('prepublish security check', () => {
+  it('scans only files that npm would publish', async () => {
+    const root = await makePackageFixture();
+    await writeFile(
+      root,
+      'eval/.cache/langsmith-cc-plugin/src/langsmith.test.ts',
+      'const api_key = "abcdefghijklmnopqrstuvwxyz";\n',
+    );
+    await writeFile(
+      root,
+      'eval/.pytest-basetemp-ci-green/token.txt',
+      'const api_key = "abcdefghijklmnopqrstuvwxyz";\n',
+    );
+
+    const result = spawnSync(process.execPath, [prepublishCheck], {
+      cwd: root,
+      encoding: 'utf-8',
+    });
+
+    expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
+    expect(result.stderr).not.toContain('[SECURITY]');
+  });
+});

test/scripts/release-prepare.test.ts

@@ -0,0 +1,17 @@
+import { spawnSync } from 'child_process';
+import path from 'path';
+import { describe, expect, it } from 'vitest';
+
+const prepareScript = path.resolve('scripts/release/prepare.js');
+
+describe('release prepare script', () => {
+  it('skips prepare work during npm publish because prepublishOnly already builds', () => {
+    const result = spawnSync(process.execPath, [prepareScript], {
+      encoding: 'utf-8',
+      env: { ...process.env, npm_command: 'publish', NPM_COMMAND: 'publish' },
+    });
+
+    expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
+    expect(result.stdout).toContain('skipped during npm publish');
+  });
+});