From 22837484f4dfa188e6b0cee7a6a7e68498c05720 Mon Sep 17 00:00:00 2001 From: Dotta Date: Thu, 8 Oct 2026 10:39:52 -0500 Subject: [PATCH] test: qualify selected Codex runtime independently of legacy dependencies Co-Authored-By: Paperclip --- .../grok-public-install-sandbox.test.mjs | 33 +++++++++++++++++-- scripts/grok-public-install-sandbox.mjs | 22 ++++++++----- 2 files changed, 44 insertions(+), 11 deletions(-) diff --git a/scripts/__tests__/grok-public-install-sandbox.test.mjs b/scripts/__tests__/grok-public-install-sandbox.test.mjs index ef296af1e50..75f6de4be0f 100644 --- a/scripts/__tests__/grok-public-install-sandbox.test.mjs +++ b/scripts/__tests__/grok-public-install-sandbox.test.mjs @@ -93,10 +93,33 @@ test('the installed Codex probe exercises the public export and rejects incomple assert.equal(JSON.parse(result.stdout).codexCommandLeaseVerified, true); assert.equal(readFileSync(join(server, 'lease-closed'), 'utf8'), 'ok'); assert.equal(JSON.parse(result.stdout).providerCalls, 0); + const legacyPath = 'node_modules/legacy-codex-adapter/node_modules/@openai/codex-' + target; + const legacy = join(consumer, legacyPath); mkdirSync(legacy, { recursive: true }); + const legacyManifest = { ...manifest, version: '0.156.1-' + target }; + writeFileSync(join(legacy, 'package.json'), JSON.stringify(legacyManifest)); + lock.packages[legacyPath] = { ...entry, version: legacyManifest.version, + resolved: 'https://registry.npmjs.org/@openai/codex/-/codex-' + legacyManifest.version + '.tgz' }; + writeFileSync(join(consumer, 'package-lock.json'), JSON.stringify(lock)); + result = run(); assert.equal(result.status, 0, result.stderr); + assert.equal(JSON.parse(result.stdout).codexPlatformPackages.length, 2); + assert.equal(JSON.parse(result.stdout).codexSelectedPlatformPath, platformPath); + assert.equal(JSON.parse(result.stdout).codexSelectedPlatformVersion, '0.160.0-' + target); + const legacyCommand = join(legacy, 'codex'); + writeFileSync(legacyCommand, '#!/bin/sh\nexit 0\n', { mode: 0o755 }); + writeFileSync(index, `export const resolvePinnedCodexCommand = () => ${JSON.stringify(legacyCommand)};`); + result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /Selected Codex platform version must match the qualified pin/); + writeFileSync(index, `import { writeFileSync } from 'node:fs'; export const resolvePinnedCodexCommand = () => { + writeFileSync(${JSON.stringify(join(platform, 'package.json'))}, ${JSON.stringify(JSON.stringify({ ...manifest, altered: true }))}); + return ${JSON.stringify(command)}; };`); + result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /metadata must match its scanned provenance/); + writeFileSync(join(platform, 'package.json'), JSON.stringify(manifest)); + writeFileSync(index, "export const resolvePinnedCodexCommand = () => { throw new Error('Bundled Codex runtime version mismatch'); };"); + result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /Bundled Codex runtime version mismatch/); + writeFileSync(index, `export const resolvePinnedCodexCommand = () => ${JSON.stringify(command)};`); const emptySlot = join(server, 'node_modules/@openai/codex-' + target); mkdirSync(emptySlot, { recursive: true }); result = run(); assert.equal(result.status, 0, result.stderr); - assert.equal(JSON.parse(result.stdout).codexPlatformPackages.length, 1, + assert.equal(JSON.parse(result.stdout).codexPlatformPackages.length, 2, 'An empty nested npm optional slot must not obscure the qualified hoisted host package'); writeFileSync(join(emptySlot, 'undeclared-native-payload'), 'native fixture; never executed'); result = run(); assert.notEqual(result.status, 0); assert.match(result.stderr, /empty regular directory; found.*undeclared-native-payload/); @@ -144,13 +167,17 @@ test('actual tar member checks allow Codex JavaScript but reject nested platform assert.match(source, /assertNoBundledCodexPayloads\(run\('tar', \['-tzf', tarball\]\)/); }); -test('consumer provenance rejects bundled, foreign, unpinned and non-official Codex payloads', () => { +test('consumer provenance rejects bundled, foreign, inconsistent and non-official Codex payloads', () => { const path = 'node_modules/@openai/codex-linux-x64'; const manifest = { name: '@openai/codex', version: '0.160.0-linux-x64', os: ['linux'], cpu: ['x64'] }; const entry = { version: manifest.version, resolved: `https://registry.npmjs.org/@openai/codex/-/codex-${manifest.version}.tgz`, integrity: `sha512-${Buffer.alloc(64, 1).toString('base64')}` }; - const check = (value = entry, installed = [{ path, manifest }]) => assertInstalledCodexPlatformProvenance({ packages: { [path]: value } }, installed, '0.160.0', 'linux-x64'); + const check = (value = entry, installed = [{ path, manifest }]) => assertInstalledCodexPlatformProvenance({ packages: { [path]: value } }, installed, 'linux-x64'); assert.equal(check().codexConsumerHostOnly, true); + const legacyManifest = { ...manifest, version: '0.156.1-linux-x64' }; + assert.equal(check({ ...entry, version: legacyManifest.version, + resolved: 'https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-linux-x64.tgz' }, [{ path, manifest: legacyManifest }]).codexConsumerHostOnly, true); + assert.throws(() => check(entry, [{ path, manifest: { ...manifest, version: '^0.160.0-linux-x64' } }]), /exact host version/); for (const change of [ { inBundle: true }, { link: true }, { version: '0.156.1-linux-x64' }, { resolved: 'https://example.com/@openai/codex/-/codex-0.160.0-linux-x64.tgz' }, diff --git a/scripts/grok-public-install-sandbox.mjs b/scripts/grok-public-install-sandbox.mjs index 4fbc8ab0ebc..b93a29879aa 100644 --- a/scripts/grok-public-install-sandbox.mjs +++ b/scripts/grok-public-install-sandbox.mjs @@ -24,17 +24,19 @@ export function assertNoBundledCodexPayloads(entries) { } } -// This same pure check is embedded in the offline installed consumer below. -export function assertInstalledCodexPlatformProvenance(lock, installed, expectedVersion, target) { +// Verify every host payload against its own official npm provenance, including +// independent legacy closures. The selected native runtime is pinned below. +export function assertInstalledCodexPlatformProvenance(lock, installed, target) { assert.match(target, /^(linux|darwin|win32)-(x64|arm64)$/); assert.ok(Array.isArray(installed) && installed.length > 0, 'Consumer must install its host Codex platform package'); const alias = `@openai/codex-${target}`; for (const { path, manifest } of installed) { assert.ok(path.endsWith(`/node_modules/${alias}`) || path === `node_modules/${alias}`, 'Consumer must contain only the host Codex platform payload'); - const version = `${expectedVersion}-${target}`; + const version = manifest.version; + assert.ok(typeof version === 'string' && version.endsWith('-' + target) + && /^\d+\.\d+\.\d+$/.test(version.slice(0, -target.length - 1)), 'Installed Codex platform must declare an exact host version'); assert.ok([alias, '@openai/codex'].includes(manifest.name), 'Installed Codex platform package identity must match its alias'); - assert.equal(manifest.version, version, 'Installed Codex platform version must match the qualified pin'); const [os, cpu] = target.split('-'); assert.deepEqual(manifest.os, [os]); assert.deepEqual(manifest.cpu, [cpu]); @@ -102,7 +104,7 @@ export function installedCodexProbeSource(indexPath, consumerRoot, expectedVersi } } } - const provenance = (${assertInstalledCodexPlatformProvenance.toString()})(lock, installed, ${JSON.stringify(expectedVersion)}, process.platform + '-' + process.arch); + const provenance = (${assertInstalledCodexPlatformProvenance.toString()})(lock, installed, process.platform + '-' + process.arch); const index = ${JSON.stringify(indexPath)}; assert.ok(contained(index), 'Codex public index must be installed in the consumer'); const { resolvePinnedCodexCommand } = await import(pathToFileURL(index).href); @@ -112,8 +114,12 @@ export function installedCodexProbeSource(indexPath, consumerRoot, expectedVersi assert.ok(statSync(command).isFile(), 'Pinned Codex must be a regular executable'); accessSync(command, constants.X_OK); const selectedPlatformManifest = realpathSync(createRequire(command).resolve('@openai/codex-' + process.platform + '-' + process.arch + '/package.json')); - assert.ok(installed.some(({ path }) => realpathSync(join(root, path, 'package.json')) === selectedPlatformManifest), - 'Codex wrapper must resolve an official host platform package from its installed graph'); + const selectedPlatform = installed.find(({ path }) => realpathSync(join(root, path, 'package.json')) === selectedPlatformManifest); + assert.ok(selectedPlatform, 'Codex wrapper must resolve an official host platform package from its installed graph'); + const selectedMetadata = JSON.parse(readFileSync(selectedPlatformManifest, 'utf8')); + assert.deepEqual(selectedMetadata, selectedPlatform.manifest, 'Selected Codex platform metadata must match its scanned provenance'); + assert.equal(selectedMetadata.version, ${JSON.stringify(expectedVersion)} + '-' + process.platform + '-' + process.arch, + 'Selected Codex platform version must match the qualified pin'); const version = execFileSync(command, ['--version'], { timeout: 30_000, maxBuffer: 128 * 1024, encoding: 'utf8', env: { PATH: '/usr/local/bin:/usr/bin:/bin', HOME: '/tmp', NODE_PATH: '' } }).trim(); assert.equal(version, 'codex-cli ' + ${JSON.stringify(expectedVersion)}, 'Installed Codex version must match the qualified pin'); @@ -130,7 +136,7 @@ export function installedCodexProbeSource(indexPath, consumerRoot, expectedVersi const lease = await installation.openCommand(); await lease.close(); console.log(JSON.stringify({ pinnedCodexCommandVerified: true, pinnedCodexVersion: ${JSON.stringify(expectedVersion)}, - ...provenance, codexQualifiedInstallationVerified: true, codexCommandLeaseVerified: true, providerCalls: 0 })); + ...provenance, codexSelectedPlatformPath: selectedPlatform.path, codexSelectedPlatformVersion: selectedMetadata.version, codexQualifiedInstallationVerified: true, codexCommandLeaseVerified: true, providerCalls: 0 })); `; }