Release CodeStory 0.16.3

.github/scripts/build-marketplace-fixture.mjs

@@ -15,6 +15,11 @@ import { execFileSync } from "node:child_process";
 import { mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
+import {
+  FIXTURE_MARKER_FILENAME,
+  FIXTURE_MARKER_PURPOSE,
+} from "./marketplace-delivery-identity.mjs";
+
 function fail(message) {
   console.error(`::error::${message}`);
   process.exit(1);
@@ -53,7 +58,8 @@ if (typeof manifest.version !== "string" || !manifest.version) {
   fail("pinned commit has no plugin version");
 }
 
-const catalogDirectory = path.join(path.resolve(args.out), ".agents", "plugins");
+const fixtureRoot = path.resolve(args.out);
+const catalogDirectory = path.join(fixtureRoot, ".agents", "plugins");
 mkdirSync(catalogDirectory, { recursive: true });
 // Mirrors the live catalog's shape at .agents/plugins/marketplace.json. The
 // resolver rejects a catalog missing `name`, and the live catalog carries no
@@ -87,9 +93,35 @@ writeFileSync(
   `${JSON.stringify(catalog, null, 2)}\n`,
 );
 
-// The fixture must be a git repository: the Codex resolver clones it like the live catalog.
+// A fixture catalog is a DISTINCT delivery state, not a stand-in that may pass for the live
+// catalog, so it says so in its own bytes. The installed-runtime predicate refuses to accept a
+// deferred installation unless the resolved marketplace root carries this marker naming the
+// exact commit the catalog pins -- an arbitrary local git directory, or a clone of the live
+// marketplace, cannot satisfy the deferred shape by accident.
+//
+// This file sits beside .agents/, not inside it: the resolver reads only
+// .agents/plugins/marketplace.json, so the catalog the resolver sees stays byte-identical in
+// shape to the live one.
+writeFileSync(
+  path.join(fixtureRoot, FIXTURE_MARKER_FILENAME),
+  `${JSON.stringify(
+    {
+      schema_version: 1,
+      purpose: FIXTURE_MARKER_PURPOSE,
+      pinned_commit: commit,
+      plugin_version: manifest.version,
+    },
+    null,
+    2,
+  )}\n`,
+);
+
+// The fixture must be a git repository: the Codex resolver reads it like the live catalog.
+// It deliberately has NO `origin` remote. Pointing one at the live marketplace URL would make
+// the fixture claim an identity it does not have, and the deferred predicate asserts the
+// absence positively rather than tolerating a failed probe.
 const git = (...command) =>
-  execFileSync("git", ["-C", path.resolve(args.out), ...command], { encoding: "utf8" });
+  execFileSync("git", ["-C", fixtureRoot, ...command], { encoding: "utf8" });
 git("init", "--quiet", "--initial-branch", "main");
 git("config", "user.email", "release@codestory.invalid");
 git("config", "user.name", "CodeStory release");

.github/scripts/build-marketplace-fixture.test.mjs

@@ -4,8 +4,8 @@
 // fixture path failed at preflight.
 
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import test from "node:test";
@@ -76,3 +76,69 @@ test("the fixture states no version, because the live catalog states none", () =
     rmSync(out, { recursive: true, force: true });
   }
 });
+
+// A fixture catalog is a DISTINCT delivery state, not a stand-in that may pass for the live one.
+// The installed-runtime predicate refuses a deferred install whose marketplace root does not carry
+// this marker naming the exact commit the catalog pins, so an arbitrary local git directory -- or
+// a clone of the live marketplace -- cannot satisfy the deferred shape by accident.
+test("the fixture identifies itself and the commit it pins", () => {
+  const { out, commit } = buildFixture();
+  try {
+    const marker = JSON.parse(
+      readFileSync(path.join(out, ".codestory-marketplace-fixture.json"), "utf8"),
+    );
+    assert.deepEqual(Object.keys(marker).sort(), [
+      "pinned_commit",
+      "plugin_version",
+      "purpose",
+      "schema_version",
+    ]);
+    assert.equal(marker.schema_version, 1);
+    assert.equal(marker.purpose, "codestory-candidate-pinned-marketplace-fixture");
+    assert.equal(marker.pinned_commit, commit);
+    // The marker must be committed, or a clean-tree check would pass over a fixture that had
+    // been re-marked after the fact.
+    assert.equal(
+      execFileSync("git", ["-C", out, "status", "--porcelain"], { encoding: "utf8" }).trim(),
+      "",
+    );
+  } finally {
+    rmSync(out, { recursive: true, force: true });
+  }
+});
+
+// The fixture deliberately has no `origin`. Pointing one at the live marketplace URL would make it
+// claim an identity it does not have, and the predicate asserts the absence positively rather than
+// treating a failed probe as proof of anything. The predicate's own probe used to hard-fail here,
+// which is what made the deferred path unprovable in the first place.
+test("the fixture is local-only and never claims the live marketplace as its origin", () => {
+  const { out } = buildFixture();
+  try {
+    const probe = spawnSync("git", ["-C", out, "remote", "get-url", "origin"], {
+      encoding: "utf8",
+    });
+    assert.notEqual(probe.status, 0, "a candidate-pinned fixture must have no origin remote");
+    assert.match(probe.stderr, /No such remote/u);
+    assert.equal(
+      execFileSync("git", ["-C", out, "remote"], { encoding: "utf8" }).trim(),
+      "",
+    );
+  } finally {
+    rmSync(out, { recursive: true, force: true });
+  }
+});
+
+// The resolver reads .agents/plugins/marketplace.json and nothing else, so the marker must not
+// change the catalog the resolver sees.
+test("the marker sits outside the catalog the resolver reads", () => {
+  const { out, catalog } = buildFixture();
+  try {
+    assert.equal(catalog.fixture, undefined);
+    assert.equal(
+      existsSync(path.join(out, ".agents", "plugins", ".codestory-marketplace-fixture.json")),
+      false,
+    );
+  } finally {
+    rmSync(out, { recursive: true, force: true });
+  }
+});