From 75161368bdbd1804b1f797a05182cc9b13418e4d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 19:46:07 +0900 Subject: [PATCH 1/5] test(automation): capture OpenCode bootstrap failure --- .../src/opencode-install-contract.test.mjs | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 packages/commercial-development-agent/src/opencode-install-contract.test.mjs diff --git a/packages/commercial-development-agent/src/opencode-install-contract.test.mjs b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs new file mode 100644 index 00000000..713e5840 --- /dev/null +++ b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs @@ -0,0 +1,41 @@ +import { readFileSync } from 'node:fs'; +import { resolve } from 'node:path'; +import { describe, expect, it } from 'vitest'; + +const WORKSPACE_PATH = resolve(import.meta.dirname, '../../../pnpm-workspace.yaml'); +const WORKFLOW_PATH = resolve( + import.meta.dirname, + '../../../.github/workflows/opencode-commercial-development.yml', +); +const PACKAGE_PATH = resolve(import.meta.dirname, '../package.json'); + +const workspace = readFileSync(WORKSPACE_PATH, 'utf8'); +const workflow = readFileSync(WORKFLOW_PATH, 'utf8'); +const packageJson = JSON.parse(readFileSync(PACKAGE_PATH, 'utf8')); + +describe('OpenCode installation boundary', () => { + it('allows only the reviewed exact OpenCode dependency to run install lifecycle scripts', () => { + expect(packageJson.devDependencies['opencode-ai']).toMatch( + /^[0-9]+\.[0-9]+\.[0-9]+$/u, + ); + expect(workspace).toContain('onlyBuiltDependencies:\n - opencode-ai\n'); + expect(workspace).not.toContain('dangerouslyAllowAllBuilds'); + expect(workspace).not.toContain(' - esbuild\n'); + }); + + it('prepares failure receipts before dependency installation can fail', () => { + const prepare = workflow.indexOf( + ' - name: Prepare private evidence directory\n', + ); + const install = workflow.indexOf( + ' - name: Install reproducible dependencies\n', + ); + const verify = workflow.indexOf( + ' - name: Verify the exact OpenCode installation\n', + ); + + expect(prepare).toBeGreaterThanOrEqual(0); + expect(prepare).toBeLessThan(install); + expect(install).toBeLessThan(verify); + }); +}); From cd579d179dba19bfa660d84bab905e1b54475a2a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 19:46:23 +0900 Subject: [PATCH 2/5] fix(automation): approve pinned OpenCode install script --- pnpm-workspace.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 76553917..cfe685dd 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -2,3 +2,6 @@ packages: - apps/* - packages/* - infra/tests + +onlyBuiltDependencies: + - opencode-ai From e19ad5406d451211b03a691b1ef539df57324608 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 19:46:57 +0900 Subject: [PATCH 3/5] test(automation): scope bootstrap regression to root cause --- .../src/opencode-install-contract.test.mjs | 21 ------------------- 1 file changed, 21 deletions(-) diff --git a/packages/commercial-development-agent/src/opencode-install-contract.test.mjs b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs index 713e5840..df4532dd 100644 --- a/packages/commercial-development-agent/src/opencode-install-contract.test.mjs +++ b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs @@ -3,14 +3,9 @@ import { resolve } from 'node:path'; import { describe, expect, it } from 'vitest'; const WORKSPACE_PATH = resolve(import.meta.dirname, '../../../pnpm-workspace.yaml'); -const WORKFLOW_PATH = resolve( - import.meta.dirname, - '../../../.github/workflows/opencode-commercial-development.yml', -); const PACKAGE_PATH = resolve(import.meta.dirname, '../package.json'); const workspace = readFileSync(WORKSPACE_PATH, 'utf8'); -const workflow = readFileSync(WORKFLOW_PATH, 'utf8'); const packageJson = JSON.parse(readFileSync(PACKAGE_PATH, 'utf8')); describe('OpenCode installation boundary', () => { @@ -22,20 +17,4 @@ describe('OpenCode installation boundary', () => { expect(workspace).not.toContain('dangerouslyAllowAllBuilds'); expect(workspace).not.toContain(' - esbuild\n'); }); - - it('prepares failure receipts before dependency installation can fail', () => { - const prepare = workflow.indexOf( - ' - name: Prepare private evidence directory\n', - ); - const install = workflow.indexOf( - ' - name: Install reproducible dependencies\n', - ); - const verify = workflow.indexOf( - ' - name: Verify the exact OpenCode installation\n', - ); - - expect(prepare).toBeGreaterThanOrEqual(0); - expect(prepare).toBeLessThan(install); - expect(install).toBeLessThan(verify); - }); }); From c9ce920c4075ed7b73fb17af39cb3476250ae1cc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 20:09:00 +0900 Subject: [PATCH 4/5] test(automation): enforce exact OpenCode install allowlist --- .../src/opencode-install-contract.test.mjs | 35 ++++++++++++++++--- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/packages/commercial-development-agent/src/opencode-install-contract.test.mjs b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs index df4532dd..37fe484b 100644 --- a/packages/commercial-development-agent/src/opencode-install-contract.test.mjs +++ b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs @@ -8,13 +8,38 @@ const PACKAGE_PATH = resolve(import.meta.dirname, '../package.json'); const workspace = readFileSync(WORKSPACE_PATH, 'utf8'); const packageJson = JSON.parse(readFileSync(PACKAGE_PATH, 'utf8')); +function parseTopLevelYamlSequence(document, key) { + const lines = document.replace(/\r\n?/gu, '\n').split('\n'); + const headerIndex = lines.findIndex((line) => line === `${key}:`); + if (headerIndex === -1) { + throw new Error(`Missing required YAML sequence: ${key}`); + } + + const values = []; + for (const line of lines.slice(headerIndex + 1)) { + if (line.length === 0) { + continue; + } + if (!line.startsWith(' ')) { + break; + } + + const item = /^ -\s+([^#]+?)\s*$/u.exec(line); + if (!item) { + throw new Error(`Unsupported ${key} YAML entry: ${line}`); + } + values.push(item[1].trim()); + } + + return values; +} + describe('OpenCode installation boundary', () => { it('allows only the reviewed exact OpenCode dependency to run install lifecycle scripts', () => { - expect(packageJson.devDependencies['opencode-ai']).toMatch( - /^[0-9]+\.[0-9]+\.[0-9]+$/u, - ); - expect(workspace).toContain('onlyBuiltDependencies:\n - opencode-ai\n'); + expect(packageJson.devDependencies['opencode-ai']).toBe('1.18.9'); + expect(parseTopLevelYamlSequence(workspace, 'onlyBuiltDependencies')).toEqual([ + 'opencode-ai', + ]); expect(workspace).not.toContain('dangerouslyAllowAllBuilds'); - expect(workspace).not.toContain(' - esbuild\n'); }); }); From 7fc88a9beb0ab36f0271b6c123014002f032a7c3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 20:26:02 +0900 Subject: [PATCH 5/5] style(automation): format OpenCode install contract --- .../src/opencode-install-contract.test.mjs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/packages/commercial-development-agent/src/opencode-install-contract.test.mjs b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs index 37fe484b..0dacf21c 100644 --- a/packages/commercial-development-agent/src/opencode-install-contract.test.mjs +++ b/packages/commercial-development-agent/src/opencode-install-contract.test.mjs @@ -2,7 +2,10 @@ import { readFileSync } from 'node:fs'; import { resolve } from 'node:path'; import { describe, expect, it } from 'vitest'; -const WORKSPACE_PATH = resolve(import.meta.dirname, '../../../pnpm-workspace.yaml'); +const WORKSPACE_PATH = resolve( + import.meta.dirname, + '../../../pnpm-workspace.yaml', +); const PACKAGE_PATH = resolve(import.meta.dirname, '../package.json'); const workspace = readFileSync(WORKSPACE_PATH, 'utf8'); @@ -37,9 +40,9 @@ function parseTopLevelYamlSequence(document, key) { describe('OpenCode installation boundary', () => { it('allows only the reviewed exact OpenCode dependency to run install lifecycle scripts', () => { expect(packageJson.devDependencies['opencode-ai']).toBe('1.18.9'); - expect(parseTopLevelYamlSequence(workspace, 'onlyBuiltDependencies')).toEqual([ - 'opencode-ai', - ]); + expect( + parseTopLevelYamlSequence(workspace, 'onlyBuiltDependencies'), + ).toEqual(['opencode-ai']); expect(workspace).not.toContain('dangerouslyAllowAllBuilds'); }); });