test: extend deep audit parity

ndycode · ndycode · commit 023bcc821471 · 2026-04-25T14:09:53.000+08:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -53,8 +53,8 @@ jobs:
       - name: Build
         run: npm run build
 
-  audit-prod:
-    name: Production dependency audit
+  audit-ci:
+    name: Dependency audit
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -71,5 +71,5 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Audit production dependencies (high+)
-        run: npm run audit:prod
+      - name: Audit dependencies and dev allowlist
+        run: npm run audit:ci
diff --git a/AGENTS.md b/AGENTS.md
@@ -44,7 +44,7 @@ OpenCode plugin: intercepts OpenAI SDK calls, routes through ChatGPT Codex backe
 - Source: root `index.ts` + `lib/`; `dist/` is generated output.
 - ESLint flat config: `no-explicit-any` enforced, unused args prefixed `_`.
 - Tests relax lint rules (see `eslint.config.js`).
-- Build emits `dist/lib/oauth-success.html` from the TypeScript source via `scripts/copy-oauth-success.js`.
+- Build cleans `dist/`, then emits `dist/lib/oauth-success.html` from the TypeScript source via `scripts/copy-oauth-success.js`.
 - ESM only (`"type": "module"`), Node >= 18.
 
 ## ANTI-PATTERNS (THIS PROJECT)
@@ -55,7 +55,7 @@ OpenCode plugin: intercepts OpenAI SDK calls, routes through ChatGPT Codex backe
 
 ## COMMANDS
 ```bash
-npm run build       # tsc + copy oauth-success.html
+npm run build       # clean dist + tsc + copy oauth-success.html
 npm run typecheck   # type checking only
 npm test            # vitest once
 npm run test:coverage # vitest coverage
diff --git a/docs/audits/_meta/verification-report.md b/docs/audits/_meta/verification-report.md
@@ -1,4 +1,4 @@
-> Audit source: 3331324cb14d2b80dd8dfb424619870a88476706 | Generated: 2026-04-25T12:45:33+08:00
+> Audit source: 3331324cb14d2b80dd8dfb424619870a88476706 | Generated: 2026-04-25T14:08:35+08:00
 
 # Verification Report
 
@@ -11,14 +11,18 @@ Local checks completed during the refresh:
 | `npm.cmd test -- test/doc-parity.test.ts test/index.test.ts` | Passed |
 | `npm.cmd test -- test/install-oc-codex-multi-auth.test.ts --reporter verbose` | Passed |
 | Deep current-doc structure sweep | Passed: 66 current documentation files checked; 21 registry entries match 21 tool modules; no stale structure anchors; no missing `npm run` script references |
-| `npm.cmd test -- test/doc-parity.test.ts` | Passed: 9 tests |
+| Deep multi-surface structure sweep | Passed: 320 repo files checked across workflows, package metadata, config models, docs, tool registry, tests, and static secret fixtures |
+| `npm.cmd test -- test/doc-parity.test.ts test/model-map.test.ts test/index.test.ts` | Passed: 3 files, 190 tests |
+| `npm.cmd test -- test/doc-parity.test.ts` | Passed: 12 tests |
+| `npm.cmd test -- test/clean-dist.test.ts test/doc-parity.test.ts` | Passed: 2 files, 15 tests |
 | `npm.cmd run lint` | Passed |
 | `npm.cmd run typecheck` | Passed |
-| `npm.cmd test` | Passed: 83 files, 2362 passed, 1 skipped |
-| `npm.cmd run test:coverage` | Passed: statements 80.38%, branches 71.6%, functions 89%, lines 81.92% |
-| `npm.cmd run build` | Passed |
+| `npm.cmd test` | Passed: 84 files, 2369 passed, 1 skipped |
+| `npm.cmd run test:coverage` | Passed: statements 80.39%, branches 71.62%, functions 89.01%, lines 81.94% |
+| `npm.cmd run build` | Passed; build now cleans `dist/` before compiling |
 | `npm.cmd run audit:ci` | Passed; production audit reported existing moderate advisories only under the configured high-severity gate |
-| `npm.cmd pack --pack-destination <temp>\pack` | Passed; produced `oc-codex-multi-auth-6.1.7.tgz` |
+| `npm.cmd pack --json --pack-destination <temp>\pack` | Passed; produced `oc-codex-multi-auth-6.1.7.tgz` |
+| `tar -tf <tarball> | findstr /i "_shared"` | Passed; rebuilt package no longer contains stale deleted `_shared` outputs |
 | `npm.cmd install <tarball> --ignore-scripts` | Passed in a fresh temp project |
 | `node --input-type=module -e 'await import("oc-codex-multi-auth"); await import("oc-codex-multi-auth/tui");'` | Passed; main default export resolved as a function and TUI export exposed `default` plus `shouldRefreshQuotaForEvent` |
 | `node node_modules\oc-codex-multi-auth\scripts\install-oc-codex-multi-auth.js --dry-run --no-cache-clear` | Passed against a temp HOME; only dry-run writes/removals were reported |
diff --git a/docs/development/TESTING.md b/docs/development/TESTING.md
@@ -21,7 +21,7 @@ What they cover:
 - `typecheck`: `tsc --noEmit`
 - `test`: Vitest suite across auth, config, request transformation, storage, UI, recovery, and rotation
 - `test:coverage`: Vitest coverage threshold gate from `vitest.config.ts`; statements/functions/lines keep an 80% global floor, while branch and legacy `index.ts` floors are calibrated to the current baseline
-- `build`: compile TypeScript and materialize `dist/lib/oauth-success.html` from `lib/oauth-success.ts` via `scripts/copy-oauth-success.js`
+- `build`: clean `dist/`, compile TypeScript, and materialize `dist/lib/oauth-success.html` from `lib/oauth-success.ts` via `scripts/copy-oauth-success.js`
 - `audit:ci`: production dependency audit plus the dev-advisory allowlist
 
 ## Current High-Value Test Areas
diff --git a/lib/tools/AGENTS.md b/lib/tools/AGENTS.md
@@ -13,7 +13,6 @@ tool into the OpenCode plugin surface.
 ```
 lib/tools/
   AGENTS.md
-  _shared.ts              # re-exports closure-free helpers from lib/runtime.ts
   index.ts                # ToolContext type + createToolRegistry(ctx) barrel
   codex-list.ts           # one file per tool
   codex-switch.ts
diff --git a/lib/tools/_shared.ts b/lib/tools/_shared.ts
diff --git a/package.json b/package.json
@@ -44,7 +44,7 @@
     "url": "https://github.com/ndycode/oc-codex-multi-auth/issues"
   },
   "scripts": {
-    "build": "tsc && node scripts/copy-oauth-success.js",
+    "build": "node scripts/clean-dist.js && tsc && node scripts/copy-oauth-success.js",
     "typecheck": "tsc --noEmit",
     "lint": "npm run lint:ts && npm run lint:scripts",
     "lint:ts": "eslint . --ext .ts",
diff --git a/scripts/clean-dist.js b/scripts/clean-dist.js
@@ -0,0 +1,27 @@
+import { promises as fs } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+function normalizeRelativePath(path) {
+	return path.replaceAll("\\", "/");
+}
+
+export async function cleanDist(options = {}) {
+	const repoRoot = resolve(options.repoRoot ?? resolve(__dirname, ".."));
+	const distDir = resolve(options.distDir ?? resolve(repoRoot, "dist"));
+	const relativeDist = normalizeRelativePath(relative(repoRoot, distDir));
+
+	if (relativeDist !== "dist") {
+		throw new Error(`Refusing to clean non-dist path: ${distDir}`);
+	}
+
+	await fs.rm(distDir, { recursive: true, force: true });
+	return { distDir };
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === __filename) {
+	await cleanDist();
+}
diff --git a/test/AGENTS.md b/test/AGENTS.md
@@ -21,6 +21,7 @@ test/
 ├── codex.test.ts                  # Codex instructions/caching
 ├── config.test.ts                 # configuration parsing/merging
 ├── context-overflow.test.ts       # context length handling
+├── clean-dist.test.ts             # build cleanup script tests
 ├── copy-oauth-success.test.ts     # build script tests
 ├── doc-parity.test.ts             # docs/config/current-structure parity
 ├── errors.test.ts                 # custom error types
diff --git a/test/README.md b/test/README.md
@@ -21,6 +21,7 @@ test/
 ├── codex.test.ts                  # Codex prompt/instructions behavior
 ├── config.test.ts                 # Configuration parsing/merging tests
 ├── context-overflow.test.ts       # Context length handling tests
+├── clean-dist.test.ts             # Build cleanup script tests
 ├── copy-oauth-success.test.ts     # Build script tests
 ├── doc-parity.test.ts             # Documentation/config/current-structure parity
 ├── errors.test.ts                 # Custom error type tests
diff --git a/test/clean-dist.test.ts b/test/clean-dist.test.ts
@@ -0,0 +1,46 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+describe("clean-dist script", () => {
+	it("exports cleanDist() for reuse/testing", async () => {
+		const mod = await import("../scripts/clean-dist.js");
+		expect(typeof mod.cleanDist).toBe("function");
+	});
+
+	it("removes only the dist directory under the provided repo root", async () => {
+		const mod = await import("../scripts/clean-dist.js");
+		const root = await mkdtemp(join(tmpdir(), "opencode-clean-dist-"));
+		const staleFile = join(root, "dist", "lib", "stale.js");
+		const siblingFile = join(root, "README.md");
+
+		try {
+			await mkdir(join(root, "dist", "lib"), { recursive: true });
+			await writeFile(staleFile, "stale", "utf8");
+			await writeFile(siblingFile, "keep", "utf8");
+
+			await mod.cleanDist({ repoRoot: root });
+
+			await expect(readFile(staleFile, "utf8")).rejects.toMatchObject({
+				code: "ENOENT",
+			});
+			await expect(readFile(siblingFile, "utf8")).resolves.toBe("keep");
+		} finally {
+			await rm(root, { recursive: true, force: true });
+		}
+	});
+
+	it("refuses to remove a path other than the repo dist directory", async () => {
+		const mod = await import("../scripts/clean-dist.js");
+		const root = await mkdtemp(join(tmpdir(), "opencode-clean-dist-"));
+
+		try {
+			await expect(
+				mod.cleanDist({ repoRoot: root, distDir: join(root, "not-dist") }),
+			).rejects.toThrow("Refusing to clean non-dist path");
+		} finally {
+			await rm(root, { recursive: true, force: true });
+		}
+	});
+});
diff --git a/test/doc-parity.test.ts b/test/doc-parity.test.ts
@@ -435,6 +435,102 @@ describe("runtime documentation parity", () => {
 		expect(hits).toEqual([]);
 	});
 
+	it("keeps GitHub CI aligned with the full local validation gate", () => {
+		const ciWorkflow = readRepoFile(".github/workflows/ci.yml");
+		const requiredCommands = [
+			"npm ci",
+			"npm run typecheck",
+			"npm run lint",
+			"npm test",
+			"npm run build",
+			"npm run audit:ci",
+		];
+
+		for (const command of requiredCommands) {
+			expect(ciWorkflow).toContain(command);
+		}
+
+		expect(ciWorkflow).not.toContain("run: npm run audit:prod");
+	});
+
+	it("keeps package metadata aligned with shipped source and install surfaces", () => {
+		const packageJson = JSON.parse(readRepoFile("package.json")) as {
+			bin?: Record<string, string>;
+			exports?: Record<string, { import?: string; types?: string }>;
+			files?: string[];
+			scripts?: Record<string, string>;
+		};
+		const requiredPackageFiles = [
+			"dist/",
+			"assets/",
+			"config/",
+			"scripts/",
+			"README.md",
+			"LICENSE",
+		];
+
+		for (const entry of requiredPackageFiles) {
+			expect(packageJson.files).toContain(entry);
+			if (entry !== "dist/") {
+				expect(repoPathExists(entry.replace(/\/$/, ""))).toBe(true);
+			}
+		}
+
+		const installerPath = packageJson.bin?.["oc-codex-multi-auth"];
+		expect(installerPath).toBe("scripts/install-oc-codex-multi-auth.js");
+		expect(repoPathExists(installerPath ?? "")).toBe(true);
+		expect(readRepoFile(installerPath ?? "")).toMatch(/^#!\/usr\/bin\/env node/);
+		expect(packageJson.scripts?.build).toContain("node scripts/clean-dist.js");
+		expect(repoPathExists("scripts/clean-dist.js")).toBe(true);
+
+		const exports = packageJson.exports ?? {};
+		const sourceForExport = new Map([
+			["./dist/index.js", "index.ts"],
+			["./dist/tui.js", "tui.ts"],
+		]);
+
+		for (const entry of Object.values(exports)) {
+			expect(entry.import).toBeDefined();
+			expect(entry.types).toBeDefined();
+			expect(entry.types).toBe(entry.import?.replace(/\.js$/, ".d.ts"));
+			const sourcePath = sourceForExport.get(entry.import ?? "");
+			expect(sourcePath).toBeDefined();
+			expect(repoPathExists(sourcePath ?? "")).toBe(true);
+		}
+	});
+
+	it("keeps committed fixtures free of static OpenAI-style secret strings", () => {
+		const scannedFiles = [
+			"AGENTS.md",
+			"README.md",
+			"CONTRIBUTING.md",
+			"SECURITY.md",
+			"package.json",
+			...collectRepoFiles(".github"),
+			...collectRepoFiles("config"),
+			...collectRepoFiles("docs"),
+			...collectRepoFiles("lib"),
+			...collectRepoFiles("scripts"),
+			...collectRepoFiles("skills"),
+			...collectRepoFiles("test"),
+		].filter((relativePath) => /\.(?:[cm]?[jt]s|json|md|ya?ml)$/.test(relativePath));
+		const secretPatterns: Array<[RegExp, string]> = [
+			[/sk-(?:live_|proj-)?[A-Za-z0-9._:-]{20,}/, "OpenAI-style API key"],
+		];
+		const hits: string[] = [];
+
+		for (const relativePath of scannedFiles) {
+			const fileContents = readRepoFile(relativePath);
+			for (const [pattern, label] of secretPatterns) {
+				if (pattern.test(fileContents)) {
+					hits.push(`${relativePath}: ${label}`);
+				}
+			}
+		}
+
+		expect(hits).toEqual([]);
+	});
+
 	it("keeps repo-local path references in current documentation resolvable", () => {
 		const hits: string[] = [];
 
diff --git a/test/index.test.ts b/test/index.test.ts
@@ -1493,6 +1493,10 @@ describe("OpenAIOAuthPlugin", () => {
 		});
 
 		it("redacts upstream auth material from usage fetch errors", async () => {
+			const fakeJwt = `eyJabc.eyJdef.${"sig"}`;
+			const fakeOpenAiKey = `sk-${"abcdefghijklmnopqrstuvwx"}`;
+			const fakeLiveKey = `sk-live_${"abcd"}.${"efgh"}:${"ijklmnopqrst"}`;
+			const fakeHexToken = `${"deadbeef".repeat(5)}`;
 			mockStorage.accounts = [
 				{
 					refreshToken: "r1",
@@ -1504,7 +1508,13 @@ describe("OpenAIOAuthPlugin", () => {
 			];
 			globalThis.fetch = vi.fn().mockResolvedValue(
 				new Response(
-					"upstream said Authorization: Bearer secret-token and jwt eyJabc.eyJdef.sig and sk-abcdefghijklmnopqrstuvwx and sk-live_abcd.efgh:ijklmnopqrst and deadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+					[
+						"upstream said Authorization: Bearer secret-token",
+						`and jwt ${fakeJwt}`,
+						`and ${fakeOpenAiKey}`,
+						`and ${fakeLiveKey}`,
+						`and ${fakeHexToken}`,
+					].join(" "),
 					{ status: 401, headers: { "content-type": "text/plain" } },
 				),
 			);
@@ -1515,10 +1525,10 @@ describe("OpenAIOAuthPlugin", () => {
 			expect(result).toContain("Bearer [redacted]");
 			expect(result).toContain("[redacted-token]");
 			expect(result).not.toContain("secret-token");
-			expect(result).not.toContain("eyJabc.eyJdef.sig");
-			expect(result).not.toContain("sk-abcdefghijklmnopqrstuvwx");
-			expect(result).not.toContain("sk-live_abcd.efgh:ijklmnopqrst");
-			expect(result).not.toContain("deadbeefdeadbeefdeadbeefdeadbeefdeadbeef");
+			expect(result).not.toContain(fakeJwt);
+			expect(result).not.toContain(fakeOpenAiKey);
+			expect(result).not.toContain(fakeLiveKey);
+			expect(result).not.toContain(fakeHexToken);
 		});
 
 		it("surfaces usage fetch timeouts without leaking raw abort errors", async () => {
diff --git a/test/model-map.test.ts b/test/model-map.test.ts
