Two build/release hygiene gaps from the review of #347, both now closed.
1. Test recovery phrase in release bundles. The 12-word phrase in src/shared/constants.js survived in every release bundle as dead text: module.exports keeps DEBUG_MNEMONIC live even though the only code that
reads it folds away in a release build, so it could not be tree-shaken. It is
now behind the __BUILD_DEBUG__ define (the pattern BUILD_DEBUG_MARKER
already uses); esbuild folds it to null in a release build and no emitted
bundle carries it, while a debug build still gets it. script/verify-build
now also fails a release build if the phrase appears in any emitted file, so a
future regression cannot pass silently; script/test-verify-build covers both
the release failure and the debug allowance.
2. Committed-key guard.tests/extensionId.test.js guarded key material by
filename extension only. It now reads the content of every tracked file and
fails on a PEM private-key header, catching a key committed under any name.
Mutation check: reverting DEBUG_MNEMONIC to an unconditional literal makes make build fail at script/verify-build ("carries the BIP-39 test
recovery phrase") instead of passing; restoring the guard makes it green.
Disclosures:
The issue tagged item 1 as post-1.0; this PR does both, per the definition
of done and the unit brief.
make check green was established across an earlier full run plus a
standalone script/test-verify-build (48/48, the identical invocation make check uses) and a clean make fmt on the rebased TODO.md: a single
monolithic run was repeatedly killed by the host's low-memory guard under a
load-300 storm. CI runs the full make check on push.
Model: opus-4-8
Two build/release hygiene gaps from the review of
https://git.eeqj.de/sneak/AutistMask/pulls/347, both now closed.
**1. Test recovery phrase in release bundles.** The 12-word phrase in
`src/shared/constants.js` survived in every release bundle as dead text:
`module.exports` keeps `DEBUG_MNEMONIC` live even though the only code that
reads it folds away in a release build, so it could not be tree-shaken. It is
now behind the `__BUILD_DEBUG__` define (the pattern `BUILD_DEBUG_MARKER`
already uses); esbuild folds it to `null` in a release build and no emitted
bundle carries it, while a debug build still gets it. `script/verify-build`
now also fails a release build if the phrase appears in any emitted file, so a
future regression cannot pass silently; `script/test-verify-build` covers both
the release failure and the debug allowance.
**2. Committed-key guard.** `tests/extensionId.test.js` guarded key material by
filename extension only. It now reads the content of every tracked file and
fails on a PEM private-key header, catching a key committed under any name.
Mutation check: reverting `DEBUG_MNEMONIC` to an unconditional literal makes
`make build` fail at `script/verify-build` ("carries the BIP-39 test
recovery phrase") instead of passing; restoring the guard makes it green.
Disclosures:
- The issue tagged item 1 as post-1.0; this PR does both, per the definition
of done and the unit brief.
- `make check` green was established across an earlier full run plus a
standalone `script/test-verify-build` (48/48, the identical invocation
`make check` uses) and a clean `make fmt` on the rebased `TODO.md`: a single
monolithic run was repeatedly killed by the host's low-memory guard under a
load-300 storm. CI runs the full `make check` on push.
Model: opus-4-8
The 12-word BIP-39 test phrase survived in every release bundle as dead
text: module.exports keeps DEBUG_MNEMONIC live even though wallet.js's only
use of it folds away in a release build, so it could not be tree-shaken.
Putting the value itself behind the __BUILD_DEBUG__ define makes esbuild fold
it to null, so no distributed bundle carries it. script/verify-build now
fails a release build if the phrase appears in any emitted file, so the fold
cannot silently regress; test-verify-build covers both the release failure
and the debug allowance.
tests/extensionId.test.js now scans the content of every tracked file for a
PEM private-key header instead of matching filename extensions alone, so a
key committed under an unexpected name is caught.
Model: opus-4-8
clawbot
self-assigned this 2026-09-21 09:57:22 +02:00
PASS: the test recovery phrase is folded out of every release bundle and script/verify-build fails a release build that carries it (mutation reproduced), a debug build still ships it in all four bundles, the committed-key guard in tests/extensionId.test.js matches on the PEM private-key header content so a rename cannot slip a key past it, and script/test-verify-build genuinely exercises both the release failure and the debug allowance; a single monolithic make check is green (tests, the verify-build harness, lint and formatting).
Judgement call: the PR body runs about 264 words, marginally over the ~250 guideline; the overage is the two required disclosures, so not treated as blocking.
Model: opus-4-8
PASS: the test recovery phrase is folded out of every release bundle and `script/verify-build` fails a release build that carries it (mutation reproduced), a debug build still ships it in all four bundles, the committed-key guard in `tests/extensionId.test.js` matches on the PEM private-key header content so a rename cannot slip a key past it, and `script/test-verify-build` genuinely exercises both the release failure and the debug allowance; a single monolithic `make check` is green (tests, the verify-build harness, lint and formatting).
Judgement call: the PR body runs about 264 words, marginally over the ~250 guideline; the overage is the two required disclosures, so not treated as blocking.
Model: opus-4-8
clawbot
merged commit 9ac7df0128 into next2026-09-21 18:29:39 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Two build/release hygiene gaps from the review of
#347, both now closed.
1. Test recovery phrase in release bundles. The 12-word phrase in
src/shared/constants.jssurvived in every release bundle as dead text:module.exportskeepsDEBUG_MNEMONIClive even though the only code thatreads it folds away in a release build, so it could not be tree-shaken. It is
now behind the
__BUILD_DEBUG__define (the patternBUILD_DEBUG_MARKERalready uses); esbuild folds it to
nullin a release build and no emittedbundle carries it, while a debug build still gets it.
script/verify-buildnow also fails a release build if the phrase appears in any emitted file, so a
future regression cannot pass silently;
script/test-verify-buildcovers boththe release failure and the debug allowance.
2. Committed-key guard.
tests/extensionId.test.jsguarded key material byfilename extension only. It now reads the content of every tracked file and
fails on a PEM private-key header, catching a key committed under any name.
Mutation check: reverting
DEBUG_MNEMONICto an unconditional literal makesmake buildfail atscript/verify-build("carries the BIP-39 testrecovery phrase") instead of passing; restoring the guard makes it green.
Disclosures:
of done and the unit brief.
make checkgreen was established across an earlier full run plus astandalone
script/test-verify-build(48/48, the identical invocationmake checkuses) and a cleanmake fmton the rebasedTODO.md: a singlemonolithic run was repeatedly killed by the host's low-memory guard under a
load-300 storm. CI runs the full
make checkon push.Model: opus-4-8
PASS: the test recovery phrase is folded out of every release bundle and
script/verify-buildfails a release build that carries it (mutation reproduced), a debug build still ships it in all four bundles, the committed-key guard intests/extensionId.test.jsmatches on the PEM private-key header content so a rename cannot slip a key past it, andscript/test-verify-buildgenuinely exercises both the release failure and the debug allowance; a single monolithicmake checkis green (tests, the verify-build harness, lint and formatting).Judgement call: the PR body runs about 264 words, marginally over the ~250 guideline; the overage is the two required disclosures, so not treated as blocking.
Model: opus-4-8