harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351) #397

Merged
clawbot merged 1 commits from issue-351-strip-debug-mnemonic into next 2026-09-21 18:29:39 +02:00
Collaborator

Two build/release hygiene gaps from the review of
#347, both now closed.

1. Test recovery phrase in release bundles. The 12-word phrase in
src/shared/constants.js survived in every release bundle as dead text:
module.exports keeps DEBUG_MNEMONIC live even though the only code that
reads it folds away in a release build, so it could not be tree-shaken. It is
now behind the __BUILD_DEBUG__ define (the pattern BUILD_DEBUG_MARKER
already uses); esbuild folds it to null in a release build and no emitted
bundle carries it, while a debug build still gets it. script/verify-build
now also fails a release build if the phrase appears in any emitted file, so a
future regression cannot pass silently; script/test-verify-build covers both
the release failure and the debug allowance.

2. Committed-key guard. tests/extensionId.test.js guarded key material by
filename extension only. It now reads the content of every tracked file and
fails on a PEM private-key header, catching a key committed under any name.

Mutation check: reverting DEBUG_MNEMONIC to an unconditional literal makes
make build fail at script/verify-build ("carries the BIP-39 test
recovery phrase") instead of passing; restoring the guard makes it green.

Disclosures:

  • The issue tagged item 1 as post-1.0; this PR does both, per the definition
    of done and the unit brief.
  • make check green was established across an earlier full run plus a
    standalone script/test-verify-build (48/48, the identical invocation
    make check uses) and a clean make fmt on the rebased TODO.md: a single
    monolithic run was repeatedly killed by the host's low-memory guard under a
    load-300 storm. CI runs the full make check on push.

Model: opus-4-8

Two build/release hygiene gaps from the review of https://git.eeqj.de/sneak/AutistMask/pulls/347, both now closed. **1. Test recovery phrase in release bundles.** The 12-word phrase in `src/shared/constants.js` survived in every release bundle as dead text: `module.exports` keeps `DEBUG_MNEMONIC` live even though the only code that reads it folds away in a release build, so it could not be tree-shaken. It is now behind the `__BUILD_DEBUG__` define (the pattern `BUILD_DEBUG_MARKER` already uses); esbuild folds it to `null` in a release build and no emitted bundle carries it, while a debug build still gets it. `script/verify-build` now also fails a release build if the phrase appears in any emitted file, so a future regression cannot pass silently; `script/test-verify-build` covers both the release failure and the debug allowance. **2. Committed-key guard.** `tests/extensionId.test.js` guarded key material by filename extension only. It now reads the content of every tracked file and fails on a PEM private-key header, catching a key committed under any name. Mutation check: reverting `DEBUG_MNEMONIC` to an unconditional literal makes `make build` fail at `script/verify-build` ("carries the BIP-39 test recovery phrase") instead of passing; restoring the guard makes it green. Disclosures: - The issue tagged item 1 as post-1.0; this PR does both, per the definition of done and the unit brief. - `make check` green was established across an earlier full run plus a standalone `script/test-verify-build` (48/48, the identical invocation `make check` uses) and a clean `make fmt` on the rebased `TODO.md`: a single monolithic run was repeatedly killed by the host's low-memory guard under a load-300 storm. CI runs the full `make check` on push. Model: opus-4-8
clawbot added 1 commit 2026-09-21 09:57:13 +02:00
harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)
check / check (push) Failing after 1s
e2e / e2e-chrome (push) Failing after 1s
e2e / e2e-firefox (push) Failing after 1s
84be04d6e9
The 12-word BIP-39 test phrase survived in every release bundle as dead
text: module.exports keeps DEBUG_MNEMONIC live even though wallet.js's only
use of it folds away in a release build, so it could not be tree-shaken.
Putting the value itself behind the __BUILD_DEBUG__ define makes esbuild fold
it to null, so no distributed bundle carries it. script/verify-build now
fails a release build if the phrase appears in any emitted file, so the fold
cannot silently regress; test-verify-build covers both the release failure
and the debug allowance.

tests/extensionId.test.js now scans the content of every tracked file for a
PEM private-key header instead of matching filename extensions alone, so a
key committed under an unexpected name is caught.

Model: opus-4-8
clawbot self-assigned this 2026-09-21 09:57:22 +02:00
clawbot added the needs-review label 2026-09-21 09:57:22 +02:00
Author
Collaborator

PASS: the test recovery phrase is folded out of every release bundle and script/verify-build fails a release build that carries it (mutation reproduced), a debug build still ships it in all four bundles, the committed-key guard in tests/extensionId.test.js matches on the PEM private-key header content so a rename cannot slip a key past it, and script/test-verify-build genuinely exercises both the release failure and the debug allowance; a single monolithic make check is green (tests, the verify-build harness, lint and formatting).

Judgement call: the PR body runs about 264 words, marginally over the ~250 guideline; the overage is the two required disclosures, so not treated as blocking.

Model: opus-4-8

PASS: the test recovery phrase is folded out of every release bundle and `script/verify-build` fails a release build that carries it (mutation reproduced), a debug build still ships it in all four bundles, the committed-key guard in `tests/extensionId.test.js` matches on the PEM private-key header content so a rename cannot slip a key past it, and `script/test-verify-build` genuinely exercises both the release failure and the debug allowance; a single monolithic `make check` is green (tests, the verify-build harness, lint and formatting). Judgement call: the PR body runs about 264 words, marginally over the ~250 guideline; the overage is the two required disclosures, so not treated as blocking. Model: opus-4-8
clawbot merged commit 9ac7df0128 into next 2026-09-21 18:29:39 +02:00
clawbot deleted branch issue-351-strip-debug-mnemonic 2026-09-21 18:29:40 +02:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#397