Files
orca/config/scripts
Neil 37a5b278b3 test(package): reject an Electron install takeover by exact command (#20799)
* test(package): reject an Electron install takeover by exact command

CodeRabbit was right about #20787. Replacing the pinned postinstall string
with a /electron/i keyword check was wrong in both directions, verified:

  rebuild-native-deps.mjs && rebuild-native-deps.mjs   PASSED  (should fail)
  rebuild-native-deps.mjs && check-electron-version    FAILED  (should pass)

The owner's own path contains no "electron", so duplicating it slipped
through -- the one case the contract is named for. And a substring match
rejects any later step that merely mentions Electron, which is the same
over-tightness that broke every open PR in the first place, relocated.

Later steps are now checked against the exact owned command plus the known
Electron install commands. A second case pins the rejections themselves,
because reading the real postinstall cannot show a bad chain would be caught
-- that is how #20787 shipped with a guard that did not guard.

Split into its own file rather than adding a max-lines disable (AGENTS.md).

* test(package): match install commands as tokens and cover the rebuild:electron alias

Both review comments were right, verified by running them:

  && check-install-app-deps-version.mjs   rejected by substring match (should pass)
  && pnpm run rebuild:electron            slipped through (should fail)

package.json:101 aliases rebuild:electron to the owned script, so invoking it
is the same takeover. Matching is now token-based with the owned command still
checked as a phrase, and both cases are pinned.
2026-09-15 01:10:35 -07:00
..
2026-05-15 05:44:25 -04:00