codex-chief-of-staff/scripts/verify-packed-package.mjs

#!/usr/bin/env node

import assert from "node:assert/strict";
import { execFile } from "node:child_process";
import { constants } from "node:fs";
import { access, mkdtemp, rm, stat } from "node:fs/promises";
import { tmpdir } from "node:os";
import { basename, join, resolve } from "node:path";
import { promisify } from "node:util";

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const execFileAsync = promisify(execFile);
const EXPECTED_TOOLS = ["overview", "list_threads", "inspect_thread", "wait_for_change"];
const DEFAULT_CACHE = "/private/tmp/codex-chief-of-staff-npm-cache";

async function selectedTarball(argv) {
  if (argv.length !== 1) {
    throw new Error("usage: npm run verify:package -- /absolute/path/to/codex-chief-of-staff-VERSION.tgz");
  }
  const tarball = resolve(argv[0]);
  if (!tarball.endsWith(".tgz")) throw new Error("package path must end in .tgz");
  const metadata = await stat(tarball);
  if (!metadata.isFile()) throw new Error("package path must identify a readable file");
  await access(tarball, constants.R_OK);
  return tarball;
}

async function verify() {
  const tarball = await selectedTarball(process.argv.slice(2));
  const prefix = await mkdtemp(join(tmpdir(), "codex-chief-of-staff-package-"));
  const cache = process.env.CODEX_CHIEF_OF_STAFF_NPM_CACHE ?? DEFAULT_CACHE;
  let client;

  try {
    await execFileAsync("npm", [
      "install",
      "--prefix",
      prefix,
      "--ignore-scripts",
      "--cache",
      cache,
      tarball,
    ], { maxBuffer: 10 * 1024 * 1024 });

    const executable = join(prefix, "node_modules", ".bin", "codex-chief-of-staff");
    await access(executable, constants.X_OK);

    client = new Client({ name: "packed-artifact-verifier", version: "1.0.0" });
    const transport = new StdioClientTransport({
      command: executable,
      env: {
        ...process.env,
        CODEX_APP_SERVER_URL: process.env.CODEX_APP_SERVER_URL ?? "ws://127.0.0.1:4500",
      },
    });
    await client.connect(transport);

    const instructions = client.getInstructions();
    assert.match(instructions ?? "", /call overview first/i);
    const listed = await client.listTools();
    assert.deepEqual(listed.tools.map(({ name }) => name), EXPECTED_TOOLS);

    process.stdout.write(`${JSON.stringify({
      ok: true,
      package: basename(tarball),
      executable: "node_modules/.bin/codex-chief-of-staff",
      instructions: "verified",
      tools: EXPECTED_TOOLS,
    })}\n`);
  } finally {
    if (client !== undefined) await client.close().catch(() => undefined);
    await rm(prefix, { recursive: true, force: true });
  }
}

verify().catch((error) => {
  const message = error instanceof Error ? error.message : String(error);
  process.stderr.write(`Packed-package verification failed: ${message}\n`);
  process.exitCode = 1;
});