From b094caeee326207dcd02461547a1e406f62549e0 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Fri, 12 Jun 2026 22:34:58 +0000
Subject: [PATCH] fix: validate D601 prepare-source yaml script

---
 scripts/src/hwlab-node.ts | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/scripts/src/hwlab-node.ts b/scripts/src/hwlab-node.ts
index 0ed2e0c9..3e5d371d 100644
--- a/scripts/src/hwlab-node.ts
+++ b/scripts/src/hwlab-node.ts
@@ -1246,6 +1246,7 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
     "node - \"$render_dir\" \"$overlay_b64\" <<'NODE'",
     "const fs = require('fs');",
     "const path = require('path');",
+    "const vm = require('node:vm');",
     "const renderDir = process.argv[2];",
     "const overlay = JSON.parse(Buffer.from(process.argv[3], 'base64').toString('utf8'));",
     "const pipelinePath = path.join(renderDir, overlay.tektonDir, 'pipeline.yaml');",
@@ -1302,11 +1303,14 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
     "  if (!file) return;",
     "  const full = path.join(dir, file);",
     "  console.error(JSON.stringify({ event: 'prepare-source-dependencies', status: 'npm-debug-log', path: full }));",
-    "  console.error(fs.readFileSync(full, 'utf8').split(/\\r?\\n/u).slice(-80).join('\\n'));",
+    "  const lines = fs.readFileSync(full, 'utf8').split(String.fromCharCode(10));",
+    "  console.error(lines.slice(-80).join(String.fromCharCode(10)));",
     "}",
     "if (hasYaml()) { emit('cached'); process.exit(0); }",
     "fs.mkdirSync('node_modules/yaml', { recursive: true });",
-    "const tarball = registry.replace(/\\/+$/u, '') + '/yaml/-/yaml-' + version + '.tgz';",
+    "let registryBase = registry;",
+    "while (registryBase.endsWith('/')) registryBase = registryBase.slice(0, -1);",
+    "const tarball = registryBase + '/yaml/-/yaml-' + version + '.tgz';",
     "const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hwlab-yaml-'));",
     "const tgz = path.join(tmpDir, 'yaml.tgz');",
     "if (run('curl', ['-fsSL', '--retry', String(retryCount), '--connect-timeout', '10', '--max-time', String(timeoutSeconds), '-o', tgz, tarball]) && run('tar', ['-xzf', tgz, '-C', 'node_modules/yaml', '--strip-components=1'])) emit('installed', { manager: 'tarball' });",
@@ -1326,6 +1330,21 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
     "NODE_UNIDESK_YAML_DEPENDENCY",
     "ci_timing_emit prepare-source-dependencies succeeded \"$prepare_source_dependencies_started_ms\"`;",
     "}",
+    "function validatePrepareSourceDependencyScript(script) {",
+    "  const marker = 'NODE_UNIDESK_YAML_DEPENDENCY';",
+    "  let offset = 0;",
+    "  while (true) {",
+    "    const markerStart = script.indexOf(\"node <<'\" + marker + \"'\", offset);",
+    "    if (markerStart === -1) return;",
+    "    const bodyStart = script.indexOf('\\n', markerStart);",
+    "    if (bodyStart === -1) throw new Error('prepare-source dependency heredoc body missing newline');",
+    "    const bodyEnd = script.indexOf('\\n' + marker, bodyStart + 1);",
+    "    if (bodyEnd === -1) throw new Error('prepare-source dependency heredoc terminator missing');",
+    "    const body = script.slice(bodyStart + 1, bodyEnd);",
+    "    try { new vm.Script(body, { filename: 'NODE_UNIDESK_YAML_DEPENDENCY.js' }); } catch (error) { throw new Error(`generated prepare-source yaml dependency script is invalid: ${error.message}`); }",
+    "    offset = bodyEnd + marker.length + 1;",
+    "  }",
+    "}",
     "function deployYamlOverlayScript() {",
     "  const runtimeOverlay = JSON.stringify({",
     "    nodeId: overlay.nodeId,",
@@ -1827,6 +1846,7 @@ function nodeRuntimePipelinePostprocessScript(): string[] {
     "    return `${match}\\n${[runtimePathOverlayScript(), runtimeGitopsPostprocessScript()].filter(Boolean).join('\\n')}`;",
     "  });",
     "  result = result.replace(/node scripts\\/run-bun\\.mjs scripts\\/gitops-render\\.mjs([^\\n]*?)--out \"\\$render_check_dir\"/g, (match) => match.includes('--gitops-root ') ? match : `${match} --gitops-root ${JSON.stringify(overlay.gitopsRoot)} --node ${shellSingle(overlay.nodeId)} --git-read-url ${shellSingle(overlay.gitReadUrl)} --git-write-url ${shellSingle(overlay.gitWriteUrl)} --runtime-endpoint ${shellSingle(overlay.publicApiUrl)} --web-endpoint ${shellSingle(overlay.publicWebUrl)}`);",
+    "  validatePrepareSourceDependencyScript(result);",
     "  return result;",
     "}",
     "function patchManifestObject(doc) {",