gamertan/sandwich-hime-tooling
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat: publish Sandwich Hime tooling preview

Browse Source 
Publish the exact sanitized Agent Skill and VS Code preview source tree with independent license boundaries, deterministic provenance manifests, and no private development history. Material design and implementation assistance was provided by OpenAI Codex.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
gamertan
2026-08-12 20:33:51 -04:00
commit 6df87bc958
51 changed files with 7424 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
editors/vscode/scripts/audit-package.js
+28
View File
@@ -0,0 +1,28 @@
// SPDX-License-Identifier: AGPL-3.0-only
'use strict';
const fs = require('node:fs');
const path = require('node:path');
const childProcess = require('node:child_process');
const root = path.join(__dirname, '..');
const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
if (manifest.publisher !== 'gamertan' || manifest.name !== 'sandwich-hime' || manifest.version !== '0.1.0-preview.1') throw new Error('extension identity drift');
if (JSON.stringify(manifest.dependencies) !== JSON.stringify({'vscode-languageclient': '9.0.1'})) throw new Error('runtime dependency allowlist drift');
const bundle = fs.readFileSync(path.join(root, 'dist', 'extension.js'), 'utf8');
if (!bundle.startsWith('// SPDX-License-Identifier: AGPL-3.0-only')) throw new Error('bundle license marker missing');
for (const forbidden of ['@opentelemetry', 'applicationinsights', 'segment.io', 'mixpanel']) {
if (bundle.toLowerCase().includes(forbidden)) throw new Error(`forbidden telemetry marker in bundle: ${forbidden}`);
}
if (Buffer.byteLength(bundle) > 4 * 1024 * 1024) throw new Error('bundled extension exceeds 4 MiB');
const vsce = path.join(root, 'node_modules', '@vscode', 'vsce', 'vsce');
const listed = childProcess.spawnSync(process.execPath, [vsce, 'ls', '--no-dependencies'], {cwd: root, encoding: 'utf8'});
if (listed.status !== 0) throw new Error(`vsce file audit failed: ${listed.stderr}`);
const allowed = [
'.vscodeignore', 'README.md', 'LICENSE', 'SECURITY.md', 'THIRD_PARTY_NOTICES.md', 'package.json',
'dist/extension.js', 'language-configuration.json', 'snippets/sando.json',
'syntaxes/sando.tmLanguage.json',
];
const actual = listed.stdout.trim().split(/\r?\n/).map((line) => line.trim()).filter(Boolean).sort();
for (const file of actual) if (!allowed.includes(file)) throw new Error(`unexpected packaged file: ${file}`);
for (const file of allowed.filter((name) => name !== '.vscodeignore')) if (!actual.includes(file)) throw new Error(`missing packaged file: ${file}`);
console.log(`package allowlist verified: ${actual.length} files, bundle ${Buffer.byteLength(bundle)} bytes`);