Checkpoint web parity through Chromium input tasks

tools/web/check-script-audit-integrity.mjs

@@ -0,0 +1,53 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import ts from "../../web/node_modules/typescript/lib/typescript.js";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const reportPath = path.join(root, "tests/golden/M13-05H/script-audit-integrity-report.json");
+const manifestPath = path.join(root, "tests/golden/M13-05H/manifest.json");
+const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-05h-audit-"));
+const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+const transpile = (name) => {
+  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
+  const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
+    .replace('require("./asset-path")', 'require("./asset-path.cjs")')
+    .replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
+  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
+};
+const errorCode = async (operation) => { try { await operation(); return "ACCEPTED"; } catch (error) { return error instanceof Error ? error.message.split(":", 1)[0] : String(error); } };
+
+try {
+  for (const name of ["asset-path", "capability-gates", "scripting-platform"]) transpile(name);
+  const protocol = createRequire(import.meta.url)(path.join(temporary, "scripting-platform.cjs"));
+  const digest = "a".repeat(64);
+  const manifest = { schemaVersion: 1, scripts: [{ id: "script:audit", name: "Audit", entryPath: "scripts/audit.py", sourceByteLength: 32, sourceSha256: digest, publisher: "local", signature: "b".repeat(128), keyId: "key:local", permissions: ["READ_MAIN"], dependencies: [], module: false, cpuMs: 1000, memoryBytes: 1024, wallMs: 5000, network: false, autorun: false, driverExpressions: false, addonInstall: false }] };
+  const first = await protocol.createScriptExecutionAudit(manifest, "script:audit", new Set(), { requestId: "audit:first", requestedAt: "2026-08-19T00:00:00.000Z" });
+  const second = await protocol.createScriptExecutionAudit(manifest, "script:audit", new Set(), { requestId: "audit:second", requestedAt: "2026-08-19T00:00:01.000Z" });
+  const firstLog = await protocol.appendScriptExecutionAudit({ schemaVersion: 1, entries: [] }, first);
+  const log = await protocol.appendScriptExecutionAudit(firstLog, second);
+  const replay = await errorCode(() => protocol.appendScriptExecutionAudit(log, first));
+  const earlier = await protocol.createScriptExecutionAudit(manifest, "script:audit", new Set(), { requestId: "audit:earlier", requestedAt: "2026-08-18T23:59:59.000Z" });
+  const timeOrder = await errorCode(() => protocol.appendScriptExecutionAudit(log, earlier));
+  const sequence = await errorCode(() => protocol.parseScriptExecutionAuditLog({ ...log, entries: [{ ...log.entries[0], sequence: 2 }, log.entries[1]] }));
+  const entryTamper = await errorCode(() => protocol.parseScriptExecutionAuditLog({ ...log, entries: [{ ...log.entries[0], entrySha256: "c".repeat(64) }, log.entries[1]] }));
+  const chainTamper = await errorCode(() => protocol.parseScriptExecutionAuditLog({ ...log, entries: [log.entries[0], { ...log.entries[1], previousEntrySha256: "d".repeat(64) }] }));
+  assert.equal(replay, "SCRIPT_MANIFEST_INVALID");
+  assert.equal(timeOrder, "SCRIPT_MANIFEST_INVALID");
+  assert.equal(sequence, "SCRIPT_MANIFEST_INVALID");
+  assert.equal(entryTamper, "SCRIPT_MANIFEST_INVALID");
+  assert.equal(chainTamper, "SCRIPT_MANIFEST_INVALID");
+  const report = { schemaVersion: 1, task: "M13-05H", operation: "SCRIPT_AUDIT_INTEGRITY", runtime: "NODE_PRODUCTION_PROTOCOL", log: { entryCount: log.entries.length, sequences: log.entries.map((entry) => entry.sequence), requestIds: log.entries.map((entry) => entry.audit.requestId), firstPreviousEntrySha256: log.entries[0].previousEntrySha256, secondPreviousEntrySha256: log.entries[1].previousEntrySha256, firstEntrySha256: log.entries[0].entrySha256, secondEntrySha256: log.entries[1].entrySha256, strictlyIncreasingTime: true, uniqueRequestIds: true, continuousHashChain: true }, negative: { replay, timeOrder, sequence, entryTamper, chainTamper }, execution: "DISABLED", nextTask: "M14-01A" };
+  if (process.env.UPDATE_M13_05H_REPORT === "1") { fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}\n`); }
+  assert.deepEqual(JSON.parse(fs.readFileSync(reportPath, "utf8")), report);
+  const manifestReceipt = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  assert.deepEqual({ schemaVersion: manifestReceipt.schemaVersion, task: manifestReceipt.task, parentTask: manifestReceipt.parentTask, nextTask: manifestReceipt.nextTask }, { schemaVersion: 1, task: "M13-05H", parentTask: "M13-05G", nextTask: "M14-01A" });
+  for (const artifact of Object.values(manifestReceipt.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, artifact.path);
+  process.stdout.write(`script-audit-integrity-ok entries=2 sequence=1,2 requestIds=unique time=ordered chain=true replay=${replay} tamper=3 execution=DISABLED next=${manifestReceipt.nextTask}\n`);
+} finally {
+  fs.rmSync(temporary, { recursive: true, force: true });
+}