From 8fdd4de00de4db24e5c230d92a5b3ff2b495afc6 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Mon, 6 Jul 2026 02:06:46 -0700
Subject: [PATCH] fix(miner): restore the strict flat-only pack-safety
 allowlist

#3778 widened scripts/check-miner-package.mjs's ALLOWED regex to accept one
level of subdirectory under lib/, to accommodate the calibration module's
nested lib/calibration/{index,types}.{js,d.ts} layout from #3704. #3772
(merged minutes earlier, independently fixing the same main-red CI break)
took the opposite approach: it flattened that module to lib/calibration.js +
lib/calibration-types.js instead, matching every other module in the package.

With the nested directory gone, #3778's widening is dead weight -- it
permanently weakens a security-relevant pack-safety allowlist (the only
guard against an arbitrary nested file sneaking into the published npm
package) for zero remaining benefit. Restore the strict flat-only pattern
and turn the now-obsolete "accepts a subdirectory" test into a rejection
test, so a future nested lib/ file is caught here instead of requiring
another regex widening.
---
 scripts/check-miner-package.mjs       |  4 +---
 test/unit/check-miner-package.test.ts | 11 +++++------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/scripts/check-miner-package.mjs b/scripts/check-miner-package.mjs
index 1bb6ec7beb..a7357fc3de 100644
--- a/scripts/check-miner-package.mjs
+++ b/scripts/check-miner-package.mjs
@@ -6,9 +6,7 @@ import { fileURLToPath } from "node:url";
 
 const ALLOWED = [
   /^bin\/gittensory-miner\.js$/,
-  // One optional level of subdirectory (e.g. lib/calibration/index.js, #2332) alongside the original flat
-  // lib/<name>.js layout -- both forms ship real runtime/type files, never build tooling or config.
-  /^lib\/([a-z0-9-]+\/)?[a-z0-9-]+\.(js|d\.ts)$/,
+  /^lib\/[a-z0-9-]+\.(js|d\.ts)$/,
   /^package\.json$/,
   /^README\.md$/,
 ];
diff --git a/test/unit/check-miner-package.test.ts b/test/unit/check-miner-package.test.ts
index 7c2f7f1c99..35ffffd263 100644
--- a/test/unit/check-miner-package.test.ts
+++ b/test/unit/check-miner-package.test.ts
@@ -35,21 +35,20 @@ describe("check-miner-package script", () => {
     expect(result.out).toContain("Unexpected file in miner package: scripts/extra.mjs");
   });
 
-  it("REGRESSION (main was red after #3704): accepts a lib module split into a one-level subdirectory", () => {
+  it("REGRESSION (#3704 caused main to go red, fixed by flattening lib/ instead of widening this allowlist): rejects a lib module nested one level under a subdirectory", () => {
     const result = runChecker({
       CHECK_MINER_PACK_TEST_FILES: JSON.stringify([
         "package.json",
         "bin/gittensory-miner.js",
+        "lib/cli.js",
         "lib/calibration/index.js",
-        "lib/calibration/index.d.ts",
       ]),
-      CHECK_MINER_PACK_TEST_CONTENT: "{}",
     });
-    expect(result.status).toBe(0);
-    expect(result.out).toContain("lib/calibration/index.js");
+    expect(result.status).toBe(1);
+    expect(result.out).toContain("Unexpected file in miner package: lib/calibration/index.js");
   });
 
-  it("still rejects a file nested two levels deep under lib/", () => {
+  it("rejects a file nested two levels deep under lib/", () => {
     const result = runChecker({
       CHECK_MINER_PACK_TEST_FILES: JSON.stringify([
         "package.json",