#!/usr/bin/env bun/** * Asserts that patched dependencies are actually installed in patched form. * * We patch several npm packages via `bun patch` (see `patchedDependencies` in * package.json and the `patches/*.patch` files). At least one of these patches * is load-bearing at runtime, not just a build-time convenience: the * `agents@0.17.3` patch carries the MCP transport persist/replay fix (the SSE * "hang" fix that preserves tool results across dropped connections). If the * installed `agents` dist is the STALE, unpatched upstream build, everything * still compiles and tests mostly pass while the deployed transport silently * lacks the fix, so prod ships the pre-fix transport with zero signal. * * This has actually happened: a bun cache edge case left a checkout with an * unpatched `agents` dist in node_modules even though the lockfile and * package.json recorded the patch. `bun install` reported no changes because * the store entry it wanted was already present; it just wasn't the patched * content. * * So we don't trust the lockfile — we read the installed dist off disk and * assert the post-patch sentinel strings are present. The check is a couple of * file reads plus greps, so it adds ~zero wall-clock time and is safe to run in * CI before the test job and in `bootstrap` on every fresh checkout. * * Usage: *   bun run scripts/check-patched-deps.ts * * Env overrides (used by the self-test): *   CHECK_PATCHED_DEPS_AGENTS_MCP=/abs/path/to/agents/dist/mcp/index.js *     Force the agents MCP entry path instead of resolving it, so the self-test *     can point the check at a deliberately-corrupted copy. */import { existsSync, readFileSync } from "node:fs";import { resolve } from "node:path"; const repoRoot = resolve(import.meta.dir, ".."); type Failure = { readonly package: string; readonly detail: string };const failures: Failure[] = []; /** * Each patched package whose *runtime content* we assert against. Sentinels are * identifiers that exist only in the patched dist (added by the patch), so * their presence proves the installed file is the patched one, not a stale * upstream build. Keep sentinels to a couple of stable, patch-unique symbols. */type RuntimeCheck = {  readonly package: string;  /** Resolve the installed entry file we assert against. */  readonly resolveEntry: () => string;  /** Strings that only appear post-patch. All must be present. */  readonly sentinels: readonly string[];  /** Human hint for what the patch does, shown on failure. */  readonly purpose: string;}; /** * Resolve a subpath export of a dependency robustly, without hardcoding the * bun store hash in `node_modules/.bun/<pkg>@<version>+<hash>/…`. We resolve * from a workspace package that actually depends on it so the module graph is * the real one; `require.resolve` then walks bun's store for us. */const resolveFrom = (specifier: string, fromPackageDir: string): string => {  const fromDir = resolve(repoRoot, fromPackageDir);  return require.resolve(specifier, { paths: [fromDir] });}; const runtimeChecks: readonly RuntimeCheck[] = [  {    package: "agents@0.17.3 (agents/mcp)",    purpose:      "MCP transport persist/replay fix (preserves tool results across dropped SSE connections)",    resolveEntry: () => {      const override = process.env.CHECK_PATCHED_DEPS_AGENTS_MCP;      if (override && override.length > 0) return resolve(override);      // `packages/hosts/cloudflare` is the workspace package that depends on      // `agents`, so resolve the `agents/mcp` export from there.      return resolveFrom("agents/mcp", "packages/hosts/cloudflare");    },    // These identifiers are introduced by patches/agents@0.17.3.patch and do    // not exist in the upstream 0.17.3 dist.    sentinels: ["markStreamUndelivered", "replayUndeliveredResponses"],  },  {    package: "@modelcontextprotocol/client@2.0.0 (dist/shimsWorkerd.mjs)",    purpose:      "drops the workerd shim's module-eval preloadSchemas() (~15MB heap per isolate; " +      "collapsed isolate reuse in the 2026-08-25 latency incident) — schemas build lazily",    resolveEntry: () => {      // The workerd shim is only reachable through the `workerd` export      // condition, which require.resolve doesn't use — resolve the package      // main from the workspace package that depends on it and take the      // sibling shim file.      const main = resolveFrom("@modelcontextprotocol/client", "packages/plugins/mcp");      return resolve(main, "..", "shimsWorkerd.mjs");    },    sentinels: ["executor-patch: no-preload-schemas"],  },]; for (const check of runtimeChecks) {  let entry: string;  try {    entry = check.resolveEntry();  } catch (err) {    failures.push({      package: check.package,      detail: `could not resolve installed entry: ${(err as Error).message.split("\n")[0]}`,    });    continue;  }   if (!existsSync(entry)) {    failures.push({ package: check.package, detail: `installed entry does not exist: ${entry}` });    continue;  }   const contents = readFileSync(entry, "utf8");  const missing = check.sentinels.filter((s) => !contents.includes(s));  if (missing.length > 0) {    failures.push({      package: check.package,      detail:        `installed dist is missing post-patch sentinel(s): ${missing.join(", ")}\n` +        `      entry: ${entry}\n` +        `      patch purpose: ${check.purpose}`,    });  }} /** * Lightweight generalized layer: every package listed in `patchedDependencies` * must still have its referenced patch file on disk. This does not verify the * installed *content* for packages without a dedicated runtime check above * (that requires per-package sentinels), but it catches a patch entry pointing * at a missing file, which would make `bun install` silently skip patching. */const rootPkg = JSON.parse(readFileSync(resolve(repoRoot, "package.json"), "utf8")) as {  patchedDependencies?: Record<string, string>;};for (const [dep, patchPath] of Object.entries(rootPkg.patchedDependencies ?? {})) {  const abs = resolve(repoRoot, patchPath);  if (!existsSync(abs)) {    failures.push({      package: dep,      detail: `patchedDependencies references a missing patch file: ${patchPath}`,    });  }} if (failures.length > 0) {  const lines = failures.map((f) => `  - ${f.package}: ${f.detail}`).join("\n");  console.error(    `\nPatched-dependency check FAILED (${failures.length} problem(s)):\n${lines}\n\n` +      "Cause: the installed dependency content does not match the patch we ship.\n" +      "This is usually a stale bun store entry: bun kept an unpatched build of the\n" +      "package in its cache and `bun install` reported no changes without applying\n" +      "the patch. The deployed/tested code then silently lacks the patched behavior\n" +      "(for `agents`, the MCP transport hang fix), with no other signal.\n\n" +      "Fix: force a clean reinstall of the affected package's store entry, e.g.\n" +      "  rm -rf node_modules/.bun/agents@* node_modules/agents\n" +      "  bun install\n" +      "If that does not take, clear bun's global cache for it:\n" +      "  bun pm cache rm\n" +      "  bun install\n",  );  process.exit(1);} console.log(  `Patched-dependency check passed: ${runtimeChecks.length} runtime sentinel check(s), ` +    `${Object.keys(rootPkg.patchedDependencies ?? {}).length} patch file(s) present.`,);