fix: tighten identity freeze against prerelease rewinds

Compare full SemVer, fail closed when npm latest is missing, keep only
provider-host moonshot-ai lines, and stop persisting CI checkout credentials.

Author: elkaix

.agents/skills/release/SKILL.md

@@ -73,12 +73,12 @@ otherwise errors.
 - **`pnpm install` fails in CI or locally.** `engine-strict=true` + Node `>=24.15.0` — check
   `.nvmrc` before debugging anything else.
 - **Identity freeze / version rewind.** Copying another product's `CHANGELOG.md`, `package.json`
-  `version`, or VS Code `publisher` onto `main` makes Release red while required CI stays green:
-  npm `latest` does not move backwards, brew 404s the tarball, native `gh release view` misses the
-  tag, vsce says the extension name already exists, and `verify-release-consistency.mjs` compares
-  local version to npm `latest`. `scripts/check-identity-freeze.mjs` (lint) plus Release `--npm`
-  fail closed. Do not merge `ci: release packages` while freeze fields disagree with npm or the
-  Marketplace. Restore identity from the last published tag; do not hand-bump a lower version.
+  `version`, or VS Code `publisher` onto `main` fails required CI (`lint` runs
+  `scripts/check-identity-freeze.mjs`) and Release (`--npm`). npm `latest` does not move backwards,
+  brew 404s the tarball, native `gh release view` misses the tag, vsce says the extension name
+  already exists, and `verify-release-consistency.mjs` compares local version to npm `latest`.
+  Do not merge `ci: release packages` while freeze fields disagree with npm or the Marketplace.
+  Restore identity from the last published tag; do not hand-bump a lower version.
 - **Pre-push hook** (`scripts/pre-push.sh` via simple-git-hooks) gates local pushes; a hook failure
   is a real gate failure — fix the cause, never `--no-verify`.
 

.github/workflows/ci.yml

@@ -123,6 +123,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: pnpm/action-setup@v6
 

scripts/check-identity-freeze.mjs

@@ -34,27 +34,54 @@ export const MOONSHOT_AI_ALLOW_FILES = new Set([
   'packages/oauth/test/open-platform.test.ts',
 ]);
 
-const CORE = /^(\d+)\.(\d+)\.(\d+)/u;
-const HEADING = /^## (\d+\.\d+\.\d+)\b/mu;
-const PROVIDER_HOST = /api\.moonshot\.(?:ai|cn)/u;
+const SEMVER =
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u;
+const HEADING = /^## (\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/mu;
+const PROVIDER_HOST = /api\.moonshot\.(?:ai|cn)/gu;
 
-export function parseSemverCore(version) {
+export function parseSemver(version) {
   if (typeof version !== 'string') return null;
-  const match = CORE.exec(version);
+  const match = SEMVER.exec(version);
   if (match === null) return null;
-  return [Number(match[1]), Number(match[2]), Number(match[3])];
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    pre: match[4] === undefined ? null : match[4].split('.'),
+  };
 }
 
-export function compareSemverCore(left, right) {
-  const a = parseSemverCore(left);
-  const b = parseSemverCore(right);
+export function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
   if (a === null || b === null) return null;
   for (let index = 0; index < 3; index += 1) {
-    if (a[index] !== b[index]) return a[index] - b[index];
+    if (a.core[index] !== b.core[index]) return a.core[index] - b.core[index];
+  }
+  if (a.pre === null && b.pre === null) return 0;
+  if (a.pre === null) return 1;
+  if (b.pre === null) return -1;
+  const length = Math.max(a.pre.length, b.pre.length);
+  for (let index = 0; index < length; index += 1) {
+    const leftId = a.pre[index];
+    const rightId = b.pre[index];
+    if (leftId === undefined) return -1;
+    if (rightId === undefined) return 1;
+    const leftNumeric = /^\d+$/u.test(leftId);
+    const rightNumeric = /^\d+$/u.test(rightId);
+    if (leftNumeric && rightNumeric) {
+      const delta = Number(leftId) - Number(rightId);
+      if (delta !== 0) return delta;
+      continue;
+    }
+    if (leftNumeric) return -1;
+    if (rightNumeric) return 1;
+    if (leftId < rightId) return -1;
+    if (leftId > rightId) return 1;
   }
   return 0;
 }
 
+export const compareSemverCore = compareSemver;
+
 export function firstChangelogHeading(source) {
   if (typeof source !== 'string') return null;
   return HEADING.exec(source)?.[1] ?? null;
@@ -103,15 +130,15 @@ export function evaluate(input) {
 
   for (const [lane, base] of Object.entries(input.baseVersions ?? {})) {
     const head = input.versions?.[lane];
-    const order = compareSemverCore(asText(head), asText(base));
+    const order = compareSemver(asText(head), asText(base));
     if (order !== null && order < 0) {
       failures.push(`${lane} version rewound ${asText(base)} -> ${asText(head)}`);
     }
   }
 
   if (typeof input.npmLatest === 'string') {
     const cliVersion = asText(input.versions?.cli);
-    const order = compareSemverCore(cliVersion, input.npmLatest);
+    const order = compareSemver(cliVersion, input.npmLatest);
     if (order !== null && order < 0) {
       failures.push(`CLI version ${cliVersion} is below npm latest ${input.npmLatest}`);
     }
@@ -122,7 +149,7 @@ export function evaluate(input) {
 
 export function moonshotHitAllowed(file, line) {
   if (MOONSHOT_AI_ALLOW_FILES.has(file)) return true;
-  return PROVIDER_HOST.test(line);
+  return !line.replaceAll(PROVIDER_HOST, '').includes('moonshot-ai');
 }
 
 function readJson(relative) {

scripts/check-identity-freeze.test.mjs

@@ -7,11 +7,11 @@ import {
   VSCODE_DISPLAY_NAME,
   VSCODE_NAME,
   VSCODE_PUBLISHER,
-  compareSemverCore,
+  compareSemver,
   evaluate,
   firstChangelogHeading,
   moonshotHitAllowed,
-  parseSemverCore,
+  parseSemver,
 } from './check-identity-freeze.mjs';
 
 const good = {
@@ -28,21 +28,25 @@ const good = {
   moonshotHits: [],
 };
 
-void test('parseSemverCore reads the numeric triple and ignores a prerelease', () => {
-  assert.deepEqual(parseSemverCore('2.1.0'), [2, 1, 0]);
-  assert.deepEqual(parseSemverCore('0.43.0-beta.1'), [0, 43, 0]);
-  assert.equal(parseSemverCore('not-a-version'), null);
+void test('parseSemver keeps prerelease identifiers', () => {
+  assert.deepEqual(parseSemver('2.1.0'), { core: [2, 1, 0], pre: null });
+  assert.deepEqual(parseSemver('2.1.0-beta.1'), { core: [2, 1, 0], pre: ['beta', '1'] });
+  assert.equal(parseSemver('not-a-version'), null);
 });
 
-void test('compareSemverCore orders published lines', () => {
-  assert.ok(compareSemverCore('2.1.0', '0.43.0') > 0);
-  assert.ok(compareSemverCore('0.43.0', '2.1.0') < 0);
-  assert.equal(compareSemverCore('2.1.0', '2.1.0'), 0);
-  assert.equal(compareSemverCore('bad', '2.1.0'), null);
+void test('compareSemver orders stable and prerelease lines', () => {
+  assert.ok(compareSemver('2.1.0', '0.43.0') > 0);
+  assert.ok(compareSemver('0.43.0', '2.1.0') < 0);
+  assert.equal(compareSemver('2.1.0', '2.1.0'), 0);
+  assert.ok(compareSemver('2.1.0', '2.1.0-beta.1') > 0);
+  assert.ok(compareSemver('2.1.0-beta.2', '2.1.0-beta.1') > 0);
+  assert.ok(compareSemver('2.1.0-beta.1', '2.1.0') < 0);
+  assert.equal(compareSemver('bad', '2.1.0'), null);
 });
 
-void test('firstChangelogHeading reads the leading version section', () => {
+void test('firstChangelogHeading reads stable and prerelease headings', () => {
   assert.equal(firstChangelogHeading('# pkg\n\n## 2.1.0\n\n### Minor\n'), '2.1.0');
+  assert.equal(firstChangelogHeading('# pkg\n\n## 2.1.0-beta.1\n\n### Minor\n'), '2.1.0-beta.1');
   assert.equal(firstChangelogHeading('# pkg\n\nno heading\n'), null);
 });
 
@@ -86,6 +90,33 @@ void test('evaluate rejects a version below npm latest or below the base branch'
   });
   assert.equal(base.ok, false);
   assert.ok(base.failures.some((line) => line.includes('rewound 0.9.7 -> 0.7.6')));
+
+  const stableToPre = evaluate({
+    ...good,
+    versions: { ...good.versions, cli: '2.1.0-beta.1' },
+    changelogHeadings: { ...good.changelogHeadings, cli: '2.1.0-beta.1' },
+    baseVersions: { cli: '2.1.0' },
+  });
+  assert.equal(stableToPre.ok, false);
+  assert.ok(stableToPre.failures.some((line) => line.includes('rewound 2.1.0 -> 2.1.0-beta.1')));
+
+  const preToPre = evaluate({
+    ...good,
+    versions: { ...good.versions, cli: '2.1.0-beta.1' },
+    changelogHeadings: { ...good.changelogHeadings, cli: '2.1.0-beta.1' },
+    baseVersions: { cli: '2.1.0-beta.2' },
+  });
+  assert.equal(preToPre.ok, false);
+  assert.ok(preToPre.failures.some((line) => line.includes('rewound 2.1.0-beta.2 -> 2.1.0-beta.1')));
+});
+
+void test('evaluate accepts a matching prerelease changelog heading', () => {
+  const result = evaluate({
+    ...good,
+    versions: { ...good.versions, cli: '2.1.0-beta.1' },
+    changelogHeadings: { ...good.changelogHeadings, cli: '2.1.0-beta.1' },
+  });
+  assert.equal(result.ok, true);
 });
 
 void test('moonshotHitAllowed keeps provider hosts and oauth platform files', () => {
@@ -95,4 +126,8 @@ void test('moonshotHitAllowed keeps provider hosts and oauth platform files', ()
     moonshotHitAllowed('packages/oauth/src/region.ts', 'https://api.moonshot.ai/v1'),
     true,
   );
+  assert.equal(
+    moonshotHitAllowed('apps/vscode/package.json', "name: 'moonshot-ai' https://api.moonshot.ai/v1"),
+    false,
+  );
 });

scripts/release/changeset-publish-idempotent.mjs

@@ -89,9 +89,18 @@ function npmLatest(name) {
 for (const pkg of unpublished) {
   if (pkg.name !== '@pymodel/pythinker-code') continue;
   const latest = npmLatest(pkg.name);
-  if (latest === undefined) continue;
+  if (latest === undefined) {
+    console.error(`Identity freeze: cannot read npm latest for ${pkg.name}; refusing to publish.`);
+    process.exit(1);
+  }
   const order = compareSemverCore(pkg.version, latest);
-  if (order !== null && order < 0) {
+  if (order === null) {
+    console.error(
+      `Identity freeze: cannot compare ${pkg.name}@${pkg.version} to npm latest ${latest}; refusing to publish.`,
+    );
+    process.exit(1);
+  }
+  if (order < 0) {
     console.error(
       `Identity freeze: refusing to publish ${pkg.name}@${pkg.version} below npm latest ${latest}.`,
     );

scripts/release/detect-lane-bumps.test.mjs

@@ -85,6 +85,22 @@ void test('fails closed when a lane version rewinds', async (t) => {
   );
 });
 
+void test('fails closed when a lane rewinds a prerelease', async (t) => {
+  const root = await mkdtemp(join(tmpdir(), 'release-lanes-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  git(root, ['init', '-b', 'main']);
+
+  await Promise.all(Object.values(packagePaths).map((path) => writePackage(root, path, '2.1.0-beta.2')));
+  const before = commit(root, 'beta');
+  await writePackage(root, packagePaths.cli, '2.1.0-beta.1');
+  const after = commit(root, 'rewound beta');
+
+  assert.throws(
+    () => detectLaneBumps({ before, after, cwd: root }),
+    /rewound 2\.1\.0-beta\.2 -> 2\.1\.0-beta\.1/,
+  );
+});
+
 void test('rejects a version that could inject a GitHub output line', async (t) => {
   const root = await mkdtemp(join(tmpdir(), 'release-lanes-'));
   t.after(() => rm(root, { recursive: true, force: true }));