fix(config): externalize ws for copilot-m365-web executor (#6098, closes #6062)

Externalize ws / bufferutil / utf-8-validate in serverExternalPackages so the copilot-m365-web WebSocket masking path works at runtime (bundling ws → TypeError: b.mask is not a function → 80s chat timeout). Regression guard in next-config.test.ts.

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

scripts/check/check-known-symbols.ts

@@ -473,7 +473,16 @@ async function main(): Promise<void> {
     ...(strategiesMod.ROUTING_STRATEGY_VALUES as readonly string[]),
     ...(strategiesMod.INTERNAL_ROUTING_STRATEGY_VALUES as readonly string[]),
   ];
-  const comboSource = readFileSync(resolvePath(REPO_ROOT, "open-sse/services/combo.ts"), "utf8");
+  // The combo dispatch was decomposed (Block J): the `strategy === "..."` branches
+  // now live across combo.ts + its strategy-ordering leaves, so scan all of them.
+  const comboDispatchFiles = [
+    "open-sse/services/combo.ts",
+    "open-sse/services/combo/applyStrategyOrdering.ts",
+    "open-sse/services/combo/resolveAutoStrategy.ts",
+  ];
+  const comboSource = comboDispatchFiles
+    .map((rel) => readFileSync(resolvePath(REPO_ROOT, rel), "utf8"))
+    .join("\n");
   const handled = extractHandledStrategies(comboSource);
 
   // Stale-enforcement (6A.3): IMPLICIT_DEFAULT_STRATEGIES is a suppression allowlist —

scripts/check/check-pr-evidence.mjs

@@ -231,7 +231,16 @@ if (isMain) {
   } else if (result === "pass") {
     reportLines.push("Result: PASS", "", reason);
   } else {
-    reportLines.push("Result: FAIL", "", reason);
+    reportLines.push(
+      "Result: FAIL",
+      "",
+      reason,
+      "",
+      "> ℹ️ Editing the PR body to add the evidence does NOT re-run this gate — `ci.yml` " +
+        "does not listen to the `edited` event. Add the `## Evidence` block, then **push a " +
+        "commit** (or re-run this job) to re-validate. For releases, put the Evidence block in " +
+        "the body BEFORE the first push (see the generate-release skill, Phase 0)."
+    );
   }
 
   const report = buildReport(reportLines);

scripts/check/check-test-discovery.mjs

@@ -53,7 +53,7 @@ export const COLLECTORS = [
   // "vitest" e explodem no node runner). Subdir novo: adicione aqui E nos scripts
   // (o drift-check + o gate de órfãos forçam a manutenção em sincronia).
   {
-    glob: "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts",
+    glob: "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,executors,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts",
     sources: ["package.json", ".github/workflows/ci.yml"],
   },
   // Node native runner — test:integration (top-level only; tests/integration/services/ NÃO roda)

scripts/quality/build-test-impact-map.mjs

@@ -60,7 +60,7 @@ function sourceDepsOf(entry) {
 const testFiles = globSync(
   [
     "tests/unit/*.test.ts",
-    "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts",
+    "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,executors,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts",
   ],
   { cwd: ROOT, absolute: true }
 );

scripts/quality/validate-release-green.mjs

@@ -146,7 +146,7 @@ function run(cmd, cmdArgs, opts = {}) {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       maxBuffer: 256 * 1024 * 1024,
-      env: { ...process.env, FORCE_COLOR: "0" },
+      env: { ...process.env, FORCE_COLOR: "0", ...(opts.env || {}) },
       // A hard ceiling for the long, silent test suites (execFileSync buffers all output until
       // exit, so they show no progress while running). undefined = no timeout for fast gates.
       ...(opts.timeout ? { timeout: opts.timeout } : {}),
@@ -255,6 +255,27 @@ function main() {
     });
   }
 
+  // test-masking (hard) — a PR-context gate: it only runs on the release PR (PR→main) in CI, so
+  // net-assert reductions accrue unseen on release/** and explode on the release PR. Reproduce it
+  // here against origin/main so a non-allowlisted reduction surfaces in the pre-flight, not in a
+  // ~40-min CI layer (v3.8.43 cost 3 such round-trips). Legitimate reductions get allowlisted in
+  // config/quality/test-masking-allowlist.json; tautology/skip/deletion signals are never allowlistable.
+  if (!QUICK) {
+    announce("Test-masking (weakened-assert guard vs main)");
+    // best-effort fetch so the merge-base diff is accurate; ignore fetch failure (offline pre-flight)
+    run("git", ["fetch", "--no-tags", "origin", "main", "--depth=200"], { timeout: 60 * 1000 });
+    const { code, out } = run(npmCmd, ["run", "check:test-masking"], {
+      env: { GITHUB_BASE_REF: "main" },
+    });
+    record({
+      id: "test-masking",
+      label: "Test-masking (weakened-assert guard)",
+      kind: "hard",
+      ok: code === 0,
+      detail: code === 0 ? "no weakening" : firstFailureLine(out),
+    });
+  }
+
   // Remaining quality-gate / quality-extended ratchets that the PR→release
   // fast-gates skip and that historically surfaced — one at a time, because the
   // CI Quality Ratchet job is fail-fast — only on the release PR. Running them all

scripts/release/gen-contributors.mjs

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+// Generate (or inject) the `### 🙌 Contributors` table for a CHANGELOG version section.
+//
+// WHY: every version's CHANGELOG `## [vX.Y.Z]` section MUST end with a `### 🙌 Contributors`
+// table (the convention across every prior version). v3.8.43 shipped without it (a real miss the
+// owner caught) because it was assembled by hand. This makes it reproducible + accurate.
+//
+// A naive `@handle` scan mis-assigns rollup PRs — a maintenance bullet lists many PRs under one
+// `— thanks @X`, and a flat scan would credit every handle on the line with all of them. This
+// parses each `([#refs] — thanks @X / @Y)` PARENTHETICAL GROUP and assigns that group's refs only
+// to that group's handles (crediting is per-parenthetical, matching how bullets are written).
+//
+// Usage:
+//   node scripts/release/gen-contributors.mjs <version>            # print the table
+//   node scripts/release/gen-contributors.mjs <version> --inject   # insert/replace it in CHANGELOG.md
+//
+// Exit codes: 0 ok · 2 version section not found · 3 nothing to inject over.
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+// Handles that are package names / code refs / scopes, never people. Extend as needed.
+export const NOISE_HANDLES = new Set([
+  "toon-format",
+  "dnd-kit",
+  "om-usage",
+  "anthropic-ai",
+  "huggingface",
+  "oven",
+  "latest",
+  "next",
+  "types",
+]);
+
+const MAINTAINER = "diegosouzapw";
+
+/** Extract the `## [version]` … up to the next `## [` section body (exclusive of the next header). */
+export function extractVersionSection(changelog, version) {
+  const esc = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const startRe = new RegExp(`^## \\[${esc}\\][^\\n]*$`, "m");
+  const sm = changelog.match(startRe);
+  if (!sm) return null;
+  const bodyStart = sm.index + sm[0].length;
+  const rest = changelog.slice(bodyStart);
+  const nextIdx = rest.search(/\n## \[/);
+  return nextIdx === -1 ? rest : rest.slice(0, nextIdx);
+}
+
+/**
+ * Parse contributor → set of ref numbers from a version section body.
+ * Rules (in order, per bullet line starting with "- "):
+ *  1. Parenthetical groups containing "thanks": refs in the group → handles in the group.
+ *  2. A "thanks @X" NOT inside such a group (direct-commit trailing credit): the last ref before
+ *     it on the line (if any) → the handles.
+ *  3. "Extracted from [#N] by [@X]": N → X.
+ * Excludes NOISE_HANDLES and the maintainer (returned separately by caller).
+ */
+export function parseContributors(sectionText) {
+  const agg = new Map(); // handle -> Set(refs)
+  const add = (handle, refs) => {
+    if (NOISE_HANDLES.has(handle) || handle === MAINTAINER) return;
+    if (!agg.has(handle)) agg.set(handle, new Set());
+    for (const r of refs) agg.get(handle).add(r);
+  };
+  const handlesIn = (s) => [...s.matchAll(/@([A-Za-z0-9_-]+)/g)].map((m) => m[1]);
+  const refsIn = (s) => [...s.matchAll(/#(\d+)/g)].map((m) => Number(m[1]));
+
+  for (const raw of sectionText.split("\n")) {
+    if (!raw.startsWith("- ")) continue;
+    // Collapse markdown links so parenthetical groups aren't broken by the URL's own parens:
+    //   [#5720](https://…/pull/5720) → #5720   ·   [@pizzav-xyz](https://…) → @pizzav-xyz
+    const line = raw
+      .replace(/\[#(\d+)\]\([^)]*\)/g, "#$1")
+      .replace(/\[@([A-Za-z0-9_-]+)\]\([^)]*\)/g, "@$1");
+    const usedSpans = [];
+
+    // (1) parenthetical groups with "thanks"
+    for (const g of line.matchAll(/\(([^()]*thanks[^()]*)\)/g)) {
+      const inner = g[1];
+      const refs = refsIn(inner);
+      for (const th of inner.matchAll(/thanks\s+((?:@[A-Za-z0-9_-]+(?:\s*\/\s*)?)+)/g)) {
+        for (const h of handlesIn(th[1])) add(h, refs);
+      }
+      usedSpans.push([g.index, g.index + g[0].length]);
+    }
+
+    // (2) trailing "— thanks @X" outside any used parenthetical (direct commits)
+    for (const th of line.matchAll(/thanks\s+((?:@[A-Za-z0-9_-]+(?:\s*\/\s*)?)+)/g)) {
+      const inGroup = usedSpans.some(([s, e]) => th.index >= s && th.index < e);
+      if (inGroup) continue;
+      const before = line.slice(0, th.index);
+      const refsBefore = refsIn(before);
+      const refs = refsBefore.length ? [refsBefore[refsBefore.length - 1]] : [];
+      for (const h of handlesIn(th[1])) add(h, refs);
+    }
+
+    // (3) "Extracted from #N by @X" (links already collapsed by the preprocessing above)
+    for (const em of line.matchAll(/[Ee]xtracted from #(\d+)\s+by\s+@([A-Za-z0-9_-]+)/g)) {
+      add(em[2], [Number(em[1])]);
+    }
+  }
+  return agg;
+}
+
+export function renderContributors(version, agg, maintainerNote = "maintainer") {
+  const fmt = (set) =>
+    set.size
+      ? [...set]
+          .sort((a, b) => a - b)
+          .map((n) => `#${n}`)
+          .join(", ")
+      : "direct commit / report";
+  const rows = [...agg.entries()].sort((a, b) =>
+    a[0].toLowerCase().localeCompare(b[0].toLowerCase())
+  );
+  const lines = [
+    "### 🙌 Contributors",
+    "",
+    `Thanks to everyone whose work landed in v${version}:`,
+    "",
+    "| Contributor | PRs / Issues |",
+    "| --- | --- |",
+  ];
+  for (const [h, refs] of rows) {
+    lines.push(`| [@${h}](https://github.com/${h}) | ${fmt(refs)} |`);
+  }
+  lines.push(`| [@${MAINTAINER}](https://github.com/${MAINTAINER}) | ${maintainerNote} |`);
+  return lines.join("\n");
+}
+
+/** Insert or replace the Contributors section inside the version block, before its closing `---`. */
+export function injectContributors(changelog, version, table) {
+  const esc = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const startRe = new RegExp(`^## \\[${esc}\\][^\\n]*$`, "m");
+  const sm = changelog.match(startRe);
+  if (!sm) return null;
+  const headerEnd = sm.index + sm[0].length;
+  const rest = changelog.slice(headerEnd);
+  const nextIdx = rest.search(/\n## \[/);
+  const bodyEnd = nextIdx === -1 ? changelog.length : headerEnd + nextIdx;
+  let body = changelog.slice(headerEnd, bodyEnd);
+  // strip an existing Contributors section (idempotent re-run)
+  body = body.replace(/\n### 🙌 Contributors[\s\S]*?(?=\n---\n|$)/, "\n");
+  // insert before the trailing `---` (or append if none)
+  const idx = body.lastIndexOf("\n---");
+  const insertion = `\n${table}\n`;
+  body = idx >= 0 ? body.slice(0, idx) + insertion + body.slice(idx) : `${body}${insertion}\n---\n`;
+  return changelog.slice(0, headerEnd) + body + changelog.slice(bodyEnd);
+}
+
+function main(argv) {
+  const version = argv[0];
+  const inject = argv.includes("--inject");
+  if (!version || !/^\d+\.\d+\.\d+$/.test(version)) {
+    process.stderr.write("usage: gen-contributors.mjs <version> [--inject]\n");
+    process.exit(1);
+  }
+  const clPath = path.join(ROOT, "CHANGELOG.md");
+  const changelog = fs.readFileSync(clPath, "utf8");
+  const section = extractVersionSection(changelog, version);
+  if (section == null) {
+    process.stderr.write(`No [${version}] section in CHANGELOG.md\n`);
+    process.exit(2);
+  }
+  const agg = parseContributors(section);
+  const table = renderContributors(version, agg);
+  if (!inject) {
+    process.stdout.write(table + "\n");
+    return;
+  }
+  const next = injectContributors(changelog, version, table);
+  if (next == null) {
+    process.stderr.write(`Could not locate [${version}] block for injection\n`);
+    process.exit(3);
+  }
+  fs.writeFileSync(clPath, next);
+  process.stderr.write(`✓ Injected ${agg.size} external contributor(s) into [${version}]\n`);
+}
+
+// direct-run guard (importable for tests)
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2));
+}

scripts/release/list-uncovered-commits.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// Reconciliation helper: list non-merge commits since the last tag whose PR/issue ref is NOT
+// represented in the current version's CHANGELOG section (or [Unreleased]).
+//
+// WHY: during the cycle, PRs merge into release/** and some land WITHOUT a CHANGELOG bullet, so
+// /generate-release reconciliation has to rediscover them by hand (v3.8.43: 123 of 176 commits had
+// no bullet). This surfaces exactly that gap in seconds — maintainer-side, non-blocking, run it at
+// reconciliation (Phase 0a) so the release CHANGELOG is complete before the PR opens.
+//
+// A commit is "covered" iff ANY `#N` in its subject appears anywhere in the CHANGELOG scan window
+// (the version section + [Unreleased]) — matching on issue OR PR number, since a bullet may cite
+// either. Internal commits (chore/ci/test/refactor) are listed under "rollup candidates" so the
+// maintainer can consolidate rather than write one bullet each.
+//
+// Usage: node scripts/release/list-uncovered-commits.mjs [--json]
+// Exit: 0 always (advisory). Prints a report to stdout.
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+const git = (args) => execFileSync("git", args, { cwd: ROOT, encoding: "utf8" }).trim();
+
+const ROLLUP_TYPES = new Set(["chore", "ci", "test", "refactor", "build", "docs", "style"]);
+
+export function refsOf(subject) {
+  return [...subject.matchAll(/#(\d+)/g)].map((m) => Number(m[1]));
+}
+
+export function typeOf(subject) {
+  const m = subject.match(/^([a-z]+)(\(|:|!)/);
+  return m ? m[1] : "other";
+}
+
+/**
+ * @param {{hash:string, subject:string}[]} commits
+ * @param {Set<number>} changelogRefs  every #N present in the CHANGELOG scan window
+ * @returns {{covered:number, uncovered:{hash,subject,refs,type,rollup}[]}}
+ */
+export function computeUncovered(commits, changelogRefs) {
+  const uncovered = [];
+  let covered = 0;
+  for (const c of commits) {
+    const refs = refsOf(c.subject);
+    const isCovered = refs.length > 0 && refs.some((r) => changelogRefs.has(r));
+    if (isCovered) {
+      covered++;
+    } else {
+      const type = typeOf(c.subject);
+      uncovered.push({ ...c, refs, type, rollup: ROLLUP_TYPES.has(type) });
+    }
+  }
+  return { covered, uncovered };
+}
+
+/** Read every #N in the version's CHANGELOG section + the [Unreleased] section. */
+export function changelogRefWindow(changelog, version) {
+  const esc = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  // From [Unreleased] up to (but excluding) the version-after-this one.
+  const startRe = /^## \[Unreleased\]/m;
+  const s = changelog.match(startRe);
+  const from = s ? s.index : 0;
+  // find the header AFTER the target version
+  const verRe = new RegExp(`^## \\[${esc}\\]`, "m");
+  const vm = changelog.slice(from).match(verRe);
+  const afterVersionStart = vm ? from + vm.index + vm[0].length : from;
+  const rest = changelog.slice(afterVersionStart);
+  const nextIdx = rest.search(/\n## \[/);
+  const to = nextIdx === -1 ? changelog.length : afterVersionStart + nextIdx;
+  const window = changelog.slice(from, to);
+  return new Set([...window.matchAll(/#(\d+)/g)].map((m) => Number(m[1])));
+}
+
+function main(argv) {
+  const jsonOut = argv.includes("--json");
+  const lastTag = git(["describe", "--tags", "--abbrev=0"]);
+  const version = JSON.parse(fs.readFileSync(path.join(ROOT, "package.json"), "utf8")).version;
+  const log = git(["log", "--no-merges", `${lastTag}..HEAD`, "--pretty=format:%h%x09%s"]);
+  const commits = log
+    ? log.split("\n").map((l) => {
+        const [hash, subject] = l.split("\t");
+        return { hash, subject };
+      })
+    : [];
+  const changelog = fs.readFileSync(path.join(ROOT, "CHANGELOG.md"), "utf8");
+  const refs = changelogRefWindow(changelog, version);
+  const { covered, uncovered } = computeUncovered(commits, refs);
+
+  if (jsonOut) {
+    process.stdout.write(
+      JSON.stringify({ version, lastTag, total: commits.length, covered, uncovered }, null, 2) +
+        "\n"
+    );
+    return;
+  }
+  const bulletsWorthy = uncovered.filter((c) => !c.rollup);
+  const rollupCandidates = uncovered.filter((c) => c.rollup);
+  process.stdout.write(`# Uncovered-commit reconciliation — v${version} (${lastTag}..HEAD)\n\n`);
+  process.stdout.write(
+    `Commits: ${commits.length} · covered: ${covered} · uncovered: ${uncovered.length}\n\n`
+  );
+  process.stdout.write(
+    `## Needs a bullet (feat/fix/other — user-facing) — ${bulletsWorthy.length}\n`
+  );
+  for (const c of bulletsWorthy) process.stdout.write(`- ${c.hash} ${c.subject}\n`);
+  process.stdout.write(
+    `\n## Rollup candidates (chore/ci/test/refactor/docs) — ${rollupCandidates.length}\n`
+  );
+  for (const c of rollupCandidates) process.stdout.write(`- ${c.hash} ${c.subject}\n`);
+  process.stdout.write(
+    `\n> Advisory. Add a bullet for each user-facing item; consolidate rollup candidates into a few Maintenance bullets (list their PR numbers).\n`
+  );
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2));
+}