Exemple
@npmcli/git 6.0.3
Échantillon vérifié pour npm @npmcli/git 6.0.3. Le contrat s'est exécuté sur node 22 · linux debian/x64 · docker et a réussi.
sha256:7f981ed3d1e20af6d911f541cec12812cfef00445739f4027c401eeace42c493
Ce réseau offre une seule chose : un échantillon qui compile. Il l'a exécuté dans un bac à sable et conservé le reçu signé. Il ne note rien et ne garantit rien : si le même code compile chez vous, il ne l'a pas mesuré.
Combien de clés de signature distinctes ont déposé un reçu de contrat réussi. Une seule, c'est l'auteur ; plus d'une signifie que quelqu'un d'autre l'a compilé aussi. Une clé est auto-générée sans identité enregistrée derrière, donc on compte des clés, pas des personnes.
MIT-0
Preuves d'exécution
L'environnement déclaré et les exécutions signées sont séparés, pour que vous voyiez exactement ce que cet échantillon a exécuté et où.
- Base de preuve
- Contrat signé réussi
- Reçus de vérification
- 1
- Clés de signature qui l’ont compilé
- 1
Environnement déclaré
linux 24 · ubuntu · glibc 2.39 x64 npm
Environnements des exécutions de vérification
| Environnement | Contrat | Étapes | Exécution |
|---|---|---|---|
| node 22 · linux debian/x64 · docker ed25519:c1973797be207ac4 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · node-typescript@1node:22@sha256:8a34c4ab3ea2… |
2026-10-18 |
Cas
HOW- Objectif
- verify pkg:npm/%40npmcli/git@6.0.3
- Paquets
- Créé
- 2026-10-18T02:06:44Z
Contrat
- git.is({ cwd }) resolves to true when a .git directory exists in cwd and false otherwise
- git.find({ cwd, root }) traverses parent directories to return the nearest directory containing .git or null if root is reached first
- git.spawn(args, { git: false }) rejects with an Error whose code is 'ENOGIT'
- git.errors exports GitConnectionError (retriable for attempts < 3), GitPathspecError (non-retriable), and GitUnknownError (non-retriable)
Fichiers
- PROMPT.md
- csx.json
- package-lock.json
- package.json
- spec.json
- test/contract.mjs
Code source
Clean-room public code sample — generation instructions
Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.
A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.
Goal: verify pkg:npm/%40npmcli/git@6.0.3
Kind: HOW
Use EXACTLY these public packages and versions:
- pkg:npm/%40npmcli/git@6.0.3
Rules:
- One focused purpose; the smallest project that proves the goal.
- Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
- Pin every dependency with a lockfile so resolution is reproducible.
- No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
- No personal names, emails, company names, or project identifiers of any kind.
- No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
- Keep it under 200 files and 256KB packed.
{"case":{"caseId":"case:sha256:418e4d79e4f86291c70de94108540d5f2e5fc484e80d78602a73d33b7d45b700","contract":["git.is({ cwd }) resolves to true when a .git directory exists in cwd and false otherwise","git.find({ cwd, root }) traverses parent directories to return the nearest directory containing .git or null if root is reached first","git.spawn(args, { git: false }) rejects with an Error whose code is 'ENOGIT'","git.errors exports GitConnectionError (retriable for attempts \u003c 3), GitPathspecError (non-retriable), and GitUnknownError (non-retriable)"],"goal":"verify pkg:npm/%40npmcli/git@6.0.3","kind":"HOW","packages":["pkg:npm/%40npmcli/git@6.0.3"],"schemaVersion":1},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40npmcli/git@6.0.3"],"schemaVersion":1,"subject":"pkg:npm/%40npmcli/git@6.0.3","verifierAdapter":"node-typescript@1"}
{
"name": "sample-npmcli-git",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "sample-npmcli-git",
"version": "1.0.0",
"dependencies": {
"@npmcli/git": "6.0.3"
}
},
"node_modules/@npmcli/git": {
"version": "6.0.3",
"resolved": "https://registry.npmjs.org/@npmcli/git/-/git-6.0.3.tgz",
"integrity": "sha512-GUYESQlxZRAdhs3UhbB6pVRNUELQOHXwK9ruDkwmCv2aZ5y0SApQzUJCg02p3A7Ue2J5hxvlk1YI53c00NmRyQ==",
"license": "ISC",
"dependencies": {
"@npmcli/promise-spawn": "^8.0.0",
"ini": "^5.0.0",
"lru-cache": "^10.0.1",
"npm-pick-manifest": "^10.0.0",
"proc-log": "^5.0.0",
"promise-retry": "^2.0.1",
"semver": "^7.3.5",
"which": "^5.0.0"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/@npmcli/promise-spawn": {
"version": "8.0.3",
"resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-8.0.3.tgz",
"integrity": "sha512-Yb00SWaL4F8w+K8YGhQ55+xE4RUNdMHV43WZGsiTM92gS+lC0mGsn7I4hLug7pbao035S6bj3Y3w0cUNGLfmkg==",
"license": "ISC",
"dependencies": {
"which": "^5.0.0"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/err-code": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
"integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
"license": "MIT"
},
"node_modules/hosted-git-info": {
"version": "8.1.0",
"resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-8.1.0.tgz",
"integrity": "sha512-Rw/B2DNQaPBICNXEm8balFz9a6WpZrkCGpcWFpy7nCj+NyhSdqXipmfvtmWt9xGfp0wZnBxB+iVpLmQMYt47Tw==",
"license": "ISC",
"dependencies": {
"lru-cache": "^10.0.1"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/ini": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/ini/-/ini-5.0.0.tgz",
"integrity": "sha512-+N0ngpO3e7cRUWOJAS7qw0IZIVc6XPrW4MlFBdD066F2L4k1L6ker3hLqSq7iXxU5tgS4WGkIUElWn5vogAEnw==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/isexe": {
"version": "3.1.5",
"resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
"integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
"license": "BlueOak-1.0.0",
"engines": {
"node": ">=18"
}
},
"node_modules/lru-cache": {
"version": "10.4.3",
"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
"integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
"license": "ISC"
},
"node_modules/npm-install-checks": {
"version": "7.1.2",
"resolved": "https://registry.npmjs.org/npm-install-checks/-/npm-install-checks-7.1.2.tgz",
"integrity": "sha512-z9HJBCYw9Zr8BqXcllKIs5nI+QggAImbBdHphOzVYrz2CB4iQ6FzWyKmlqDZua+51nAu7FcemlbTc9VgQN5XDQ==",
"license": "BSD-2-Clause",
"dependencies": {
"semver": "^7.1.1"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/npm-normalize-package-bin": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-4.0.0.tgz",
"integrity": "sha512-TZKxPvItzai9kN9H/TkmCtx/ZN/hvr3vUycjlfmH0ootY9yFBzNOpiXAdIn1Iteqsvk4lQn6B5PTrt+n6h8k/w==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/npm-package-arg": {
"version": "12.0.2",
"resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-12.0.2.tgz",
"integrity": "sha512-f1NpFjNI9O4VbKMOlA5QoBq/vSQPORHcTZ2feJpFkTHJ9eQkdlmZEKSjcAhxTGInC7RlEyScT9ui67NaOsjFWA==",
"license": "ISC",
"dependencies": {
"hosted-git-info": "^8.0.0",
"proc-log": "^5.0.0",
"semver": "^7.3.5",
"validate-npm-package-name": "^6.0.0"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/npm-pick-manifest": {
"version": "10.0.0",
"resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-10.0.0.tgz",
"integrity": "sha512-r4fFa4FqYY8xaM7fHecQ9Z2nE9hgNfJR+EmoKv0+chvzWkBcORX3r0FpTByP+CbOVJDladMXnPQGVN8PBLGuTQ==",
"license": "ISC",
"dependencies": {
"npm-install-checks": "^7.1.0",
"npm-normalize-package-bin": "^4.0.0",
"npm-package-arg": "^12.0.0",
"semver": "^7.3.5"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/proc-log": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
"integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/promise-retry": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
"integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
"license": "MIT",
"dependencies": {
"err-code": "^2.0.2",
"retry": "^0.12.0"
},
"engines": {
"node": ">=10"
}
},
"node_modules/retry": {
"version": "0.12.0",
"resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
"integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
"license": "MIT",
"engines": {
"node": ">= 4"
}
},
"node_modules/semver": {
"version": "7.8.5",
"resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
"integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
"license": "ISC",
"bin": {
"semver": "bin/semver.js"
},
"engines": {
"node": ">=10"
}
},
"node_modules/validate-npm-package-name": {
"version": "6.0.2",
"resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-6.0.2.tgz",
"integrity": "sha512-IUoow1YUtvoBBC06dXs8bR8B9vuA3aJfmQNKMoaPG/OFsPmoQvw8xh+6Ye25Gx9DQhoEom3Pcu9MKHerm/NpUQ==",
"license": "ISC",
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
},
"node_modules/which": {
"version": "5.0.0",
"resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
"integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
"license": "ISC",
"dependencies": {
"isexe": "^3.1.1"
},
"bin": {
"node-which": "bin/which.js"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
}
}
}
}
{
"name": "sample-npmcli-git",
"version": "1.0.0",
"private": true,
"type": "module",
"scripts": {
"test": "node test/contract.mjs"
},
"dependencies": {
"@npmcli/git": "6.0.3"
}
}
{
"schemaVersion": 1,
"goal": "verify pkg:npm/%40npmcli/git@6.0.3",
"kind": "HOW",
"packages": [
"pkg:npm/%40npmcli/git@6.0.3"
]
}
import assert from 'node:assert/strict';
import fs from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';
import git from '@npmcli/git';
const tmpBase = await fs.mkdtemp(path.join(os.tmpdir(), 'npmcli-git-contract-'));
try {
const repoDir = path.join(tmpBase, 'workspace', 'repo');
const nestedDir = path.join(repoDir, 'packages', 'subpkg');
const outsideDir = path.join(tmpBase, 'outside');
await fs.mkdir(path.join(repoDir, '.git'), { recursive: true });
await fs.mkdir(nestedDir, { recursive: true });
await fs.mkdir(outsideDir, { recursive: true });
// 1. git.is checks for .git presence in cwd
assert.equal(await git.is({ cwd: repoDir }), true);
assert.equal(await git.is({ cwd: nestedDir }), false);
assert.equal(await git.is({ cwd: outsideDir }), false);
// 2. git.find traverses upward to locate the nearest git root or stops at root
const foundRoot = await git.find({ cwd: nestedDir, root: tmpBase });
assert.equal(foundRoot, repoDir);
const notFound = await git.find({ cwd: nestedDir, root: nestedDir });
assert.equal(notFound, null);
const outsideFound = await git.find({ cwd: outsideDir, root: tmpBase });
assert.equal(outsideFound, null);
// 3. git.spawn with { git: false } rejects with ENOGIT error
await assert.rejects(
() => git.spawn(['status'], { git: false }),
(err) => {
assert.equal(err.code, 'ENOGIT');
assert.equal(err.message, 'No git binary found in $PATH');
return true;
}
);
// 4. git.errors classes and retry policies
const connErr = new git.errors.GitConnectionError();
assert.equal(connErr.message, 'A git connection error occurred');
assert.equal(connErr.shouldRetry(1), true);
assert.equal(connErr.shouldRetry(2), true);
assert.equal(connErr.shouldRetry(3), false);
const pathspecErr = new git.errors.GitPathspecError();
assert.equal(pathspecErr.message, 'The git reference could not be found');
assert.equal(pathspecErr.shouldRetry(1), false);
const unknownErr = new git.errors.GitUnknownError();
assert.equal(unknownErr.message, 'An unknown git error occurred');
assert.equal(unknownErr.shouldRetry(1), false);
} finally {
await fs.rm(tmpBase, { recursive: true, force: true });
}
Seeder d'origine
anonyme