[Bug]: SSH device prerequisite test accepts Node releases below the pinned tool minimum #35981

import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import vm from 'node:vm';
import crypto from 'node:crypto';
import { spawnSync } from 'node:child_process';

const checkout = path.resolve(process.argv[2] ?? '.');
const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 't3-node-floor-'));
let result = 'inconclusive';
let status = 2;
try {
  console.log(`Harness Node ${process.version}; ${os.platform()} ${os.arch()}`);
  const tarVersion = spawnSync('tar', ['--version'], { encoding: 'utf8' });
  console.log(tarVersion.stdout.split('\n')[0]);
  if (tarVersion.status !== 0) throw new Error('tar unavailable');
  if (!['darwin', 'linux'].includes(os.platform()) || !['arm64', 'x64'].includes(os.arch())) throw new Error('Use macOS/Linux arm64/x64');
  const versions = JSON.parse(fs.readFileSync(path.join(checkout, 'apps/server/src/device/deviceToolVersions.json'), 'utf8'));
  const maintenance = fs.readFileSync(path.join(checkout, 'apps/server/src/device/deviceToolMaintenance.ts'), 'utf8').match(/export const deviceToolMaintenanceScript = String.raw`([\s\S]*?)`;/)?.[1];
  if (!maintenance) throw new Error('Maintenance script extraction failed');
  const source = fs.readFileSync(path.join(checkout, 'apps/server/src/device/sshDeviceScript.ts'), 'utf8');
  const prefix = `const owner = 'fixture'; const mode = 'probe'; const hubVersion = ${JSON.stringify(versions['expo-device-hub'])}; const agentVersion = ${JSON.stringify(versions['agent-device'])};\n`;
  const body = source.slice(source.indexOf('String.raw`') + 'String.raw`'.length, source.lastIndexOf('`;'));
  if (!body.startsWith('\nconst fs')) throw new Error('Remote script extraction failed');
  const probeFile = path.join(scratch, 'probe.cjs');
  fs.writeFileSync(probeFile, prefix + maintenance + body);
  const fakeBin = path.join(scratch, 'fake-bin'); fs.mkdirSync(fakeBin);
  for (const [name, code] of [['adb', 0], ['xcrun', 1]]) {
    const file = path.join(fakeBin, name); fs.writeFileSync(file, `#!/bin/sh\nexit ${code}\n`); fs.chmodSync(file, 0o755);
  }
  const probes = [];
  const installs = [];
  for (const version of ['22.11.0', '22.12.0']) {
    const archive = `node-v${version}-${os.platform()}-${os.arch()}.tar.gz`;
    const base = `https://nodejs.org/dist/v${version}/`;
    const [bytes, sums] = await Promise.all([fetch(base + archive).then(async r => { if (!r.ok) throw new Error('Node archive fetch'); return Buffer.from(await r.arrayBuffer()); }), fetch(base + 'SHASUMS256.txt').then(r => r.text())]);
    const digest = crypto.createHash('sha256').update(bytes).digest('hex');
    if (!sums.split('\n').some(line => line.trim() === `${digest}  ${archive}`)) throw new Error('Node checksum mismatch');
    const archivePath = path.join(scratch, archive); fs.writeFileSync(archivePath, bytes);
    if (spawnSync('tar', ['-xzf', archivePath, '-C', scratch]).status !== 0) throw new Error('Node extraction failed');
    const nodeDir = path.join(scratch, `node-v${version}-${os.platform()}-${os.arch()}`, 'bin');
    const home = path.join(scratch, `home-${version}`); const tmp = path.join(scratch, `tmp-${version}`); fs.mkdirSync(home); fs.mkdirSync(tmp);
    const env = { HOME: home, TMPDIR: tmp, T3CODE_HOME: path.join(home, 't3'), AGENT_DEVICE_STATE_DIR: path.join(home, 'agent'), PATH: `${fakeBin}:${nodeDir}:/usr/bin:/bin`, npm_config_cache: path.join(home, 'cache'), npm_config_userconfig: path.join(home, 'npmrc'), npm_config_engine_strict: 'true' };
    const node = path.join(nodeDir, 'node');
    console.log(spawnSync(node, ['--version'], { env, encoding: 'utf8' }).stdout.trim());
    console.log('npm ' + spawnSync(path.join(nodeDir, 'npm'), ['--version'], { env, encoding: 'utf8' }).stdout.trim());
    const probe = spawnSync(node, [probeFile], { env, cwd: home, encoding: 'utf8' });
    probes.push(probe.status === 0 && JSON.parse(probe.stdout).platforms.some(p => p.platform === 'android' && p.available));
    console.log(`Node ${version}: T3 SSH probe exit ${probe.status}; Android available ${probes.at(-1)}`);
    const install = spawnSync(path.join(nodeDir, 'npm'), ['install', '--prefix', path.join(home, 'install'), '--no-fund', '--no-audit', '--ignore-scripts', `agent-device@${versions['agent-device']}`], { env, cwd: home, encoding: 'utf8', timeout: 120000 });
    installs.push(install);
    console.log(`Node ${version}: pinned agent-device install exit ${install.status}; EBADENGINE ${install.stderr.includes('EBADENGINE')}`);
    console.log(install.stderr.split('\n').filter(line => /EBADENGINE|Required:|Actual:/.test(line)).join('\n'));
  }
  if (!probes[1] || installs[1].status !== 0) throw new Error('Supported Node control failed');
  if (probes[0] && installs[0].status !== 0 && installs[0].stderr.includes('EBADENGINE')) { result = 'defect reproduced'; status = 1; }
  else if (!probes[0]) { result = 'expected behavior'; status = 0; }
  else throw new Error('Unsupported Node did not fail installation');
} catch (error) {
  console.error(error.message);
} finally {
  fs.rmSync(scratch, { recursive: true, force: true });
}
// Possible final lines: RESULT: defect reproduced; RESULT: expected behavior; RESULT: inconclusive
console.log(`RESULT: ${result}`);
process.exitCode = status;