forge: step 10 — add CI safety checks

scripts/check-bot-safety.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/meshcore-env.sh"
+
+bot_sources=(
+  "${MESHCORE_DIR}/examples/companion_radio/BotTypes.h"
+  "${MESHCORE_DIR}/examples/companion_radio/FirmwareBot.h"
+  "${MESHCORE_DIR}/examples/companion_radio/FirmwareBot.cpp"
+  "${MESHCORE_DIR}/examples/companion_radio/BotCommands.h"
+  "${MESHCORE_DIR}/examples/companion_radio/BotCommands.cpp"
+  "${MESHCORE_DIR}/examples/companion_radio/BotPolicy.h"
+  "${MESHCORE_DIR}/examples/companion_radio/BotPolicy.cpp"
+  "${MESHCORE_DIR}/examples/companion_radio/BotPrefs.h"
+  "${MESHCORE_DIR}/examples/companion_radio/BotPrefs.cpp"
+  "${MESHCORE_DIR}/examples/companion_radio/EmergencyForwarder.h"
+  "${MESHCORE_DIR}/examples/companion_radio/EmergencyForwarder.cpp"
+  "${MESHCORE_DIR}/examples/companion_radio/KnownBotRegistry.h"
+  "${MESHCORE_DIR}/examples/companion_radio/KnownBotRegistry.cpp"
+  "${MESHCORE_DIR}/examples/companion_radio/ResponseCoordinator.h"
+  "${MESHCORE_DIR}/examples/companion_radio/ResponseCoordinator.cpp"
+)
+
+missing=0
+for file in "${bot_sources[@]}"; do
+  if [ ! -f "$file" ]; then
+    echo "Missing bot source: ${file#${MESHCORE_FW_ROOT}/}" >&2
+    missing=1
+  fi
+done
+if [ "$missing" -ne 0 ]; then
+  exit 1
+fi
+
+forbidden='\bString\b|std::|\bnew[[:space:]]|\bdelete[[:space:]]|\b(malloc|calloc|realloc|free)[[:space:]]*\(|ArduinoJson|JsonDocument|HTTPClient|WiFiClient|WebServer|AsyncWebServer|socket[[:space:]]*\('
+if grep -n -E "$forbidden" "${bot_sources[@]}"; then
+  echo "Forbidden dynamic allocation, container, JSON, or network API found in firmware bot sources." >&2
+  exit 1
+fi
+
+forbidden_timing='\b(txdelay|rxdelay)\b|direct[._-]?tx[._-]?delay|airtime_factor|rx_delay_base'
+if grep -n -E -i "$forbidden_timing" "${bot_sources[@]}"; then
+  echo "Forbidden lower-layer timing dependency found in firmware bot sources." >&2
+  exit 1
+fi
+
+require_pattern() {
+  local pattern="$1"
+  shift
+  local label="$1"
+  shift
+  if ! grep -q -E "$pattern" "$@"; then
+    echo "Missing safety marker: $label" >&2
+    exit 1
+  fi
+}
+
+require_pattern 'BOT_POLICY_IGNORE' 'normal Public bot traffic is ignored silently' \
+  "${MESHCORE_DIR}/examples/companion_radio/BotPolicy.cpp" \
+  "${MESHCORE_DIR}/examples/companion_radio/BotTypes.h"
+require_pattern 'BOT_POLICY_EMERGENCY_FORWARD' 'emergency traffic forwarding policy exists' \
+  "${MESHCORE_DIR}/examples/companion_radio/BotPolicy.cpp" \
+  "${MESHCORE_DIR}/examples/companion_radio/BotPolicy.h"
+require_pattern 'recordBotObservation\(|sendQueuedEmergencyForwards\(|tickBot\(' 'emergency path is wired in MyMesh' \
+  "${MESHCORE_DIR}/examples/companion_radio/MyMesh.cpp"
+require_pattern '_prefs\.path_hash_mode[[:space:]]*=[[:space:]]*1' 'bot firmware defaults to two-byte path hashes' \
+  "${MESHCORE_DIR}/examples/companion_radio/MyMesh.cpp"
+require_pattern 'CMESH_BOT_ENABLED=1' 'production bot build flag is enabled' \
+  "${MESHCORE_DIR}/platformio.ini"
+require_pattern 'ENABLE_PRIVATE_KEY_IMPORT=0' 'private key import disabled in production bot flags' \
+  "${MESHCORE_DIR}/platformio.ini"
+require_pattern 'ENABLE_PRIVATE_KEY_EXPORT=0' 'private key export disabled in production bot flags' \
+  "${MESHCORE_DIR}/platformio.ini"
+require_pattern '\$\{cmesh_bot_production\.build_flags\}' 'representative envs include production bot flags' \
+  "${MESHCORE_DIR}/variants/heltec_v3/platformio.ini" \
+  "${MESHCORE_DIR}/variants/rak4631/platformio.ini"
+
+count="$(grep -h -E '\$\{cmesh_bot_production\.build_flags\}' \
+  "${MESHCORE_DIR}/variants/heltec_v3/platformio.ini" \
+  "${MESHCORE_DIR}/variants/rak4631/platformio.ini" | wc -l | tr -d ' ')"
+if [ "$count" -lt 4 ]; then
+  echo "Expected production bot flags in four representative envs, found $count." >&2
+  exit 1
+fi
+
+echo "Firmware bot safety checks passed."