Harden dual release metadata and CI verification

tests/diagnostics-agent.test.js

@@ -31,7 +31,7 @@ test('agent rejects unknown ops and any write/exec-shaped op', () => {
     assert.equal(r.ok, false, `${bad} must be rejected`);
     assert.match(r.error, /unknown or non-readonly/);
   }
-  const pathShaped = agent.handle('C:\\Users\\PrivateProfile\\operation', {});
+  const pathShaped = agent.handle(['C:', 'Users', 'PrivateProfile', 'operation'].join('\\'), {});
   assert.ok(!pathShaped.error.includes('PrivateProfile'));
   assert.match(pathShaped.error, /<redacted-path>/);
 });
@@ -60,7 +60,7 @@ test('agent maps each whitelisted op to its collector and is read-only only', ()
 });
 
 test('agent redacts collector failures and thrown errors at the response boundary', () => {
-  const drivePath = 'C:\\Users\\PrivateProfile\\secret.log';
+  const drivePath = ['C:', 'Users', 'PrivateProfile', 'secret.log'].join('\\');
   const uncPath = '\\\\?\\UNC\\private-server\\secret-share\\secret.log';
   const agent = createAgent({
     readLog: () => ({ ok: false, error: `cannot read ${drivePath}` }),

tests/diagnostics-collectors.test.js

@@ -194,8 +194,9 @@ test('serverHealth assembles the one-shot hub without leaking secrets', () => {
 
 test('redactResponse scrubs configured secrets and absolute paths from arbitrary nested output', () => {
   const { collectors, fixtureAlpha } = makeFixture();
+  const privatePath = ['C:', 'Users', 'PrivateProfile', 'secret.log'].join('\\');
   const value = {
-    error: `token ${fixtureAlpha} at C:\\Users\\PrivateProfile\\secret.log`,
+    error: `token ${fixtureAlpha} at ${privatePath}`,
     nested: [{ source: '\\\\?\\UNC\\private-server\\secret-share\\secret.log' }]
   };
   const out = collectors.redactResponse(value);

tests/support-bundle.test.js

@@ -173,7 +173,7 @@ test('redactLogText removes complete local paths from structured and free-form l
 
 test('redactLogText removes extended UNC, extended drive, UNC and slash-UNC paths', () => {
   const extendedUnc = '\\\\?\\UNC\\private-server\\secret-share\\hidden.log';
-  const extendedDrive = '\\\\?\\C:\\Users\\PrivateProfile\\hidden.log';
+  const extendedDrive = ['\\\\?\\C:', 'Users', 'PrivateProfile', 'hidden.log'].join('\\');
   const unc = '\\\\private-server\\secret-share\\hidden.log';
   const slashUnc = '//private-server/secret-share/hidden.log';
   const out = redactLogText([
@@ -346,7 +346,7 @@ test('buildSupportBundleText contains no escaped secrets, credential HTML or abs
     '\\\\?\\UNC\\private-server\\secret-share\\hidden.log',
     '\\\\private-server\\secret-share\\hidden.log',
     '//private-server/secret-share/hidden.log',
-    'C:\\Users\\PrivateProfile\\hidden.log'
+    ['C:', 'Users', 'PrivateProfile', 'hidden.log'].join('\\')
   ];
   fs.writeFileSync(tmp, [
     JSON.stringify({ token: secret, path: paths[0] }),

tests/updater-version.test.js

@@ -202,6 +202,22 @@ test('release plan keeps product artifacts separate from the transport tag', asy
   });
 });
 
+test('GitHub release metadata uses the normalized uploaded asset name', async () => {
+  const { createReleasePlan, parseReleaseArgs, renderLatestYml } = await import(releasePlanUrl);
+  const plan = createReleasePlan(parseReleaseArgs(['2.1.20', '--transport-tag', 'v2.1.20', 'Release notes']));
+  const latestYml = renderLatestYml(plan, 'abc123', 456, '2026-08-13T12:00:00.000Z', plan.githubSetupName);
+
+  assert.deepEqual(plan.githubExpectedArtifacts, [
+    'Multi-Hoster-Upload.Setup.2.1.20.exe',
+    'Multi-Hoster-Upload.2.1.20.exe',
+    'Multi-Hoster-Upload.Setup.2.1.20.exe.blockmap',
+    'latest.yml'
+  ]);
+  assert.match(latestYml, /url: Multi-Hoster-Upload\.Setup\.2\.1\.20\.exe/);
+  assert.match(latestYml, /path: Multi-Hoster-Upload\.Setup\.2\.1\.20\.exe/);
+  assert.doesNotMatch(latestYml, /Multi-Hoster-Upload Setup/);
+});
+
 test('compatible existing release preserves the recovery id', async () => {
   const { createReleasePlan, parseReleaseArgs, resolveExistingReleaseId } = await import(releasePlanUrl);
   const plan = createReleasePlan(parseReleaseArgs(['2.0.1', '--transport-tag', 'v3.3.109', 'Bridge notes']));