973 lines
36 KiB
JavaScript
973 lines
36 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* P4/D12 preflight — fail a Tauri build LOUDLY when the arch-parameterized
|
|
* sidecar resources are missing.
|
|
*
|
|
* The tauri.conf.json beforeBuildCommand regenerates ONLY the sidecar JS
|
|
* bundle (build-sidecar.mjs — arch-independent, safe to run arch-blind). The
|
|
* Node runtime and native modules are arch-PARAMETERIZED (TARGET_ARCH) and
|
|
* must be staged by the explicit npm scripts / CI steps that set it — the
|
|
* hook must never regenerate them (an arch-blind re-run on a cross-arch
|
|
* matrix leg clobbers the staged artifacts; P4 review HIGH). But the bundle
|
|
* resources glob (`resources/*`) silently tolerates ABSENT files — a raw
|
|
* `npx tauri build` on a fresh clone would package a binary with no Node
|
|
* runtime at all. This check turns that silent miss into a hard stop.
|
|
*/
|
|
|
|
import fs from 'node:fs';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { execFileSync } from 'node:child_process';
|
|
import { createHash } from 'node:crypto';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
const root = path.resolve(__dirname, '..');
|
|
const resourcesDir = path.join(root, 'app', 'src-tauri', 'resources');
|
|
const stagedDepsDir = path.join(resourcesDir, 'node_modules');
|
|
const bundledNpmRuntimeDir = path.join(stagedDepsDir, 'waggle-node-runtime');
|
|
const bundledNpmBinDir = path.join(bundledNpmRuntimeDir, 'bin');
|
|
const bundledNpmPackageDir = path.join(bundledNpmRuntimeDir, 'node_modules', 'npm');
|
|
const marketplaceDbRelative = 'packages/marketplace/marketplace.db';
|
|
const targetArch = process.env.TARGET_ARCH || process.arch;
|
|
const SIDECAR_PROVENANCE_PREFIX = '// Waggle-Sidecar-Provenance: ';
|
|
const SOURCE_ARTIFACT_PATTERN = /(?:\.map|\.(?:[cm]?ts|tsx)|\.tsbuildinfo)$/i;
|
|
const FIRST_PARTY_RUNTIME_ENTRY_PATTERN = /^(?:dist|package\.json|licen[cs]e(?:\.(?:md|txt))?|notice(?:\.(?:md|txt))?)$/i;
|
|
const MANUAL_FIRST_PARTY_RUNTIME_TARGETS = new Map([
|
|
['@waggle/hive-mind-hooks-openclaw', ['dist/handler.bundle.cjs']],
|
|
]);
|
|
const REQUIRED_SHARP_VERSION = '0.35.3';
|
|
const REQUIRED_BETTER_SQLITE_RANGE = '>=12.6.2 <13';
|
|
const STAGED_DEPENDENCY_VERSION_ALLOWLISTS = new Map([
|
|
['brace-expansion', new Set(['1.1.18', '2.1.4', '5.0.9'])],
|
|
['fast-uri', new Set(['3.1.5'])],
|
|
['ip-address', new Set(['10.4.0'])],
|
|
]);
|
|
const STAGED_DEPENDENCY_DENYLIST = new Set(['js-yaml']);
|
|
|
|
const missing = [];
|
|
const unsafe = [];
|
|
|
|
function listFiles(dir) {
|
|
const files = [];
|
|
const stack = [dir];
|
|
while (stack.length > 0) {
|
|
const current = stack.pop();
|
|
for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
|
|
const full = path.join(current, entry.name);
|
|
if (entry.isDirectory()) stack.push(full);
|
|
else if (entry.isFile()) files.push(full);
|
|
}
|
|
}
|
|
return files;
|
|
}
|
|
|
|
function resourceRelative(file) {
|
|
return path.relative(resourcesDir, file).split(path.sep).join('/');
|
|
}
|
|
|
|
function sha256File(file) {
|
|
return createHash('sha256').update(fs.readFileSync(file)).digest('hex');
|
|
}
|
|
|
|
function readGitBlob(revision, relative) {
|
|
return execFileSync(
|
|
'git',
|
|
['-C', root, 'cat-file', 'blob', `${revision}:${relative}`],
|
|
{ maxBuffer: 64 * 1024 * 1024, windowsHide: true },
|
|
);
|
|
}
|
|
|
|
function listSqliteSidecars(dir) {
|
|
if (!fs.existsSync(dir)) return [];
|
|
const sidecars = [];
|
|
const stack = [dir];
|
|
while (stack.length > 0) {
|
|
const current = stack.pop();
|
|
for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
|
|
const full = path.join(current, entry.name);
|
|
if (/\.db-(?:wal|shm|journal)$/i.test(entry.name)) sidecars.push(full);
|
|
if (entry.isDirectory()) stack.push(full);
|
|
}
|
|
}
|
|
return sidecars.sort();
|
|
}
|
|
|
|
function parseSidecarProvenance(serviceBuffer) {
|
|
const newlineIndex = serviceBuffer.indexOf(0x0a);
|
|
if (newlineIndex < 0) {
|
|
throw new Error('resources/service.js is missing embedded provenance');
|
|
}
|
|
const firstLine = serviceBuffer.subarray(0, newlineIndex).toString('utf8');
|
|
if (!firstLine.startsWith(SIDECAR_PROVENANCE_PREFIX)) {
|
|
throw new Error('resources/service.js is missing embedded provenance');
|
|
}
|
|
const encoded = firstLine.slice(SIDECAR_PROVENANCE_PREFIX.length);
|
|
if (
|
|
encoded.length === 0
|
|
|| encoded.length % 4 !== 0
|
|
|| !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)
|
|
) {
|
|
throw new Error('resources/service.js embedded provenance is not canonical base64');
|
|
}
|
|
const decoded = Buffer.from(encoded, 'base64');
|
|
if (decoded.toString('base64') !== encoded) {
|
|
throw new Error('resources/service.js embedded provenance is not canonical base64');
|
|
}
|
|
|
|
let provenance;
|
|
try {
|
|
provenance = JSON.parse(decoded.toString('utf8'));
|
|
} catch {
|
|
throw new Error('resources/service.js embedded provenance is not valid JSON');
|
|
}
|
|
if (!provenance || typeof provenance !== 'object' || Array.isArray(provenance)) {
|
|
throw new Error('resources/service.js embedded provenance must be an object');
|
|
}
|
|
if (provenance.schemaVersion !== 1) {
|
|
throw new Error('resources/service.js embedded provenance schemaVersion must be 1');
|
|
}
|
|
if (!/^[0-9a-f]{40}$/.test(provenance.sourceRevision)) {
|
|
throw new Error('resources/service.js embedded provenance sourceRevision is invalid');
|
|
}
|
|
if (provenance.entryPoint !== 'packages/server/src/local/service.ts') {
|
|
throw new Error('resources/service.js embedded provenance entryPoint is invalid');
|
|
}
|
|
if (!Array.isArray(provenance.sourceInputs) || provenance.sourceInputs.length === 0) {
|
|
throw new Error('resources/service.js embedded provenance sourceInputs are missing');
|
|
}
|
|
|
|
const requiredInputs = new Set([
|
|
'package-lock.json',
|
|
'package.json',
|
|
'packages/server/src/local/service.ts',
|
|
'scripts/build-sidecar.mjs',
|
|
]);
|
|
let previousPath = null;
|
|
for (const input of provenance.sourceInputs) {
|
|
if (!input || typeof input !== 'object' || Array.isArray(input)) {
|
|
throw new Error('resources/service.js embedded provenance source input is invalid');
|
|
}
|
|
const relative = input.path;
|
|
if (
|
|
typeof relative !== 'string'
|
|
|| relative.length === 0
|
|
|| relative.includes('\\')
|
|
|| relative.includes('\0')
|
|
|| path.posix.isAbsolute(relative)
|
|
|| relative.split('/').some((part) => part === '' || part === '.' || part === '..')
|
|
|| relative.split('/').includes('node_modules')
|
|
) {
|
|
throw new Error('resources/service.js embedded provenance source input path is unsafe');
|
|
}
|
|
if (previousPath !== null && previousPath >= relative) {
|
|
throw new Error('resources/service.js embedded provenance source inputs are not unique and sorted');
|
|
}
|
|
if (!/^[0-9a-f]{64}$/.test(input.sha256)) {
|
|
throw new Error('resources/service.js embedded provenance source input hash is invalid');
|
|
}
|
|
previousPath = relative;
|
|
requiredInputs.delete(relative);
|
|
}
|
|
if (requiredInputs.size > 0) {
|
|
throw new Error('resources/service.js embedded provenance omits required source inputs');
|
|
}
|
|
|
|
const payload = serviceBuffer.subarray(newlineIndex + 1);
|
|
if (
|
|
!provenance.bundlePayload
|
|
|| typeof provenance.bundlePayload !== 'object'
|
|
|| !Number.isSafeInteger(provenance.bundlePayload.sizeBytes)
|
|
|| provenance.bundlePayload.sizeBytes < 1
|
|
|| !/^[0-9a-f]{64}$/.test(provenance.bundlePayload.sha256)
|
|
|| provenance.bundlePayload.sizeBytes !== payload.byteLength
|
|
|| provenance.bundlePayload.sha256 !== createHash('sha256').update(payload).digest('hex')
|
|
) {
|
|
throw new Error('resources/service.js payload does not match embedded provenance');
|
|
}
|
|
|
|
return provenance;
|
|
}
|
|
|
|
function expectedSourceRevision() {
|
|
const index = process.argv.indexOf('--expected-source-revision');
|
|
const supplied = index >= 0 ? process.argv[index + 1] : null;
|
|
if (index >= 0 && !supplied) {
|
|
throw new Error('--expected-source-revision requires a 40-character revision');
|
|
}
|
|
const revision = supplied ?? execFileSync(
|
|
'git',
|
|
['-C', root, 'rev-parse', 'HEAD'],
|
|
{ encoding: 'utf8', windowsHide: true },
|
|
).trim();
|
|
if (!/^[0-9a-f]{40}$/.test(revision)) {
|
|
throw new Error('expected source revision must be exactly 40 lowercase hexadecimal characters');
|
|
}
|
|
return revision;
|
|
}
|
|
|
|
function readManifest(packageDir) {
|
|
try {
|
|
return JSON.parse(fs.readFileSync(path.join(packageDir, 'package.json'), 'utf8'));
|
|
} catch {
|
|
return {};
|
|
}
|
|
}
|
|
|
|
function listPackageDirs(nodeModulesDir) {
|
|
if (!fs.existsSync(nodeModulesDir)) return [];
|
|
const packageDirs = [];
|
|
const stack = [nodeModulesDir];
|
|
while (stack.length > 0) {
|
|
const current = stack.pop();
|
|
for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
|
|
if (!entry.isDirectory()) continue;
|
|
const full = path.join(current, entry.name);
|
|
if (fs.existsSync(path.join(full, 'package.json'))) packageDirs.push(full);
|
|
stack.push(full);
|
|
}
|
|
}
|
|
return packageDirs;
|
|
}
|
|
|
|
function isSupportedBetterSqliteVersion(version) {
|
|
if (typeof version !== 'string') return false;
|
|
const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
|
|
if (!match) return false;
|
|
const [major, minor, patch] = match.slice(1).map(Number);
|
|
if (![major, minor, patch].every(Number.isSafeInteger)) return false;
|
|
return major === 12 && (minor > 6 || (minor === 6 && patch >= 2));
|
|
}
|
|
|
|
function stagedDependencyVersionFailures(nodeModulesDir, packageManifests) {
|
|
const manifests = packageManifests ?? listPackageDirs(nodeModulesDir)
|
|
.map((packageDir) => [packageDir, readManifest(packageDir)]);
|
|
const failures = [];
|
|
|
|
for (const [packageDir, manifest] of manifests) {
|
|
const relative = path.relative(nodeModulesDir, packageDir).split(path.sep).join('/');
|
|
const normalizedRelative = relative.toLowerCase();
|
|
const isBetterSqlitePath = (
|
|
normalizedRelative === 'better-sqlite3'
|
|
|| normalizedRelative.endsWith('/node_modules/better-sqlite3')
|
|
);
|
|
const allowedVersions = STAGED_DEPENDENCY_VERSION_ALLOWLISTS.get(manifest.name);
|
|
if (allowedVersions && !allowedVersions.has(manifest.version)) {
|
|
failures.push(
|
|
`node_modules/${relative} contains ${manifest.name}@${manifest.version}; `
|
|
+ `allowed versions: ${[...allowedVersions].join(', ')}`,
|
|
);
|
|
}
|
|
if (isBetterSqlitePath && manifest.name !== 'better-sqlite3') {
|
|
failures.push(
|
|
`node_modules/${relative} must identify as better-sqlite3; `
|
|
+ `found name ${JSON.stringify(manifest.name)}`,
|
|
);
|
|
}
|
|
if (
|
|
(isBetterSqlitePath || manifest.name === 'better-sqlite3')
|
|
&& !isSupportedBetterSqliteVersion(manifest.version)
|
|
) {
|
|
failures.push(
|
|
`node_modules/${relative} contains better-sqlite3@${manifest.version}; `
|
|
+ `required version: ${REQUIRED_BETTER_SQLITE_RANGE}`,
|
|
);
|
|
}
|
|
if (
|
|
(
|
|
manifest.name === 'sharp'
|
|
|| (
|
|
typeof manifest.name === 'string'
|
|
&& /^@img\/sharp-(?!libvips-)/.test(manifest.name)
|
|
)
|
|
)
|
|
&& manifest.version !== REQUIRED_SHARP_VERSION
|
|
) {
|
|
failures.push(
|
|
`node_modules/${relative} contains ${manifest.name}@${manifest.version}; `
|
|
+ `required version: ${REQUIRED_SHARP_VERSION}`,
|
|
);
|
|
}
|
|
if (STAGED_DEPENDENCY_DENYLIST.has(manifest.name)) {
|
|
failures.push(`node_modules/${relative} contains development-only ${manifest.name}`);
|
|
}
|
|
}
|
|
|
|
const bundledBraceDir = path.join(
|
|
nodeModulesDir,
|
|
'waggle-node-runtime',
|
|
'node_modules',
|
|
'npm',
|
|
'node_modules',
|
|
'brace-expansion',
|
|
);
|
|
const bundledBraceVersion = readManifest(bundledBraceDir).version;
|
|
if (bundledBraceVersion !== '2.1.4') {
|
|
failures.push(
|
|
`node_modules/waggle-node-runtime/node_modules/npm/node_modules/brace-expansion `
|
|
+ `must be exactly 2.1.4; found ${bundledBraceVersion ?? 'missing'}`,
|
|
);
|
|
}
|
|
|
|
return failures;
|
|
}
|
|
|
|
function localWorkspacePackageNames() {
|
|
const names = new Set();
|
|
for (const workspaceRoot of ['packages', 'apps'].map((entry) => path.join(root, entry))) {
|
|
if (!fs.existsSync(workspaceRoot)) continue;
|
|
for (const entry of fs.readdirSync(workspaceRoot, { withFileTypes: true })) {
|
|
if (!entry.isDirectory()) continue;
|
|
const manifest = readManifest(path.join(workspaceRoot, entry.name));
|
|
if (typeof manifest.name === 'string') names.add(manifest.name);
|
|
}
|
|
}
|
|
return names;
|
|
}
|
|
|
|
function collectRuntimeExportTargets(value, targets, condition = '') {
|
|
if (condition === 'types') return;
|
|
if (typeof value === 'string') {
|
|
targets.add(value);
|
|
return;
|
|
}
|
|
if (Array.isArray(value)) {
|
|
for (const entry of value) collectRuntimeExportTargets(entry, targets, condition);
|
|
return;
|
|
}
|
|
if (!value || typeof value !== 'object') return;
|
|
for (const [key, entry] of Object.entries(value)) {
|
|
collectRuntimeExportTargets(entry, targets, key);
|
|
}
|
|
}
|
|
|
|
function firstPartyRuntimeTargets(manifest) {
|
|
const targets = new Set();
|
|
if (typeof manifest.main === 'string') targets.add(manifest.main);
|
|
if (typeof manifest.module === 'string') targets.add(manifest.module);
|
|
if (typeof manifest.bin === 'string') targets.add(manifest.bin);
|
|
else if (manifest.bin && typeof manifest.bin === 'object') {
|
|
for (const entry of Object.values(manifest.bin)) {
|
|
if (typeof entry === 'string') targets.add(entry);
|
|
}
|
|
}
|
|
collectRuntimeExportTargets(manifest.exports, targets);
|
|
for (const entry of MANUAL_FIRST_PARTY_RUNTIME_TARGETS.get(manifest.name) || []) {
|
|
targets.add(entry);
|
|
}
|
|
return targets;
|
|
}
|
|
|
|
function validateFirstPartyRuntimeTargets(packageDir, manifest) {
|
|
const failures = [];
|
|
const distDir = path.resolve(packageDir, 'dist');
|
|
for (const target of firstPartyRuntimeTargets(manifest)) {
|
|
const relative = target.replace(/^\.\//, '').split('/').join(path.sep);
|
|
const resolved = path.resolve(packageDir, relative);
|
|
const withinDist = resolved.startsWith(`${distDir}${path.sep}`);
|
|
let regularRuntimeFile = false;
|
|
let realDistWithinPackage = false;
|
|
let realWithinDist = false;
|
|
if (withinDist && fs.existsSync(resolved)) {
|
|
const stat = fs.lstatSync(resolved);
|
|
regularRuntimeFile = stat.isFile() && !stat.isSymbolicLink();
|
|
if (regularRuntimeFile) {
|
|
const realPackageDir = fs.realpathSync.native(packageDir);
|
|
const realDistDir = fs.realpathSync.native(distDir);
|
|
const realTarget = fs.realpathSync.native(resolved);
|
|
realDistWithinPackage = realDistDir.startsWith(`${realPackageDir}${path.sep}`);
|
|
realWithinDist = realTarget.startsWith(`${realDistDir}${path.sep}`);
|
|
}
|
|
}
|
|
if (
|
|
!withinDist
|
|
|| !realDistWithinPackage
|
|
|| !realWithinDist
|
|
|| !regularRuntimeFile
|
|
|| target.includes('*')
|
|
) {
|
|
failures.push(target);
|
|
}
|
|
}
|
|
return failures;
|
|
}
|
|
|
|
const dependencyOnlyIndex = process.argv.indexOf('--dependency-versions-only');
|
|
if (dependencyOnlyIndex >= 0) {
|
|
const target = process.argv[dependencyOnlyIndex + 1];
|
|
if (!target) {
|
|
console.error('[check-sidecar-resources] --dependency-versions-only requires a directory');
|
|
process.exit(1);
|
|
}
|
|
const failures = stagedDependencyVersionFailures(path.resolve(target));
|
|
if (failures.length > 0) {
|
|
for (const failure of failures) console.error(failure);
|
|
process.exit(1);
|
|
}
|
|
console.log('[check-sidecar-resources] staged dependency versions are release-safe');
|
|
process.exit(0);
|
|
}
|
|
|
|
let expectedRevision = null;
|
|
try {
|
|
expectedRevision = expectedSourceRevision();
|
|
} catch (err) {
|
|
unsafe.push(err instanceof Error ? err.message : String(err));
|
|
}
|
|
|
|
const servicePath = path.join(resourcesDir, 'service.js');
|
|
if (!fs.existsSync(servicePath)) {
|
|
missing.push('resources/service.js (run: node scripts/build-sidecar.mjs)');
|
|
} else {
|
|
const serviceBuffer = fs.readFileSync(servicePath);
|
|
const service = serviceBuffer.toString('utf8');
|
|
if (/(?:\/\/|\/\*)[#@]\s*sourceMappingURL\s*=/.test(service)) {
|
|
unsafe.push('resources/service.js contains a sourceMappingURL directive');
|
|
}
|
|
try {
|
|
const provenance = parseSidecarProvenance(serviceBuffer);
|
|
if (expectedRevision && provenance.sourceRevision !== expectedRevision) {
|
|
throw new Error('resources/service.js source revision does not match expected revision');
|
|
}
|
|
for (const input of provenance.sourceInputs) {
|
|
const absolute = path.join(root, ...input.path.split('/'));
|
|
let sourceSafe = false;
|
|
if (fs.existsSync(absolute)) {
|
|
const stat = fs.lstatSync(absolute);
|
|
const relative = path.relative(root, absolute);
|
|
sourceSafe = stat.isFile()
|
|
&& !stat.isSymbolicLink()
|
|
&& relative !== ''
|
|
&& !relative.startsWith(`..${path.sep}`)
|
|
&& !path.isAbsolute(relative)
|
|
&& sha256File(absolute) === input.sha256;
|
|
}
|
|
if (!sourceSafe) {
|
|
throw new Error(
|
|
`resources/service.js source input hash does not match current source: ${input.path}`,
|
|
);
|
|
}
|
|
}
|
|
} catch (err) {
|
|
unsafe.push(err instanceof Error ? err.message : String(err));
|
|
}
|
|
}
|
|
|
|
const canonicalMarketplaceDb = path.join(root, ...marketplaceDbRelative.split('/'));
|
|
const marketplaceResource = path.join(resourcesDir, 'marketplace.db');
|
|
for (const suffix of ['-wal', '-shm', '-journal']) {
|
|
if (fs.existsSync(`${canonicalMarketplaceDb}${suffix}`)) {
|
|
unsafe.push(`packages/marketplace/marketplace.db${suffix} must not be present while staging`);
|
|
}
|
|
}
|
|
for (const sidecar of listSqliteSidecars(resourcesDir)) {
|
|
unsafe.push(`resources/${resourceRelative(sidecar)} must not be packaged`);
|
|
}
|
|
const canonicalMarketplaceIsRegular = fs.existsSync(canonicalMarketplaceDb)
|
|
&& fs.lstatSync(canonicalMarketplaceDb).isFile()
|
|
&& !fs.lstatSync(canonicalMarketplaceDb).isSymbolicLink();
|
|
const marketplaceResourceIsRegular = fs.existsSync(marketplaceResource)
|
|
&& fs.lstatSync(marketplaceResource).isFile()
|
|
&& !fs.lstatSync(marketplaceResource).isSymbolicLink();
|
|
if (!canonicalMarketplaceIsRegular) {
|
|
missing.push('packages/marketplace/marketplace.db canonical build input');
|
|
}
|
|
let marketplaceGitBlob = null;
|
|
if (expectedRevision) {
|
|
try {
|
|
marketplaceGitBlob = readGitBlob(expectedRevision, marketplaceDbRelative);
|
|
} catch {
|
|
unsafe.push('canonical marketplace database is missing from exact source revision');
|
|
}
|
|
}
|
|
const canonicalMarketplaceBytes = canonicalMarketplaceIsRegular
|
|
? fs.readFileSync(canonicalMarketplaceDb)
|
|
: null;
|
|
if (
|
|
marketplaceGitBlob
|
|
&& canonicalMarketplaceBytes
|
|
&& !canonicalMarketplaceBytes.equals(marketplaceGitBlob)
|
|
) {
|
|
unsafe.push(
|
|
'packages/marketplace/marketplace.db canonical marketplace database does not match exact source revision',
|
|
);
|
|
}
|
|
if (!fs.existsSync(marketplaceResource)) {
|
|
missing.push('resources/marketplace.db (run: node scripts/build-sidecar.mjs)');
|
|
} else if (!marketplaceResourceIsRegular) {
|
|
unsafe.push('resources/marketplace.db must be a regular file');
|
|
} else {
|
|
const marketplaceResourceBytes = fs.readFileSync(marketplaceResource);
|
|
if (marketplaceGitBlob && !marketplaceResourceBytes.equals(marketplaceGitBlob)) {
|
|
unsafe.push(
|
|
'resources/marketplace.db does not match the canonical marketplace database at the exact source revision',
|
|
);
|
|
} else if (
|
|
canonicalMarketplaceBytes
|
|
&& !marketplaceResourceBytes.equals(canonicalMarketplaceBytes)
|
|
) {
|
|
unsafe.push('resources/marketplace.db does not match the canonical marketplace database');
|
|
}
|
|
}
|
|
|
|
const sourceArtifacts = fs.existsSync(resourcesDir)
|
|
? fs.readdirSync(resourcesDir, { withFileTypes: true })
|
|
.filter((entry) => /\.(?:map|tsx?)$/i.test(entry.name))
|
|
.map((entry) => entry.name)
|
|
: [];
|
|
for (const artifact of sourceArtifacts) {
|
|
unsafe.push(`resources/${artifact} must not be packaged`);
|
|
}
|
|
|
|
const stagedPackageDirs = listPackageDirs(stagedDepsDir);
|
|
const stagedPackageManifests = stagedPackageDirs
|
|
.map((packageDir) => [packageDir, readManifest(packageDir)]);
|
|
for (const failure of stagedDependencyVersionFailures(stagedDepsDir, stagedPackageManifests)) {
|
|
unsafe.push(`resources/${failure}`);
|
|
}
|
|
const firstPartyRoot = path.join(stagedDepsDir, '@waggle');
|
|
const firstPartyPackageDirs = new Map();
|
|
if (fs.existsSync(firstPartyRoot)) {
|
|
for (const packageEntry of fs.readdirSync(firstPartyRoot, { withFileTypes: true })) {
|
|
if (!packageEntry.isDirectory()) continue;
|
|
firstPartyPackageDirs.set(
|
|
path.join(firstPartyRoot, packageEntry.name),
|
|
`@waggle/${packageEntry.name}`,
|
|
);
|
|
}
|
|
}
|
|
const workspacePackageNames = localWorkspacePackageNames();
|
|
for (const name of workspacePackageNames) {
|
|
const directPackageDir = path.join(stagedDepsDir, ...name.split('/'));
|
|
if (fs.existsSync(directPackageDir)) {
|
|
firstPartyPackageDirs.set(directPackageDir, name);
|
|
}
|
|
}
|
|
for (const [packageDir, manifest] of stagedPackageManifests) {
|
|
const { name } = manifest;
|
|
if (
|
|
typeof name === 'string'
|
|
&& (name.startsWith('@waggle/') || workspacePackageNames.has(name))
|
|
) {
|
|
firstPartyPackageDirs.set(packageDir, name);
|
|
}
|
|
}
|
|
for (const [packageDir, expectedName] of firstPartyPackageDirs) {
|
|
let manifest = {};
|
|
const manifestPath = path.join(packageDir, 'package.json');
|
|
try {
|
|
const stat = fs.lstatSync(manifestPath);
|
|
if (!stat.isFile() || stat.isSymbolicLink()) {
|
|
throw new Error('manifest must be a regular file');
|
|
}
|
|
const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
|
|
if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
|
|
throw new Error('manifest must contain a JSON object');
|
|
}
|
|
if (parsed.name !== expectedName) {
|
|
throw new Error(`manifest name ${JSON.stringify(parsed.name)} does not match ${expectedName}`);
|
|
}
|
|
manifest = parsed;
|
|
} catch (err) {
|
|
unsafe.push(
|
|
`resources/${resourceRelative(manifestPath)} is missing or invalid: `
|
|
+ (err instanceof Error ? err.message : String(err)),
|
|
);
|
|
}
|
|
for (const entry of fs.readdirSync(packageDir, { withFileTypes: true })) {
|
|
if (FIRST_PARTY_RUNTIME_ENTRY_PATTERN.test(entry.name)) continue;
|
|
const relative = resourceRelative(path.join(packageDir, entry.name));
|
|
unsafe.push(`resources/${relative} is not a runtime package entry`);
|
|
}
|
|
for (const file of listFiles(packageDir)) {
|
|
if (SOURCE_ARTIFACT_PATTERN.test(file)) {
|
|
unsafe.push(`resources/${resourceRelative(file)} must not be packaged`);
|
|
}
|
|
if (
|
|
/\.(?:[cm]?js)$/i.test(file)
|
|
&& /(?:\/\/|\/\*)[#@]\s*sourceMappingURL\s*=/.test(fs.readFileSync(file, 'utf8'))
|
|
) {
|
|
unsafe.push(`resources/${resourceRelative(file)} contains a sourceMappingURL directive`);
|
|
}
|
|
}
|
|
for (const target of validateFirstPartyRuntimeTargets(packageDir, manifest)) {
|
|
unsafe.push(
|
|
`resources/${resourceRelative(packageDir)} has an invalid or missing runtime target: ${target}`,
|
|
);
|
|
}
|
|
}
|
|
|
|
const nodeBinary = process.platform === 'win32' ? 'node.exe' : 'node';
|
|
const nodePath = path.join(resourcesDir, nodeBinary);
|
|
const npmCliPath = path.join(bundledNpmPackageDir, 'bin', 'npm-cli.js');
|
|
const npxCliPath = path.join(bundledNpmPackageDir, 'bin', 'npx-cli.js');
|
|
const npmWrapperPath = path.join(
|
|
bundledNpmBinDir,
|
|
process.platform === 'win32' ? 'npm.cmd' : 'npm',
|
|
);
|
|
const npxWrapperPath = path.join(
|
|
bundledNpmBinDir,
|
|
process.platform === 'win32' ? 'npx.cmd' : 'npx',
|
|
);
|
|
const bundledNpmFiles = [
|
|
path.join(bundledNpmRuntimeDir, 'package.json'),
|
|
path.join(bundledNpmRuntimeDir, 'NODE-LICENSE'),
|
|
path.join(bundledNpmPackageDir, 'LICENSE'),
|
|
npmCliPath,
|
|
npxCliPath,
|
|
npmWrapperPath,
|
|
npxWrapperPath,
|
|
];
|
|
for (const file of bundledNpmFiles) {
|
|
if (!fs.existsSync(file) || !fs.lstatSync(file).isFile()) {
|
|
missing.push(`resources/${resourceRelative(file)} (run: node scripts/bundle-node.mjs)`);
|
|
}
|
|
}
|
|
if (process.platform !== 'win32') {
|
|
for (const wrapper of [npmWrapperPath, npxWrapperPath]) {
|
|
if (fs.existsSync(wrapper) && (fs.statSync(wrapper).mode & 0o111) === 0) {
|
|
unsafe.push(`resources/${resourceRelative(wrapper)} is not executable`);
|
|
}
|
|
}
|
|
}
|
|
let bundledNodeVersion = null;
|
|
if (!fs.existsSync(nodePath)) {
|
|
missing.push(`resources/${nodeBinary} (run: node scripts/bundle-node.mjs)`);
|
|
} else {
|
|
try {
|
|
const bundledRuntime = JSON.parse(execFileSync(nodePath, [
|
|
'-p',
|
|
'JSON.stringify({ arch: process.arch, version: process.versions.node })',
|
|
], {
|
|
encoding: 'utf-8',
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
}).trim());
|
|
bundledNodeVersion = bundledRuntime.version;
|
|
// The checker may run under a different Node major than the bundled runtime.
|
|
// The native-module probe below is the authoritative ABI compatibility check.
|
|
if (bundledRuntime.arch !== targetArch) {
|
|
missing.push(
|
|
`resources/${nodeBinary} architecture ${bundledRuntime.arch} does not match target ${targetArch}`,
|
|
);
|
|
}
|
|
} catch (err) {
|
|
missing.push(`resources/${nodeBinary} is not executable (${err.message})`);
|
|
}
|
|
}
|
|
|
|
if (
|
|
fs.existsSync(nodePath)
|
|
&& bundledNpmFiles.every((file) => fs.existsSync(file))
|
|
) {
|
|
try {
|
|
const runtimeManifest = readManifest(bundledNpmRuntimeDir);
|
|
const npmManifest = readManifest(bundledNpmPackageDir);
|
|
if (runtimeManifest.name !== 'waggle-node-runtime') {
|
|
throw new Error('runtime manifest has an unexpected name');
|
|
}
|
|
if (runtimeManifest.version !== bundledNodeVersion) {
|
|
throw new Error(
|
|
`runtime manifest Node ${runtimeManifest.version} does not match bundled Node ${bundledNodeVersion}`,
|
|
);
|
|
}
|
|
if (typeof npmManifest.version !== 'string' || npmManifest.version.length === 0) {
|
|
throw new Error('npm manifest has no version');
|
|
}
|
|
const runBundledCli = (cliPath) => execFileSync(nodePath, [cliPath, '--version'], {
|
|
encoding: 'utf8',
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
}).trim();
|
|
const runWrapper = (wrapperPath) => {
|
|
if (process.platform === 'win32') {
|
|
return execFileSync(process.env.ComSpec || 'cmd.exe', [
|
|
'/d',
|
|
'/s',
|
|
'/c',
|
|
`""${wrapperPath}" --version"`,
|
|
], {
|
|
encoding: 'utf8',
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
windowsVerbatimArguments: true,
|
|
}).trim();
|
|
}
|
|
return execFileSync(wrapperPath, ['--version'], {
|
|
encoding: 'utf8',
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
}).trim();
|
|
};
|
|
const versions = [
|
|
runBundledCli(npmCliPath),
|
|
runBundledCli(npxCliPath),
|
|
runWrapper(npmWrapperPath),
|
|
runWrapper(npxWrapperPath),
|
|
];
|
|
if (versions.some((version) => version !== npmManifest.version)) {
|
|
throw new Error(`npm/npx version mismatch: ${versions.join(', ')}`);
|
|
}
|
|
} catch (err) {
|
|
missing.push(
|
|
`resources bundled npm/npx runtime probe failed (${err instanceof Error ? err.message : String(err)})`,
|
|
);
|
|
}
|
|
}
|
|
|
|
const nativeDir = path.join(resourcesDir, 'native');
|
|
const nativeEntries = fs.existsSync(nativeDir)
|
|
? fs.readdirSync(nativeDir).filter((e) => e !== '.gitkeep' && e !== 'onnxruntime')
|
|
: [];
|
|
const requiredWindowsNativeFiles = [
|
|
'better_sqlite3.node',
|
|
'vec0.dll',
|
|
'onnxruntime/onnxruntime_binding.node',
|
|
];
|
|
if (process.platform === 'win32') {
|
|
for (const entry of requiredWindowsNativeFiles) {
|
|
if (!fs.existsSync(path.join(nativeDir, ...entry.split('/')))) {
|
|
missing.push(
|
|
`resources/native/${entry} (run: node scripts/bundle-native-deps.mjs)`,
|
|
);
|
|
}
|
|
}
|
|
} else if (process.platform === 'darwin') {
|
|
const requiredMacNativeFiles = [
|
|
'better_sqlite3.node',
|
|
'vec0.dylib',
|
|
'onnxruntime/onnxruntime_binding.node',
|
|
];
|
|
for (const entry of requiredMacNativeFiles) {
|
|
if (!fs.existsSync(path.join(nativeDir, ...entry.split('/')))) {
|
|
missing.push(`resources/native/${entry} (run: node scripts/bundle-native-deps.mjs)`);
|
|
}
|
|
}
|
|
const onnxDir = path.join(nativeDir, 'onnxruntime');
|
|
const hasOnnxLibrary = fs.existsSync(onnxDir)
|
|
&& fs.readdirSync(onnxDir).some((entry) => entry.endsWith('.dylib'));
|
|
if (!hasOnnxLibrary) {
|
|
missing.push('resources/native/onnxruntime/*.dylib (run: node scripts/bundle-native-deps.mjs)');
|
|
}
|
|
} else if (nativeEntries.length === 0) {
|
|
missing.push('resources/native/* (run: node scripts/bundle-native-deps.mjs)');
|
|
}
|
|
|
|
// Staged production node_modules for the esbuild-externalized packages
|
|
// (better-sqlite3, @fastify/static, mammoth, …). The bundled service.js
|
|
// `require()`s these by bare name and resolves them via NODE_PATH=resources/
|
|
// node_modules (service.rs). Like the native deps above, staging is done by the
|
|
// npm scripts / CI (stage-sidecar-deps.mjs), NOT the arch-blind beforeBuildCommand
|
|
// hook — so a raw `npx tauri build` that skips those would package a sidecar that
|
|
// dies with MODULE_NOT_FOUND on first boot. Probe a canonical external.
|
|
const stagedBetterSqlite = path.join(stagedDepsDir, 'better-sqlite3');
|
|
const stagedOnnxRuntime = path.join(stagedDepsDir, 'onnxruntime-node');
|
|
const stagedTransformers = path.join(stagedDepsDir, '@huggingface', 'transformers');
|
|
const stagedTransformersEntry = path.join(
|
|
stagedTransformers,
|
|
'dist',
|
|
'transformers.node.cjs',
|
|
);
|
|
const stagedSharp = path.join(stagedDepsDir, 'sharp');
|
|
const stagedSharpWindowsBinding = path.join(
|
|
stagedDepsDir,
|
|
'@img',
|
|
'sharp-win32-x64',
|
|
'lib',
|
|
`sharp-win32-x64-${REQUIRED_SHARP_VERSION}.node`,
|
|
);
|
|
const vecExtension = path.join(
|
|
nativeDir,
|
|
`vec0.${process.platform === 'win32' ? 'dll' : process.platform === 'darwin' ? 'dylib' : 'so'}`,
|
|
);
|
|
if (!fs.existsSync(path.join(stagedBetterSqlite, 'package.json'))) {
|
|
missing.push('resources/node_modules/* (run: node scripts/stage-sidecar-deps.mjs)');
|
|
}
|
|
if (!fs.existsSync(path.join(stagedOnnxRuntime, 'package.json'))) {
|
|
missing.push('resources/node_modules/onnxruntime-node (run: node scripts/stage-sidecar-deps.mjs)');
|
|
}
|
|
if (!fs.existsSync(path.join(stagedTransformers, 'package.json'))) {
|
|
missing.push(
|
|
'resources/node_modules/@huggingface/transformers '
|
|
+ '(run: node scripts/stage-sidecar-deps.mjs)',
|
|
);
|
|
}
|
|
if (!fs.existsSync(stagedTransformersEntry)) {
|
|
missing.push(
|
|
'resources/node_modules/@huggingface/transformers/dist/transformers.node.cjs '
|
|
+ '(run: node scripts/stage-sidecar-deps.mjs)',
|
|
);
|
|
}
|
|
if (!fs.existsSync(path.join(stagedSharp, 'package.json'))) {
|
|
missing.push('resources/node_modules/sharp (run: node scripts/stage-sidecar-deps.mjs)');
|
|
}
|
|
if (
|
|
process.platform === 'win32'
|
|
&& targetArch === 'x64'
|
|
&& !fs.existsSync(stagedSharpWindowsBinding)
|
|
) {
|
|
missing.push(
|
|
`resources/node_modules/@img/sharp-win32-x64/lib/`
|
|
+ `sharp-win32-x64-${REQUIRED_SHARP_VERSION}.node `
|
|
+ '(run: node scripts/stage-sidecar-deps.mjs)',
|
|
);
|
|
}
|
|
if (
|
|
fs.existsSync(nodePath)
|
|
&& fs.existsSync(path.join(stagedBetterSqlite, 'package.json'))
|
|
&& marketplaceResourceIsRegular
|
|
) {
|
|
let marketplaceProbeRoot;
|
|
try {
|
|
marketplaceProbeRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'waggle-marketplace-probe-'));
|
|
const marketplaceProbeDb = path.join(marketplaceProbeRoot, 'marketplace.db');
|
|
fs.copyFileSync(marketplaceResource, marketplaceProbeDb);
|
|
const marketplaceProbe = [
|
|
'const Database = require(process.argv[1]);',
|
|
'const database = new Database(process.argv[2], { readonly: true, fileMustExist: true });',
|
|
'const integrity = database.pragma("integrity_check", { simple: true });',
|
|
'if (integrity !== "ok") throw new Error(`integrity_check: ${integrity}`);',
|
|
'const foreignKeys = database.pragma("foreign_key_check");',
|
|
'if (foreignKeys.length !== 0) throw new Error("foreign_key_check failed");',
|
|
'const tables = database.prepare("SELECT name FROM sqlite_master WHERE type = \'table\' AND name IN (\'sources\', \'packages\')").all();',
|
|
'database.close();',
|
|
'if (new Set(tables.map((row) => row.name)).size !== 2) throw new Error("required tables missing");',
|
|
].join('');
|
|
execFileSync(nodePath, [
|
|
'-e',
|
|
marketplaceProbe,
|
|
stagedBetterSqlite,
|
|
marketplaceProbeDb,
|
|
], {
|
|
cwd: marketplaceProbeRoot,
|
|
env: { ...process.env, NODE_PATH: stagedDepsDir },
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
});
|
|
} catch {
|
|
unsafe.push('resources/marketplace.db failed its SQLite integrity/schema probe');
|
|
} finally {
|
|
if (marketplaceProbeRoot) {
|
|
fs.rmSync(marketplaceProbeRoot, { recursive: true, force: true });
|
|
}
|
|
}
|
|
}
|
|
if (
|
|
fs.existsSync(nodePath)
|
|
&& fs.existsSync(path.join(stagedTransformers, 'package.json'))
|
|
&& fs.existsSync(stagedTransformersEntry)
|
|
&& fs.existsSync(path.join(stagedSharp, 'package.json'))
|
|
&& (
|
|
process.platform !== 'win32'
|
|
|| targetArch !== 'x64'
|
|
|| fs.existsSync(stagedSharpWindowsBinding)
|
|
)
|
|
) {
|
|
try {
|
|
const imageProbe = [
|
|
'const { RawImage } = require(process.argv[1]);',
|
|
'const sharp = require(process.argv[2]);',
|
|
'if (process.argv[3]) require(process.argv[3]);',
|
|
'if (sharp.versions?.emscripten) throw new Error("Sharp fell back to WASM");',
|
|
'void (async () => {',
|
|
'const image = new RawImage(',
|
|
'Uint8Array.from([255,0,0,255,0,255,0,255,0,0,255,255,255,255,255,255]),',
|
|
'2,2,4);',
|
|
'const buffer = await image.toSharp().resize(1, 1).png().toBuffer();',
|
|
'const signature = Buffer.from([137,80,78,71,13,10,26,10]);',
|
|
'if (buffer.length < signature.length || !buffer.subarray(0, 8).equals(signature)) {',
|
|
'throw new Error("Sharp PNG probe failed");',
|
|
'}',
|
|
'})().catch((error) => { console.error(error); process.exit(1); });',
|
|
].join('');
|
|
execFileSync(nodePath, [
|
|
'-e',
|
|
imageProbe,
|
|
stagedTransformersEntry,
|
|
stagedSharp,
|
|
...(
|
|
process.platform === 'win32' && targetArch === 'x64'
|
|
? [stagedSharpWindowsBinding]
|
|
: []
|
|
),
|
|
], {
|
|
cwd: resourcesDir,
|
|
env: { ...process.env, NODE_PATH: stagedDepsDir },
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
});
|
|
} catch (err) {
|
|
missing.push(
|
|
`resources image runtime probe failed for @huggingface/transformers and sharp `
|
|
+ `using bundled ${nodeBinary} for ${targetArch} `
|
|
+ `(${err instanceof Error ? err.message : String(err)})`,
|
|
);
|
|
}
|
|
}
|
|
if (
|
|
fs.existsSync(nodePath)
|
|
&& fs.existsSync(path.join(stagedBetterSqlite, 'package.json'))
|
|
&& fs.existsSync(path.join(stagedOnnxRuntime, 'package.json'))
|
|
&& fs.existsSync(vecExtension)
|
|
) {
|
|
try {
|
|
const probe = [
|
|
'const Database = require(process.argv[1]);',
|
|
'if (process.arch !== process.argv[2]) throw new Error(`architecture ${process.arch}`);',
|
|
'const database = new Database(\':memory:\');',
|
|
'database.loadExtension(process.argv[3]);',
|
|
'const row = database.prepare(\'SELECT 1 AS ok\').get();',
|
|
'const vec = database.prepare(\'SELECT vec_version() AS version\').get();',
|
|
'database.close();',
|
|
'if (row.ok !== 1) throw new Error(\'SQLite query failed\');',
|
|
'if (typeof vec.version !== \'string\' || vec.version.length === 0) throw new Error(\'sqlite-vec query failed\');',
|
|
'const onnx = require(process.argv[4]);',
|
|
'if (typeof onnx.InferenceSession !== \'function\') throw new Error(\'ONNX binding failed\');',
|
|
].join('');
|
|
execFileSync(nodePath, [
|
|
'-e',
|
|
probe,
|
|
stagedBetterSqlite,
|
|
targetArch,
|
|
vecExtension,
|
|
stagedOnnxRuntime,
|
|
], {
|
|
cwd: resourcesDir,
|
|
env: { ...process.env, NODE_PATH: stagedDepsDir },
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
});
|
|
} catch {
|
|
missing.push(
|
|
`resources native runtime probe failed for better-sqlite3, sqlite-vec, or onnxruntime-node `
|
|
+ `using bundled ${nodeBinary} for ${targetArch}`,
|
|
);
|
|
}
|
|
}
|
|
|
|
// External agents and hook management run directly from this staged payload;
|
|
// none of these packages are available from npm in a packaged installation.
|
|
const hookRuntimeEntries = [
|
|
'@waggle/hive-mind-cli/dist/index.js',
|
|
'@waggle/hive-mind-hooks-claude-code/dist/bin/claude-code-hooks-cli.js',
|
|
'@waggle/hive-mind-hooks-claude-desktop/dist/bin/claude-desktop-hooks.js',
|
|
'@waggle/hive-mind-hooks-codex/dist/bin/codex-hooks.js',
|
|
'@waggle/hive-mind-hooks-codex-desktop/dist/bin/codex-desktop-hooks.js',
|
|
'@waggle/hive-mind-hooks-cursor/dist/bin/cursor-hooks.js',
|
|
'@waggle/hive-mind-hooks-hermes/dist/bin/hermes-hooks.js',
|
|
'@waggle/hive-mind-hooks-openclaw/dist/bin/openclaw-hooks.js',
|
|
'@waggle/hive-mind-hooks-openclaw/dist/handler.bundle.cjs',
|
|
'waggle-memory-mcp/dist/index.js',
|
|
];
|
|
for (const entry of hookRuntimeEntries) {
|
|
if (!fs.existsSync(path.join(stagedDepsDir, ...entry.split('/')))) {
|
|
missing.push(`resources/node_modules/${entry} (run: node scripts/stage-sidecar-deps.mjs)`);
|
|
}
|
|
}
|
|
|
|
if (missing.length > 0 || unsafe.length > 0) {
|
|
console.error('[check-sidecar-resources] FATAL — sidecar resources are not release-safe:');
|
|
for (const m of missing) console.error(` - ${m}`);
|
|
for (const item of unsafe) console.error(` - ${item}`);
|
|
console.error(
|
|
'[check-sidecar-resources] Stage them with the bundle scripts (set TARGET_ARCH for\n' +
|
|
'cross-arch builds) or use the npm tauri:build* scripts / CI, which run them for you.',
|
|
);
|
|
process.exit(1);
|
|
}
|
|
|
|
console.log('[check-sidecar-resources] OK — Node runtime + native deps + staged node_modules present');
|