372 lines
13 KiB
JavaScript
372 lines
13 KiB
JavaScript
import { spawn } from 'node:child_process';
|
|
import { readFile, readdir, stat } from 'node:fs/promises';
|
|
import { arch as hostArch, platform as hostPlatform } from 'node:os';
|
|
import {
|
|
dirname,
|
|
isAbsolute,
|
|
join,
|
|
relative,
|
|
resolve,
|
|
sep,
|
|
} from 'node:path';
|
|
import YAML from 'yaml';
|
|
|
|
import {
|
|
PI_RUNTIME_CLI_ENTRY,
|
|
PI_RUNTIME_MANIFEST,
|
|
PI_RUNTIME_PACKAGE,
|
|
PI_RUNTIME_VERSION,
|
|
} from './pi-runtime-bundle.mjs';
|
|
import {
|
|
inspectPackagedClosure,
|
|
packagedResourcesDirectory,
|
|
} from '../probe-pi-packaged-runtime.mjs';
|
|
|
|
const PRODUCT_NAME = 'Makelore';
|
|
const LINUX_EXECUTABLE_NAME = 'niancode';
|
|
const EXTENSION_CONTRACT_MARKERS = Object.freeze([
|
|
'Makelore runtime bridge rejected the request',
|
|
'subagent.dispatch',
|
|
'makelore.write-lease',
|
|
'MAKELORE_PI_BRIDGE_URL',
|
|
]);
|
|
const PI_AI_PROVIDER_PREFIX = 'pi-runtime/node_modules/@earendil-works/pi-ai/dist/providers/';
|
|
|
|
async function pathExists(path) {
|
|
try {
|
|
await stat(path);
|
|
return true;
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function portable(path) {
|
|
return path.split(sep).join('/');
|
|
}
|
|
|
|
function normalizeLockedVersion(value) {
|
|
return typeof value === 'string' ? value.split('(', 1)[0] : null;
|
|
}
|
|
|
|
function runCommand(executable, args, options = {}) {
|
|
return new Promise((resolvePromise, reject) => {
|
|
const child = spawn(executable, args, {
|
|
cwd: options.cwd,
|
|
env: options.env ?? process.env,
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
windowsHide: true,
|
|
});
|
|
let stdout = '';
|
|
let stderr = '';
|
|
child.stdout.on('data', (chunk) => { stdout += chunk.toString(); });
|
|
child.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
|
|
child.once('error', reject);
|
|
child.once('exit', (code, signal) => {
|
|
if (code === 0) resolvePromise({ stdout, stderr });
|
|
else reject(new Error(
|
|
`${executable} exited with code ${code ?? 'null'} signal ${signal ?? 'none'}: ${stderr || stdout}`,
|
|
));
|
|
});
|
|
});
|
|
}
|
|
|
|
export function defaultProductExecutable(projectRoot, currentPlatform = hostPlatform()) {
|
|
const root = resolve(projectRoot);
|
|
if (currentPlatform === 'win32') {
|
|
return join(root, 'release', 'win-unpacked', `${PRODUCT_NAME}.exe`);
|
|
}
|
|
if (currentPlatform === 'darwin') {
|
|
return join(root, 'release', 'mac', `${PRODUCT_NAME}.app`, 'Contents', 'MacOS', PRODUCT_NAME);
|
|
}
|
|
if (currentPlatform === 'linux') {
|
|
return join(root, 'release', 'linux-unpacked', LINUX_EXECUTABLE_NAME);
|
|
}
|
|
throw new Error(`Unsupported product artifact platform: ${currentPlatform}`);
|
|
}
|
|
|
|
export function assertNodeEngineCompatible(engine, nodeVersion) {
|
|
const match = /^>=(\d+)\.(\d+)\.(\d+)$/.exec(engine ?? '');
|
|
if (!match) throw new Error(`Unsupported Pi Node engine expression: ${engine ?? 'missing'}`);
|
|
const required = match.slice(1).map(Number);
|
|
const actualMatch = /^(\d+)\.(\d+)\.(\d+)/.exec(nodeVersion ?? '');
|
|
if (!actualMatch) throw new Error(`Invalid packaged Node version: ${nodeVersion ?? 'missing'}`);
|
|
const actual = actualMatch.slice(1).map(Number);
|
|
for (let index = 0; index < required.length; index += 1) {
|
|
if (actual[index] > required[index]) return;
|
|
if (actual[index] < required[index]) {
|
|
throw new Error(`Packaged Node ${nodeVersion} does not satisfy Pi engine ${engine}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
export function validatePiArtifactMetadata({
|
|
rootPackage,
|
|
lockfile,
|
|
packagedPackage,
|
|
runtimePackage,
|
|
manifest,
|
|
runtimePlatform,
|
|
}) {
|
|
const rootDependency = rootPackage.dependencies?.[PI_RUNTIME_PACKAGE];
|
|
const packagedDependency = packagedPackage.dependencies?.[PI_RUNTIME_PACKAGE];
|
|
const lockDependency = lockfile.importers?.['.']?.dependencies?.[PI_RUNTIME_PACKAGE];
|
|
const lockedVersion = normalizeLockedVersion(lockDependency?.version);
|
|
const versions = {
|
|
expected: PI_RUNTIME_VERSION,
|
|
rootDependency,
|
|
packagedDependency,
|
|
lockSpecifier: lockDependency?.specifier ?? null,
|
|
lockedVersion,
|
|
runtimePackage: runtimePackage.version,
|
|
manifest: manifest.runtime?.version ?? null,
|
|
};
|
|
const mismatched = Object.entries(versions)
|
|
.filter(([key, value]) => key !== 'expected' && value !== PI_RUNTIME_VERSION);
|
|
if (mismatched.length > 0) {
|
|
throw new Error(`Pi artifact versions do not match: ${JSON.stringify(versions)}`);
|
|
}
|
|
if (runtimePackage.name !== PI_RUNTIME_PACKAGE) {
|
|
throw new Error(`Packaged Pi package name is ${runtimePackage.name ?? 'missing'}`);
|
|
}
|
|
if (runtimePackage.bin?.pi !== PI_RUNTIME_CLI_ENTRY) {
|
|
throw new Error(`Packaged Pi CLI entry is ${runtimePackage.bin?.pi ?? 'missing'}`);
|
|
}
|
|
if (manifest.runtime?.packageName !== PI_RUNTIME_PACKAGE
|
|
|| manifest.runtime?.cliEntry !== PI_RUNTIME_CLI_ENTRY) {
|
|
throw new Error(`Packaged Pi manifest identity is invalid: ${JSON.stringify(manifest.runtime)}`);
|
|
}
|
|
if (manifest.target?.platform !== runtimePlatform.platform
|
|
|| manifest.target?.arch !== runtimePlatform.arch) {
|
|
throw new Error(
|
|
`Packaged Pi target ${manifest.target?.platform ?? 'missing'}-${manifest.target?.arch ?? 'missing'} `
|
|
+ `does not match executable ${runtimePlatform.platform}-${runtimePlatform.arch}`,
|
|
);
|
|
}
|
|
assertNodeEngineCompatible(manifest.runtime?.nodeEngine, runtimePlatform.node);
|
|
return versions;
|
|
}
|
|
|
|
export function collectAbsoluteManifestValues(value, at = '$', results = []) {
|
|
if (typeof value === 'string') {
|
|
if (isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value)) results.push({ at, value });
|
|
return results;
|
|
}
|
|
if (Array.isArray(value)) {
|
|
value.forEach((entry, index) => collectAbsoluteManifestValues(entry, `${at}[${index}]`, results));
|
|
return results;
|
|
}
|
|
if (value && typeof value === 'object') {
|
|
for (const [key, entry] of Object.entries(value)) {
|
|
collectAbsoluteManifestValues(entry, `${at}.${key}`, results);
|
|
}
|
|
}
|
|
return results;
|
|
}
|
|
|
|
export async function collectForbiddenResourcePaths(root, pattern = /opencode/i) {
|
|
const matches = [];
|
|
const visit = async (directory) => {
|
|
if (!await pathExists(directory)) return;
|
|
for (const entry of await readdir(directory, { withFileTypes: true })) {
|
|
const path = join(directory, entry.name);
|
|
if (pattern.test(entry.name)) matches.push(portable(relative(root, path)));
|
|
if (entry.isDirectory()) await visit(path);
|
|
}
|
|
};
|
|
await visit(root);
|
|
return matches.sort();
|
|
}
|
|
|
|
export function classifyOpenCodeResourcePaths(paths) {
|
|
const upstreamPiProvider = paths.filter((path) => path.startsWith(PI_AI_PROVIDER_PREFIX));
|
|
const productOwned = paths.filter((path) => !path.startsWith(PI_AI_PROVIDER_PREFIX));
|
|
return { productOwned, upstreamPiProvider };
|
|
}
|
|
|
|
async function filesContainingNeedles(root, needles) {
|
|
const matches = [];
|
|
const visit = async (path) => {
|
|
const details = await stat(path);
|
|
if (details.isDirectory()) {
|
|
for (const entry of await readdir(path, { withFileTypes: true })) {
|
|
await visit(join(path, entry.name));
|
|
}
|
|
return;
|
|
}
|
|
const contents = await readFile(path);
|
|
const found = needles.filter((needle) => needle.length > 0 && contents.includes(needle));
|
|
if (found.length > 0) matches.push({ path, needles: found.map((value) => value.toString()) });
|
|
};
|
|
await visit(root);
|
|
return matches;
|
|
}
|
|
|
|
async function inspectProductRuntime(executable, resourcesDirectory) {
|
|
const script = String.raw`
|
|
const { createRequire } = require('node:module');
|
|
const path = require('node:path');
|
|
const resources = process.env.MAKELORE_PI_PRODUCT_RESOURCES;
|
|
const appRequire = createRequire(path.join(resources, 'app.asar', 'package.json'));
|
|
const packagedPackage = appRequire('./package.json');
|
|
process.stdout.write(JSON.stringify({
|
|
platform: process.platform,
|
|
arch: process.arch,
|
|
node: process.versions.node,
|
|
electron: process.versions.electron,
|
|
packagedPackage,
|
|
}));
|
|
`;
|
|
const { stdout } = await runCommand(executable, ['-e', script], {
|
|
env: {
|
|
...process.env,
|
|
ELECTRON_RUN_AS_NODE: '1',
|
|
MAKELORE_PI_PRODUCT_RESOURCES: resourcesDirectory,
|
|
},
|
|
});
|
|
return JSON.parse(stdout.trim());
|
|
}
|
|
|
|
async function packagedSkillIds(resourcesDirectory) {
|
|
const root = join(resourcesDirectory, 'resources', 'coding-skills');
|
|
if (!await pathExists(root)) throw new Error(`Packaged coding skills are missing: ${root}`);
|
|
const entries = await readdir(root, { withFileTypes: true });
|
|
const ids = [];
|
|
for (const entry of entries) {
|
|
if (!entry.isDirectory()) continue;
|
|
if (!await pathExists(join(root, entry.name, 'SKILL.md'))) {
|
|
throw new Error(`Packaged coding skill has no SKILL.md: ${entry.name}`);
|
|
}
|
|
ids.push(entry.name);
|
|
}
|
|
return ids.sort();
|
|
}
|
|
|
|
async function sourceSkillIds(projectRoot) {
|
|
const root = join(projectRoot, 'resources', 'coding-skills');
|
|
const entries = await readdir(root, { withFileTypes: true });
|
|
return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
|
|
}
|
|
|
|
export async function verifyPiProductArtifact({ projectRoot, executable }) {
|
|
const root = resolve(projectRoot);
|
|
const appExecutable = resolve(executable ?? defaultProductExecutable(root));
|
|
if (!await pathExists(appExecutable)) throw new Error(`Product executable is missing: ${appExecutable}`);
|
|
const resourcesDirectory = packagedResourcesDirectory(appExecutable);
|
|
const runtimeRoot = join(resourcesDirectory, 'pi-runtime');
|
|
const appAsar = join(resourcesDirectory, 'app.asar');
|
|
for (const required of [runtimeRoot, appAsar]) {
|
|
if (!await pathExists(required)) throw new Error(`Product artifact resource is missing: ${required}`);
|
|
}
|
|
|
|
const [rootPackageSource, lockfileSource, runtimePackageSource, manifestSource] = await Promise.all([
|
|
readFile(join(root, 'package.json'), 'utf8'),
|
|
readFile(join(root, 'pnpm-lock.yaml'), 'utf8'),
|
|
readFile(join(runtimeRoot, 'package.json'), 'utf8'),
|
|
readFile(join(runtimeRoot, PI_RUNTIME_MANIFEST), 'utf8'),
|
|
]);
|
|
const rootPackage = JSON.parse(rootPackageSource);
|
|
const lockfile = YAML.parse(lockfileSource);
|
|
const runtimePackage = JSON.parse(runtimePackageSource);
|
|
const manifest = JSON.parse(manifestSource);
|
|
const runtimePlatform = await inspectProductRuntime(appExecutable, resourcesDirectory);
|
|
const versions = validatePiArtifactMetadata({
|
|
rootPackage,
|
|
lockfile,
|
|
packagedPackage: runtimePlatform.packagedPackage,
|
|
runtimePackage,
|
|
manifest,
|
|
runtimePlatform,
|
|
});
|
|
|
|
const absoluteManifestValues = collectAbsoluteManifestValues(manifest);
|
|
if (absoluteManifestValues.length > 0) {
|
|
throw new Error(`Pi runtime manifest contains absolute paths: ${JSON.stringify(absoluteManifestValues)}`);
|
|
}
|
|
const openCodeResourcePaths = classifyOpenCodeResourcePaths(
|
|
await collectForbiddenResourcePaths(resourcesDirectory),
|
|
);
|
|
if (openCodeResourcePaths.productOwned.length > 0) {
|
|
throw new Error(
|
|
`Product-owned resources contain OpenCode paths: ${openCodeResourcePaths.productOwned.join(', ')}`,
|
|
);
|
|
}
|
|
|
|
const expectedSkills = await sourceSkillIds(root);
|
|
const actualSkills = await packagedSkillIds(resourcesDirectory);
|
|
if (JSON.stringify(actualSkills) !== JSON.stringify(expectedSkills)) {
|
|
throw new Error(`Packaged coding skills differ: expected ${expectedSkills}, got ${actualSkills}`);
|
|
}
|
|
const appAsarContents = await readFile(appAsar);
|
|
const missingExtensionMarkers = EXTENSION_CONTRACT_MARKERS.filter(
|
|
(marker) => !appAsarContents.includes(Buffer.from(marker)),
|
|
);
|
|
if (missingExtensionMarkers.length > 0) {
|
|
throw new Error(
|
|
`Packaged app.asar does not contain Pi extension contract markers: ${missingExtensionMarkers.join(', ')}`,
|
|
);
|
|
}
|
|
|
|
const sourceNeedles = [
|
|
Buffer.from(root),
|
|
Buffer.from(portable(root)),
|
|
];
|
|
const devPathResidue = [
|
|
...await filesContainingNeedles(appAsar, sourceNeedles),
|
|
...await filesContainingNeedles(runtimeRoot, sourceNeedles),
|
|
];
|
|
if (devPathResidue.length > 0) {
|
|
throw new Error(`Product artifact contains development path residue: ${JSON.stringify(devPathResidue)}`);
|
|
}
|
|
|
|
const packagedClosure = await inspectPackagedClosure(
|
|
appExecutable,
|
|
resourcesDirectory,
|
|
manifest.runtimeAssets,
|
|
);
|
|
return {
|
|
schemaVersion: 1,
|
|
artifact: {
|
|
executable: appExecutable,
|
|
resourcesDirectory,
|
|
appAsar,
|
|
runtimeRoot,
|
|
cliPath: join(runtimeRoot, ...PI_RUNTIME_CLI_ENTRY.split('/')),
|
|
},
|
|
platform: {
|
|
platform: runtimePlatform.platform,
|
|
arch: runtimePlatform.arch,
|
|
electron: runtimePlatform.electron,
|
|
node: runtimePlatform.node,
|
|
},
|
|
versions,
|
|
manifest: {
|
|
target: manifest.target,
|
|
packageCount: manifest.productionPackages.length,
|
|
assetCount: manifest.runtimeAssets.length,
|
|
nodeEngine: manifest.runtime.nodeEngine,
|
|
},
|
|
packagedClosure,
|
|
extension: {
|
|
contractMarkers: EXTENSION_CONTRACT_MARKERS,
|
|
packaged: true,
|
|
executionProof: 'smoke:pi:real final-product extension/subagent run',
|
|
},
|
|
skills: actualSkills,
|
|
openCodeResourcePaths: {
|
|
...openCodeResourcePaths,
|
|
upstreamDecision: openCodeResourcePaths.upstreamPiProvider.length > 0
|
|
? 'retained-required-files-from-exact-pinned-pi-production-package'
|
|
: 'none',
|
|
},
|
|
developmentPathResidue: [],
|
|
result: 'pass',
|
|
};
|
|
}
|
|
|
|
export const PI_PRODUCT_ARTIFACT_DEFAULTS = Object.freeze({
|
|
platform: hostPlatform(),
|
|
arch: hostArch(),
|
|
extensionContractMarkers: EXTENSION_CONTRACT_MARKERS,
|
|
});
|