mirror of
https://github.com/stablyai/orca.git
synced 2026-10-20 16:03:20 +00:00
Neil
7ea01279cd
* feat(search): bundle ripgrep for local, WSL, and SSH search Ship @vscode/ripgrep-universal's prebuilt rg for all six relay platforms in every desktop artifact. Local and WSL searches spawn the bundled binary and drop the git ls-files / git grep fallbacks; SSH deploys upload the remote's binary once per ripgrep version and the relay prefers it over PATH rg. * fix(search): address bundled ripgrep review findings - Key the SSH ripgrep cache on the binary's content hash; a package bump is the only update step - glibc verifier: read arch tokens below the slice root and accept static ELFs (arm64 release blocker) - Ship ripgrep/PCRE2/musl license notices; bundle rg with orcad - Packaged builds never spawn a bare rg; report fd pressure as transient - SSH: install rg before sweep/GC, size-validate installs, back off instead of disabling on launch failure - Scope Dependabot to @vscode/ripgrep-universal; revert unrelated lockfile churn * chore(search): drop bundled-ripgrep reference doc; assert full packaging layout parity * refactor(search): one entry point for spawning the bundled ripgrep Local Quick Open, Quick Open path search, the Explorer name filter, and runtime text search each repeated the same three steps: resolve the bundled command, spread in the WSL distro, spread in the WSL shell expression. Fold that into spawnBundledRipgrep so one place owns the rule that a bare 'rg' must never reach spawn, and simplify the resolver's command/packaged checks. Restore the AGENTS.md ripgrep rule dropped alongside its reference doc in63f4dac, and note why the relay's availability probe may spawn a bare 'rg'. No behaviour change; verified by the existing suites plus a new test that pins the local, WSL-routed, and distro-routed-but-Windows-output cases. * refactor(search): drop the local install-ripgrep path; enforce the rg rule Bundling rg removed the local git/readdir fallback, so nothing can produce the "install ripgrep on the host running the Quick Open scan" guidance any more -- only a remote host an upload never reached still reaches the capped listing. Drop the host parameter, the renderer's local branch and its translation key, and the relay wrapper that existed only to pass 'remote'. Add a ratchet test for bare 'rg' spawns, since the AGENTS.md rule alone had nothing enforcing it. Its one allowlist entry is the relay's PATH probe, which asks about PATH by definition. Verified the guard catches a planted offender rather than passing vacuously. Also stop chaining the remote cleanup sweep behind the ripgrep upload: on a cold host that is a multi-MB transfer, and stale upload stages and superseded version dirs were left on the remote for its whole duration. The two touch different trees, so they now run concurrently. * test(ssh): pin that the cleanup sweep does not wait on the ripgrep upload * fix(search): derive rg spawn types instead of importing node:child_process A type-only import still counts against the child_process ratchet, whose pin and allowlist only ever shrink. Derive both types from wslAwareSpawn instead. * fix(search): surface an unreachable WSL workspace instead of an empty result Inside `bash -c`, a failed `cd` exits 1 -- the same code ripgrep uses for "no matches" -- so a WSL workspace whose directory had gone away reported an empty listing as a successful scan. main did not have this hole: checkRgAvailable ran the same `cd` wrapper first and settled on `code === 0`, diverting to the git fallback that this PR deletes. The WSL wrapper now takes an optional cwdFailureExitCode; rg passes 97, and all four close handlers reject with a clear error before the unavailable check can blame the install. Also from review: - Bound the fire-and-forget ripgrep upload with deploySignal. The controller aborts only on the deploy timeout, never on success, so this cancels a still-running upload when the deploy gives up. - Run the stale-stage sweep before the installed check rather than inside its else branch. Once rg was installed every later deploy took the PRESENT path, so a stage orphaned by a dropped connection was never collected again. - Note in orcad-remote-deploy.ts why wiring it up needs ripgrep work first: build-orcad.mjs copies only the build host's rg, and orcad reports isPackaged() === true, so a remote of another platform would find nothing. ssh-relay-deploy.test.ts sat at the max-lines cap, so any edit to it failed the gate. Split the four Windows named-pipe deploys into their own file (926 -> 737 + 333); both are now well clear of it. * fix(search): name the unreachable root in every handler, not three of four Round-two review caught that the missing-cwd branch in scanRipgrepPaths sat AFTER isRipgrepUnavailableExit, which classifies any code above 2 as a broken install -- so for exit 97 it was dead code and Quick Open still told the user to reinstall Orca. Reordered; all four handlers now check it first. Also from review: - A vanished workspace makes spawn fail with ENOENT, which read as a damaged install on every local path. Confirm the cwd with isRipgrepSpawnCwdUsable -- the guard the relay already applies -- before blaming the binary. The async continuation re-checks `resolved`, because finish() drops its argument once settled and the rejected promise would otherwise go unhandled. - bundledRipgrepCommand returned a bare 'rg' for an arch outside the bundled set, bypassing the guard that exists so Windows cannot resolve a bare name against the repo cwd. A packaged app now always names an absolute path. Drop ci-shards/unit-assignment.json, a 9,425-line CI artifact swept in from reproducing a shard locally, and gitignore the directory that produced it. The "rg genuinely cannot start" test pointed at a synthetic /repo, which the new guard correctly reports as unreachable; it now resolves to a real root so it still tests what its name says. * fix(search): let the error handler own the spawn-failure verdict A failed spawn emits 'error' and THEN 'close' with a negative code. The cwd check added in the error handler did not settle, so the close handler settled first -- synchronously, with the reinstall message -- and won the race every time. The branch was not merely flaky, it was unreachable in all four handlers: it is guarded by pid === undefined, which is exactly the case that always produces a following close(code < 0). Verified against a real spawn: 3/3 runs give error(ENOENT) -> close(-2). The error handler now detaches 'close' before the probe, so it owns the outcome. The probe also had no rejection handler, so a probe that rejected left the search unsettled forever -- a hang, not just a wrong message. It now falls back to the prior verdict rather than inventing one. Tests: filesystem-search-rg-timeout and orca-runtime-files-search already cover error-first and close-first, but against synthetic roots that the new guard correctly calls unreachable; they now resolve to a real root, keeping each test's stated intent. Added a Quick Open case for the vanished-workspace path and confirmed it fails with the old ordering. * test(search): cover exit code 97 in all four ripgrep close handlers Round-four review found the missing-cwd branch had zero handler coverage: no test anywhere emitted close(97), only -2/0/1/2/127. Ordering was correct, but guarded by source-line order alone -- and that exact ordering was wrong in three of four handlers two commits ago. Each suite now drives close(97) through its real handler and expects the unreachable-root message. Verified the tests earn their place: neutering the missing-cwd check fails exactly four tests, one per handler. Also drop a Reflect.get the anti-slop gate rejects, in favour of `in` narrowing. * docs(search): stop claiming the close handler always wins the race The previous commit asserted close "would beat this threadpool round-trip every time", from an n=3 sample that measured event ordering -- which was never in dispute -- rather than probe-vs-close. Two later measurements disagree with each other: 50/50 close-first here, 30/50 probe-first in review. Either way it is a race on a sub-millisecond margin, and the detach is what makes the verdict deterministic. Why this wording matters: "close wins every time" is an argument for deleting the detach as a guard against an impossible race. No test would catch that -- the suites emit error and close in the same synchronous tick. * chore(search): ship the jemalloc and libunwind notices the Linux rg needs The statically linked Linux builds carry jemalloc (BSD-2-Clause) and LLVM libunwind (Apache-2.0 WITH LLVM-exception) in addition to PCRE2 and musl, and both require their notice on binary redistribution. Confirmed with `strings`: their symbols are present in linux-x64 and linux-arm64 and absent from the darwin and win32 builds. Texts taken from the upstream canonical sources. extraResources already copies the whole licenses directory, so these ship without a packaging change. * fix(relay): stop spawning a bare rg, name unreachable roots, collect old builds Three gaps the reviews surfaced on the remote side, all pre-existing on main. Bare `rg` on Windows remotes. Both relay spawn sites pass the user's repo as cwd, and CreateProcessW searches the cwd before PATH -- the same hijack the desktop side already fixes. The relay now walks PATH itself and spawns an absolute rg.exe, skipping relative PATH entries because those resolve against the cwd. No rg on PATH yields null, which callers treat as "ripgrep unavailable" rather than handing spawn a bare name. POSIX keeps the bare name: execvp never consults the cwd, so there is nothing to resolve and nothing to gain. With the last probe converted, the bare-spawn ratchet allowlist is empty. Empty results for an unreachable root. settleLaunchFailure resolved an empty, successful-looking scan when the root was gone but PATH rg existed, and the git/readdir chain never engaged because it only triggers on RipgrepUnavailableError. Both relay paths now reject naming the root, matching local workspaces. Missing-rg keeps precedence over a missing root, because only that verdict engages the fallback chain -- two tests pinned that deliberately and it would have been wrong to flip it. Unbounded ~/.orca-remote/ripgrep/. Nothing collected this tree; the relay's version GC only matches `relay-*`, so every rg bump left another ~5 MB per host forever. The probe command now also drops sibling builds older than two weeks, sparing the current one and live upload stages, on POSIX and PowerShell alike. Two weeks because a client pinned to an older build may still be using it; the cost of collecting one early is that client re-uploading once. * fix(relay): probe the rg that failed, and close the drive-relative PATH hole Five review findings against the previous commit, all reproduced first. The launch-failure classifier probed PATH rg, but the spawn that failed was the bundled binary. On the normal remote setup -- no rg on PATH, which is why Orca uploads one -- the probe failed and a moved workspace was reported as a missing ripgrep, telling the user to install what Orca already ships. So the fix was inert on exactly the hosts the uploader exists for. It now takes a candidate list and asks the binary that actually failed first, then PATH. path.win32.isAbsolute accepts `\tools` and `/tools`: rooted, but carrying no drive, so they resolve against whatever drive the process is on. The probe would have validated one against the relay's drive while the spawn, running with the user's repo as cwd, resolved it against the repo's -- the same cwd-dependence this lookup removes, narrowed from directory to drive. A real drive letter or UNC root is now required. probeRipgrepVersion had lost the timeout's kill in the rewrite, leaking a live process and a ref'd handle per launch failure -- for a hang, which is the very case the bundled-rg back-off exists for. It also spawned without windowsHide, which would flash a console; fixing that made an allowlist entry stale, so the entry is gone and the pin ratchets down 63 -> 62. `windowsPathRipgrep ??= …` never memoised a miss, because null is nullish. The caching was inverted against cost: a hit stops at the first directory, a miss stats every one, and only the miss was repeated -- per spawn. The bare-spawn ratchet claimed "nothing in production spawns a bare rg", which is false on POSIX. It now also matches PATH_RIPGREP_COMMAND at a spawn site, and the comment states plainly what a textual guard cannot see: the POSIX bare name reaches spawn as a parameter, and is safe because execvp ignores the cwd. The drive-rooted predicate is tested directly rather than through the filesystem -- a temp dir on a POSIX CI host has no drive letter to exercise win32 semantics with, so the filesystem test could never have caught this. * test(mobile): repin the session closure past #22452's two shared modules Merging main brought the closure to 4220 against a pin of 4218. The two extra modules are `src/shared/agent-turn-outcome.ts` and `src/shared/main-agent-status.ts` from #22452, which the status projection this route already reaches import. That change was src/shared-only, so the mobile job never ran on it -- the same way the structured tool line slipped past, as the ledger above already records. Repinned here because this PR's file set is what next made the job run, not because this PR reaches either module. Verified: of the 28 source files this branch changes, none appear anywhere in the route's 4220-module closure. * fix(search): preserve remote binaries and complete runtime packaging * test(relay): pin the probe's env now that it inherits the relay's PATH8d6759athreaded the relay env into probeRipgrepVersion -- correctly, since the probe decides whether a launch failure was the binary or the root and so has to resolve the same rg the failed spawn would have. It left the assertion that pins the probe's spawn arguments behind, which is what CI caught. Asserting buildRelayCommandEnv() rather than loosening the match to any object: under process.env the probe could resolve a different rg, or none, which is the regression the change exists to prevent. * feat(ssh): collect remote ripgrep builds by reference, not by age Nothing collected `~/.orca-remote/ripgrep/`: the version GC matches only `relay-*`, so every change to the shipped bytes left another ~5 MB on every SSH host, permanently. The age window this replaces was the wrong instrument -- a directory's mtime is when it was written, not when it was last used, so it cannot tell a superseded build from the one a live relay was launched against. Deleting the latter is not graceful degradation: without a PATH ripgrep remote text search rejects outright, and listing drops to the capped walk this PR exists to remove. So the question is reference. Each relay directory now records the build it runs against in `.ripgrep-ref`, written only once that binary is confirmed present, and the GC collects a build only when no installation names it. The discipline is ssh-relay-native-deps-cache-gc.ts': anything the pass cannot account for blocks the whole pass. A relay directory with no readable marker is an older Orca's, possibly running right now against a binary it never recorded, so the pass declines rather than guessing. Those directories are removed by the version GC in time, which is what makes their builds collectable -- hence running after it, not beside it. Deletion is the same tombstone, recheck under the rename, then remove, so a deploy that takes a reference mid-pass gets its tree restored. Windows has no pass yet, matching the native-deps cache's gate. One test note: the first version of the "unaccountable blocks the pass" test passed against a deliberately broken guard, because the tombstone recheck masked its absence. The test now puts a readable recheck behind an unreadable first scan, which is the only shape that fails when that guard is removed. Recording the reference lives inside ensureRemoteBundledRipgrep rather than at the call site: it is the same concern, and it keeps the deploy's ripgrep surface to one call for the tests that mock it to protect their exec queues. * feat(ssh): collect Windows remotes too, and ship the Rust crate notices Three items previously left documented-but-open. Windows remote accumulation. The cache GC was POSIX-gated, so the leak did not go away -- it moved to the platform with the larger binary (rg.exe is 5.43 MB on win32-x64, against 4.77 MB for linux-arm64). The PowerShell dialect now does the same reference scan: entries and references carry token prefixes, because PowerShell writes every uncaptured value to stdout and an untokenised listing would feed Remove-Item whatever a cmdlet happened to emit. Verified on a real Windows host rather than a mock: the listing emits its ENTRY/LIST_OK tokens, a relay directory carrying a marker yields REF <entry>, and a relay directory without one yields REFS_ERR -- the safety path, on the real interpreter. Rust crate notices. The crate set was read out of the shipped binary's symbols and the licence identifiers taken from crates.io rather than assumed. Where a crate offers the Unlicense, Orca elects it: a public-domain dedication carries no notice obligation, and that covers eight of them. The four that do not offer it get their MIT text reproduced. encoding_rs carries a BSD-3-Clause notice for its WHATWG-derived encoding data that is joined by AND, not OR, so electing MIT does not discharge it. Release-only validation, corrected rather than repeated. Linux AppImage/deb/rpm already runs in CI's package job on every PR, and Windows signing was already rehearsed on this branch. macOS notarization is the only item a release must still exercise, and the exposure is narrow: notarization requires signatures on Mach-O binaries, and of the six bundled builds only the two darwin ones are Mach-O -- `file` reports ELF for linux and PE32+ for win32 -- so signIgnore excludes only files the notary never asks about. orcad-artifacts.test.ts caught the new notice file missing from the standalone runtime's shipped list, which is exactly the gap that test exists to catch: a notice committed to the repo but never actually shipped. * fix(search): protect relay cache references and handle failed spawns * fix(ripgrep): close review gaps and repair deployment fixtures * test(mobile): refresh merged session module census * fix(ssh): preserve ripgrep caches with empty legacy references * test(mobile): assert bundle boundaries instead of global module count
816 lines
36 KiB
JavaScript
816 lines
36 KiB
JavaScript
const { chmodSync, existsSync, readdirSync, readFileSync, writeFileSync } = require('node:fs')
|
|
const { execFileSync } = require('node:child_process')
|
|
const { join, resolve } = require('node:path')
|
|
const electronBuilderNativeRebuild = require('./scripts/electron-builder-native-rebuild.cjs')
|
|
const {
|
|
assertPackagedDaemonEntryExists,
|
|
verifyPackagedDaemonEntryBoots
|
|
} = require('./scripts/verify-packaged-daemon-entry.cjs')
|
|
const {
|
|
assertPackagedNativeVariantsInstalled,
|
|
createPackagedRuntimeNodeModuleResources,
|
|
prunePackagedRuntimeNodeModules,
|
|
verifyPackagedMainRuntimeDeps
|
|
} = require('./packaged-runtime-node-modules.cjs')
|
|
const { verifyLinuxGlibcFloor } = require('./scripts/verify-linux-glibc-floor.cjs')
|
|
const { writeMacBuildCompatibility } = require('./scripts/mac-build-compatibility.cjs')
|
|
const {
|
|
MOBILE_WEB_BUNDLE_DIR,
|
|
assertMobileWebBundleBuilt
|
|
} = require('./scripts/verify-packaged-mobile-web-bundle.cjs')
|
|
const { verifyPackagedPluginResources } = require('./scripts/verify-packaged-plugin-resources.cjs')
|
|
const {
|
|
assertBundledRipgrepInstalled,
|
|
bundledRipgrepExtraResources,
|
|
bundledRipgrepMacSignIgnore,
|
|
finalizePackagedRipgrep
|
|
} = require('./bundled-ripgrep-resources.cjs')
|
|
const {
|
|
verifyPackagedWindowsNodePty
|
|
} = require('./scripts/verify-packaged-node-pty-job-ownership.cjs')
|
|
const { verifySkillsCliRuntime } = require('./scripts/verify-skills-cli-runtime.cjs')
|
|
const { verifyStaticAppImagePackage } = require('./scripts/static-appimage-package-contract.cjs')
|
|
const { signWindowsUninstallerViaSignPath } = require('./scripts/windows-uninstaller-signing.cjs')
|
|
|
|
// Why: dev-channel builds must carry the *release* identity — same bundle id,
|
|
// Developer ID signature, and notarization ticket — or Squirrel.Mac refuses to
|
|
// swap them over an installed Orca and macOS treats each build as a new app.
|
|
const isMacHourly = process.env.ORCA_MAC_HOURLY === '1'
|
|
const isMacDaily = process.env.ORCA_MAC_DAILY === '1'
|
|
const isMacAdhoc = process.env.ORCA_MAC_ADHOC === '1'
|
|
// Why a second set of variables rather than making the mac ones platform-neutral:
|
|
// the mac ones gate `isMacRelease` below, which turns on hardened runtime,
|
|
// notarization, and root-level `forceCodeSigning`. A Windows dev build that
|
|
// reused them would fail packaging outright for want of a cert it is
|
|
// deliberately not using.
|
|
const isWinHourly = process.env.ORCA_WIN_HOURLY === '1'
|
|
const isWinDaily = process.env.ORCA_WIN_DAILY === '1'
|
|
const isWinAdhoc = process.env.ORCA_WIN_ADHOC === '1'
|
|
const isWinDevChannel = isWinHourly || isWinDaily || isWinAdhoc
|
|
const isMacRelease = process.env.ORCA_MAC_RELEASE === '1' || isMacHourly || isMacDaily || isMacAdhoc
|
|
const isLinuxArm64Release = process.env.ORCA_LINUX_ARM64_RELEASE === '1'
|
|
const localBuildVersion =
|
|
isMacRelease || isWinDevChannel ? undefined : process.env.ORCA_LOCAL_BUILD_VERSION
|
|
const isHourlyChannel = isMacHourly || isWinHourly
|
|
const isDailyChannel = isMacDaily || isWinDaily
|
|
const isAdhocChannel = isMacAdhoc || isWinAdhoc
|
|
const devChannelBuildVersion = isHourlyChannel
|
|
? process.env.ORCA_HOURLY_BUILD_VERSION
|
|
: isDailyChannel
|
|
? process.env.ORCA_DAILY_BUILD_VERSION
|
|
: isAdhocChannel
|
|
? process.env.ORCA_ADHOC_BUILD_VERSION
|
|
: undefined
|
|
// Why each dev channel gets its own repo rather than tagging into the main one:
|
|
// the releases atom feed exposes only the 10 newest entries, so 24 hourly tags a
|
|
// day would evict every stable/RC entry and strand users on a feed with nothing
|
|
// to install. Keeping adhoc/daily separate from hourly too means a branch build
|
|
// or a once-a-day cut cannot be picked up by someone who only meant to ride
|
|
// main's hourlies.
|
|
const devChannelRepo = isHourlyChannel
|
|
? 'orca-hourly'
|
|
: isDailyChannel
|
|
? 'orca-daily'
|
|
: isAdhocChannel
|
|
? 'orca-adhoc'
|
|
: null
|
|
const appId = 'com.stablyai.orca'
|
|
const featureWallResources = {
|
|
from: 'resources/onboarding/feature-wall',
|
|
to: 'onboarding/feature-wall'
|
|
}
|
|
// Why: freshness detection needs immutable identity metadata from this exact
|
|
// app build, but never needs the skill package bytes or a runtime network read.
|
|
const skillFreshnessResources = {
|
|
from: 'resources/skills',
|
|
to: 'skills'
|
|
}
|
|
// Why: SSH relay deploy resolves bundles from process.resourcesPath in packaged
|
|
// apps. Keeping relay assets as extraResources makes them real directories
|
|
// instead of paths hidden inside app.asar.
|
|
const relayExtraResource = {
|
|
from: 'out/relay',
|
|
to: 'relay'
|
|
}
|
|
// Why: bundled plugins are immutable install inputs and must remain ordinary
|
|
// directories so the startup bootstrap can verify and publish exact bytes.
|
|
const bundledPluginResources = {
|
|
from: 'resources/plugins/launch',
|
|
to: 'plugins/launch'
|
|
}
|
|
// Why: the main bundle, packaged CLI, SSH paths, and speech worker all execute
|
|
// from package directories where pnpm's symlink farm is absent. Copy the exact
|
|
// runtime dependency closure to Resources/node_modules so bare require() calls
|
|
// do not fall through to a developer checkout's node_modules.
|
|
// Why the single file rather than the package root: app.asar carries no node_modules, so main's
|
|
// lazy require in deferred-emoji-shortcode-dataset.ts resolves only out of Resources/node_modules,
|
|
// but emojibase-data is 49 MB of locale datasets and worktree naming reads exactly this 166 KB file.
|
|
const emojiShortcodeDatasetResource = {
|
|
from: 'node_modules/emojibase-data/en/shortcodes/emojibase.json',
|
|
to: 'node_modules/emojibase-data/en/shortcodes/emojibase.json'
|
|
}
|
|
const commonExtraResources = [
|
|
relayExtraResource,
|
|
...bundledRipgrepExtraResources,
|
|
bundledPluginResources,
|
|
skillFreshnessResources,
|
|
emojiShortcodeDatasetResource
|
|
]
|
|
// Why: native speech addons must be real files outside app.asar; copy only the
|
|
// package matching the artifact target instead of every optional variant.
|
|
const macSpeechNativeResource = {
|
|
from: 'node_modules/sherpa-onnx-darwin-${arch}',
|
|
to: 'node_modules/sherpa-onnx-darwin-${arch}'
|
|
}
|
|
const linuxSpeechNativeResource = {
|
|
from: 'node_modules/sherpa-onnx-linux-${arch}',
|
|
to: 'node_modules/sherpa-onnx-linux-${arch}'
|
|
}
|
|
const winSpeechNativeResource = {
|
|
from: 'node_modules/sherpa-onnx-win-x64',
|
|
to: 'node_modules/sherpa-onnx-win-x64'
|
|
}
|
|
// electron-builder replaces these defaults when `depends` is configured; retain
|
|
// Electron's loader requirements alongside Orca's headless-host dependencies.
|
|
const debElectronRuntimeDependencies = [
|
|
'libgtk-3-0',
|
|
'libnotify4',
|
|
'libnss3',
|
|
'libxss1',
|
|
'libxtst6',
|
|
'xdg-utils',
|
|
'libatspi2.0-0',
|
|
'libuuid1',
|
|
'libsecret-1-0'
|
|
]
|
|
const rpmElectronRuntimeDependencies = [
|
|
'gtk3',
|
|
'libnotify',
|
|
'nss',
|
|
'libXScrnSaver',
|
|
'(libXtst or libXtst6)',
|
|
'xdg-utils',
|
|
'at-spi2-core',
|
|
'(libuuid or libuuid1)'
|
|
]
|
|
|
|
// Why mirrored, not imported: this config is CJS loaded by electron-builder outside the TS build.
|
|
// Keep in sync with isMarkdownDocumentName() in src/main/ipc/markdown-documents.ts and with
|
|
// config/nsis/orca-installer-hooks.nsh, which registers the same set on Windows.
|
|
const MARKDOWN_FILE_EXTENSIONS = ['md', 'markdown', 'mdx']
|
|
|
|
// Why: the config must load on a host-only install without resolving unused Windows addons.
|
|
// This is load-time tolerance only; beforePack enforces that the target's natives are installed.
|
|
// Why one package: @vscode/windows-process-tree is the only os: win32 npm addon;
|
|
// @orca/windows-registry is a workspace link present on every host, so its presence proves nothing.
|
|
const windowsRuntimeResources = existsSync(
|
|
join(__dirname, '..', 'node_modules', '@vscode', 'windows-process-tree', 'package.json')
|
|
)
|
|
? createPackagedRuntimeNodeModuleResources('win32')
|
|
: []
|
|
|
|
/** @type {import('electron-builder').Configuration} */
|
|
module.exports = {
|
|
appId,
|
|
productName: 'Orca',
|
|
protocols: [{ name: 'Orca', schemes: ['orca'] }],
|
|
toolsets: { appimage: '1.0.3' },
|
|
...(devChannelBuildVersion
|
|
? { extraMetadata: { version: devChannelBuildVersion } }
|
|
: localBuildVersion
|
|
? { extraMetadata: { version: localBuildVersion } }
|
|
: {}),
|
|
directories: {
|
|
buildResources: 'resources/build'
|
|
},
|
|
files: [
|
|
'!**/.vscode/*',
|
|
// Why: these repo-only inputs are either bundled into out/ or copied via
|
|
// extraResources. Shipping them in app.asar bloats the desktop bundle.
|
|
'!src{,/**/*}',
|
|
'!config{,/**/*}',
|
|
'!docs{,/**/*}',
|
|
'!mobile{,/**/*}',
|
|
'!native{,/**/*}',
|
|
'!skills{,/**/*}',
|
|
// Why: guide/stub authoring sources are compiled into runtime artifacts; shipping
|
|
// either source tree would duplicate content without a runtime consumer.
|
|
'!skill-guides{,/**/*}',
|
|
'!skill-stubs{,/**/*}',
|
|
'!tests{,/**/*}',
|
|
// Why: examples/ is plugin authoring documentation with no runtime consumer —
|
|
// bundled plugins ship via extraResources from resources/plugins/launch/. It also
|
|
// carries hostile-panel, the adversarial fixture the containment tests point at,
|
|
// which must never reach a user's install.
|
|
'!examples{,/**/*}',
|
|
// Why: pr-evidence/ is a local e2e screenshot output (ORCA_CAPTURE_EVIDENCE);
|
|
// it is gitignored, but exclude it defensively so a stray local capture at
|
|
// package time never bloats app.asar.
|
|
'!pr-evidence{,/**/*}',
|
|
// Why: local agent/tooling directories may contain worktree symlink loops;
|
|
// they are never runtime inputs and must not be traversed by electron-builder.
|
|
'!{.claude,.grok,.agents,.codex}{,/**/*}',
|
|
'!Casks{,/**/*}',
|
|
'!{AGENTS.md,CLAUDE.md,DEVELOPING.md,bundle-size-progress.md,ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md,ORCHESTRATION_STRUCTURED_OUTPUT_DESIGN.md}',
|
|
'!out/**/*.test.js',
|
|
// Why: main builds with sourcemap:'hidden' so release CI can publish maps
|
|
// for decoding minified crash traces. The app never loads them (no
|
|
// sourceMappingURL is emitted), and packing them would add ~34MB to app.asar.
|
|
'!out/**/*.map',
|
|
// Why: Vite's manifest is only used to project the paired web client.
|
|
'!out/renderer/.vite{,/**/*}',
|
|
// Why: out/electron-dev caches `pnpm dev`'s per-branch Electron.app copies (~270MB each).
|
|
// CI never creates it, but packaging on a machine that has run dev would pack them all.
|
|
'!out/electron-dev{,/**/*}',
|
|
'!electron.vite.config.{js,ts,mjs,cjs}',
|
|
'!{.eslintcache,eslint.config.mjs,.prettierignore,.prettierrc.yaml,CHANGELOG.md,README.md}',
|
|
'!{.env,.env.*,.npmrc,pnpm-lock.yaml}',
|
|
'!tsconfig.json',
|
|
// Why: feature-wall media is copied via extraResources so runtime can read
|
|
// it from process.resourcesPath; exclude the source copy from app.asar.
|
|
'!resources/onboarding/feature-wall/**',
|
|
'!resources/skills/**',
|
|
// Why: bundled plugins ship via extraResources to resources/plugins/launch;
|
|
// packing the source tree into app.asar would duplicate those exact bytes.
|
|
'!resources/plugins/launch/**',
|
|
// Why: speech packages are copied selectively through the platform
|
|
// extraResources entry below; keeping them in app.asar would ship every
|
|
// native variant (and duplicate the selected one).
|
|
'!node_modules/sherpa-onnx*{,/**/*}',
|
|
// Why: the Windows CLI shim ships via extraResources to resources/bin/orca.cmd
|
|
// (beside the native resources/bin/orca.exe). Packing the source tree into
|
|
// app.asar too lets asarUnpack:['resources/**'] extract a second copy at
|
|
// app.asar.unpacked/resources/win32/bin/orca.cmd with no adjacent orca.exe,
|
|
// which fails to launch the CLI (#7351).
|
|
'!resources/win32{,/**/*}'
|
|
],
|
|
// Why: the CLI entry-point lives in out/cli/ but imports shared modules
|
|
// from out/shared/ and local hook mutators from out/main/. These paths must be
|
|
// unpacked so that Node's require() can resolve the cross-directory imports
|
|
// when the CLI runs outside the asar archive.
|
|
// Why: daemon-entry.js is forked as a separate Node.js process and must be
|
|
// accessible on disk (not inside the asar archive) for child_process.fork().
|
|
// Why: the CLI is compiled by tsc (not bundled), so its runtime imports
|
|
// resolve at runtime via Node's normal module lookup. The shim launches
|
|
// the CLI with ELECTRON_RUN_AS_NODE, which bypasses Electron's asar
|
|
// integration — dependencies inside the asar archive are invisible to
|
|
// require(). Unpack CLI runtime deps so they resolve from
|
|
// app.asar.unpacked/node_modules/.
|
|
// Why: remote runtime connections use WebSocket + E2EE from the packaged CLI
|
|
// before the GUI process starts, so those deps need the same treatment.
|
|
// Why: out/package.json pins compiled output to CommonJS so parent
|
|
// package.json files with type=module cannot change the packaged CLI loader.
|
|
// Why: the OpenCode SQLite worker entry is also spawned by the scanner
|
|
// service, which runs under ELECTRON_RUN_AS_NODE and so cannot see into
|
|
// app.asar. Left packed, that spawn fails closed and every OpenCode session
|
|
// disappears from Agent Session History in packaged builds only. Worker
|
|
// entries reached solely from the Electron main process stay packed, since
|
|
// asar redirects their app.asar paths.
|
|
asarUnpack: [
|
|
'out/package.json',
|
|
'out/cli/**',
|
|
'out/shared/**',
|
|
'out/main/agent-hooks/**',
|
|
'out/main/antigravity/**',
|
|
'out/main/claude/**',
|
|
'out/main/claude-accounts/keychain.js',
|
|
'out/main/codex/**',
|
|
'out/main/copilot/**',
|
|
'out/main/cursor/**',
|
|
'out/main/droid/**',
|
|
'out/main/gemini/**',
|
|
'out/main/grok/**',
|
|
'out/main/hermes/**',
|
|
'out/main/daemon-entry.js',
|
|
'out/main/session-scanner-service-entry.js',
|
|
'out/main/wsl-transcript-fs-process-entry.js',
|
|
'out/main/session-scanner-opencode-sqlite-worker-entry.js',
|
|
'out/main/plugin-host-entry.js',
|
|
'out/main/computer-sidecar.js',
|
|
'out/main/parcel-watcher-process-entry.js',
|
|
'out/main/chunks/**',
|
|
'resources/**',
|
|
'node_modules/ws/**',
|
|
'node_modules/tweetnacl/**',
|
|
'node_modules/zod/**',
|
|
'node_modules/yaml/**'
|
|
],
|
|
artifactBuildCompleted: ({ file, arch }) => {
|
|
if (file.endsWith('.AppImage')) {
|
|
verifyStaticAppImagePackage(file, arch)
|
|
}
|
|
},
|
|
// electron-builder calls this with the context alone. The second parameter is the bundle root,
|
|
// so a test can point the guard at a scratch bundle instead of needing the repo's out/ built.
|
|
beforePack: (context, mobileWebBundleDir = MOBILE_WEB_BUNDLE_DIR) => {
|
|
assertPackagedNativeVariantsInstalled(context.electronPlatformName, context.arch)
|
|
assertBundledRipgrepInstalled()
|
|
assertMobileWebBundleBuilt(mobileWebBundleDir)
|
|
},
|
|
afterPack: async (context) => {
|
|
const resourcesDir =
|
|
context.electronPlatformName === 'darwin'
|
|
? join(
|
|
context.appOutDir,
|
|
`${context.packager.appInfo.productFilename}.app`,
|
|
'Contents',
|
|
'Resources'
|
|
)
|
|
: join(context.appOutDir, 'resources')
|
|
if (!existsSync(resourcesDir)) {
|
|
throw new Error(`Missing packaged resources directory: ${resourcesDir}`)
|
|
}
|
|
// FpmTarget replaces this with deb/rpm while building those artifacts from the shared app tree.
|
|
if (context.electronPlatformName === 'linux') {
|
|
writeFileSync(join(resourcesDir, 'package-type'), 'AppImage')
|
|
}
|
|
if (context.electronPlatformName === 'darwin') {
|
|
const architectureByEnum = { 1: 'x64', 3: 'arm64' }
|
|
const architecture = architectureByEnum[context.arch]
|
|
if (!architecture) {
|
|
throw new Error(`Unsupported local-build compatibility architecture: ${context.arch}`)
|
|
}
|
|
const version = context.packager.appInfo.version
|
|
let commit = process.env.ORCA_BUILD_COMMIT || process.env.GITHUB_SHA || 'unknown'
|
|
if (commit === 'unknown') {
|
|
try {
|
|
commit = execFileSync('git', ['rev-parse', '--short=12', 'HEAD'], {
|
|
encoding: 'utf8'
|
|
}).trim()
|
|
} catch {
|
|
// Source archives can still produce a signed build with an explicit version.
|
|
}
|
|
}
|
|
writeMacBuildCompatibility(resourcesDir, { version, commit, architecture })
|
|
}
|
|
stampPackagedCliVersion(resourcesDir, context.packager.appInfo.version)
|
|
prunePackagedRuntimeNodeModules(resourcesDir, context.electronPlatformName, context.arch)
|
|
// Why: a Linux runner-image glibc bump silently shipped a node-pty pty.node
|
|
// requiring GLIBC_2.34, crashing the app on startup on Ubuntu 20.04 (#9902).
|
|
// Fail packaging if any bundled native binary exceeds the supported floor.
|
|
// Why after the prune: `pnpm install:release` widens the CPU set for cross-builds,
|
|
// so an arm64 slice can still carry the x64 @parcel/watcher until
|
|
// prunePackagedRuntimeNodeModules drops it.
|
|
if (context.electronPlatformName === 'linux') {
|
|
// Why the arch is passed: symbol-version checks pass happily on a wrong-architecture binary,
|
|
// so a cross-built slice could ship the host's pty.node and only fail at runtime.
|
|
verifyLinuxGlibcFloor(context.appOutDir, {
|
|
targetArch: { 1: 'x64', 3: 'arm64' }[context.arch]
|
|
})
|
|
}
|
|
verifyPackagedMainRuntimeDeps(resourcesDir)
|
|
// Why: boot the packaged daemon-entry under plain Node, but only for the
|
|
// slice matching the packaging host's arch — daemon-entry.js is JS, yet it
|
|
// require()s the native (N-API) node-pty for the TARGET arch, which the host
|
|
// Node cannot load cross-arch. `Arch` enum: ia32=0, x64=1, armv7l=2,
|
|
// arm64=3, universal=4 (universal contains the host slice, so run it).
|
|
const archEnumByNodeArch = { ia32: 0, x64: 1, armv7l: 2, arm64: 3 }
|
|
const hostArchEnum = archEnumByNodeArch[process.arch]
|
|
const canExecuteTargetArch = context.arch === hostArchEnum || context.arch === 4
|
|
if (context.electronPlatformName === 'win32') {
|
|
verifyPackagedWindowsNodePty(resourcesDir, context.arch, { canExecuteTargetArch })
|
|
}
|
|
verifySkillsCliRuntime(join(resourcesDir, 'app.asar.unpacked', 'out'), resourcesDir, {
|
|
executeCommands: canExecuteTargetArch
|
|
})
|
|
if (!canExecuteTargetArch) {
|
|
console.log(
|
|
`[verify-skills-cli-runtime] skipped command probes on cross-arch slice (target ${context.arch}, host ${process.arch})`
|
|
)
|
|
}
|
|
if (canExecuteTargetArch) {
|
|
verifyPackagedDaemonEntryBoots(resourcesDir)
|
|
} else {
|
|
// Why: a cross-arch slice can't be booted by the host Node, but the
|
|
// unpacked entry must still exist — its absence is a layout regression
|
|
// regardless of arch, so only the boot is skipped, not the check.
|
|
assertPackagedDaemonEntryExists(resourcesDir)
|
|
console.log(
|
|
`[verify-packaged-daemon-entry] skipped boot on cross-arch slice (target ${context.arch}, host ${process.arch})`
|
|
)
|
|
}
|
|
// Why: inspect electron-builder's real output so a broken extraResources
|
|
// mapping fails packaging before bundled content reaches users.
|
|
verifyPackagedPluginResources(resourcesDir)
|
|
finalizePackagedRipgrep(resourcesDir)
|
|
chmodUnixCliLaunchers(resourcesDir, context.electronPlatformName)
|
|
chmodMacServeSimHelpers(resourcesDir, context.electronPlatformName)
|
|
for (const filename of readdirSync(resourcesDir)) {
|
|
if (!filename.startsWith('agent-browser-')) {
|
|
continue
|
|
}
|
|
// Why: the upstream package has inconsistent executable bits across
|
|
// platform binaries (notably darwin-x64). child_process.execFile needs
|
|
// the copied binary to be executable in packaged apps.
|
|
chmodSync(join(resourcesDir, filename), 0o755)
|
|
}
|
|
if (context.electronPlatformName === 'darwin') {
|
|
await signMacComputerUseHelper(join(resourcesDir, 'Orca Computer Use.app'), context.packager)
|
|
await signMacStandaloneHelper(
|
|
join(resourcesDir, '..', 'MacOS', 'orca-notification-status'),
|
|
'orca-notification-status',
|
|
context.packager
|
|
)
|
|
await signMacStandaloneHelper(
|
|
join(resourcesDir, '..', 'MacOS', 'orca-keyboard-layout'),
|
|
'orca-keyboard-layout',
|
|
context.packager
|
|
)
|
|
}
|
|
},
|
|
win: {
|
|
executableName: 'Orca',
|
|
// Why: Windows installers are signed after electron-builder packaging by
|
|
// SignPath, so the packager cannot infer the updater publisherName.
|
|
//
|
|
// Why dev channels drop it instead: they ship unsigned, because SignPath's
|
|
// approval waits are budgeted in hours and cannot fit an hourly cadence.
|
|
// electron-updater Authenticode-verifies every installer it downloads
|
|
// against the publisherName baked into the *installed* app's app-update.yml
|
|
// (NsisUpdater.verifySignature), and skips verification entirely when that
|
|
// name is absent. An unsigned build that still claimed 'SignPath Foundation'
|
|
// would therefore reject its own channel's next build — and its way back to
|
|
// stable with it. Dropping it is what makes dev→dev and dev→stable work.
|
|
// Why a sign hook on a build that does not sign: it is the only moment
|
|
// electron-builder exposes the NSIS uninstaller (built in its own makensis
|
|
// pass, embedded, then deleted). The hook signs nothing — it relays the file
|
|
// to and from the CI SignPath request, and is inert when the relay env vars
|
|
// are unset, so local and dev builds are unaffected. publisherName stays on
|
|
// its existing channel split above.
|
|
signtoolOptions: {
|
|
sign: signWindowsUninstallerViaSignPath,
|
|
...(isWinDevChannel ? {} : { publisherName: 'SignPath Foundation' })
|
|
},
|
|
...(isWinDevChannel ? { verifyUpdateCodeSignature: false } : {}),
|
|
extraResources: [
|
|
...commonExtraResources,
|
|
...windowsRuntimeResources,
|
|
winSpeechNativeResource,
|
|
{
|
|
from: 'resources/win32/bin/orca.cmd',
|
|
to: 'bin/orca.cmd'
|
|
},
|
|
{
|
|
from: 'native/windows-cli-launcher/.build/orca.exe',
|
|
to: 'bin/orca.exe'
|
|
},
|
|
{
|
|
from: 'node_modules/agent-browser/bin/agent-browser-win32-x64.exe',
|
|
to: 'agent-browser-win32-x64.exe'
|
|
},
|
|
{
|
|
from: 'native/computer-use-windows/runtime.ps1',
|
|
to: 'computer-use-windows/runtime.ps1'
|
|
},
|
|
featureWallResources
|
|
]
|
|
},
|
|
nsis: {
|
|
artifactName: 'orca-windows-setup.${ext}',
|
|
shortcutName: '${productName}',
|
|
uninstallDisplayName: '${productName}',
|
|
createDesktopShortcut: 'always',
|
|
// Why: electron-builder allows one include, so both Windows installer hooks live in it -
|
|
// the relocated-daemon uninstall sweep (guarded by ${isUpdated} so it never runs during an
|
|
// update's uninstallOldVersion) and the additive markdown "Open with" registration.
|
|
// Windows markdown association is deliberately NOT done via `fileAssociations`; see the
|
|
// header comment in that file for why that would steal the user's default .md handler.
|
|
include: resolve(__dirname, 'nsis', 'orca-installer-hooks.nsh')
|
|
},
|
|
mac: {
|
|
// Why rank Alternate: Orca joins Finder's "Open With" list for Markdown without claiming
|
|
// LSHandlerRank ownership, so whichever editor the user already prefers stays the default.
|
|
// Why one entry per extension: app-builder-lib globs `*.${ext}`, which an array would break.
|
|
fileAssociations: MARKDOWN_FILE_EXTENSIONS.map((ext) => ({
|
|
ext,
|
|
name: 'Markdown Document',
|
|
description: 'Markdown Document',
|
|
role: 'Editor',
|
|
rank: 'Alternate'
|
|
})),
|
|
icon: 'resources/build/icon.icns',
|
|
entitlements: 'resources/build/entitlements.mac.plist',
|
|
entitlementsInherit: 'resources/build/entitlements.mac.plist',
|
|
signIgnore: bundledRipgrepMacSignIgnore,
|
|
extendInfo: {
|
|
NSAppleEventsUsageDescription:
|
|
'Orca allows terminal-launched developer tools to automate local apps when you request it.',
|
|
NSBluetoothAlwaysUsageDescription:
|
|
'Orca allows terminal-launched developer tools to access Bluetooth devices when you request it.',
|
|
NSBluetoothPeripheralUsageDescription:
|
|
'Orca allows terminal-launched developer tools to access Bluetooth devices when you request it.',
|
|
NSCameraUsageDescription: "Application requests access to the device's camera.",
|
|
NSLocationUsageDescription:
|
|
'Orca allows terminal-launched developer tools to access location when you request it.',
|
|
NSLocalNetworkUsageDescription:
|
|
'Orca allows terminal-launched developer tools to discover and connect to local development servers when you request it.',
|
|
NSMicrophoneUsageDescription: "Application requests access to the device's microphone.",
|
|
NSAudioCaptureUsageDescription:
|
|
'Orca allows terminal-launched developer tools to capture desktop audio when you request it.',
|
|
NSBonjourServices: ['_http._tcp', '_https._tcp'],
|
|
NSDocumentsFolderUsageDescription:
|
|
"Application requests access to the user's Documents folder.",
|
|
NSDownloadsFolderUsageDescription:
|
|
"Application requests access to the user's Downloads folder."
|
|
},
|
|
// Why: local macOS validation builds should launch without Apple release
|
|
// credentials. Hardened runtime + notarization stay enabled only on the
|
|
// explicit release path so production artifacts remain strict while dev
|
|
// artifacts do not fail with broken ad-hoc launch behavior.
|
|
hardenedRuntime: isMacRelease,
|
|
// Why dev builds notarize too, despite the ~10min notary round trip: TCC
|
|
// anchors a notarized Developer ID app's permission grants on identifier +
|
|
// team, which is cdhash-independent and so survives an update. Without a
|
|
// ticket there is no such stable identity, so every build reads as a
|
|
// different client — the grant row stays but stops matching, and file access
|
|
// under Documents/Desktop/Downloads fails with EPERM and no re-prompt. At 24
|
|
// builds a day that revokes the user's grants faster than they can re-grant.
|
|
notarize: isMacRelease,
|
|
extraResources: [
|
|
...commonExtraResources,
|
|
...createPackagedRuntimeNodeModuleResources('darwin'),
|
|
macSpeechNativeResource,
|
|
{
|
|
from: 'resources/darwin/bin/orca',
|
|
to: 'bin/orca'
|
|
},
|
|
{
|
|
from: 'node_modules/agent-browser/bin/agent-browser-darwin-${arch}',
|
|
to: 'agent-browser-darwin-${arch}'
|
|
},
|
|
{
|
|
from: 'native/computer-use-macos/.build/release/Orca Computer Use.app',
|
|
to: 'Orca Computer Use.app'
|
|
},
|
|
featureWallResources
|
|
],
|
|
// Why: the notification-status helper must execute from Contents/MacOS —
|
|
// on macOS 26 UNUserNotificationCenter aborts (bundleProxyForCurrentProcess
|
|
// is nil) for executables launched out of Contents/Resources (#7929).
|
|
extraFiles: [
|
|
{
|
|
from: 'native/notification-status-macos/.build/release/orca-notification-status',
|
|
to: 'MacOS/orca-notification-status'
|
|
},
|
|
{
|
|
from: 'native/keyboard-layout-macos/.build/release/orca-keyboard-layout',
|
|
to: 'MacOS/orca-keyboard-layout'
|
|
}
|
|
],
|
|
target: [
|
|
{
|
|
target: 'dmg',
|
|
arch: ['x64', 'arm64']
|
|
},
|
|
{
|
|
target: 'zip',
|
|
arch: ['x64', 'arm64']
|
|
}
|
|
]
|
|
},
|
|
// Why: release builds should fail if signing is unavailable instead of
|
|
// silently downgrading to ad-hoc artifacts that look shippable in CI logs.
|
|
forceCodeSigning: isMacRelease,
|
|
dmg: {
|
|
artifactName: 'orca-macos-${arch}.${ext}'
|
|
},
|
|
linux: {
|
|
// Why mimeTypes and not fileAssociations: shared-mime-info already maps *.md/*.markdown to
|
|
// text/markdown, so reusing that type puts Orca in the Open With list without shipping a glob
|
|
// override. A desktop entry's MimeType only adds a handler - mimeapps.list still owns the
|
|
// default. .mdx is deliberately absent: Ubuntu 24.04's mime database maps it to
|
|
// application/x-genesis-32x-rom, so claiming it here would need a glob override.
|
|
mimeTypes: ['text/markdown'],
|
|
// Why: Ubuntu desktop ships GNOME Orca as the `orca` package and /usr/bin/orca.
|
|
// The Linux installer should not claim those system package/file names.
|
|
executableName: 'orca-ide',
|
|
// Why: the icns source lets electron-builder emit standard hicolor PNG
|
|
// sizes; a single 1024px PNG is ignored by some Linux docks/launchers.
|
|
icon: 'resources/build/icon.icns',
|
|
desktop: {
|
|
entry: {
|
|
// Why: Electron reports WM_CLASS=orca for the visible Linux window;
|
|
// GNOME docks need an exact match to group it with orca-ide.desktop.
|
|
StartupWMClass: 'orca'
|
|
}
|
|
},
|
|
extraResources: [
|
|
...commonExtraResources,
|
|
...createPackagedRuntimeNodeModuleResources('linux'),
|
|
linuxSpeechNativeResource,
|
|
{
|
|
from: 'resources/linux/bin/orca-ide',
|
|
to: 'bin/orca-ide'
|
|
},
|
|
{
|
|
from: 'node_modules/agent-browser/bin/agent-browser-linux-${arch}',
|
|
to: 'agent-browser-linux-${arch}'
|
|
},
|
|
{
|
|
from: 'native/computer-use-linux/runtime.py',
|
|
to: 'computer-use-linux/runtime.py'
|
|
},
|
|
featureWallResources
|
|
],
|
|
// Keep local artifacts aligned with the release pipeline.
|
|
target: ['AppImage', 'deb', 'rpm'],
|
|
maintainer: 'stablyai',
|
|
category: 'Utility'
|
|
},
|
|
appImage: {
|
|
artifactName: isLinuxArm64Release ? 'orca-linux-arm64.${ext}' : 'orca-linux.${ext}'
|
|
},
|
|
deb: {
|
|
packageName: 'orca-ide',
|
|
artifactName: 'orca-ide_${version}_${arch}.${ext}',
|
|
// Why: xvfb lets the bundled `orca serve` CLI run browser panes on a headless
|
|
// Linux host — Chromium needs a display server even for offscreen rendering,
|
|
// and serve starts Xvfb itself when present (see ensure-virtual-display.ts).
|
|
depends: [
|
|
...debElectronRuntimeDependencies,
|
|
'python3',
|
|
'python3-gi',
|
|
'gir1.2-atspi-2.0',
|
|
'at-spi2-core',
|
|
'xdotool',
|
|
'xclip',
|
|
'xvfb'
|
|
],
|
|
// Why: symlink the bundled CLI onto PATH at install time so `orca-ide serve`
|
|
// works on a headless host. The in-app CLI registration (CliInstaller) is
|
|
// GUI-triggered and can never run on a server, so without this the CLI is
|
|
// unreachable from the shell on exactly the hosts that need it.
|
|
afterInstall: 'resources/linux/packaging/after-install.sh',
|
|
afterRemove: 'resources/linux/packaging/after-remove.sh'
|
|
},
|
|
rpm: {
|
|
packageName: 'orca-ide',
|
|
artifactName: 'orca-ide-${version}.${arch}.${ext}',
|
|
// Why: see deb depends. RPM distros ship Xvfb as xorg-x11-server-Xvfb (there
|
|
// is no `xvfb` package), so the name differs from the deb here.
|
|
depends: [
|
|
...rpmElectronRuntimeDependencies,
|
|
'python3',
|
|
'python3-gobject',
|
|
'xdotool',
|
|
'xclip',
|
|
'xorg-x11-server-Xvfb'
|
|
],
|
|
// Why: same headless CLI-on-PATH registration as deb; rpm runs these via fpm.
|
|
afterInstall: 'resources/linux/packaging/after-install.sh',
|
|
afterRemove: 'resources/linux/packaging/after-remove.sh'
|
|
},
|
|
beforeBuild: electronBuilderNativeRebuild,
|
|
// Why: must be true so that electron-builder rebuilds native modules
|
|
// (node-pty) for each target architecture when producing dual-arch macOS
|
|
// builds (x64 + arm64). With npmRebuild disabled, CI on an arm64 runner
|
|
// packages arm64 binaries into the x64 DMG, causing "posix_spawnp failed"
|
|
// on Intel Macs. The beforeBuild hook performs Orca's targeted rebuild and
|
|
// returns false so electron-builder does not rebuild optional cpu-features.
|
|
npmRebuild: true,
|
|
publish: {
|
|
provider: 'github',
|
|
owner: 'stablyai',
|
|
repo: devChannelRepo ?? 'orca',
|
|
// Why draft on the main repo: `--publish always` otherwise creates a
|
|
// public GitHub release as soon as the first platform uploads, and
|
|
// /releases/latest serves a missing Windows exe. release-cut undrafts
|
|
// only after every required asset exists.
|
|
releaseType: devChannelRepo ? 'prerelease' : 'draft'
|
|
}
|
|
}
|
|
|
|
// Stamp the effective channel version where node-mode CLI code can read it.
|
|
function stampPackagedCliVersion(resourcesDir, version) {
|
|
const packageJsonPath = join(resourcesDir, 'app.asar.unpacked', 'out', 'package.json')
|
|
if (!existsSync(packageJsonPath)) {
|
|
throw new Error(`Missing unpacked CLI package boundary: ${packageJsonPath}`)
|
|
}
|
|
const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'))
|
|
writeFileSync(packageJsonPath, `${JSON.stringify({ ...packageJson, version }, null, 2)}\n`)
|
|
}
|
|
|
|
function chmodUnixCliLaunchers(resourcesDir, electronPlatformName) {
|
|
if (electronPlatformName === 'win32') {
|
|
return
|
|
}
|
|
for (const launcherName of ['orca', 'orca-ide']) {
|
|
const launcherPath = join(resourcesDir, 'bin', launcherName)
|
|
if (!existsSync(launcherPath)) {
|
|
continue
|
|
}
|
|
// Why: packaged Unix installs expose these extraResources as public shell
|
|
// commands, and source/packager mode drift must not ship a non-executable CLI.
|
|
chmodSync(launcherPath, 0o755)
|
|
}
|
|
}
|
|
|
|
function chmodMacServeSimHelpers(resourcesDir, electronPlatformName) {
|
|
if (electronPlatformName !== 'darwin') {
|
|
return
|
|
}
|
|
const helperPaths = [
|
|
join(resourcesDir, 'serve-sim', 'bin', 'serve-sim-bin'),
|
|
join(resourcesDir, 'serve-sim', 'dist', 'simcam', 'serve-sim-camera-helper'),
|
|
join(resourcesDir, 'node_modules', 'serve-sim', 'bin', 'serve-sim-bin'),
|
|
join(resourcesDir, 'node_modules', 'serve-sim', 'dist', 'simcam', 'serve-sim-camera-helper')
|
|
]
|
|
for (const helperPath of helperPaths) {
|
|
if (existsSync(helperPath)) {
|
|
chmodSync(helperPath, 0o755)
|
|
}
|
|
}
|
|
}
|
|
|
|
async function signMacComputerUseHelper(helperAppPath, packager) {
|
|
if (!existsSync(helperAppPath)) {
|
|
if (isMacRelease) {
|
|
throw new Error(`Missing Orca Computer Use helper app at ${helperAppPath}`)
|
|
}
|
|
return
|
|
}
|
|
const codeSigningInfo =
|
|
isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value
|
|
? await packager.codeSigningInfo.value
|
|
: null
|
|
const identity =
|
|
process.env.ORCA_COMPUTER_MACOS_SIGN_IDENTITY ??
|
|
process.env.CSC_NAME ??
|
|
findInstalledMacSigningIdentity(codeSigningInfo?.keychainFile) ??
|
|
(isMacRelease ? null : '-')
|
|
if (!identity) {
|
|
throw new Error('Missing signing identity for Orca Computer Use helper app')
|
|
}
|
|
// Why: TCC grants attach to this nested app's code identity. Sign it before
|
|
// the outer Orca.app is sealed so production builds preserve that identity.
|
|
execFileSync('codesign', codesignArgs(identity, helperAppPath), { stdio: 'inherit' })
|
|
execFileSync('codesign', ['--verify', '--deep', '--strict', helperAppPath], {
|
|
stdio: 'inherit'
|
|
})
|
|
}
|
|
|
|
async function signMacStandaloneHelper(helperPath, helperName, packager) {
|
|
if (!existsSync(helperPath)) {
|
|
if (isMacRelease) {
|
|
throw new Error(`Missing ${helperName} helper at ${helperPath}`)
|
|
}
|
|
return
|
|
}
|
|
const codeSigningInfo =
|
|
isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value
|
|
? await packager.codeSigningInfo.value
|
|
: null
|
|
const identity =
|
|
process.env.CSC_NAME ??
|
|
findInstalledMacSigningIdentity(codeSigningInfo?.keychainFile) ??
|
|
(isMacRelease ? null : '-')
|
|
if (!identity) {
|
|
throw new Error(`Missing signing identity for ${helperName} helper`)
|
|
}
|
|
// Why: nested executables must be signed before the outer app bundle is sealed.
|
|
const args = ['--force', '--sign', identity]
|
|
if (isMacRelease) {
|
|
args.push('--options', 'runtime', '--timestamp')
|
|
}
|
|
args.push(helperPath)
|
|
execFileSync('codesign', args, { stdio: 'inherit' })
|
|
execFileSync('codesign', ['--verify', '--strict', helperPath], { stdio: 'inherit' })
|
|
}
|
|
|
|
function codesignArgs(identity, targetPath) {
|
|
const args = ['--force', '--deep', '--sign', identity]
|
|
if (isMacRelease) {
|
|
args.push(
|
|
'--options',
|
|
'runtime',
|
|
'--timestamp',
|
|
'--entitlements',
|
|
resolve(__dirname, '../resources/build/entitlements.computer-use.mac.plist')
|
|
)
|
|
}
|
|
args.push(targetPath)
|
|
return args
|
|
}
|
|
|
|
function findInstalledMacSigningIdentity(keychainFile) {
|
|
try {
|
|
const output = execFileSync(
|
|
'security',
|
|
['find-identity', '-v', '-p', 'codesigning', ...(keychainFile ? [keychainFile] : [])],
|
|
{
|
|
encoding: 'utf8'
|
|
}
|
|
)
|
|
const releaseMatch =
|
|
output.match(/"([^"]*Developer ID Application:[^"]+)"/) ??
|
|
output.match(/"([^"]*Apple Distribution:[^"]+)"/)
|
|
if (releaseMatch?.[1]) {
|
|
return releaseMatch[1]
|
|
}
|
|
if (!isMacRelease) {
|
|
return output.match(/"([^"]*Apple Development:[^"]+)"/)?.[1] ?? null
|
|
}
|
|
} catch {}
|
|
return null
|
|
}
|