ruby_everywhere 0.7.0 → 0.8.0

data/lib/everywhere/desktop_dev_app.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "shellwords"
+require_relative "desktop_assets"
+require_relative "host"
+require_relative "icon"
+require_relative "paths"
+require_relative "plist"
+require_relative "ui"
+
+module Everywhere
+  # What `every dev` stages under ~/.rubyeverywhere so a live `cargo run` shell
+  # looks like the app being built: the flat assets folder, the Dock icon, and
+  # on macOS a throwaway .app around the dev binary — plus the command that
+  # links the two together and launches it.
+  #
+  # None of this is packaging. `every build` writes the real, complete bundle;
+  # this is the subset a dev session needs, restaged on every launch so
+  # editing an asset and pressing `d` is enough to see it.
+  class DesktopDevApp
+    def initialize(config:)
+      @config = config
+    end
+
+    # native/desktop/assets/** → the staged flat folder the running shell
+    # reads. Runs the same compiler `every build` does, so an asset that
+    # resolves in dev resolves in the packaged app too. Returns
+    # [dir, errors]; the dir is returned even when the app ships no assets,
+    # because the shell only has to cope with it not existing.
+    def stage_desktop_assets
+      dest = Everywhere::Paths.desktop_assets_dir(@config.bundle_id)
+      source = File.join(@config.root, "native", "desktop", "assets")
+      _names, errors = Everywhere::DesktopAssets.write!(source, dest)
+      [dest, errors]
+    end
+
+    # A minimal .app around the dev binary, so macOS has a CFBundleName to
+    # read. Without it every menu that names the app says "example-shell" —
+    # the crate name — because an unbundled process has nothing else to go on.
+    # (Setting NSProcessInfo's processName at runtime does NOT fix this: the
+    # menu bar and the predefined About/Hide/Quit items are built from the
+    # bundle, and macOS has already decided by the time any Rust runs.)
+    #
+    # Only the plist matters here. No icon is stamped: the shell sets the Dock
+    # icon at runtime from NATIVE_ICON_PATH, because Tauri applies its own
+    # compiled-in icon after launch and would win over a bundle icns anyway.
+    # `every build` writes the real, complete plist — this is the dev subset.
+    def stage_dev_bundle
+      app = File.join(Everywhere::Paths.desktop_dev_app_dir(@config.bundle_id),
+                      "#{dev_bundle_name}.app")
+      macos = File.join(app, "Contents", "MacOS")
+      FileUtils.mkdir_p(macos)
+      File.write(File.join(app, "Contents", "Info.plist"), dev_info_plist)
+      [app, File.join(macos, dev_exe_name)]
+    end
+
+    # Display names are free-form (spaces, punctuation, emoji all fine), but
+    # this one becomes a directory name — so the separators, and a leading dot
+    # that would hide or escape the bundle, are the only things taken out.
+    def dev_bundle_name
+      cleaned = @config.name.to_s.gsub(%r{[/\\]}, "-").sub(/\A\.+/, "").strip
+      cleaned.empty? ? "App" : cleaned
+    end
+
+    # Spaces are legal in CFBundleExecutable but a nuisance in every shell
+    # command that names it, so the executable follows the packaged app's
+    # convention and drops them.
+    def dev_exe_name = dev_bundle_name.gsub(/\s+/, "")
+
+    def dev_info_plist
+      name = Everywhere::Plist.escape(@config.name)
+      <<~PLIST
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+        <plist version="1.0">
+        <dict>
+          <key>CFBundleName</key><string>#{name}</string>
+          <key>CFBundleDisplayName</key><string>#{name}</string>
+          <key>CFBundleExecutable</key><string>#{Everywhere::Plist.escape(dev_exe_name)}</string>
+          <key>CFBundleIdentifier</key><string>#{Everywhere::Plist.escape(@config.bundle_id)}</string>
+          <key>CFBundlePackageType</key><string>APPL</string>
+          <key>CFBundleShortVersionString</key><string>#{Everywhere::Plist.escape(@config.version)}</string>
+          <key>NSHighResolutionCapable</key><true/>
+        </dict>
+        </plist>
+      PLIST
+    end
+
+    # The Dock icon for the running shell. `cargo run` produces a bare binary
+    # with no .app around it, so macOS has nothing to read an icon from and
+    # Tauri's compiled-in placeholder wins — which is how you end up staring
+    # at the gem's icon while testing your own app.
+    #
+    # Shaped with the same Big Sur inset + squircle the packaged .icns gets
+    # (Icon.macos_master), so the Dock looks identical in dev and in a release
+    # build rather than subtly rounder in one of them. Returns "" when the app
+    # has no icon — the shell reads that as "leave it alone".
+    def stage_desktop_icon
+      source = @config.icon
+      return "" unless source && File.exist?(source)
+
+      dest = File.join(Everywhere::Paths.desktop_icon_dir(@config.bundle_id), "icon.png")
+      FileUtils.mkdir_p(File.dirname(dest))
+      FileUtils.cp(source, dest) unless Everywhere::Icon.macos_master(source, dest)
+      dest
+    rescue StandardError => e
+      # A Dock icon is never worth failing a dev session over.
+      UI.warn("couldn't prepare the Dock icon (#{e.class}) — using the default")
+      ""
+    end
+
+    # macOS runs the shell from inside a throwaway .app so it has a name;
+    # everywhere else `cargo run` is still the whole story.
+    #
+    # Three steps in one command rather than three Ruby calls, because the
+    # link has to happen between the compile and the launch and we want ONE
+    # supervised child: cargo's progress relays into the dock, and exec then
+    # replaces it with the app, so the pid we're tracking is the window.
+    #
+    # A hard link, not a copy: same volume (both under ~/.rubyeverywhere), so
+    # it's free and instant, where copying a debug Tauri binary is ~100MB on
+    # every launch. cargo replaces the file on rebuild rather than writing
+    # through it, so the link is remade each time — hence `ln -f`.
+    def desktop_command(prepared)
+      return "cargo run" unless Host.darwin?
+
+      _app, exe = stage_dev_bundle
+      built = File.join(prepared.target_dir, "debug", "example-shell")
+      [
+        "cargo build",
+        "{ ln -f #{built.shellescape} #{exe.shellescape} 2>/dev/null || " \
+          "cp -f #{built.shellescape} #{exe.shellescape}; }",
+        "exec #{exe.shellescape}"
+      ].join(" && ")
+    end
+  end
+end

data/lib/everywhere/dock/state.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../clock"
+
 module Everywhere
   class Dock
     # What the dock knows about each thing `every dev` is running. Pure data
@@ -22,7 +24,7 @@ module Everywhere
         def busy? = BUSY.include?(state)
       end
 
-      def initialize(keys, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+      def initialize(keys, clock: -> { Clock.monotonic })
         @clock = clock
         @lock = Mutex.new
         ordered = ORDER & keys

data/lib/everywhere/entrypoint.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require_relative "cli"
+require_relative "ui"
+
+module Everywhere
+  # The body of both executables — `every` and `rbe` are the same CLI under two
+  # names, so exe/* stay one-liners that call in here.
+  module Entrypoint
+    module_function
+
+    def run(argv = ARGV)
+      Dry::CLI.new(Everywhere::CLI).call(arguments: argv)
+    rescue Interrupt
+      # ^C is an answer, not a crash: no backtrace, and the shell's own convention
+      # for "killed by SIGINT".
+      exit 130
+    rescue Everywhere::Error => e
+      # Everywhere::Fatal is a SystemExit, not an Error, so a die! that already
+      # printed its own line passes straight through here.
+      Everywhere::UI.die!(e.message)
+    end
+  end
+end

data/lib/everywhere/error.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # Required on its own by every file that raises it, so each stays loadable
+  # standalone (the packaged runtime requires them piecemeal, without going
+  # through everywhere.rb).
+  class Error < StandardError; end
+end

data/lib/everywhere/framework.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "error"
+
 module Everywhere
   # Framework adapters keep both the CLI (dev/build) and the packaged runtime
   # (boot) framework-agnostic. Each adapter owns two sides of one framework:
@@ -223,6 +225,4 @@ module Everywhere
       def env_exports = { "HANAMI_ENV" => "production", "RACK_ENV" => "production" }
     end
   end
-
-  class Error < StandardError; end
 end

data/lib/everywhere/host.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # The machine the CLI is running on — never the machine it's building for
+  # (that's the --target, see Config.os_of and the receipt).
+  module Host
+    module_function
+
+    def darwin? = RUBY_PLATFORM.include?("darwin")
+  end
+end

data/lib/everywhere/ignore.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 module Everywhere
-  # Shared source-exclusion rules, read from `.everywhereignore` (dockerignore
-  # style) when present, else a sensible default. ONE source of truth so the
+  # Shared source-exclusion rules: the built-in DEFAULTS, plus `.everywhereignore`
+  # (dockerignore style) appended when the app has one. ONE source of truth so the
   # build receipt's source checksum (Receipt) and the Platform snapshot
   # (`every platform build`, later) describe exactly the same set of files — a
   # checksum that didn't match what actually ships would be worse than none.
@@ -15,7 +15,8 @@ module Everywhere
   #
   # Rules are evaluated top to bottom and the LAST one that matches a path wins
   # (dockerignore semantics), so ordering matters: put `!` re-includes after the
-  # broad exclude they carve out of.
+  # broad exclude they carve out of — and the app's file, coming last, can
+  # re-include anything DEFAULTS excluded.
   class Ignore
     FILE = ".everywhereignore"
     FLAGS = File::FNM_PATHNAME | File::FNM_DOTMATCH
@@ -29,12 +30,17 @@ module Everywhere
       *.key *.pem *.crt *.p12 *.mobileprovision
     ].freeze
 
+    # The app's file is layered ON TOP of DEFAULTS rather than replacing them:
+    # a project that adds one line to skip a fixture dir must not thereby start
+    # shipping .env and *.p12. Last match wins, so a user who really wants a
+    # defaulted-out file back can still `!` it in.
     def self.for(root)
       path = File.join(root, FILE)
+      return new(parse(DEFAULTS.join("\n"))) unless File.exist?(path)
+
       # UTF-8 explicitly (and scrubbed): under LANG=C the bytes come back
       # US-ASCII and a non-ASCII path pattern makes the matching raise.
-      source = File.exist?(path) ? File.read(path, encoding: "UTF-8").scrub : DEFAULTS.join("\n")
-      new(parse(source))
+      new(parse(DEFAULTS.join("\n")) + parse(File.read(path, encoding: "UTF-8").scrub))
     end
 
     # → [{ negated:, pattern: }, ...] in file order. Blank lines and whole-line

data/lib/everywhere/line_pump.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "clock"
+
 module Everywhere
   # Turns the raw byte stream off a pty master into whole lines.
   #
@@ -25,7 +27,7 @@ module Everywhere
     # "Overwrite? [Yn]" — would be invisible for as long as it mattered.
     IDLE_FLUSH = 0.2
 
-    def initialize(idle_flush: IDLE_FLUSH, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+    def initialize(idle_flush: IDLE_FLUSH, clock: -> { Clock.monotonic })
       # Bytes in, text out. A pty hands over BINARY, and a chunk boundary can
       # land in the middle of a multi-byte character, so buffering and splitting
       # happen on bytes — UTF-8 is self-synchronizing, so a newline is never

data/lib/everywhere/minisign.rb

@@ -4,6 +4,7 @@ require "openssl"
 require "base64"
 require "securerandom"
 require_relative "blake2b"
+require_relative "error"
 
 module Everywhere
   # Minisign-compatible Ed25519 signing, stdlib-only (OpenSSL + our Blake2b).

data/lib/everywhere/native_platform.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Everywhere
+  class << self
+    # The desktop shell's marker. WKWebView APPENDS
+    # `applicationNameForUserAgent` to the real system UA, so this arrives
+    # alongside a normal Safari UA rather than replacing it — hence a pattern
+    # rather than a prefix check. The version is absent when everywhere.yml
+    # declares none.
+    #
+    # macOS only for now: the marker is set in macos_webview_configuration, and
+    # Windows/Linux have no append-only equivalent (their user_agent() REPLACES
+    # the string, and fabricating a whole UA is worse than not marking it).
+    # Desktop only ships macOS today; revisit when it doesn't.
+    DESKTOP_UA = %r{\bRubyEverywhere(?:/[\w.\-]+)? \((?:macos|windows|linux)\)}
+
+    MOBILE_PLATFORMS = %i[ios android].freeze
+
+    # :ios, :android, :desktop or nil, from a User-Agent string. Present from
+    # the very first request, before any JS has run. Shared by the view helpers
+    # and the auth middleware.
+    #
+    # Mobile is checked FIRST and the order matters: the mobile shells prepend
+    # the same "RubyEverywhere/<version> (<os>)" marker to Hotwire Native's own,
+    # so a mobile UA matches DESKTOP_UA too.
+    def native_platform_of(user_agent)
+      ua = user_agent.to_s
+      return :ios if ua.include?("Hotwire Native iOS")
+      return :android if ua.include?("Hotwire Native Android")
+      return :desktop if ua.match?(DESKTOP_UA)
+
+      nil
+    end
+
+    # Just the phone shells. Anything that leans on a mobile-only affordance —
+    # the OAuth handoff to ASWebAuthenticationSession / Custom Tabs, biometric
+    # gating — has to ask for this rather than "is this a native shell", because
+    # the desktop shell answers yes to that and has neither.
+    def mobile_platform_of(user_agent)
+      platform = native_platform_of(user_agent)
+      platform if MOBILE_PLATFORMS.include?(platform)
+    end
+  end
+end

data/lib/everywhere/paths.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "error"
 require_relative "ui"
 
 module Everywhere
@@ -97,7 +98,7 @@ module Everywhere
     # tmpdir) on purpose: a stable project path keeps Xcode's incremental state
     # valid across builds, and users can open the stamped project in Xcode.
     def ios_work_dir(bundle_id)
-      File.join(cache_dir, "ios", bundle_id)
+      File.join(cache_dir, "ios", segment!(bundle_id))
     end
 
     # Where xcodebuild writes DerivedData for iOS shell builds. Shared across
@@ -118,7 +119,7 @@ module Everywhere
     # incremental state is path-sensitive, and the stamped project opens in
     # Android Studio unmodified.
     def android_work_dir(application_id)
-      File.join(cache_dir, "android", application_id)
+      File.join(cache_dir, "android", segment!(application_id))
     end
 
     # GRADLE_USER_HOME for shell builds. Redirected here so the multi-GB Gradle
@@ -144,7 +145,7 @@ module Everywhere
     # stays warm across projects. Persistent for the same reason the mobile
     # work dirs are: a cold Tauri build is minutes where a warm one is seconds.
     def desktop_work_dir(bundle_id)
-      File.join(cache_dir, "desktop", bundle_id)
+      File.join(cache_dir, "desktop", segment!(bundle_id))
     end
 
     # CARGO_TARGET_DIR for a stamped shell. Per-app rather than shared, because
@@ -152,7 +153,7 @@ module Everywhere
     # every other app's — pointing them at one target dir would make cargo
     # rebuild the world on every alternating build.
     def desktop_target_dir(bundle_id)
-      File.join(cache_dir, "desktop-target", bundle_id)
+      File.join(cache_dir, "desktop-target", segment!(bundle_id))
     end
 
     # Where `every dev` keeps the throwaway .app wrapper it runs the shell
@@ -161,14 +162,14 @@ module Everywhere
     # menu bar, the About/Hide/Quit items and the Dock. The wrapper exists only
     # to carry an Info.plist; the binary inside it is a hard link to cargo's.
     def desktop_dev_app_dir(bundle_id)
-      File.join(cache_dir, "desktop-app", bundle_id)
+      File.join(cache_dir, "desktop-app", segment!(bundle_id))
     end
 
     # Where `every dev` stages the app's Dock icon for the running shell. The
     # shaped master is derived from app.icon, so it's a build product, not the
     # app's own file — it belongs in the cache next to the rest of them.
     def desktop_icon_dir(bundle_id)
-      File.join(cache_dir, "desktop-icon", bundle_id)
+      File.join(cache_dir, "desktop-icon", segment!(bundle_id))
     end
 
     # Where `every dev` stages native/desktop/assets for the running shell.
@@ -178,7 +179,7 @@ module Everywhere
     # in dev. Staging runs the same DesktopAssets compiler both ways, so the two
     # can't drift. Keyed by bundle id like the mobile work dirs.
     def desktop_assets_dir(bundle_id)
-      File.join(cache_dir, "desktop-assets", bundle_id)
+      File.join(cache_dir, "desktop-assets", segment!(bundle_id))
     end
 
     # Where cargo writes the shell's build output (CARGO_TARGET_DIR) for apps on
@@ -199,5 +200,20 @@ module Everywhere
     def app_bundle_dir
       File.join(cache_dir, "bundle")
     end
+
+    # Bundle ids and application ids come from the app's everywhere.yml and are
+    # used as ONE path segment under the cache — directories the builders rm_rf
+    # wholesale. Config#identity_errors rejects a malformed id before a build
+    # starts; this is the backstop for every other caller. Raise, not die!:
+    # Paths is reachable from the packaged app's runtime.
+    def segment!(value)
+      segment = value.to_s
+      if segment.empty? || segment.include?("/") || segment.include?("\\") || segment.include?("..")
+        raise Everywhere::Error, "#{segment.inspect} can't be a directory name (app.bundle_id in " \
+                                 "config/everywhere.yml must be reverse-DNS, like com.example.app)"
+      end
+
+      segment
+    end
   end
 end

data/lib/everywhere/platform/client.rb

@@ -8,6 +8,7 @@ begin
 rescue LoadError
   nil
 end
+require_relative "../error"
 require_relative "../version"
 
 module Everywhere
@@ -92,7 +93,7 @@ module Everywhere
             when Net::HTTPRedirection
               raise Error, "too many redirects downloading #{url}" if redirects <= 0
 
-              return download(res["location"], dest, redirects: redirects - 1)
+              return download(redirect_target(uri, res["location"]), dest, redirects: redirects - 1)
             when Net::HTTPSuccess
               File.open(dest, "wb") { |f| res.read_body { |chunk| f.write(chunk) } }
             else
@@ -107,6 +108,23 @@ module Everywhere
 
       private
 
+      # A signed-blob redirect is expected to leave the platform host, but it
+      # may never leave TLS: an http:// hop would put the artifact — and the
+      # snapshot or credentials inside it — on the wire in the clear. Only a
+      # base that was already http (`every platform --url http://localhost`)
+      # has nothing to downgrade from. Location is resolved against the current
+      # hop, which is also what makes a relative one work.
+      def redirect_target(from, location)
+        target = URI.join(from, location.to_s)
+        if from.scheme == "https" && target.scheme != "https"
+          raise Error, "refusing an https → #{target.scheme} redirect to #{target.host}"
+        end
+
+        target.to_s
+      rescue URI::Error => e
+        raise Error, "bad redirect from #{from.host} (#{e.message})"
+      end
+
       def http(uri, &block)
         Net::HTTP.start(uri.hostname, uri.port,
                         use_ssl: uri.scheme == "https", open_timeout: OPEN_TIMEOUT, &block)

data/lib/everywhere/platform/snapshot.rb

@@ -39,10 +39,12 @@ module Everywhere
 
       def add(tar, root, rel)
         abs = File.join(root, rel)
-        # lstat first: File.stat follows the link, so a dangling symlink (a
-        # deleted bundle path, a checked-in link to an absent sibling repo)
-        # would raise Errno::ENOENT and abort the whole snapshot.
-        return Everywhere::UI.warn("skipping dangling symlink #{rel}") if File.lstat(abs).symlink? && !File.exist?(abs)
+        # lstat, and never follow: File.stat would read through the link, so a
+        # dangling one (a deleted bundle path, a checked-in link to an absent
+        # sibling repo) raises Errno::ENOENT and aborts the whole snapshot —
+        # and a LIVE one pointing outside the tree (link → ~/.ssh/id_rsa) would
+        # pack and upload its target's contents under an innocent name.
+        return Everywhere::UI.warn("skipping symlink #{rel}") if File.lstat(abs).symlink?
 
         stat = File.stat(abs)
         tar.add_file_simple(rel, stat.mode & 0o777, stat.size) do |io|

data/lib/everywhere/plist.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # Escaping for the plists and entitlements the CLI writes by hand (there are
+  # four: `every build`'s Info.plist, `every dev`'s dev bundle, and the iOS
+  # builder's entitlements + export options). Every value interpolated into them
+  # comes from everywhere.yml or from Apple, so an unescaped `&` or `<` is at
+  # best a plist macOS refuses to parse and at worst extra keys of someone
+  # else's choosing.
+  module Plist
+    module_function
+
+    def escape(value)
+      value.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;")
+    end
+  end
+end

data/lib/everywhere/png.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "zlib"
+require_relative "error"
 
 module Everywhere
   # Minimal PNG surgery: Tauri requires RGBA icons, users hand us whatever

data/lib/everywhere/raw_tty.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require_relative "shellout"
+
+module Everywhere
+  # A terminal that reports keys as they're pressed, put back the way it was
+  # found on the way out.
+  #
+  # io/console's getch holds full raw mode while blocked, which clears OPOST
+  # and stair-steps every log line we relay; stty -icanon -echo disables only
+  # line buffering and echo, leaving output processing (and Ctrl-C as SIGINT)
+  # intact.
+  module RawTty
+    module_function
+
+    def with
+      # stty is POSIX-only, and the non-pty spawn path otherwise works on
+      # Windows: without it the menu simply stays line-buffered (press d,
+      # then Enter) rather than the session dying on Errno::ENOENT.
+      saved_tty = saved_tty_state
+      system("stty", "-icanon", "-echo") if saved_tty
+      trap_exit_signals
+      yield
+    ensure
+      system("stty", saved_tty) if saved_tty
+    end
+
+    # The tty settings to put back on the way out, or nil when there's no
+    # usable stty to read them with — the one signal both the raw-mode setup
+    # and its restore key off.
+    def saved_tty_state
+      return nil unless Shellout.tool?("stty")
+
+      state = `stty -g`.chomp
+      state.empty? ? nil : state
+    rescue StandardError
+      nil
+    end
+
+    # The dock hides the cursor and the key loop puts the tty in -icanon
+    # -echo; a SIGTERM that skipped our ensure blocks would leave the user's
+    # shell in that state. exit(1) from a trap unwinds normally, which is all
+    # this needs to do — a handler must stay this small, because anything that
+    # takes a lock (Console, the dock) raises ThreadError in trap context.
+    def trap_exit_signals
+      %w[TERM HUP].each { |sig| Signal.trap(sig) { exit(1) } }
+    rescue ArgumentError
+      nil
+    end
+  end
+end

data/lib/everywhere/s3.rb

@@ -4,6 +4,7 @@ require "net/http"
 require "openssl"
 require "uri"
 require "time"
+require_relative "error"
 
 module Everywhere
   # Minimal S3 client — just the four operations `every publish` needs