@cnrai/pave 0.3.32 → 0.3.34

package/build-binary.js

@@ -0,0 +1,591 @@
+#!/usr/bin/env node
+/**
+ * Build script for PAVE native binary
+ *
+ * Process:
+ *   1. Bundle ALL dependencies with esbuild (including blessed, SandboxRunner)
+ *   2. Obfuscate the bundle (hide SandboxRunner code)
+ *   3. Compile to native binary with Bun
+ *
+ * The resulting binary contains ALL code - no external JS files needed!
+ *
+ * Usage:
+ *   node build-binary.js                    # Build for current platform
+ *   node build-binary.js --skip-obfuscate   # Skip obfuscation (faster, for testing)
+ *   node build-binary.js --target=all       # Build for all platforms
+ */
+
+const esbuild = require('esbuild');
+const { execSync, spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const DIST_DIR = path.join(__dirname, 'dist');
+const BIN_DIR = path.join(DIST_DIR, 'bin');
+
+// Parse arguments
+const args = process.argv.slice(2);
+const skipObfuscate = args.includes('--skip-obfuscate'); // Obfuscate by default, use --skip-obfuscate to disable
+const targetArg = args.find((a) => a.startsWith('--target='));
+const target = targetArg ? targetArg.split('=')[1] : 'current';
+
+// Bun compile targets
+// Note: We use baseline builds for x64 platforms to avoid AVX instruction requirement
+// This fixes the "CPU lacks AVX support" warning on older CPUs and VMs
+// See: https://github.com/cnrai/openpave/issues/73
+const TARGETS = {
+  'darwin-arm64': 'bun-darwin-arm64',
+  'darwin-x64': 'bun-darwin-x64-baseline', // baseline = no AVX requirement
+  'linux-x64': 'bun-linux-x64-baseline', // baseline = no AVX requirement
+  'linux-arm64': 'bun-linux-arm64',
+};
+
+// Export TARGETS for testing (Issue #73 regression tests)
+// Use exports.TARGETS to avoid clobbering module.exports
+exports.TARGETS = TARGETS;
+
+async function checkBun() {
+  try {
+    const result = spawnSync('bun', ['--version'], { encoding: 'utf-8' });
+    if (result.status === 0) {
+      console.log('   Bun version:', result.stdout.trim());
+      return true;
+    }
+  } catch (e) {}
+
+  console.error('Error: Bun is not installed');
+  console.error('Install with: brew install bun');
+  process.exit(1);
+}
+
+async function bundleAll() {
+  console.log('\n[1/3] Creating fully bundled JS (all dependencies inline)...');
+
+  // Read version from package.json
+  const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));
+  const VERSION = packageJson.version || '0.0.0';
+  console.log('   Version:', VERSION);
+
+  const fullBundlePath = path.join(DIST_DIR, 'pave-full.js');
+
+  // Find blessed's widget directory to pre-bundle all widgets
+  const tuiNodeModules = path.join(__dirname, '..', 'tui', 'node_modules');
+  const blessedLibDir = path.join(tuiNodeModules, 'blessed', 'lib');
+
+  // Plugin to replace node-fetch with native fetch for Bun binary compatibility
+  // Note: The pave-full.js bundle will use native fetch which works in:
+  // - Bun (native fetch)
+  // - Node 18+ (native fetch via undici)
+  // The regular pave.js bundle (from build.js) still uses node-fetch for Node 16 compat
+  const nodeFetchNativePlugin = {
+    name: 'node-fetch-native',
+    setup(build) {
+      // Replace node-fetch with native fetch wrapper
+      build.onResolve({ filter: /^node-fetch$/ }, () => {
+        return {
+          path: 'node-fetch',
+          namespace: 'node-fetch-native',
+        };
+      });
+
+      build.onLoad({ filter: /.*/, namespace: 'node-fetch-native' }, () => {
+        return {
+          contents: `
+            // Native fetch wrapper for Bun/Node 18+ binary
+            // This replaces node-fetch in the pave-full.js bundle
+            
+            const nativeFetch = globalThis.fetch;
+            
+            // Wrapper to ensure consistent behavior
+            async function fetchWrapper(url, options) {
+              const response = await nativeFetch(url, options);
+              
+              // Add .body stream compatibility for SSE
+              // Native fetch response.body is a ReadableStream, not a Node stream
+              // We need to add .on() methods for compatibility with opencode-client.js
+              // 
+              // IMPORTANT: We must NOT consume the body (via getReader()) until .on() is called
+              // Otherwise response.text() and response.json() will fail for non-streaming requests
+              if (response.body && !response.body.on) {
+                const originalBody = response.body;
+                let reader = null;
+                let streamConsumed = false;
+                
+                const nodeStyleBody = {
+                  _listeners: { data: [], end: [], error: [] },
+                  _reading: false,
+                  _destroyed: false,
+                  
+                  on(event, handler) {
+                    this._listeners[event] = this._listeners[event] || [];
+                    this._listeners[event].push(handler);
+                    
+                    // Start reading only when we have a data handler
+                    // This is when we actually consume the stream
+                    if (event === 'data' && !this._reading) {
+                      this._reading = true;
+                      streamConsumed = true;
+                      reader = originalBody.getReader();
+                      this._read();
+                    }
+                    return this;
+                  },
+                  
+                  // Node.js stream compatibility - destroy the stream
+                  destroy() {
+                    this._destroyed = true;
+                    this._listeners = { data: [], end: [], error: [] };
+                    if (reader) {
+                      try {
+                        reader.cancel();
+                      } catch (e) {
+                        // Ignore cancel errors
+                      }
+                    }
+                  },
+                  
+                  async _read() {
+                    try {
+                      while (true) {
+                        if (this._destroyed) break;
+                        const { done, value } = await reader.read();
+                        if (done || this._destroyed) {
+                          if (!this._destroyed) {
+                            this._listeners.end.forEach(h => h());
+                          }
+                          break;
+                        }
+                        // Convert Uint8Array to string
+                        const chunk = new TextDecoder().decode(value);
+                        this._listeners.data.forEach(h => h(chunk));
+                      }
+                    } catch (err) {
+                      if (!this._destroyed) {
+                        this._listeners.error.forEach(h => h(err));
+                      }
+                    }
+                  }
+                };
+                
+                // Create a new response with our compatible body
+                // text() and json() call the original response methods ONLY if stream wasn't consumed
+                return {
+                  ok: response.ok,
+                  status: response.status,
+                  statusText: response.statusText,
+                  headers: response.headers,
+                  body: nodeStyleBody,
+                  async text() {
+                    if (streamConsumed) {
+                      throw new Error('Body already consumed by stream reader');
+                    }
+                    streamConsumed = true;
+                    return response.text();
+                  },
+                  async json() {
+                    if (streamConsumed) {
+                      throw new Error('Body already consumed by stream reader');
+                    }
+                    streamConsumed = true;
+                    return response.json();
+                  },
+                  async arrayBuffer() {
+                    if (streamConsumed) {
+                      throw new Error('Body already consumed by stream reader');
+                    }
+                    streamConsumed = true;
+                    return response.arrayBuffer();
+                  },
+                  async blob() {
+                    if (streamConsumed) {
+                      throw new Error('Body already consumed by stream reader');
+                    }
+                    streamConsumed = true;
+                    return response.blob();
+                  }
+                };
+              }
+              
+              return response;
+            }
+            
+            // Export as function (node-fetch style)
+            module.exports = fetchWrapper;
+            module.exports.default = fetchWrapper;
+            
+            // Export types
+            module.exports.Headers = globalThis.Headers;
+            module.exports.Request = globalThis.Request;
+            module.exports.Response = globalThis.Response;
+            
+            // FetchError class
+            class FetchError extends Error {
+              constructor(message, type, systemError) {
+                super(message);
+                this.name = 'FetchError';
+                this.type = type;
+                if (systemError) this.code = systemError.code;
+              }
+            }
+            module.exports.FetchError = FetchError;
+            
+            // AbortError class  
+            class AbortError extends Error {
+              constructor(message) {
+                super(message);
+                this.name = 'AbortError';
+                this.type = 'aborted';
+              }
+            }
+            module.exports.AbortError = AbortError;
+          `,
+          loader: 'js',
+        };
+      });
+    },
+  };
+
+  // Plugin to replace blessed's dynamic widget loading with static requires
+  const blessedShimPlugin = {
+    name: 'blessed-shim',
+    setup(build) {
+      // Redirect blessed's widget.js to our patched version with static requires
+      build.onResolve({ filter: /^\.\/widget$/ }, (args) => {
+        // Only intercept if it's from blessed's blessed.js
+        if (args.importer && args.importer.includes('blessed') && args.importer.endsWith('blessed.js')) {
+          return {
+            path: path.join(__dirname, 'lib', 'blessed-widget-patched.js'),
+          };
+        }
+        return null;
+      });
+
+      // Resolve ./widgets/* requires in our patched widget.js to blessed's actual widgets
+      build.onResolve({ filter: /^\.\/widgets\// }, (args) => {
+        // If it's from our patched widget file, resolve to blessed's widgets
+        if (args.importer && args.importer.includes('blessed-widget-patched.js')) {
+          const widgetName = args.path.replace('./widgets/', '');
+          const widgetPath = path.join(blessedLibDir, 'widgets', widgetName + '.js');
+          if (fs.existsSync(widgetPath)) {
+            return { path: widgetPath };
+          }
+        }
+        return null;
+      });
+
+      // Stub out optional blessed dependencies that don't exist
+      // Instead of marking external (which fails Bun compile), return empty modules
+      build.onResolve({ filter: /^(term\.js|pty\.js)$/ }, (args) => {
+        return {
+          path: args.path,
+          namespace: 'blessed-stub',
+        };
+      });
+
+      // Also catch them when required with explicit paths
+      build.onResolve({ filter: /term\.js$|pty\.js$/ }, (args) => {
+        return {
+          path: args.path,
+          namespace: 'blessed-stub',
+        };
+      });
+
+      // Return empty stub for these modules
+      build.onLoad({ filter: /.*/, namespace: 'blessed-stub' }, (args) => {
+        return {
+          contents: `
+            // Stub for ${args.path} - not available in bundled binary
+            module.exports = function() {
+              throw new Error('${args.path} is not available in bundled binary');
+            };
+          `,
+          loader: 'js',
+        };
+      });
+    },
+  };
+
+  try {
+    // Bundle EVERYTHING - no externals
+    // This includes SandboxRunner, blessed, and all other dependencies
+    await esbuild.build({
+      entryPoints: [path.join(__dirname, 'index.js')],
+      bundle: true,
+      platform: 'node',
+      target: 'node16', // Target Node 16 for iSH compatibility
+      outfile: fullBundlePath,
+      // Inject version at build time
+      define: {
+        PAVE_VERSION: JSON.stringify(VERSION),
+      },
+      // Help esbuild find modules
+      nodePaths: [path.join(__dirname, 'node_modules')],
+      // No external dependencies - everything bundled or stubbed
+      external: [],
+      // Use plugins to handle dependencies
+      plugins: [nodeFetchNativePlugin, blessedShimPlugin],
+      // Minify
+      minify: true,
+      keepNames: true,
+      sourcemap: false,
+      format: 'cjs',
+      // Handle dynamic requires in blessed
+      mainFields: ['module', 'main'],
+      // Bundle all dependencies
+      packages: 'bundle',
+    });
+
+    // Add shebang
+    let content = fs.readFileSync(fullBundlePath, 'utf-8');
+    content = content.replace(/^(#!.*\n)+/, '');
+    content = '#!/usr/bin/env node\n' + content;
+    fs.writeFileSync(fullBundlePath, content);
+
+    const stats = fs.statSync(fullBundlePath);
+    console.log('   Full bundle: ' + fullBundlePath);
+    console.log('   Size: ' + (stats.size / 1024).toFixed(1) + ' KB');
+
+    return fullBundlePath;
+  } catch (err) {
+    console.error('   Bundle failed:', err.message);
+
+    // Fallback: try bundling with blessed as external and warn
+    console.log('   Retrying with blessed as external...');
+
+    await esbuild.build({
+      entryPoints: [path.join(__dirname, 'index.js')],
+      bundle: true,
+      platform: 'node',
+      target: 'node16', // Target Node 16 for iSH compatibility
+      outfile: fullBundlePath,
+      // Inject version at build time
+      define: {
+        PAVE_VERSION: JSON.stringify(VERSION),
+      },
+      nodePaths: [path.join(__dirname, 'node_modules')],
+      external: ['blessed'], // Only blessed external
+      minify: true,
+      keepNames: true,
+      sourcemap: false,
+      format: 'cjs',
+    });
+
+    let content = fs.readFileSync(fullBundlePath, 'utf-8');
+    content = content.replace(/^(#!.*\n)+/, '');
+    content = '#!/usr/bin/env node\n' + content;
+    fs.writeFileSync(fullBundlePath, content);
+
+    console.log('   Warning: blessed still external - binary may not work standalone');
+    return fullBundlePath;
+  }
+}
+
+async function obfuscate(inputPath) {
+  if (skipObfuscate) {
+    console.log('\n[2/3] Skipping obfuscation (--skip-obfuscate)');
+    return inputPath;
+  }
+
+  console.log('\n[2/3] Obfuscating bundle (hiding SandboxRunner code)...');
+
+  const obfuscatedPath = path.join(DIST_DIR, 'pave-obfuscated.js');
+
+  try {
+    // Check if javascript-obfuscator is available
+    try {
+      execSync('npx javascript-obfuscator --version', { stdio: 'pipe' });
+    } catch (e) {
+      console.log('   Installing javascript-obfuscator...');
+      execSync('npm install --save-dev javascript-obfuscator', { stdio: 'inherit', cwd: __dirname });
+    }
+
+    // Obfuscate with safer settings that preserve function references
+    // Use ES2020 target for Node 16 compatibility
+    const cmd = [
+      'npx', 'javascript-obfuscator',
+      inputPath,
+      '--output', obfuscatedPath,
+      '--compact', 'true',
+      '--control-flow-flattening', 'false', // Disable - breaks dynamic calls
+      '--dead-code-injection', 'false', // Disable - can break code
+      '--identifier-names-generator', 'mangled', // More predictable than hex
+      '--rename-globals', 'false', // Don't rename globals
+      '--self-defending', 'false', // Disable
+      '--string-array', 'true',
+      '--string-array-encoding', 'base64',
+      '--string-array-threshold', '0.3', // Lower threshold
+      '--transform-object-keys', 'false', // Disable - breaks obj[key] calls
+      '--unicode-escape-sequence', 'false',
+      '--target', 'node', // Target Node.js environment
+      '--options-preset', 'low-obfuscation', // Use low preset to avoid breaking code
+      // Preserve critical identifiers and strings
+      '--reserved-names', 'authenticated,valid,token,copilot,github,OpenCode,blessed,require,module,exports,process,console,Buffer,__dirname,__filename,program,tput,screen,cursor,options,element,children,parent,box,text,list,input,key,mouse,emit,on,off,render,destroy,focus,append,remove,hide,show,toggle,scroll,setContent,getContent,pushLine,setLine,insertLine,deleteLine,width,height,left,right,top,bottom,rows,cols',
+      '--reserved-strings', 'authenticated,valid,token,GitHub Copilot,Saved token is valid,OpenCode',
+      // '--ignore-require-imports', 'false',
+      '--split-strings', 'false', // Don't split strings that might be function names
+    ].join(' ');
+
+    console.log('   Running obfuscator (this may take a minute)...');
+    execSync(cmd, { stdio: 'inherit' });
+
+    const stats = fs.statSync(obfuscatedPath);
+    console.log('   Obfuscated: ' + obfuscatedPath);
+    console.log('   Size: ' + (stats.size / 1024).toFixed(1) + ' KB');
+
+    // Verify obfuscation worked
+    const content = fs.readFileSync(obfuscatedPath, 'utf-8');
+    const sensitiveStrings = ['newGlobal', 'os.system', 'SandboxRunner', 'drainJobQueue'];
+    const found = sensitiveStrings.filter((s) => content.includes(s));
+
+    if (found.length > 0) {
+      console.log('   ⚠️  Warning: Some sensitive strings may still be visible:', found.join(', '));
+    } else {
+      console.log('   ✅ Sensitive strings successfully obfuscated');
+    }
+
+    return obfuscatedPath;
+  } catch (err) {
+    console.error('   Obfuscation failed:', err.message);
+    console.log('   Continuing without obfuscation...');
+    return inputPath;
+  }
+}
+
+async function buildBinary(bundlePath, targetName, bunTarget) {
+  const outputPath = path.join(BIN_DIR, `pave-${targetName}`);
+
+  console.log(`   Building: pave-${targetName}`);
+
+  try {
+    // Don't use --minify to preserve function names/references that esbuild already optimized
+    const cmd = `bun build ${bundlePath} --compile --target=${bunTarget} --outfile=${outputPath}`;
+    execSync(cmd, { stdio: 'inherit' });
+
+    if (fs.existsSync(outputPath)) {
+      const stats = fs.statSync(outputPath);
+      console.log(`   Output: ${outputPath}`);
+      console.log(`   Size: ${(stats.size / 1024 / 1024).toFixed(1)} MB`);
+      return true;
+    }
+  } catch (err) {
+    console.error(`   Failed: ${err.message}`);
+  }
+
+  return false;
+}
+
+async function verifyBinary(binaryPath) {
+  console.log('\n   Verifying binary...');
+
+  try {
+    const binary = fs.readFileSync(binaryPath);
+    const str = binary.toString('utf8');
+
+    const sensitiveStrings = ['newGlobal', 'os.system', 'SandboxRunner', '__ipc__', 'drainJobQueue'];
+    const found = sensitiveStrings.filter((s) => str.includes(s));
+
+    if (found.length > 0) {
+      console.log('   ⚠️  Warning: These strings are visible in binary:', found.join(', '));
+      console.log('   Consider running without --skip-obfuscate');
+    } else {
+      console.log('   ✅ Binary verification passed - sensitive strings are hidden');
+    }
+  } catch (err) {
+    console.log('   Could not verify binary:', err.message);
+  }
+}
+
+async function main() {
+  console.log('='.repeat(60));
+  console.log('PAVE Native Binary Build');
+  console.log('='.repeat(60));
+  console.log('');
+  console.log('Process: Bundle → Obfuscate → Compile to Binary');
+  console.log('');
+  console.log('All code (including SandboxRunner) will be bundled inside the binary.');
+  console.log('No external JavaScript files will be needed!');
+  console.log('');
+
+  await checkBun();
+
+  // Ensure dist directory exists
+  fs.mkdirSync(BIN_DIR, { recursive: true });
+
+  // Step 1: Bundle everything (including SandboxRunner)
+  const fullBundle = await bundleAll();
+
+  // Step 2: Obfuscate (hide SandboxRunner internals)
+  const obfuscatedBundle = await obfuscate(fullBundle);
+
+  // Step 3: Compile to binary
+  console.log('\n[3/3] Compiling to native binary with Bun...');
+
+  let success = false;
+  let builtBinary = null;
+
+  if (target === 'all') {
+    for (const [targetName, bunTarget] of Object.entries(TARGETS)) {
+      const result = await buildBinary(obfuscatedBundle, targetName, bunTarget);
+      if (result) {
+        success = true;
+        builtBinary = path.join(BIN_DIR, `pave-${targetName}`);
+      }
+    }
+  } else if (target === 'current') {
+    const platform = process.platform === 'darwin' ? 'darwin' : 'linux';
+    const arch = process.arch === 'arm64' ? 'arm64' : 'x64';
+    const targetName = `${platform}-${arch}`;
+    const bunTarget = TARGETS[targetName];
+    success = await buildBinary(obfuscatedBundle, targetName, bunTarget);
+    if (success) {
+      builtBinary = path.join(BIN_DIR, `pave-${targetName}`);
+    }
+  } else if (TARGETS[target]) {
+    success = await buildBinary(obfuscatedBundle, target, TARGETS[target]);
+    if (success) {
+      builtBinary = path.join(BIN_DIR, `pave-${target}`);
+    }
+  }
+
+  // Verify the binary
+  if (builtBinary && fs.existsSync(builtBinary)) {
+    await verifyBinary(builtBinary);
+  }
+
+  console.log('\n' + '='.repeat(60));
+
+  if (success) {
+    console.log('✅ Build complete!');
+    console.log('');
+    console.log('📍 Binary location: ' + BIN_DIR);
+    console.log('');
+    console.log('🧪 Test commands:');
+    const platform = process.platform === 'darwin' ? 'darwin' : 'linux';
+    const arch = process.arch === 'arm64' ? 'arm64' : 'x64';
+    console.log(`   ${BIN_DIR}/pave-${platform}-${arch} --help`);
+    console.log(`   ${BIN_DIR}/pave-${platform}-${arch} --version`);
+    console.log('');
+    console.log('🔍 Verify code is hidden:');
+    console.log(`   strings ${BIN_DIR}/pave-${platform}-${arch} | grep -i "newGlobal"`);
+    console.log('   (should return nothing)');
+    console.log('');
+    console.log('📦 Distribution:');
+    console.log('   The binary is self-contained - no external JS files needed!');
+    console.log('   Only SpiderMonkey is required for sandbox execution:');
+    console.log('   brew install spidermonkey');
+    console.log('');
+    console.log('='.repeat(60));
+  } else {
+    console.log('❌ Build failed!');
+    process.exit(1);
+  }
+}
+
+// Only run main() when script is executed directly, not when imported
+// This allows tests to import TARGETS without triggering the build process
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('Build error:', err);
+    process.exit(1);
+  });
+}