@coderook/cli 0.33.1 → 0.34.1

package/dist/cli/src/build_command.js

@@ -0,0 +1,932 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TARGETS = exports.ALL_TARGETS = void 0;
+exports.parseTargets = parseTargets;
+exports.thisHost = thisHost;
+exports.detectTools = detectTools;
+exports.describeProject = describeProject;
+exports.wslPath = wslPath;
+exports.planBuild = planBuild;
+exports.markExecutables = markExecutables;
+exports.fileFromTar = fileFromTar;
+exports.outputsOf = outputsOf;
+exports.commandBuild = commandBuild;
+/**
+ * `cbx build` — make a project's executables for Windows, Linux and macOS on
+ * the machine you are sitting at.
+ *
+ * Actions could already run a command, on CodeRook's Linux sandbox or on a
+ * machine that ran `cbx runner` — and each of those built for whatever it was.
+ * Shipping one app for three systems meant three machines. Most toolchains do
+ * not need that: Go, Bun, Deno and .NET produce every platform's binary from
+ * any one of them, Rust does with zig, and Electron does Windows and Linux
+ * through a container. What they lacked was something that knows which is
+ * which on *this* machine and says plainly what it cannot do.
+ *
+ * So this plans first and builds second. Every target gets a route — native,
+ * cross-compiled, in Docker, or in WSL — chosen from what is actually
+ * installed, or a sentence saying why it cannot be built here and where it
+ * can. Nothing is uploaded unless `--ship` is given; the output lands in
+ * `.coderook/build/<target>/` — beside the folder's link, which CodeRook never
+ * uploads and git is told to ignore. Not `dist/`: Electron apps commonly
+ * package `dist/**`, and every installer would then carry the last ones.
+ *
+ * A project can describe itself in `coderook.build.json` at its root, which is
+ * saved with the project like any other file. Without one, the toolchain is
+ * worked out from the files that are there.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_zlib_1 = require("node:zlib");
+const node_os_1 = __importDefault(require("node:os"));
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
+const portable_python_js_1 = require("./portable_python.js");
+const ESC = String.fromCharCode(27);
+const colour = node_process_1.default.stdout.isTTY && !node_process_1.default.env.NO_COLOR;
+const paint = (code) => (value) => (colour ? `${ESC}[${code}m${value}${ESC}[0m` : value);
+const dim = paint("2");
+const bold = paint("1");
+const red = paint("31");
+const green = paint("32");
+const accent = paint("33");
+exports.ALL_TARGETS = [
+    "windows-x64", "windows-arm64", "linux-x64", "linux-arm64", "macos-x64", "macos-arm64",
+];
+exports.DEFAULT_TARGETS = ["windows-x64", "linux-x64", "macos-arm64"];
+const ALIASES = {
+    all: ["windows-x64", "linux-x64", "macos-x64", "macos-arm64"],
+    win: ["windows-x64"], windows: ["windows-x64"],
+    linux: ["linux-x64"],
+    mac: ["macos-arm64"], macos: ["macos-arm64"], darwin: ["macos-arm64"],
+};
+/** `win,linux,mac`, `windows-x64`, `all`: what was asked for, as targets. */
+function parseTargets(text) {
+    const found = [];
+    for (const word of text.split(/[\s,]+/).map((one) => one.trim().toLowerCase()).filter(Boolean)) {
+        const normal = word.replace(/^win-/, "windows-").replace(/^mac-|^darwin-/, "macos-").replace(/-amd64$/, "-x64").replace(/-aarch64$/, "-arm64");
+        const named = ALIASES[normal] ?? (exports.ALL_TARGETS.includes(normal) ? [normal] : null);
+        if (!named)
+            throw new Error(`"${word}" is not a target. Use ${exports.ALL_TARGETS.join(", ")}, or win, linux, mac, all.`);
+        for (const target of named)
+            if (!found.includes(target))
+                found.push(target);
+    }
+    return found;
+}
+const osOf = (target) => target.split("-")[0];
+const archOf = (target) => target.split("-")[1];
+const exe = (target) => (osOf(target) === "windows" ? ".exe" : "");
+function thisHost() {
+    const platform = node_process_1.default.platform === "win32" ? "windows" : node_process_1.default.platform === "darwin" ? "macos" : "linux";
+    return { os: platform, arch: node_process_1.default.arch === "arm64" ? "arm64" : "x64" };
+}
+/** Whether a command answers within a few seconds, without a shell. */
+function answers(program, args, timeoutMs = 8000) {
+    return new Promise((done) => {
+        let child;
+        try {
+            child = (0, node_child_process_1.spawn)(program, args, { stdio: "ignore", windowsHide: true });
+        }
+        catch {
+            done(false);
+            return;
+        }
+        const timer = setTimeout(() => {
+            child.kill();
+            done(false);
+        }, timeoutMs);
+        child.on("error", () => {
+            clearTimeout(timer);
+            done(false);
+        });
+        child.on("exit", (code) => {
+            clearTimeout(timer);
+            done(code === 0);
+        });
+    });
+}
+/** What this machine has, asked of each tool rather than guessed from PATH. */
+async function detectTools(host = thisHost()) {
+    const checks = [
+        ["go", answers("go", ["version"])],
+        ["bun", answers("bun", ["--version"])],
+        ["deno", answers("deno", ["--version"])],
+        ["cargo", answers("cargo", ["--version"])],
+        ["rustup", answers("rustup", ["--version"])],
+        ["zigbuild", answers("cargo", ["zigbuild", "--help"])],
+        ["cross", answers("cross", ["--version"])],
+        ["dotnet", answers("dotnet", ["--version"])],
+        /* The daemon, not the client: a stopped Docker Desktop answers --version. */
+        ["docker", answers("docker", ["info", "--format", "{{.ServerVersion}}"], 15000)],
+        ["pyinstaller", answers("pyinstaller", ["--version"], 15000)],
+        ["uv", answers("uv", ["--version"])],
+        ["python", answers(host.os === "windows" ? "python" : "python3", ["-m", "pip", "--version"], 15000)],
+        ["wine", host.os === "windows" ? Promise.resolve(false) : answers("wine", ["--version"])],
+        ["node", answers(node_process_1.default.execPath, ["--version"])],
+    ];
+    if (host.os === "windows") {
+        checks.push(["wsl", answers("wsl", ["-e", "true"], 20000)]);
+        checks.push(["wslPython", answers("wsl", ["-e", "python3", "-m", "PyInstaller", "--version"], 30000)]);
+    }
+    const tools = {};
+    await Promise.all(checks.map(async ([name, check]) => {
+        tools[name] = await check;
+    }));
+    return tools;
+}
+const CONFIG_FILE = "coderook.build.json";
+async function readJson(file) {
+    try {
+        return JSON.parse(await (0, promises_1.readFile)(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+const safeName = (name) => name.replace(/^@[^/]+\//, "").replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-|-$/g, "") || "app";
+/** The preset, name and entry point, from the config and the files present. */
+async function describeProject(folder) {
+    const here = (file) => (0, node_fs_1.existsSync)(node_path_1.default.join(folder, file));
+    let config = {};
+    if (here(CONFIG_FILE)) {
+        const raw = await readJson(node_path_1.default.join(folder, CONFIG_FILE));
+        if (!raw)
+            throw new Error(`${CONFIG_FILE} is not valid JSON.`);
+        config = raw;
+    }
+    const pkg = await readJson(node_path_1.default.join(folder, "package.json"));
+    const entries = (await (0, promises_1.readdir)(folder).catch(() => []));
+    const csproj = entries.find((file) => file.endsWith(".csproj"));
+    const spec = entries.find((file) => file.endsWith(".spec"));
+    const dependencies = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
+    let preset = config.preset ?? (config.command ? "custom" : null);
+    if (!preset) {
+        if (here("go.mod"))
+            preset = "go";
+        else if (here("Cargo.toml"))
+            preset = "rust";
+        else if (csproj)
+            preset = "dotnet";
+        else if (dependencies["electron-builder"] || dependencies["electron"])
+            preset = "electron";
+        else if (here("deno.json") || here("deno.jsonc"))
+            preset = "deno";
+        else if (here("bun.lock") || here("bun.lockb") || here("bunfig.toml"))
+            preset = "bun";
+        else if (spec || (await (0, promises_1.readFile)(node_path_1.default.join(folder, "requirements.txt"), "utf8").catch(() => "")).match(/pyinstaller/i))
+            preset = "pyinstaller";
+        else if (here("requirements.txt") || here("pyproject.toml") || here("main.py") || here("app.py"))
+            preset = "python";
+    }
+    let name = config.name ?? "";
+    let entry = config.entry ?? null;
+    let windowsOnly = false;
+    if (preset === "go" && !name) {
+        const module = (await (0, promises_1.readFile)(node_path_1.default.join(folder, "go.mod"), "utf8").catch(() => "")).match(/^module\s+(\S+)/m)?.[1];
+        name = module?.split("/").pop() ?? "";
+        entry ??= ".";
+    }
+    if (preset === "rust" && !name) {
+        const cargo = await (0, promises_1.readFile)(node_path_1.default.join(folder, "Cargo.toml"), "utf8").catch(() => "");
+        name = cargo.match(/\[package\][^[]*?\bname\s*=\s*"([^"]+)"/)?.[1] ?? "";
+    }
+    if (preset === "dotnet") {
+        entry ??= csproj ?? null;
+        if (entry) {
+            const text = await (0, promises_1.readFile)(node_path_1.default.join(folder, entry), "utf8").catch(() => "");
+            windowsOnly = /<UseWindowsForms>\s*true|<UseWPF>\s*true|<TargetFrameworks?>[^<]*-windows/i.test(text);
+            name ||= text.match(/<AssemblyName>([^<]+)</)?.[1] ?? node_path_1.default.basename(entry, ".csproj");
+        }
+    }
+    if (preset === "bun" || preset === "deno") {
+        const bin = pkg?.bin;
+        entry ??=
+            (typeof bin === "string" ? bin : bin && typeof bin === "object" ? String(Object.values(bin)[0]) : null) ??
+                (typeof pkg?.module === "string" ? pkg.module : null) ??
+                (typeof pkg?.main === "string" ? pkg.main : null) ??
+                ["main.ts", "mod.ts", "index.ts", "src/main.ts", "src/index.ts", "index.js"].find(here) ??
+                null;
+    }
+    if (preset === "pyinstaller" || preset === "python") {
+        entry ??= spec ?? ["main.py", "app.py", "__main__.py", "src/main.py"].find(here) ?? null;
+    }
+    if (!name && typeof pkg?.name === "string")
+        name = pkg.name;
+    /*
+      An Electron app is usually compiled before it is packaged, and
+      electron-builder packages whatever is there: without this the installer
+      holds last week's build, or none. A `build` script that is itself
+      electron-builder is the packaging, not the compiling, and is left alone.
+    */
+    const scripts = (pkg?.scripts ?? {});
+    if (preset === "electron" && config.before === undefined && scripts.build && !/electron-builder/.test(scripts.build)) {
+        config = { ...config, before: "npm run build" };
+    }
+    if (preset === "pyinstaller" && !name && entry?.endsWith(".spec"))
+        name = node_path_1.default.basename(entry, ".spec");
+    const hasBuilder = preset === "electron" ? (0, node_fs_1.existsSync)(node_path_1.default.join(folder, "node_modules", "electron-builder", "cli.js")) : undefined;
+    return {
+        folder, preset, name: safeName(name || node_path_1.default.basename(folder)), entry, windowsOnly, config,
+        ...(hasBuilder === undefined ? {} : { hasBuilder }),
+    };
+}
+/** Where fetched toolchain pieces are kept between builds. */
+function cacheDirectory() {
+    const base = node_process_1.default.platform === "win32"
+        ? node_process_1.default.env.LOCALAPPDATA ?? node_path_1.default.join(node_os_1.default.homedir(), "AppData", "Local")
+        : node_process_1.default.env.XDG_CACHE_HOME ?? node_path_1.default.join(node_os_1.default.homedir(), ".cache");
+    return node_path_1.default.join(base, "coderook", "build");
+}
+/** A command that runs inside a throwaway container with the project mounted. */
+function inDocker(project, image, inner, volumes = []) {
+    return {
+        program: "docker",
+        args: [
+            "run", "--rm",
+            "-v", `${project.folder}:/project`,
+            ...volumes.flatMap((volume) => ["-v", volume]),
+            "-w", "/project",
+            image, "sh", "-lc", inner,
+        ],
+    };
+}
+/** A path inside WSL for a Windows path: `A:\x\y` is `/mnt/a/x/y`. */
+function wslPath(windowsPath) {
+    const match = windowsPath.match(/^([A-Za-z]):[\\/](.*)$/);
+    if (!match)
+        return windowsPath.replace(/\\/g, "/");
+    return `/mnt/${match[1].toLowerCase()}/${match[2].replace(/\\/g, "/")}`;
+}
+const sq = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+const GO_OS = { windows: "windows", linux: "linux", macos: "darwin" };
+const GO_ARCH = { x64: "amd64", arm64: "arm64" };
+const DENO = {
+    "windows-x64": "x86_64-pc-windows-msvc", "windows-arm64": "",
+    "linux-x64": "x86_64-unknown-linux-gnu", "linux-arm64": "aarch64-unknown-linux-gnu",
+    "macos-x64": "x86_64-apple-darwin", "macos-arm64": "aarch64-apple-darwin",
+};
+const DOTNET = {
+    "windows-x64": "win-x64", "windows-arm64": "win-arm64", "linux-x64": "linux-x64",
+    "linux-arm64": "linux-arm64", "macos-x64": "osx-x64", "macos-arm64": "osx-arm64",
+};
+const RUST = {
+    "windows-x64": "x86_64-pc-windows-msvc", "windows-arm64": "aarch64-pc-windows-msvc",
+    "linux-x64": "x86_64-unknown-linux-gnu", "linux-arm64": "aarch64-unknown-linux-gnu",
+    "macos-x64": "x86_64-apple-darwin", "macos-arm64": "aarch64-apple-darwin",
+};
+const NEEDS = (os) => `run cbx build --target ${os === "macos" ? "mac" : os} on a ${os === "macos" ? "Mac" : os === "windows" ? "Windows PC" : "Linux machine"}, or a cbx runner on one`;
+/**
+ * Every target, with how this machine would build it or why it cannot.
+ *
+ * Pure: the same project, host and tools always give the same plan, which is
+ * what lets the choices be tested for machines this one is not.
+ */
+function planBuild(project, host, tools, targets) {
+    const outRoot = project.config.out ?? node_path_1.default.join(".coderook", "build");
+    const extra = project.config.args ?? [];
+    const before = project.config.before;
+    return targets.map((target) => {
+        const out = node_path_1.default.join(outRoot, target);
+        const outAbs = node_path_1.default.join(project.folder, out);
+        const os_ = osOf(target);
+        const arch = archOf(target);
+        const native = host.os === os_ && host.arch === arch;
+        const sameOs = host.os === os_;
+        const file = `${project.name}-${target}${exe(target)}`;
+        const pre = before ? [{ shell: before }] : [];
+        /* Found by asking the PATH, so a tool installed but not on it reads as absent: say both. */
+        const missing = (tool, why = "") => ({ target, ok: false, why: `needs ${tool}${why}, on the PATH this command sees` });
+        /*
+          Python for any system from any system: the target's own CPython, its
+          wheels and the program, in one archive. Needs uv, or Python with pip to
+          fetch uv; a dependency with no wheel for the target is the one thing it
+          cannot do, and it says which.
+        */
+        const portable = () => tools.uv || tools.python
+            ? {
+                target, ok: true, route: native ? "native" : "cross", out,
+                how: `portable CPython for ${target} + its wheels (uv), as a tar.gz with a launcher`,
+                steps: [...pre, { portablePython: { target, out: outAbs } }],
+            }
+            : null;
+        switch (project.preset) {
+            case "go": {
+                if (!tools.go)
+                    return missing("Go (https://go.dev/dl)");
+                return {
+                    target, ok: true, route: native ? "native" : "cross", out,
+                    how: native ? "go build" : `go build for ${GO_OS[os_]}/${GO_ARCH[arch]}, cgo off`,
+                    steps: [...pre, {
+                            program: "go",
+                            args: ["build", ...extra, "-o", node_path_1.default.join(outAbs, file), project.entry ?? "."],
+                            env: { GOOS: GO_OS[os_], GOARCH: GO_ARCH[arch], CGO_ENABLED: "0" },
+                        }],
+                };
+            }
+            case "bun": {
+                if (!tools.bun)
+                    return missing("Bun (https://bun.sh)");
+                if (target === "windows-arm64")
+                    return { target, ok: false, why: "Bun cannot compile for Windows on Arm" };
+                if (!project.entry)
+                    return { target, ok: false, why: `no entry point; set "entry" in ${CONFIG_FILE}` };
+                const bunOs = os_ === "macos" ? "darwin" : os_;
+                /*
+                  Bun fetches another system's runtime itself, and on Windows 1.3 fails
+                  to unpack it ("Failed to extract executable"). Fetching it here, from
+                  the same npm package and checked against npm's own digest, and
+                  handing Bun the file works on every host.
+                */
+                const runtime = node_path_1.default.join(cacheDirectory(), "bun", target, `bun${exe(target)}`);
+                return {
+                    target, ok: true, route: native ? "native" : "cross", out,
+                    how: `bun build --compile --target=bun-${bunOs}-${arch}`,
+                    steps: [
+                        ...pre,
+                        ...(native ? [] : [{ bunRuntime: { target, to: runtime } }]),
+                        {
+                            program: "bun",
+                            args: [
+                                "build", "--compile", `--target=bun-${bunOs}-${arch}`,
+                                ...(native ? [] : [`--compile-executable-path=${runtime}`]),
+                                ...extra, project.entry, "--outfile", node_path_1.default.join(outAbs, file),
+                            ],
+                        },
+                    ],
+                };
+            }
+            case "deno": {
+                if (!tools.deno)
+                    return missing("Deno (https://deno.com)");
+                if (!DENO[target])
+                    return { target, ok: false, why: "Deno cannot compile for Windows on Arm" };
+                if (!project.entry)
+                    return { target, ok: false, why: `no entry point; set "entry" in ${CONFIG_FILE}` };
+                return {
+                    target, ok: true, route: native ? "native" : "cross", out,
+                    how: `deno compile --target ${DENO[target]}`,
+                    steps: [...pre, {
+                            program: "deno",
+                            args: ["compile", ...extra, "--target", DENO[target], "--output", node_path_1.default.join(outAbs, file), project.entry],
+                        }],
+                };
+            }
+            case "dotnet": {
+                if (!tools.dotnet)
+                    return missing(".NET SDK (https://dot.net)");
+                if (project.windowsOnly && os_ !== "windows") {
+                    return { target, ok: false, why: "a WinForms or WPF app runs only on Windows" };
+                }
+                return {
+                    target, ok: true, route: native ? "native" : "cross", out,
+                    how: `dotnet publish -r ${DOTNET[target]}, self-contained, single file`,
+                    steps: [...pre, {
+                            program: "dotnet",
+                            args: [
+                                "publish", ...(project.entry ? [project.entry] : []), "-c", "Release", "-r", DOTNET[target],
+                                "--self-contained", "true", "-p:PublishSingleFile=true", ...extra, "-o", outAbs,
+                            ],
+                        }],
+                };
+            }
+            case "rust": {
+                if (!tools.cargo)
+                    return missing("Rust (https://rustup.rs)");
+                const triple = RUST[target];
+                const built = (tripleUsed) => ({
+                    copy: {
+                        from: node_path_1.default.join(project.folder, "target", tripleUsed, "release", `${project.name}${exe(target)}`),
+                        to: node_path_1.default.join(outAbs, file),
+                    },
+                });
+                const addTarget = (tripleUsed) => tools.rustup ? [{ program: "rustup", args: ["target", "add", tripleUsed] }] : [];
+                /*
+                  Plain cargo for this machine's own target, and for the other Mac
+                  architecture on a Mac, which Xcode links. Anything else needs a
+                  linker for the other system: zig, or a container.
+                */
+                if (native || (host.os === "macos" && os_ === "macos")) {
+                    return {
+                        target, ok: true, route: native ? "native" : "cross", out,
+                        how: `cargo build --target ${triple}`,
+                        steps: [...pre, ...addTarget(triple), { program: "cargo", args: ["build", "--release", "--target", triple, ...extra] }, built(triple)],
+                    };
+                }
+                const gnu = os_ === "windows" ? triple.replace("-msvc", "-gnu") : triple;
+                if (tools.zigbuild && !(os_ === "windows" && arch === "arm64")) {
+                    return {
+                        target, ok: true, route: "cross", out,
+                        how: `cargo zigbuild --target ${gnu}${os_ === "macos" ? " (pure-Rust crates; system frameworks need a Mac)" : ""}`,
+                        steps: [...pre, ...addTarget(gnu), { program: "cargo", args: ["zigbuild", "--release", "--target", gnu, ...extra] }, built(gnu)],
+                    };
+                }
+                if (tools.cross && tools.docker && os_ !== "macos") {
+                    return {
+                        target, ok: true, route: "docker", out,
+                        how: `cross build --target ${gnu}`,
+                        steps: [...pre, { program: "cross", args: ["build", "--release", "--target", gnu, ...extra] }, built(gnu)],
+                    };
+                }
+                return {
+                    target, ok: false,
+                    why: os_ === "macos"
+                        ? `needs cargo-zigbuild (cargo install cargo-zigbuild, plus zig) to cross-compile, or ${NEEDS("macos")}`
+                        : "needs cargo-zigbuild (cargo install cargo-zigbuild, plus zig), or cross with Docker running",
+                };
+            }
+            case "electron": {
+                /* Only the container installs its own; this machine's must already be there. */
+                const local = os_ === "macos" || sameOs || (os_ === "windows" && tools.wine);
+                if (project.hasBuilder === false && local) {
+                    return { target, ok: false, why: "electron-builder is not installed here; run npm install first" };
+                }
+                const flag = os_ === "windows" ? "--win" : os_ === "macos" ? "--mac" : "--linux";
+                const builder = ["electron-builder", flag, `--${arch}`, "--publish", "never", ...extra];
+                const outputFlag = (dir) => `--config.directories.output=${dir}`;
+                if (os_ === "macos") {
+                    if (host.os !== "macos") {
+                        return { target, ok: false, why: `macOS apps are packaged and signed with tools only macOS has; ${NEEDS("macos")}` };
+                    }
+                    return {
+                        target, ok: true, route: native ? "native" : "cross", out, how: `electron-builder ${flag} --${arch}`,
+                        steps: [...pre, { program: node_process_1.default.execPath, args: [node_path_1.default.join(project.folder, "node_modules", "electron-builder", "cli.js"), ...builder.slice(1), outputFlag(out)] }],
+                    };
+                }
+                /*
+                  Linux from Windows needs no container. electron-builder packages a
+                  Linux app on Windows by itself; what it cannot do is mark anything
+                  executable, because Windows has no such bit, so every program in
+                  the archive arrives as a plain file. The archive is fixed up after.
+                  A tar.gz only: AppImage needs symlinks and Linux tools, deb needs fpm.
+                */
+                if (os_ === "linux" && host.os === "windows") {
+                    return {
+                        target, ok: true, route: "cross", out,
+                        how: `electron-builder --linux tar.gz --${arch} on Windows, executables marked afterwards (AppImage and deb need Linux)`,
+                        steps: [
+                            ...pre,
+                            {
+                                program: node_process_1.default.execPath,
+                                args: [node_path_1.default.join(project.folder, "node_modules", "electron-builder", "cli.js"), "--linux", "tar.gz", `--${arch}`, "--publish", "never", ...extra, outputFlag(out)],
+                            },
+                            { fixTarModes: outAbs },
+                        ],
+                    };
+                }
+                const nativeOk = sameOs || (os_ === "windows" && host.os !== "windows" && tools.wine);
+                if (nativeOk) {
+                    return {
+                        target, ok: true, route: sameOs ? (native ? "native" : "cross") : "cross", out,
+                        how: `electron-builder ${flag} --${arch}${!sameOs ? " with wine" : ""}`,
+                        steps: [...pre, { program: node_process_1.default.execPath, args: [node_path_1.default.join(project.folder, "node_modules", "electron-builder", "cli.js"), ...builder.slice(1), outputFlag(out)] }],
+                    };
+                }
+                if (!tools.docker) {
+                    return { target, ok: false, why: `needs Docker running (electronuserland/builder${os_ === "windows" ? ":wine" : ""}), or ${NEEDS(os_)}` };
+                }
+                const image = os_ === "windows" ? "electronuserland/builder:wine" : "electronuserland/builder";
+                const inner = [
+                    "npm ci",
+                    before,
+                    `npx --no-install ${builder.join(" ")} ${outputFlag(out.replace(/\\/g, "/"))}`,
+                ].filter(Boolean).join(" && ");
+                return {
+                    target, ok: true, route: "docker", out, how: `electron-builder ${flag} --${arch} in ${image}`,
+                    steps: [inDocker(project, image, inner, [
+                            /* This machine's node_modules are for this machine; the container keeps its own. */
+                            `coderook-build-${project.name}-node-modules:/project/node_modules`,
+                            "coderook-build-electron-cache:/root/.cache/electron",
+                            "coderook-build-electron-builder-cache:/root/.cache/electron-builder",
+                        ])],
+                };
+            }
+            case "pyinstaller": {
+                if (!project.entry)
+                    return { target, ok: false, why: `no entry point; set "entry" in ${CONFIG_FILE}` };
+                const work = node_path_1.default.join("build", "coderook", target);
+                const flags = (dist, workDir, specDir) => project.entry.endsWith(".spec")
+                    ? ["--noconfirm", "--distpath", dist, "--workpath", workDir, ...extra, project.entry]
+                    : ["--noconfirm", "--onefile", "--name", `${project.name}-${target}`, "--distpath", dist, "--workpath", workDir, "--specpath", specDir, ...extra, project.entry];
+                if (native) {
+                    if (!tools.pyinstaller)
+                        return portable() ?? missing("PyInstaller (pip install pyinstaller)");
+                    return {
+                        target, ok: true, route: "native", out, how: "pyinstaller",
+                        steps: [...pre, { program: "pyinstaller", args: flags(outAbs, node_path_1.default.join(project.folder, work), node_path_1.default.join(project.folder, "build", "coderook")) }],
+                    };
+                }
+                /* PyInstaller cannot cross-compile; Linux on x64 can still be reached from here. */
+                if (target === "linux-x64" && host.arch === "x64") {
+                    const unix = (value) => value.replace(/\\/g, "/");
+                    const requirements = (0, node_fs_1.existsSync)(node_path_1.default.join(project.folder, "requirements.txt")) ? "pip install -q -r requirements.txt && " : "";
+                    if (tools.docker) {
+                        const inner = `${before ? `${before} && ` : ""}pip install -q pyinstaller && ${requirements}pyinstaller ${flags(unix(out), unix(work), "build/coderook").map(sq).join(" ")}`;
+                        return {
+                            target, ok: true, route: "docker", out, how: "pyinstaller in python:3.12 (Debian)",
+                            steps: [inDocker(project, "python:3.12", inner, ["coderook-build-pip-cache:/root/.cache/pip"])],
+                        };
+                    }
+                    if (tools.wslPython) {
+                        const inner = `cd ${sq(wslPath(project.folder))} && ${before ? `${before} && ` : ""}python3 -m PyInstaller ${flags(unix(out), unix(work), "build/coderook").map(sq).join(" ")}`;
+                        return {
+                            target, ok: true, route: "wsl", out, how: "pyinstaller in WSL",
+                            steps: [{ program: "wsl", args: ["-e", "sh", "-lc", inner] }],
+                        };
+                    }
+                    return portable() ?? { target, ok: false, why: `PyInstaller builds only for the system it runs on; needs Docker running, or WSL with PyInstaller, or ${NEEDS("linux")}` };
+                }
+                return portable() ?? { target, ok: false, why: `PyInstaller builds only for the system it runs on; ${NEEDS(os_)}` };
+            }
+            case "python": {
+                if (!project.entry)
+                    return { target, ok: false, why: `no entry point; set "entry" in ${CONFIG_FILE}` };
+                return portable() ?? missing("uv, or Python with pip (https://docs.astral.sh/uv)");
+            }
+            case "custom": {
+                if (!project.config.command)
+                    return { target, ok: false, why: `"custom" needs a "command" in ${CONFIG_FILE}` };
+                const fill = (text, outPath) => text.replace(/\{target\}/g, target).replace(/\{os\}/g, os_).replace(/\{arch\}/g, arch).replace(/\{out\}/g, outPath);
+                const image = project.config.docker?.[target];
+                if (image) {
+                    if (!tools.docker)
+                        return { target, ok: false, why: `needs Docker running for ${image}` };
+                    const unixOut = out.replace(/\\/g, "/");
+                    return {
+                        target, ok: true, route: "docker", out, how: `${project.config.command} in ${image}`,
+                        steps: [inDocker(project, image, [before, fill(project.config.command, unixOut)].filter(Boolean).join(" && "))],
+                    };
+                }
+                return {
+                    target, ok: true, route: native ? "native" : "cross", out, how: project.config.command,
+                    steps: [...pre, { shell: fill(project.config.command, out), env: { CODEROOK_TARGET: target, CODEROOK_OS: os_, CODEROOK_ARCH: arch, CODEROOK_OUT: out } }],
+                };
+            }
+            default:
+                return { target, ok: false, why: `no toolchain recognised here; set "preset" in ${CONFIG_FILE}` };
+        }
+    });
+}
+/* ---------------------------------------------------------------- run */
+/** What a command prints, or null when it does not run. */
+function output(program, args) {
+    return new Promise((done) => {
+        let text = "";
+        const child = (0, node_child_process_1.spawn)(program, args, { windowsHide: true });
+        child.stdout.on("data", (chunk) => (text += chunk));
+        child.on("error", () => done(null));
+        child.on("exit", (code) => done(code === 0 ? text.trim() : null));
+    });
+}
+/**
+ * Mark the programs in a tar archive executable: Linux ELF binaries and
+ * scripts with a `#!` line. Each entry's mode is rewritten in its header and
+ * the header checksum recomputed; nothing else in the archive moves.
+ */
+function markExecutables(archive) {
+    const out = Buffer.from(archive);
+    const marked = [];
+    let at = 0;
+    while (at + 512 <= out.length) {
+        const header = out.subarray(at, at + 512);
+        if (header.every((byte) => byte === 0))
+            break;
+        const field = (start, length) => header.subarray(start, start + length).toString("utf8").replace(/\0.*$/s, "");
+        const size = parseInt(field(124, 12).trim() || "0", 8);
+        const type = String.fromCharCode(header[156] ?? 48);
+        const body = out.subarray(at + 512, at + 512 + Math.min(size, 4));
+        const program = (body[0] === 0x7f && body.toString("latin1", 1, 4) === "ELF") || body.toString("latin1", 0, 2) === "#!";
+        if ((type === "0" || type === "\0") && program) {
+            const mode = parseInt(field(100, 8).trim() || "0", 8);
+            const wanted = mode | 0o755;
+            if (wanted !== mode) {
+                header.write(`${wanted.toString(8).padStart(7, "0")}\0`, 100, 8, "latin1");
+                header.fill(0x20, 148, 156);
+                let sum = 0;
+                for (const byte of header)
+                    sum += byte;
+                header.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "latin1");
+                const prefix = field(345, 155);
+                marked.push(prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
+            }
+        }
+        at += 512 + Math.ceil(size / 512) * 512;
+    }
+    return { archive: out, marked };
+}
+async function fixTarModes(folder) {
+    for (const name of await (0, promises_1.readdir)(folder).catch(() => [])) {
+        if (!name.endsWith(".tar.gz"))
+            continue;
+        const file = node_path_1.default.join(folder, name);
+        const { archive, marked } = markExecutables((0, node_zlib_1.gunzipSync)(await (0, promises_1.readFile)(file)));
+        if (!marked.length)
+            continue;
+        await (0, promises_1.writeFile)(file, (0, node_zlib_1.gzipSync)(archive, { level: 9 }));
+        console.log(dim(`Marked ${marked.length} program${marked.length === 1 ? "" : "s"} executable in ${name}.`));
+    }
+    return 0;
+}
+/** The one file at `name` in a tar archive, read without unpacking the rest. */
+function fileFromTar(archive, name) {
+    let at = 0;
+    while (at + 512 <= archive.length) {
+        const header = archive.subarray(at, at + 512);
+        if (header.every((byte) => byte === 0))
+            break;
+        const field = (start, length) => header.subarray(start, start + length).toString("utf8").replace(/\0.*$/s, "");
+        const prefix = field(345, 155);
+        const entry = prefix ? `${prefix}/${field(0, 100)}` : field(0, 100);
+        const size = parseInt(field(124, 12).trim() || "0", 8);
+        if (entry === name)
+            return archive.subarray(at + 512, at + 512 + size);
+        at += 512 + Math.ceil(size / 512) * 512;
+    }
+    return null;
+}
+async function fetchBunRuntime(target, to) {
+    const version = await output("bun", ["--version"]);
+    if (!version) {
+        console.error(red("Could not ask bun for its version."));
+        return 1;
+    }
+    const marker = `${to}.version`;
+    if ((0, node_fs_1.existsSync)(to) && (await (0, promises_1.readFile)(marker, "utf8").catch(() => "")) === version)
+        return 0;
+    const pkg = `bun-${osOf(target) === "macos" ? "darwin" : osOf(target)}-${archOf(target) === "arm64" ? "aarch64" : "x64"}`;
+    console.log(dim(`Fetching Bun ${version}'s runtime for ${target} (@oven/${pkg})…`));
+    try {
+        const meta = (await (await fetch(`https://registry.npmjs.org/@oven/${pkg}/${version}`)).json());
+        if (!meta.dist?.tarball || !meta.dist.integrity?.startsWith("sha512-"))
+            throw new Error("npm did not describe the package");
+        const tarball = Buffer.from(await (await fetch(meta.dist.tarball)).arrayBuffer());
+        const digest = `sha512-${(0, node_crypto_1.createHash)("sha512").update(tarball).digest("base64")}`;
+        if (digest !== meta.dist.integrity)
+            throw new Error("the download does not match npm's digest");
+        const binary = fileFromTar((0, node_zlib_1.gunzipSync)(tarball), `package/bin/bun${exe(target)}`);
+        if (!binary)
+            throw new Error("the package holds no runtime");
+        await (0, promises_1.mkdir)(node_path_1.default.dirname(to), { recursive: true });
+        await (0, promises_1.writeFile)(to, binary, { mode: 0o755 });
+        await (0, promises_1.writeFile)(marker, version);
+        return 0;
+    }
+    catch (error) {
+        console.error(red(`Could not fetch Bun's runtime for ${target}: ${error instanceof Error ? error.message : String(error)}`));
+        return 1;
+    }
+}
+/** The project being built, for the steps that need more than a command line. */
+let building = null;
+async function runPortable(step) {
+    if (!building?.entry)
+        return 1;
+    try {
+        await (0, portable_python_js_1.buildPortablePython)({
+            folder: building.folder,
+            target: step.target,
+            name: building.name,
+            entry: building.entry,
+            ...(building.config.python ? { python: building.config.python } : {}),
+            ...(building.config.gui ? { gui: true } : {}),
+            outFolder: step.out,
+            cache: cacheDirectory(),
+            say: (text) => console.log(dim(text)),
+        });
+        return 0;
+    }
+    catch (error) {
+        console.error(red(error instanceof Error ? error.message : String(error)));
+        return 1;
+    }
+}
+function run(step, cwd) {
+    if ("portablePython" in step)
+        return runPortable(step.portablePython);
+    if ("bunRuntime" in step)
+        return fetchBunRuntime(step.bunRuntime.target, step.bunRuntime.to);
+    if ("fixTarModes" in step)
+        return fixTarModes(step.fixTarModes);
+    if ("copy" in step) {
+        return (async () => {
+            try {
+                await (0, promises_1.mkdir)(node_path_1.default.dirname(step.copy.to), { recursive: true });
+                await (0, promises_1.copyFile)(step.copy.from, step.copy.to);
+                return 0;
+            }
+            catch (error) {
+                console.error(red(`Could not find the built file: ${step.copy.from}`));
+                console.error(dim(`  ${error instanceof Error ? error.message : String(error)}`));
+                return 1;
+            }
+        })();
+    }
+    return new Promise((done) => {
+        const env = { ...node_process_1.default.env, ...(step.env ?? {}) };
+        const child = "shell" in step
+            ? (0, node_child_process_1.spawn)(step.shell, { cwd, env, stdio: "inherit", shell: true })
+            /*
+              Never through a shell: it joins arguments without quoting them, so a
+              path with a space in it splits. Electron's builder is started by its
+              own script under this Node for the same reason, rather than by npx,
+              which on Windows is a .cmd that only a shell can run.
+            */
+            : (0, node_child_process_1.spawn)(step.program, step.args, { cwd, env, stdio: "inherit" });
+        child.on("error", (error) => {
+            console.error(red(`${"shell" in step ? step.shell : step.program}: ${error.message}`));
+            done(1);
+        });
+        child.on("exit", (code) => done(code ?? 1));
+    });
+}
+/** The files a target produced, at the top of its folder. */
+async function outputsOf(folder) {
+    const found = [];
+    for (const entry of await (0, promises_1.readdir)(folder, { withFileTypes: true }).catch(() => [])) {
+        if (!entry.isFile())
+            continue;
+        /* electron-builder's own bookkeeping; CodeRook's update feed writes its own. */
+        if (/\.(yml|yaml|blockmap|pdb|dbg)$/i.test(entry.name))
+            continue;
+        const full = node_path_1.default.join(folder, entry.name);
+        found.push({ file: full, size: (await (0, promises_1.stat)(full)).size });
+    }
+    return found;
+}
+const human = (bytes) => bytes > 1024 ** 2 ? `${(bytes / 1024 ** 2).toFixed(1)} MB` : `${Math.max(1, Math.round(bytes / 1024))} KB`;
+/* ------------------------------------------------------------ command */
+async function commandBuild(parsed) {
+    const folder = node_path_1.default.resolve(parsed.positional[0] === "init" ? (parsed.positional[1] ?? node_process_1.default.cwd()) : (parsed.positional[0] ?? node_process_1.default.cwd()));
+    const flag = (name) => parsed.flags.get(name);
+    if (parsed.positional[0] === "init")
+        return initConfig(folder);
+    let project;
+    try {
+        project = await describeProject(folder);
+    }
+    catch (error) {
+        console.error(red(error instanceof Error ? error.message : String(error)));
+        return 1;
+    }
+    const presetFlag = flag("preset");
+    if (typeof presetFlag === "string")
+        project = { ...project, preset: presetFlag };
+    if (!project.preset) {
+        console.error(red("No toolchain recognised in this folder."));
+        console.error(dim(`  Looked for go.mod, Cargo.toml, a .csproj, electron-builder, deno.json, a Bun lockfile, a PyInstaller .spec and Python files.`));
+        console.error(dim(`  Say which with ${accent("--preset <go|bun|deno|rust|dotnet|electron|pyinstaller|python>")}, or describe it in ${CONFIG_FILE} (${accent("cbx build init")}).`));
+        return 1;
+    }
+    let targets;
+    try {
+        const asked = flag("target") ?? flag("t");
+        targets = typeof asked === "string"
+            ? parseTargets(asked)
+            : project.config.targets?.length
+                ? parseTargets(project.config.targets.join(","))
+                : exports.DEFAULT_TARGETS;
+    }
+    catch (error) {
+        console.error(red(error instanceof Error ? error.message : String(error)));
+        return 1;
+    }
+    building = project;
+    const host = thisHost();
+    console.log(dim(`Checking what this ${host.os} ${host.arch} machine can build with…`));
+    const tools = await detectTools(host);
+    const plan = planBuild(project, host, tools, targets);
+    console.log(`${bold(project.name)} ${dim(`(${project.preset})`)}`);
+    const width = Math.max(...plan.map((one) => one.target.length));
+    for (const one of plan) {
+        console.log(one.ok
+            ? `  ${accent(one.target.padEnd(width))}  ${one.route.padEnd(6)}  ${dim(one.how)}`
+            : `  ${red(one.target.padEnd(width))}  ${"no".padEnd(6)}  ${dim(one.why)}`);
+    }
+    if (parsed.flags.has("plan") || parsed.flags.has("dry-run") || parsed.flags.has("n")) {
+        console.log(dim("Nothing was built."));
+        return 0;
+    }
+    /* Kept out of git as the link beside it is, without touching .gitignore. */
+    if (!project.config.out) {
+        await (0, promises_1.mkdir)(node_path_1.default.join(folder, ".coderook"), { recursive: true });
+        if (!(0, node_fs_1.existsSync)(node_path_1.default.join(folder, ".coderook", ".gitignore"))) {
+            await (0, promises_1.writeFile)(node_path_1.default.join(folder, ".coderook", ".gitignore"), "*\n");
+        }
+    }
+    const results = [];
+    for (const one of plan) {
+        if (!one.ok)
+            continue;
+        console.log(`\n${bold(`Building ${one.target}`)} ${dim(`— ${one.how}`)}`);
+        const outAbs = node_path_1.default.join(folder, one.out);
+        await (0, promises_1.rm)(outAbs, { recursive: true, force: true });
+        await (0, promises_1.mkdir)(outAbs, { recursive: true });
+        let code = 0;
+        for (const step of one.steps) {
+            code = await run(step, folder);
+            if (code !== 0)
+                break;
+        }
+        const files = code === 0 ? await outputsOf(outAbs) : [];
+        results.push({ target: one.target, ok: code === 0 && files.length > 0, files });
+        if (code === 0 && !files.length)
+            console.error(red(`${one.target}: the build finished but left nothing in ${one.out}.`));
+    }
+    console.log(`\n${bold("Built")}`);
+    for (const one of plan) {
+        const result = results.find((each) => each.target === one.target);
+        if (!one.ok) {
+            console.log(`  ${red("✗")} ${one.target.padEnd(width)}  ${dim(`not here: ${one.why}`)}`);
+        }
+        else if (!result?.ok) {
+            console.log(`  ${red("✗")} ${one.target.padEnd(width)}  ${red("failed")}`);
+        }
+        else {
+            for (const [at, output] of result.files.entries()) {
+                console.log(`  ${at ? " " : green("✓")} ${(at ? "" : one.target).padEnd(width)}  ${node_path_1.default.relative(folder, output.file)} ${dim(human(output.size))}`);
+            }
+        }
+    }
+    const failed = results.filter((one) => !one.ok).length;
+    if (parsed.flags.has("ship") && results.some((one) => one.ok)) {
+        if (failed) {
+            console.error(red("\nNothing was attached: a build failed, and a release missing a platform is worse than a late one."));
+            return 1;
+        }
+        const { commandAttach } = await Promise.resolve().then(() => __importStar(require("./attach_command.js")));
+        for (const result of results) {
+            for (const output of result.files) {
+                const base = node_path_1.default.basename(output.file);
+                const named = base.includes(result.target) || /win|linux|mac|darwin|osx/i.test(base)
+                    ? base
+                    : `${node_path_1.default.parse(base).name}-${result.target}${node_path_1.default.parse(base).ext}`;
+                const code = await commandAttach({
+                    positional: [output.file],
+                    flags: new Map([["name", named]]),
+                });
+                if (code !== 0)
+                    return code;
+            }
+        }
+    }
+    if (failed)
+        return 1;
+    return results.length ? 0 : 1;
+}
+async function initConfig(folder) {
+    const file = node_path_1.default.join(folder, CONFIG_FILE);
+    if ((0, node_fs_1.existsSync)(file)) {
+        console.error(red(`${CONFIG_FILE} already exists here.`));
+        return 1;
+    }
+    const project = await describeProject(folder);
+    const config = {
+        preset: project.preset ?? "custom",
+        name: project.name,
+        ...(project.entry ? { entry: project.entry } : {}),
+        targets: exports.DEFAULT_TARGETS,
+        ...(project.preset ? {} : { command: "echo describe how to build {target} into {out}" }),
+    };
+    await (0, promises_1.writeFile)(file, `${JSON.stringify(config, null, 2)}\n`);
+    console.log(`Wrote ${CONFIG_FILE} ${dim(`(${config.preset}${project.preset ? ", recognised from the files here" : ", fill in the command"})`)}.`);
+    console.log(dim(`  ${accent("cbx build --plan")} shows what this machine can build from it.`));
+    return 0;
+}