@cydm/pie 1.0.51 → 2.1.0

package/dist/builtin/extensions/computer-use/scripts/setup-helper.mjs

@@ -0,0 +1,549 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { spawn, execFile as execFileCallback } from "node:child_process";
+import { constants as fsConstants, realpathSync } from "node:fs";
+import { promisify } from "node:util";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveMacosHelperAppPath } from "./helper-path.mjs";
+
+const execFile = promisify(execFileCallback);
+const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const helperAppPath = resolveMacosHelperAppPath();
+const helperAppExecutablePath = path.join(helperAppPath, "Contents", "MacOS", "pie-computer-use");
+const helperSourceHashPath = path.join(helperAppPath, "Contents", "Resources", "source.sha256");
+const helperBundleId = "com.pie.computer-use";
+const windowsCrateDir = path.join(rootDir, "native", "windows", "bridge-rs");
+const windowsHelperDestPath = process.env.PIE_COMPUTER_USE_WINDOWS_HELPER_PATH || path.join(resolvePieConfigDir(), "helpers", "computer-use", "windows-bridge.exe");
+const linuxCrateDir = path.join(rootDir, "native", "linux", "bridge-rs");
+const linuxHelperDestPath = process.env.PIE_COMPUTER_USE_LINUX_HELPER_PATH || path.join(resolvePieConfigDir(), "helpers", "computer-use", "linux-bridge");
+const helperSourcePaths = ["agent_cursor.swift", "agent_cursor_motion.swift", "bridge.swift"]
+	.map((file) => path.join(rootDir, "native", "macos", file));
+const packageJsonPath = path.join(rootDir, "package.json");
+const localCodeSignCommonName = "pie-computer-use Local Signing (com.pie.computer-use)";
+const localSigningLockPath = path.join(os.tmpdir(), `pie-computer-use-local-signing-${typeof process.getuid === "function" ? process.getuid() : "user"}.lock`);
+
+const args = new Set(process.argv.slice(2));
+
+/** Mirror of products/cli/src/config.ts getConfigDir() for standalone .mjs use. */
+function resolvePieConfigDir() {
+	const envDir = process.env.PIE_CODING_AGENT_DIR;
+	if (envDir) {
+		if (envDir === "~") return os.homedir();
+		if (envDir.startsWith("~/")) return os.homedir() + envDir.slice(1);
+		return envDir;
+	}
+	return path.join(os.homedir(), ".pie");
+}
+const isPostinstall = args.has("--postinstall");
+const allowBuildFallback = args.has("--allow-build") || args.has("--runtime") || process.env.PIE_COMPUTER_USE_ALLOW_BUILD === "1";
+// Windows matches Linux: a first-tool-call runtime install must not trigger a
+// full cargo source build (it far exceeds the 60s setup timeout); require an
+// explicit --allow-build / PIE_COMPUTER_USE_ALLOW_BUILD=1 for that.
+const allowWindowsBuildFallback = args.has("--allow-build") || process.env.PIE_COMPUTER_USE_ALLOW_BUILD === "1";
+const allowLinuxBuildFallback = args.has("--allow-build") || process.env.PIE_COMPUTER_USE_ALLOW_BUILD === "1";
+const allowAdhocUpdate = args.has("--allow-adhoc-update") || process.env.PIE_COMPUTER_USE_ALLOW_ADHOC_UPDATE === "1";
+
+function getArg(name) {
+	const index = process.argv.indexOf(name);
+	if (index >= 0 && index + 1 < process.argv.length) return process.argv[index + 1];
+	return undefined;
+}
+const archTriples = {
+	arm64: "arm64-apple-macosx",
+	x64: "x86_64-apple-macosx",
+};
+const deploymentTarget = "14.0";
+const frameworks = ["ApplicationServices", "AppKit", "ScreenCaptureKit", "Foundation", "SwiftUI"];
+const defaultCodeSignIdentifier = "com.pie.computer-use";
+
+function normalizeArch(arch) {
+	if (arch === "arm64" || arch === "x64") return arch;
+	throw new Error(`Unsupported architecture '${arch}'. Supported: arm64, x64.`);
+}
+
+function prebuiltPathForArch(arch) {
+	return path.join(rootDir, "prebuilt", "macos", arch, "pie-computer-use");
+}
+
+function prebuiltAppPathForArch(arch) {
+	return path.join(rootDir, "prebuilt", "macos", arch, "pie-computer-use.app");
+}
+
+async function packageVersion() {
+	const packageJson = JSON.parse(await fs.readFile(packageJsonPath, "utf8"));
+	if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+		throw new Error(`Could not read package version from ${packageJsonPath}.`);
+	}
+	return packageJson.version;
+}
+
+async function exists(filePath) {
+	try {
+		await fs.access(filePath, fsConstants.F_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+async function hashFile(filePath) {
+	const data = await fs.readFile(filePath);
+	return createHash("sha256").update(data).digest("hex");
+}
+
+async function copyIfChanged(sourcePath, destinationPath) {
+	const destinationExists = await exists(destinationPath);
+	if (destinationExists) {
+		const [sourceHash, destinationHash] = await Promise.all([hashFile(sourcePath), hashFile(destinationPath)]);
+		if (sourceHash === destinationHash) {
+			await fs.chmod(destinationPath, 0o755);
+			return { changed: false };
+		}
+	}
+
+	await fs.mkdir(path.dirname(destinationPath), { recursive: true });
+	const tempPath = `${destinationPath}.tmp-${process.pid}-${Date.now()}`;
+	await fs.copyFile(sourcePath, tempPath);
+	await fs.chmod(tempPath, 0o755);
+	try {
+		await fs.rename(tempPath, destinationPath);
+	} catch (err) {
+		await fs.rm(tempPath, { force: true }).catch(() => {});
+		if (err.code === "EPERM") {
+			throw new Error(`Cannot update helper at ${destinationPath} — the existing helper process is still running. Close the helper process and re-run this script.`);
+		}
+		throw err;
+	}
+	return { changed: true };
+}
+
+async function run(command, commandArgs) {
+	await new Promise((resolve, reject) => {
+		const child = spawn(command, commandArgs, { stdio: "inherit" });
+		child.on("error", reject);
+		child.on("close", (code) => {
+			if (code === 0) {
+				resolve();
+				return;
+			}
+			reject(new Error(`Command failed (${code}): ${command} ${commandArgs.join(" ")}`));
+		});
+	});
+}
+
+function moduleCachePath(arch) {
+	return path.join(os.tmpdir(), `pie-computer-use-swift-module-cache-${arch}`);
+}
+
+async function commandOutput(command, commandArgs) {
+	const { stdout } = await execFile(command, commandArgs, { encoding: "utf8" });
+	return stdout;
+}
+
+async function findDeveloperIdIdentity() {
+	const output = await commandOutput("security", ["find-identity", "-p", "codesigning", "-v"]).catch(() => "");
+	const line = output.split("\n").find((item) => item.includes("Developer ID Application"));
+	return line?.trim().split(/\s+/)[1];
+}
+
+export function parseCodeSigningIdentities(output, commonName = localCodeSignCommonName) {
+	return output.split("\n")
+		.map((line) => line.match(/^\s*\d+\)\s+([0-9A-F]{40})\s+"([^"]+)"/i))
+		.filter((match) => match?.[2] === commonName)
+		.map((match) => match[1].toUpperCase());
+}
+
+async function findLocalSigningIdentity() {
+	// Self-signed local identities appear as CSSMERR_TP_NOT_TRUSTED and are
+	// omitted by `-v`, but remain valid inputs to codesign. Match the identity
+	// list directly and return its fingerprint rather than its display name.
+	const output = await commandOutput("security", ["find-identity", "-p", "codesigning"]).catch(() => "");
+	return parseCodeSigningIdentities(output)[0];
+}
+
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export async function withDirectoryLock(lockPath, callback, { waitMs = 15_000, staleMs = 300_000, retryMs = 50 } = {}) {
+	const deadline = Date.now() + waitMs;
+	while (true) {
+		try {
+			await fs.mkdir(lockPath);
+			break;
+		} catch (error) {
+			if (error?.code !== "EEXIST") throw error;
+			const stat = await fs.stat(lockPath).catch(() => undefined);
+			if (stat && Date.now() - stat.mtimeMs > staleMs) {
+				await fs.rm(lockPath, { force: true, recursive: true }).catch(() => undefined);
+				continue;
+			}
+			if (Date.now() >= deadline) throw new Error(`Timed out waiting for local signing identity lock at ${lockPath}.`);
+			await delay(retryMs);
+		}
+	}
+	try {
+		return await callback();
+	} finally {
+		await fs.rm(lockPath, { force: true, recursive: true }).catch(() => undefined);
+	}
+}
+
+export async function ensureIdentityOnce(findIdentity, createIdentity, withLock) {
+	return (await findIdentity()) ?? await withLock(async () => (await findIdentity()) ?? await createIdentity());
+}
+
+async function loginKeychainPath() {
+	for (const candidate of [
+		path.join(os.homedir(), "Library", "Keychains", "login.keychain-db"),
+		path.join(os.homedir(), "Library", "Keychains", "login.keychain"),
+	]) {
+		if (await exists(candidate)) return candidate;
+	}
+	return undefined;
+}
+
+async function ensureLocalSigningIdentity() {
+	if (process.platform !== "darwin") return undefined;
+	if (!(await commandOutput("which", ["codesign"]).catch(() => ""))) return undefined;
+	const existingIdentity = await findLocalSigningIdentity();
+	if (existingIdentity) return existingIdentity;
+	if (!(await commandOutput("which", ["openssl"]).catch(() => ""))) return undefined;
+	const keychain = await loginKeychainPath();
+	if (!keychain) return undefined;
+
+	return await ensureIdentityOnce(findLocalSigningIdentity, createLocalSigningIdentity, (callback) => withDirectoryLock(localSigningLockPath, callback));
+}
+
+async function createLocalSigningIdentity() {
+	const keychain = await loginKeychainPath();
+	if (!keychain) return undefined;
+	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "pie-computer-use-signing-"));
+	const password = `pie-computer-use-local-${process.pid}-${Date.now()}`;
+	try {
+		const configPath = path.join(tempDir, "req.cnf");
+		await fs.writeFile(configPath, [
+			"[req]",
+			"distinguished_name=dn",
+			"x509_extensions=ext",
+			"prompt=no",
+			"[dn]",
+			`CN=${localCodeSignCommonName}`,
+			"[ext]",
+			"basicConstraints=critical,CA:FALSE",
+			"keyUsage=critical,digitalSignature",
+			"extendedKeyUsage=critical,codeSigning",
+			"",
+		].join("\n"));
+		const keyPath = path.join(tempDir, "key.pem");
+		const certPath = path.join(tempDir, "cert.pem");
+		const p12Path = path.join(tempDir, "id.p12");
+		await execFile("openssl", ["req", "-x509", "-newkey", "rsa:2048", "-keyout", keyPath, "-out", certPath, "-days", "3650", "-nodes", "-config", configPath]);
+		await execFile("openssl", ["pkcs12", "-export", "-legacy", "-inkey", keyPath, "-in", certPath, "-out", p12Path, "-passout", `pass:${password}`, "-name", localCodeSignCommonName])
+			.catch(async () => {
+				await execFile("openssl", ["pkcs12", "-export", "-inkey", keyPath, "-in", certPath, "-out", p12Path, "-passout", `pass:${password}`, "-name", localCodeSignCommonName]);
+			});
+		await execFile("security", ["import", p12Path, "-k", keychain, "-P", password, "-A", "-T", "/usr/bin/codesign"]);
+		const identity = await findLocalSigningIdentity();
+		if (!identity) throw new Error("Imported local signing certificate is not a valid code-signing identity.");
+		return identity;
+	} catch (error) {
+		console.warn(`[pie-computer-use] could not create a valid local signing identity: ${error instanceof Error ? error.message : String(error)}`);
+		return undefined;
+	} finally {
+		await fs.rm(tempDir, { force: true, recursive: true }).catch(() => {});
+	}
+}
+
+async function resolveCodeSignIdentity() {
+	if (process.env.PIE_COMPUTER_USE_CODESIGN_IDENTITY) return process.env.PIE_COMPUTER_USE_CODESIGN_IDENTITY;
+	return (await findDeveloperIdIdentity()) ?? (await ensureLocalSigningIdentity()) ?? "-";
+}
+
+async function signHelper(outputPath, identifier = defaultCodeSignIdentifier) {
+	if (process.env.PIE_COMPUTER_USE_NO_SIGN === "1") {
+		return "unsigned";
+	}
+
+	const identity = await resolveCodeSignIdentity();
+	const commandArgs = ["--force", "--deep", "-i", identifier, "--timestamp=none", "--sign", identity, outputPath];
+	await run("codesign", commandArgs);
+	if (identity === "-") {
+		console.warn("[pie-computer-use] warning: signed helper ad-hoc; macOS may require permission review after native helper changes. Release installs should use a Developer ID-signed helper app.");
+	} else if (identity === await findLocalSigningIdentity()) {
+		console.log(`[pie-computer-use] signed ${outputPath} with local identity '${localCodeSignCommonName}'. macOS may still require permission review after local rebuilds.`);
+	}
+	return identity;
+}
+
+async function helperHasAdhocSignature() {
+	const output = await execFile("codesign", ["-dv", "--verbose=4", helperAppPath], { encoding: "utf8" }).then(
+		(result) => `${result.stdout ?? ""}\n${result.stderr ?? ""}`,
+		(error) => `${error.stdout ?? ""}\n${error.stderr ?? ""}`,
+	);
+	return /Signature=adhoc/i.test(output);
+}
+
+async function registerHelperApp() {
+	// Tests run the installer against throwaway HOMEs; registering those
+	// copies pollutes the user's Launch Services database (and those names
+	// later surface in TCC dialogs). Tests opt out via this env var.
+	if (process.env.PIE_COMPUTER_USE_SKIP_LS_REGISTER === "1") return;
+	const lsregister = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
+	if (!(await exists(lsregister))) return;
+	await run(lsregister, ["-f", helperAppPath]).catch(() => {});
+}
+
+async function ensureHelperParentDirectory() {
+	const parentPath = path.dirname(helperAppPath);
+	await fs.mkdir(parentPath, { recursive: true });
+	await fs.access(parentPath, fsConstants.W_OK);
+}
+
+async function installPrebuiltHelperApp(sourceAppPath) {
+	await ensureHelperParentDirectory();
+	const sourceExecutablePath = path.join(sourceAppPath, "Contents", "MacOS", "pie-computer-use");
+	const sourceInfoPath = path.join(sourceAppPath, "Contents", "Info.plist");
+	const existingExecutable = await fs.readFile(helperAppExecutablePath).catch(() => undefined);
+	const sourceExecutable = await fs.readFile(sourceExecutablePath);
+	const existingInfo = await fs.readFile(path.join(helperAppPath, "Contents", "Info.plist"), "utf8").catch(() => undefined);
+	const sourceInfo = await fs.readFile(sourceInfoPath, "utf8");
+	if (existingExecutable?.equals(sourceExecutable) && existingInfo === sourceInfo) {
+		await registerHelperApp();
+		return false;
+	}
+	// The sealed bundle must arrive intact — a broken signature would burn
+	// the user's TCC grants on an identity that can never validate.
+	await run("codesign", ["--verify", "--strict", sourceAppPath]);
+	await fs.rm(helperAppPath, { force: true, recursive: true });
+	// ditto preserves the bundle byte-for-byte (signature + stapled
+	// notarization ticket). The sealed app is NEVER re-signed here: its
+	// Developer ID designated requirement (identifier + team) is exactly
+	// what gives release builds their best chance of retaining TCC grants.
+	await run("/usr/bin/ditto", [sourceAppPath, helperAppPath]);
+	await registerHelperApp();
+	return true;
+}
+
+async function installHelperApp(sourcePath) {
+	await ensureHelperParentDirectory();
+	const version = await packageVersion();
+	const infoPlistPath = path.join(helperAppPath, "Contents", "Info.plist");
+	const infoPlist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>CFBundleIdentifier</key><string>${helperBundleId}</string>
+<key>CFBundleName</key><string>pie-computer-use</string>
+<key>CFBundleDisplayName</key><string>pie-computer-use</string>
+<key>CFBundleExecutable</key><string>pie-computer-use</string>
+<key>CFBundlePackageType</key><string>APPL</string>
+<key>CFBundleShortVersionString</key><string>${version}</string>
+<key>CFBundleVersion</key><string>${version}</string>
+<key>LSMinimumSystemVersion</key><string>14.0</string>
+<key>LSUIElement</key><true/>
+</dict></plist>\n`;
+
+	const sourceExecutable = await fs.readFile(sourcePath);
+	const sourceHash = createHash("sha256").update(sourceExecutable).digest("hex");
+	const existingSourceHash = await fs.readFile(helperSourceHashPath, "utf8").catch(() => undefined);
+	const existingInfoPlist = await fs.readFile(infoPlistPath, "utf8").catch(() => undefined);
+	if (existingSourceHash?.trim() === sourceHash && existingInfoPlist === infoPlist) {
+		// If a real signing identity is available, upgrade older ad-hoc installs
+		// in place so local builds have a consistent identity. macOS may still
+		// require permission review after native code changes.
+		const signingIdentity = process.env.PIE_COMPUTER_USE_NO_SIGN === "1" ? "-" : await resolveCodeSignIdentity();
+		if (signingIdentity !== "-" && await helperHasAdhocSignature()) {
+			await signHelper(helperAppPath, helperBundleId);
+			await registerHelperApp();
+			return true;
+		}
+		await registerHelperApp();
+		return false;
+	}
+
+	const signingIdentity = process.env.PIE_COMPUTER_USE_NO_SIGN === "1" ? "-" : await resolveCodeSignIdentity();
+	if (signingIdentity === "-" && existingSourceHash !== undefined && !allowAdhocUpdate) {
+		throw new Error("Refusing to replace an installed helper with an ad-hoc signed rebuild because macOS may reset Accessibility/Screen Recording grants. Use a pre-signed helper app, install a Developer ID identity, or set PIE_COMPUTER_USE_ALLOW_ADHOC_UPDATE=1 for local development.");
+	}
+
+	await fs.mkdir(path.dirname(helperAppExecutablePath), { recursive: true });
+	await fs.mkdir(path.dirname(helperSourceHashPath), { recursive: true });
+	await fs.copyFile(sourcePath, helperAppExecutablePath);
+	await fs.chmod(helperAppExecutablePath, 0o755);
+	await fs.writeFile(infoPlistPath, infoPlist);
+	await fs.writeFile(helperSourceHashPath, `${sourceHash}\n`);
+	await signHelper(helperAppPath, helperBundleId);
+	await registerHelperApp();
+	return true;
+}
+
+async function buildHelper(arch, outputPath) {
+	for (const sourcePath of helperSourcePaths) {
+		if (!(await exists(sourcePath))) throw new Error(`Native helper source not found at ${sourcePath}`);
+	}
+
+	await fs.mkdir(path.dirname(outputPath), { recursive: true });
+	const swiftArgs = [
+		"swiftc",
+		"-target",
+		`${archTriples[arch]}${deploymentTarget}`,
+		"-module-cache-path",
+		moduleCachePath(arch),
+		"-O",
+	];
+	for (const framework of frameworks) swiftArgs.push("-framework", framework);
+	swiftArgs.push(...helperSourcePaths, "-o", outputPath);
+
+	await run("xcrun", swiftArgs);
+	await fs.chmod(outputPath, 0o755);
+	await signHelper(outputPath);
+}
+
+function windowsBinaryPath() {
+	const releaseDir = path.join(windowsCrateDir, "target", "release");
+	return {
+		exePath: path.join(releaseDir, "windows-bridge.exe"),
+		binPath: path.join(releaseDir, "windows-bridge"),
+	};
+}
+
+async function setupWindowsHelper() {
+	const prebuiltPath = path.join(rootDir, "prebuilt", "windows", "windows-bridge.exe");
+	if (await exists(prebuiltPath)) {
+		const { changed } = await copyIfChanged(prebuiltPath, windowsHelperDestPath);
+		console.log(changed
+			? `[pie-computer-use] installed Windows helper from prebuilt to ${windowsHelperDestPath}`
+			: `[pie-computer-use] Windows helper already up to date at ${windowsHelperDestPath}`);
+		return;
+	}
+
+	if (allowWindowsBuildFallback) {
+		console.log("[pie-computer-use] Windows prebuilt helper missing; attempting source build with cargo...");
+		await run("cargo", ["build", "--release", "--manifest-path", path.join(windowsCrateDir, "Cargo.toml")]);
+		const { exePath, binPath } = windowsBinaryPath();
+		const cargoOutput = (await exists(exePath)) ? exePath : (await exists(binPath)) ? binPath : exePath;
+		const { changed } = await copyIfChanged(cargoOutput, windowsHelperDestPath);
+		console.log(changed
+			? `[pie-computer-use] built and installed Windows helper at ${windowsHelperDestPath}`
+			: `[pie-computer-use] Windows helper already up to date at ${windowsHelperDestPath}`);
+		return;
+	}
+
+	throw new Error(
+		`No Windows prebuilt helper found at ${prebuiltPath}. ` +
+			"Reinstall Pie to restore the bundled helper. Source builds (node scripts/build-native.mjs --platform windows; needs cargo and the native/ sources) only work in a Pie source checkout, not in an installed copy; PIE_COMPUTER_USE_ALLOW_BUILD=1 enables that fallback at install time.",
+	);
+}
+
+async function setupLinuxHelper() {
+	const arch = normalizeArch(process.arch);
+	const prebuiltPath = path.join(rootDir, "prebuilt", "linux", arch, "linux-bridge");
+	if (await exists(prebuiltPath)) {
+		const { changed } = await copyIfChanged(prebuiltPath, linuxHelperDestPath);
+		console.log(changed ? `[pie-computer-use] installed Linux helper (${arch}) from prebuilt to ${linuxHelperDestPath}` : `[pie-computer-use] Linux helper already up to date at ${linuxHelperDestPath}`);
+		return;
+	}
+	if (allowLinuxBuildFallback) {
+		if (process.platform !== "linux") throw new Error("The Linux helper source fallback must be built on Linux.");
+		console.log("[pie-computer-use] Linux prebuilt helper missing; attempting source build with cargo...");
+		await run("cargo", ["build", "--release", "--manifest-path", path.join(linuxCrateDir, "Cargo.toml")]);
+		const cargoOutput = path.join(linuxCrateDir, "target", "release", "linux-bridge");
+		const { changed } = await copyIfChanged(cargoOutput, linuxHelperDestPath);
+		console.log(changed ? `[pie-computer-use] built and installed Linux helper at ${linuxHelperDestPath}` : `[pie-computer-use] Linux helper already up to date at ${linuxHelperDestPath}`);
+		return;
+	}
+	throw new Error(`No Linux prebuilt helper found for ${arch} at ${prebuiltPath}. Reinstall Pie to restore the bundled helper. Source builds (node scripts/build-native.mjs --platform linux; needs cargo and the native/ sources) only work in a Pie source checkout, not in an installed copy; PIE_COMPUTER_USE_ALLOW_BUILD=1 enables that fallback at install time.`);
+}
+
+async function setup() {
+	const explicitPlatform = getArg("--platform");
+	if (explicitPlatform === "windows" || (!explicitPlatform && process.platform === "win32")) {
+		await setupWindowsHelper();
+		return;
+	}
+	if (explicitPlatform === "linux" || (!explicitPlatform && process.platform === "linux")) {
+		await setupLinuxHelper();
+		return;
+	}
+
+	if (process.platform !== "darwin") {
+		if (isPostinstall) {
+			console.warn("[pie-computer-use] skipping helper setup: platform is not macOS.");
+			return;
+		}
+		throw new Error("pie-computer-use helper is supported on macOS, Windows, and Linux. Use the matching --platform option.");
+	}
+
+	const arch = normalizeArch(process.arch);
+	// Prefer the universal bundle (one artifact for both arches, built and
+	// signed with Pie's identity via build-native.mjs) over per-arch
+	// bundles, over loose binaries (dev fallback).
+	const universalAppPath = prebuiltAppPathForArch("universal");
+	const prebuiltAppPath = (await exists(universalAppPath))
+		? universalAppPath
+		: prebuiltAppPathForArch(arch);
+	const prebuiltPath = prebuiltPathForArch(arch);
+	const prebuiltAppExists = await exists(prebuiltAppPath);
+	const prebuiltExists = await exists(prebuiltPath);
+
+	if (prebuiltAppExists) {
+		const installed = await installPrebuiltHelperApp(prebuiltAppPath);
+		const bundleKind = prebuiltAppPath === universalAppPath ? "universal" : arch;
+		console.log(
+			installed
+				? `[pie-computer-use] installed pre-signed helper app (${bundleKind}) at ${helperAppPath}`
+				: `[pie-computer-use] pre-signed helper app (${bundleKind}) already current at ${helperAppPath}`,
+		);
+		return;
+	}
+
+	if (prebuiltExists) {
+		const installed = await installHelperApp(prebuiltPath);
+		console.log(
+			installed
+				? `[pie-computer-use] installed helper app (${arch}) at ${helperAppPath}`
+				: `[pie-computer-use] helper app (${arch}) already current at ${helperAppPath}`,
+		);
+		return;
+	}
+
+	if (allowBuildFallback) {
+		const tempPath = path.join(os.tmpdir(), `pie-computer-use-bridge-${process.pid}-${Date.now()}`);
+		try {
+			console.log("[pie-computer-use] prebuilt helper missing; attempting source build with xcrun swiftc...");
+			await buildHelper(arch, tempPath);
+			const installed = await installHelperApp(tempPath);
+			console.log(
+				installed
+					? `[pie-computer-use] built helper app at ${helperAppPath}`
+					: `[pie-computer-use] built helper app; installed app already current at ${helperAppPath}`,
+			);
+		} finally {
+			await fs.rm(tempPath, { force: true }).catch(() => {});
+		}
+		return;
+	}
+
+	throw new Error(
+		`No prebuilt helper found for ${arch} at ${prebuiltPath}. Reinstall Pie to restore the bundled helper. Source builds (node scripts/build-native.mjs --arch ${arch}; needs Xcode command line tools and the native/ Swift sources) only work in a Pie source checkout, not in an installed copy; PIE_COMPUTER_USE_ALLOW_BUILD=1 enables that fallback at install time.`,
+	);
+}
+
+const normalizeMainPath = (candidate) => {
+	const normalized = path.normalize(realpathSync(candidate));
+	return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+};
+const isMain = process.argv[1] && normalizeMainPath(path.resolve(process.argv[1])) === normalizeMainPath(fileURLToPath(import.meta.url));
+if (isMain) setup().catch((error) => {
+	if (isPostinstall) {
+		console.warn(`[pie-computer-use] postinstall helper setup skipped: ${error instanceof Error ? error.message : String(error)}`);
+		process.exit(0);
+	}
+
+	console.error(error instanceof Error ? error.message : String(error));
+	process.exit(1);
+});

package/dist/builtin/extensions/document-attachments/package.json

@@ -1,11 +1,11 @@
 {
-  "name": "@pie/extension-document-attachments",
-  "version": "1.0.0",
-  "description": "Local document attachment preprocessing (PDF, HTML, plain text)",
-  "main": "index.ts",
-  "type": "module",
-  "pie": {
-    "name": "document-attachments",
-    "main": "index.ts"
-  }
+	"name": "@pie/extension-document-attachments",
+	"version": "1.0.0",
+	"description": "Local document attachment preprocessing (PDF, HTML, plain text)",
+	"main": "index.js",
+	"type": "module",
+	"pie": {
+		"name": "document-attachments",
+		"main": "index.js"
+	}
 }

package/dist/builtin/extensions/init/package.json

@@ -1,11 +1,11 @@
 {
-  "name": "@pie/extension-init",
-  "version": "1.0.0",
-  "description": "Project initialization and root AGENTS.md management",
-  "main": "index.ts",
-  "type": "module",
-  "pie": {
-    "name": "init",
-    "main": "index.ts"
-  }
+	"name": "@pie/extension-init",
+	"version": "1.0.0",
+	"description": "Project initialization and root AGENTS.md management",
+	"main": "index.js",
+	"type": "module",
+	"pie": {
+		"name": "init",
+		"main": "index.js"
+	}
 }