@elizaos/app-core 2.0.0-beta.3 → 2.0.3-beta.3

package/scripts/assert-required-bundled-packages.test.ts

@@ -0,0 +1,555 @@
+/**
+ * Test for the `assertRequiredBundledPackagesLanded` defense-in-depth check.
+ *
+ * The function fails the desktop build when any package marked
+ * `alwaysBundled` (CORE_PLUGINS / OPTIONAL_CORE_PLUGINS / BASELINE_*) is
+ * missing its `package.json`, or a baseline package is missing its declared
+ * runtime entrypoint, in `dist/node_modules/` after the copy + prune phases.
+ * Companion safety net to the transitive-walk filter introduced with the
+ * fresh-clone build fixes — if a future refactor accidentally excludes a
+ * required package, the build fails loudly here instead of shipping a broken
+ * bundle.
+ */
+
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import {
+  assertRequiredBundledPackagesLanded,
+  getRuntimeDependencies,
+  getWorkspacePackageRuntimeCopyEntries,
+  selectCopyTargetNodeModules,
+  shouldCopyPackageEntry,
+  shouldCopyWorkspacePublishEntry,
+  shouldSkipPackagedDependency,
+} from "./copy-runtime-node-modules";
+
+let tmpDir: string;
+let nodeModulesDir: string;
+
+function writePackageJson(
+  name: string,
+  manifest: Record<string, unknown> = {},
+): string {
+  const dir = name.startsWith("@")
+    ? path.join(nodeModulesDir, ...name.split("/"))
+    : path.join(nodeModulesDir, name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify({ name, ...manifest }, null, 2),
+  );
+  return dir;
+}
+
+describe("assertRequiredBundledPackagesLanded", () => {
+  beforeEach(() => {
+    tmpDir = mkdtempSync(path.join(process.cwd(), ".tmp-assert-bundled-"));
+    nodeModulesDir = path.join(tmpDir, "node_modules");
+    mkdirSync(nodeModulesDir, { recursive: true });
+  });
+
+  afterEach(() => {
+    rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("passes when every required package has a package.json", () => {
+    writePackageJson("@elizaos/core");
+    writePackageJson("@elizaos/plugin-sql");
+    writePackageJson("react");
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/core", "@elizaos/plugin-sql", "react"]),
+      ),
+    ).not.toThrow();
+  });
+
+  it("passes on an empty alwaysBundled set", () => {
+    expect(() =>
+      assertRequiredBundledPackagesLanded(nodeModulesDir, new Set()),
+    ).not.toThrow();
+  });
+
+  it("throws when a scoped required package is missing", () => {
+    writePackageJson("@elizaos/core"); // present
+    // @elizaos/plugin-sql intentionally not written
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/core", "@elizaos/plugin-sql"]),
+      ),
+    ).toThrowError(/@elizaos\/plugin-sql/);
+  });
+
+  it("throws when an unscoped required package is missing", () => {
+    writePackageJson("react"); // present
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["react", "react-dom"]),
+      ),
+    ).toThrowError(/react-dom/);
+  });
+
+  it("lists ALL missing packages, not just the first one", () => {
+    writePackageJson("@elizaos/core");
+    // plugin-sql, plugin-local-inference, app-companion all missing
+
+    try {
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set([
+          "@elizaos/core",
+          "@elizaos/plugin-sql",
+          "@elizaos/plugin-local-inference",
+          "@elizaos/plugin-companion",
+        ]),
+      );
+      throw new Error("expected assertRequiredBundledPackagesLanded to throw");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      expect(message).toContain("@elizaos/plugin-sql");
+      expect(message).toContain("@elizaos/plugin-local-inference");
+      expect(message).toContain("@elizaos/plugin-companion");
+      // Count of missing should be in the header
+      expect(message).toContain("3 required runtime package");
+    }
+  });
+
+  it("only checks package.json — empty dir for a package still counts as missing", () => {
+    // Create the package dir but NO package.json (could happen if prune
+    // wiped the manifest).
+    mkdirSync(path.join(nodeModulesDir, "@elizaos", "plugin-sql"), {
+      recursive: true,
+    });
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/plugin-sql"]),
+      ),
+    ).toThrowError(/@elizaos\/plugin-sql/);
+  });
+
+  it("throws when a baseline package main entrypoint was not copied", () => {
+    writePackageJson("@elizaos/core", { main: "./dist/index.js" });
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/core"]),
+      ),
+    ).toThrowError(/missing runtime entry .*dist[\\/]index\.js/);
+  });
+
+  it("throws when a baseline package module entrypoint was pruned", () => {
+    writePackageJson("@elizaos/core", { module: "./dist/index.mjs" });
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/core"]),
+      ),
+    ).toThrowError(/missing runtime entry .*dist[\\/]index\.mjs/);
+  });
+
+  it("checks baseline package runtime export targets but ignores type-only exports", () => {
+    const packageRoot = writePackageJson("@elizaos/core", {
+      exports: {
+        ".": {
+          import: "./dist/index.js",
+          require: "./dist/index.cjs",
+          types: "./dist/index.d.ts",
+        },
+      },
+    });
+    mkdirSync(path.join(packageRoot, "dist"), { recursive: true });
+    writeFileSync(path.join(packageRoot, "dist", "index.d.ts"), "");
+
+    try {
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/core"]),
+      );
+      throw new Error("expected throw");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      expect(message).toContain(path.join(packageRoot, "dist", "index.js"));
+      expect(message).toContain(path.join(packageRoot, "dist", "index.cjs"));
+      expect(message).not.toContain("index.d.ts");
+    }
+  });
+
+  it("passes when a baseline package manifest entrypoint exists", () => {
+    const packageRoot = writePackageJson("@elizaos/core", {
+      main: "./dist/index.js",
+      exports: {
+        ".": {
+          import: "./dist/index.js",
+          types: "./dist/index.d.ts",
+        },
+      },
+    });
+    mkdirSync(path.join(packageRoot, "dist"), { recursive: true });
+    writeFileSync(path.join(packageRoot, "dist", "index.js"), "");
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/core"]),
+      ),
+    ).not.toThrow();
+  });
+
+  it("does not entrypoint-check non-baseline always-bundled packages", () => {
+    writePackageJson("react", { main: "./index.js" });
+
+    expect(() =>
+      assertRequiredBundledPackagesLanded(nodeModulesDir, new Set(["react"])),
+    ).not.toThrow();
+  });
+
+  it("keeps bundled skill markdown payloads", () => {
+    const packageRoot = path.join(tmpDir, "skills-package");
+    const skillDir = path.join(packageRoot, "skills", "example-skill");
+    const referenceDir = path.join(skillDir, "references");
+    mkdirSync(referenceDir, { recursive: true });
+
+    const skillFile = path.join(skillDir, "SKILL.md");
+    const referenceFile = path.join(referenceDir, "usage.md");
+    const packageReadme = path.join(packageRoot, "README.md");
+    writeFileSync(skillFile, "# Example\n");
+    writeFileSync(referenceFile, "# Usage\n");
+    writeFileSync(packageReadme, "# Package readme\n");
+
+    expect(
+      shouldCopyPackageEntry(skillFile, "@elizaos/skills", packageRoot),
+    ).toBe(true);
+    expect(
+      shouldCopyPackageEntry(referenceFile, "@elizaos/skills", packageRoot),
+    ).toBe(true);
+    expect(
+      shouldCopyPackageEntry(packageReadme, "@elizaos/skills", packageRoot),
+    ).toBe(false);
+  });
+
+  it("keeps documented runtime assets for packages that load them dynamically", () => {
+    const googleapisRoot = path.join(tmpDir, "googleapis");
+    const googleDocsApiFile = path.join(
+      googleapisRoot,
+      "build",
+      "src",
+      "apis",
+      "docs",
+      "v1.js",
+    );
+    const googleReadme = path.join(googleapisRoot, "README.md");
+    mkdirSync(path.dirname(googleDocsApiFile), { recursive: true });
+    writeFileSync(googleDocsApiFile, "");
+    writeFileSync(googleReadme, "# Google APIs\n");
+
+    expect(
+      shouldCopyPackageEntry(googleDocsApiFile, "googleapis", googleapisRoot),
+    ).toBe(true);
+    expect(
+      shouldCopyPackageEntry(googleReadme, "googleapis", googleapisRoot),
+    ).toBe(false);
+
+    const threeRoot = path.join(tmpDir, "three");
+    const threeExampleFile = path.join(
+      threeRoot,
+      "examples",
+      "jsm",
+      "loaders",
+      "GLTFLoader.js",
+    );
+    mkdirSync(path.dirname(threeExampleFile), { recursive: true });
+    writeFileSync(threeExampleFile, "");
+
+    expect(shouldCopyPackageEntry(threeExampleFile, "three", threeRoot)).toBe(
+      true,
+    );
+
+    const uiRoot = path.join(tmpDir, "ui");
+    const uiDocsFile = path.join(
+      uiRoot,
+      "dist",
+      "cloud-ui",
+      "components",
+      "docs",
+      "usage.md",
+    );
+    const uiReadme = path.join(uiRoot, "README.md");
+    mkdirSync(path.dirname(uiDocsFile), { recursive: true });
+    writeFileSync(uiDocsFile, "# Usage\n");
+    writeFileSync(uiReadme, "# UI\n");
+
+    expect(shouldCopyPackageEntry(uiDocsFile, "@elizaos/ui", uiRoot)).toBe(
+      true,
+    );
+    expect(shouldCopyPackageEntry(uiReadme, "@elizaos/ui", uiRoot)).toBe(false);
+  });
+
+  it("uses the top-level Octokit peer for git-workspace-service", () => {
+    expect(
+      shouldSkipPackagedDependency("git-workspace-service", "@octokit/rest"),
+    ).toBe(true);
+    expect(
+      shouldSkipPackagedDependency(
+        "git-workspace-service",
+        "@octokit/auth-app",
+      ),
+    ).toBe(false);
+    expect(
+      shouldSkipPackagedDependency(
+        "@elizaos/plugin-agent-orchestrator",
+        "@octokit/rest",
+      ),
+    ).toBe(false);
+  });
+
+  it("keeps lucide-react as a runtime dependency", () => {
+    const packageRoot = path.join(tmpDir, "icon-consumer");
+    mkdirSync(packageRoot, { recursive: true });
+    writeFileSync(
+      path.join(packageRoot, "package.json"),
+      JSON.stringify(
+        {
+          dependencies: {
+            "lucide-react": "^1.0.0",
+            typescript: "^5.0.0",
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    expect(
+      getRuntimeDependencies(path.join(packageRoot, "package.json")),
+    ).toEqual(["lucide-react"]);
+  });
+
+  it("hoists Solana packages when a compatible top-level copy exists", () => {
+    const rootDestDir = path.join(tmpDir, "dist");
+    const targetNodeModules = path.join(rootDestDir, "node_modules");
+    const requesterDestDir = path.join(
+      targetNodeModules,
+      "@elizaos",
+      "plugin-wallet",
+    );
+
+    expect(
+      selectCopyTargetNodeModules({
+        name: "@solana/web3.js",
+        requesterDestDir,
+        rootDestDir,
+        targetNodeModules,
+        topLevelVersions: new Map([["@solana/web3.js", "1.98.0"]]),
+        resolvedVersion: "2.0.0",
+      }),
+    ).toBe(targetNodeModules);
+
+    expect(
+      selectCopyTargetNodeModules({
+        name: "@example/nested-only",
+        requesterDestDir,
+        rootDestDir,
+        targetNodeModules,
+        topLevelVersions: new Map([["@example/nested-only", "1.0.0"]]),
+        resolvedVersion: "2.0.0",
+      }),
+    ).toBe(path.join(requesterDestDir, "node_modules"));
+  });
+
+  it("hoists the S3 client so packaged S3 adapters do not create tar-unsafe nested AWS paths", () => {
+    const rootDestDir = path.join(tmpDir, "dist");
+    const targetNodeModules = path.join(rootDestDir, "node_modules");
+    const requesterDestDir = path.join(
+      targetNodeModules,
+      "@brighter",
+      "storage-adapter-s3",
+    );
+
+    expect(
+      selectCopyTargetNodeModules({
+        name: "@aws-sdk/client-s3",
+        requesterDestDir,
+        rootDestDir,
+        targetNodeModules,
+        topLevelVersions: new Map([["@aws-sdk/client-s3", "3.1069.0"]]),
+        resolvedVersion: "3.1050.0",
+      }),
+    ).toBe(targetNodeModules);
+  });
+
+  it("collapses WalletConnect patch drift to avoid duplicate desktop runtime copies", () => {
+    const rootDestDir = path.join(tmpDir, "dist");
+    const targetNodeModules = path.join(rootDestDir, "node_modules");
+    const requesterDestDir = path.join(
+      targetNodeModules,
+      "@reown",
+      "appkit-utils",
+    );
+
+    expect(
+      selectCopyTargetNodeModules({
+        name: "@walletconnect/universal-provider",
+        requesterDestDir,
+        rootDestDir,
+        targetNodeModules,
+        topLevelVersions: new Map([
+          ["@walletconnect/universal-provider", "2.19.0"],
+        ]),
+        resolvedVersion: "2.19.1",
+      }),
+    ).toBe(targetNodeModules);
+  });
+
+  it("keeps WalletConnect minor drift nested so incompatible APIs do not collapse", () => {
+    const rootDestDir = path.join(tmpDir, "dist");
+    const targetNodeModules = path.join(rootDestDir, "node_modules");
+    const requesterDestDir = path.join(
+      targetNodeModules,
+      "@walletconnect",
+      "ethereum-provider",
+    );
+
+    expect(
+      selectCopyTargetNodeModules({
+        name: "@walletconnect/universal-provider",
+        requesterDestDir,
+        rootDestDir,
+        targetNodeModules,
+        topLevelVersions: new Map([
+          ["@walletconnect/universal-provider", "2.19.0"],
+        ]),
+        resolvedVersion: "2.21.1",
+      }),
+    ).toBe(path.join(requesterDestDir, "node_modules"));
+  });
+
+  it("honors workspace package publish files when copying runtime packages", () => {
+    const packageRoot = path.join(tmpDir, "workspace-package");
+    mkdirSync(path.join(packageRoot, "dist"), { recursive: true });
+    mkdirSync(path.join(packageRoot, "src"), { recursive: true });
+    mkdirSync(path.join(packageRoot, "scripts"), { recursive: true });
+    writeFileSync(path.join(packageRoot, "dist", "index.js"), "");
+    writeFileSync(path.join(packageRoot, "src", "index.ts"), "");
+    writeFileSync(path.join(packageRoot, "scripts", "build.mjs"), "");
+    writeFileSync(
+      path.join(packageRoot, "package.json"),
+      JSON.stringify(
+        {
+          name: "@elizaos/example-runtime-package",
+          files: ["dist", "!src"],
+          main: "./dist/index.js",
+        },
+        null,
+        2,
+      ),
+    );
+
+    const allowedEntries = getWorkspacePackageRuntimeCopyEntries(
+      "@elizaos/example-runtime-package",
+      packageRoot,
+    );
+
+    expect(allowedEntries).not.toBeNull();
+    expect(
+      shouldCopyWorkspacePublishEntry(
+        path.join(packageRoot, "dist", "index.js"),
+        packageRoot,
+        allowedEntries!,
+      ),
+    ).toBe(true);
+    expect(
+      shouldCopyWorkspacePublishEntry(
+        path.join(packageRoot, "package.json"),
+        packageRoot,
+        allowedEntries!,
+      ),
+    ).toBe(true);
+    expect(
+      shouldCopyWorkspacePublishEntry(
+        path.join(packageRoot, "src", "index.ts"),
+        packageRoot,
+        allowedEntries!,
+      ),
+    ).toBe(false);
+    expect(
+      shouldCopyWorkspacePublishEntry(
+        path.join(packageRoot, "scripts", "build.mjs"),
+        packageRoot,
+        allowedEntries!,
+      ),
+    ).toBe(false);
+  });
+
+  it("keeps source roots that are exposed through runtime export conditions", () => {
+    const packageRoot = path.join(tmpDir, "bun-source-package");
+    mkdirSync(path.join(packageRoot, "dist"), { recursive: true });
+    mkdirSync(path.join(packageRoot, "src"), { recursive: true });
+    writeFileSync(path.join(packageRoot, "dist", "index.js"), "");
+    writeFileSync(path.join(packageRoot, "src", "index.ts"), "");
+    writeFileSync(
+      path.join(packageRoot, "package.json"),
+      JSON.stringify(
+        {
+          name: "@elizaos/example-bun-source-package",
+          files: ["dist"],
+          exports: {
+            ".": {
+              bun: "./src/index.ts",
+              import: "./dist/index.js",
+              types: "./dist/index.d.ts",
+            },
+          },
+        },
+        null,
+        2,
+      ),
+    );
+
+    const allowedEntries = getWorkspacePackageRuntimeCopyEntries(
+      "@elizaos/example-bun-source-package",
+      packageRoot,
+    );
+
+    expect(allowedEntries).not.toBeNull();
+    expect(
+      shouldCopyWorkspacePublishEntry(
+        path.join(packageRoot, "src", "index.ts"),
+        packageRoot,
+        allowedEntries!,
+      ),
+    ).toBe(true);
+    expect(
+      shouldCopyWorkspacePublishEntry(
+        path.join(packageRoot, "dist", "index.js"),
+        packageRoot,
+        allowedEntries!,
+      ),
+    ).toBe(true);
+  });
+
+  it("error message points to the expected on-disk path so ops can investigate", () => {
+    try {
+      assertRequiredBundledPackagesLanded(
+        nodeModulesDir,
+        new Set(["@elizaos/plugin-sql"]),
+      );
+      throw new Error("expected throw");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      expect(message).toContain(
+        path.join(nodeModulesDir, "@elizaos", "plugin-sql", "package.json"),
+      );
+    }
+  });
+});

package/scripts/audit-apple-store-sandbox.mjs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import {
+  closeSync,
+  existsSync,
+  openSync,
+  readdirSync,
+  readFileSync,
+  readSync,
+  statSync,
+} from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const appCoreRoot = path.resolve(__dirname, "..");
+const entitlementsDir = path.join(
+  appCoreRoot,
+  "platforms/electrobun/entitlements",
+);
+
+const entitlementFiles = {
+  parent: path.join(entitlementsDir, "mas.entitlements"),
+  child: path.join(entitlementsDir, "mas-child.entitlements"),
+  bun: path.join(entitlementsDir, "mas-bun.entitlements"),
+};
+
+const forbiddenEverywhere = [
+  "com.apple.security.cs.allow-unsigned-executable-memory",
+  "com.apple.security.cs.disable-library-validation",
+  "com.apple.security.cs.allow-dyld-environment-variables",
+];
+
+const forbiddenOutsideBun = ["com.apple.security.cs.allow-jit"];
+const jitSymbols = [
+  "_pthread_jit_write_protect_np",
+  "_pthread_jit_write_protect_supported_np",
+  "_MAP_JIT",
+];
+
+const machoMagic = new Set([
+  0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe, 0xcafebabe, 0xbebafeca,
+]);
+
+function fail(message) {
+  console.error(`apple-store-sandbox-audit: ${message}`);
+  process.exitCode = 1;
+}
+
+function readEntitlements(filePath) {
+  if (!existsSync(filePath)) {
+    fail(`missing entitlements file: ${filePath}`);
+    return "";
+  }
+  return readFileSync(filePath, "utf8");
+}
+
+function assertEntitlementAbsent(filePath, content, key) {
+  if (content.includes(key)) {
+    fail(`${path.relative(appCoreRoot, filePath)} must not contain ${key}`);
+  }
+}
+
+function auditEntitlementFiles() {
+  for (const [name, filePath] of Object.entries(entitlementFiles)) {
+    const content = readEntitlements(filePath);
+    for (const key of forbiddenEverywhere) {
+      assertEntitlementAbsent(filePath, content, key);
+    }
+    if (name !== "bun") {
+      for (const key of forbiddenOutsideBun) {
+        assertEntitlementAbsent(filePath, content, key);
+      }
+    }
+  }
+}
+
+function isMachO(filePath) {
+  const st = statSync(filePath);
+  if (!st.isFile() || st.size < 4) return false;
+  const fd = openSync(filePath, "r");
+  const buf = Buffer.alloc(4);
+  readSync(fd, buf, 0, 4, 0);
+  closeSync(fd);
+  return machoMagic.has(buf.readUInt32BE(0));
+}
+
+function walkFiles(root) {
+  const out = [];
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    for (const name of readdirSync(dir)) {
+      const full = path.join(dir, name);
+      const st = statSync(full);
+      if (st.isDirectory()) stack.push(full);
+      else out.push(full);
+    }
+  }
+  return out;
+}
+
+function nmUndefinedSymbols(filePath) {
+  const result = spawnSync("nm", ["-u", filePath], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.status !== 0) return "";
+  return `${result.stdout}\n${result.stderr}`;
+}
+
+function auditBuiltApp(appPath) {
+  if (!existsSync(appPath) || !appPath.endsWith(".app")) {
+    fail(`--app must point at an existing .app bundle: ${appPath}`);
+    return;
+  }
+
+  for (const filePath of walkFiles(appPath)) {
+    if (!isMachO(filePath)) continue;
+    const rel = path.relative(appPath, filePath).split(path.sep).join("/");
+    const symbols = nmUndefinedSymbols(filePath);
+    const importsJit = jitSymbols.some((symbol) => symbols.includes(symbol));
+    if (importsJit && rel !== "Contents/MacOS/bun") {
+      fail(`${rel} imports Apple JIT APIs; only Contents/MacOS/bun may do so`);
+    }
+  }
+}
+
+function parseArgs(argv) {
+  const out = {};
+  for (const arg of argv.slice(2)) {
+    if (!arg.startsWith("--")) continue;
+    const eq = arg.indexOf("=");
+    if (eq === -1) out[arg.slice(2)] = true;
+    else out[arg.slice(2, eq)] = arg.slice(eq + 1);
+  }
+  return out;
+}
+
+const args = parseArgs(process.argv);
+auditEntitlementFiles();
+if (args.app) auditBuiltApp(path.resolve(args.app));
+
+if (process.exitCode) process.exit(process.exitCode);
+console.log("apple-store-sandbox-audit: passed");