@fungi.computer/computer 0.0.0-stage → 0.1.0

package/dist/apply-patch/cache.mjs

@@ -0,0 +1,168 @@
+import { createHash } from "node:crypto";
+import {
+  chmod,
+  copyFile,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
+import { join } from "node:path";
+import lockfile from "proper-lockfile";
+import { z } from "zod";
+
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+const versionSchema = z.string().regex(/^rust-v\d+\.\d+\.\d+$/u);
+const targetSchema = z.enum([
+  "linux-x64",
+  "linux-arm64",
+  "darwin-x64",
+  "darwin-arm64",
+]);
+const pinSchema = z.object({
+  version: versionSchema,
+  sourceSha256: digestSchema,
+});
+const receiptSchema = z.strictObject({
+  schemaVersion: z.literal(1),
+  version: versionSchema,
+  target: targetSchema,
+  sourceSha256: digestSchema,
+  wrapperSha256: digestSchema,
+  binarySha256: digestSchema,
+  noticesSha256: digestSchema,
+});
+const noticesSchema = z.object({
+  platform: targetSchema,
+  packages: z.array(
+    z.object({ name: z.string().min(1), texts: z.array(z.string()) }),
+  ),
+});
+function missing(cause) {
+  return cause instanceof Error && "code" in cause && cause.code === "ENOENT";
+}
+async function digest(path) {
+  return createHash("sha256")
+    .update(await readFile(path))
+    .digest("hex");
+}
+
+/** One immutable artifact per Codex pin/target, shared by every checkout and updater. */
+export async function ensureNativePatchArtifact({
+  cacheRoot,
+  pin: inputPin,
+  target: inputTarget,
+  wrapper,
+  destination,
+  build,
+}) {
+  const pin = pinSchema.parse(inputPin);
+  const target = targetSchema.parse(inputTarget);
+  const wrapperSha256 = await digest(wrapper);
+  const key = join(cacheRoot, pin.version, target);
+  const artifact = join(key, "artifact");
+  await mkdir(key, { recursive: true, mode: 0o700 });
+  async function published() {
+    try {
+      await stat(artifact);
+    } catch (cause) {
+      if (missing(cause)) return false;
+      throw cause;
+    }
+    const receipt = receiptSchema.parse(
+      JSON.parse(await readFile(join(artifact, "receipt.json"), "utf8")),
+    );
+    if (
+      receipt.version !== pin.version ||
+      receipt.target !== target ||
+      receipt.sourceSha256 !== pin.sourceSha256 ||
+      receipt.wrapperSha256 !== wrapperSha256
+    )
+      throw new Error(
+        `Cached patch artifact does not match this pin or wrapper: ${artifact}. Use a new pin before rebuilding.`,
+      );
+    if (
+      (await digest(join(artifact, "fungi-apply-patch"))) !==
+        receipt.binarySha256 ||
+      (await digest(join(artifact, "build.json"))) !== receipt.noticesSha256
+    )
+      throw new Error(
+        `Cached patch artifact checksum mismatch: ${artifact}. The artifact was not used or rebuilt.`,
+      );
+    const notices = noticesSchema.parse(
+      JSON.parse(await readFile(join(artifact, "build.json"), "utf8")),
+    );
+    if (notices.platform !== target)
+      throw new Error("Cached patch notices do not match their target");
+    return true;
+  }
+  async function restore(kind) {
+    await mkdir(destination, { recursive: true });
+    await copyFile(
+      join(artifact, "fungi-apply-patch"),
+      join(destination, "fungi-apply-patch"),
+    );
+    await copyFile(
+      join(artifact, "build.json"),
+      join(destination, "build.json"),
+    );
+    await chmod(join(destination, "fungi-apply-patch"), 0o755);
+    return { kind, artifact };
+  }
+  if (await published()) return restore("hit");
+  // Compilation runs in an asynchronous child, so the maintained lock heartbeat stays live.
+  const release = await lockfile.lock(key, {
+    stale: 120_000,
+    update: 20_000,
+    retries: { retries: 600, factor: 1.5, minTimeout: 50, maxTimeout: 1_000 },
+  });
+  let staging;
+  try {
+    if (await published()) return await restore("hit");
+    await build();
+    const notices = noticesSchema.parse(
+      JSON.parse(await readFile(join(destination, "build.json"), "utf8")),
+    );
+    if (notices.platform !== target)
+      throw new Error("Native build does not match the cache target");
+    staging = await mkdtemp(join(key, "staging-"));
+    await copyFile(
+      join(destination, "fungi-apply-patch"),
+      join(staging, "fungi-apply-patch"),
+    );
+    await copyFile(
+      join(destination, "build.json"),
+      join(staging, "build.json"),
+    );
+    await writeFile(
+      join(staging, "receipt.json"),
+      JSON.stringify(
+        {
+          schemaVersion: 1,
+          version: pin.version,
+          target,
+          sourceSha256: pin.sourceSha256,
+          wrapperSha256,
+          binarySha256: await digest(join(staging, "fungi-apply-patch")),
+          noticesSha256: await digest(join(staging, "build.json")),
+        },
+        null,
+        2,
+      ) + "\n",
+      { mode: 0o600 },
+    );
+    await rename(staging, artifact);
+    staging = undefined;
+    return await restore("built");
+  } finally {
+    try {
+      if (staging !== undefined)
+        await rm(staging, { recursive: true, force: true });
+    } finally {
+      await release();
+    }
+  }
+}

package/dist/apply-patch/compile.mjs

@@ -0,0 +1,199 @@
+// Compiles `fungi-apply-patch` for one target inside a prepared builder: a
+// native host with rustup, a release container (docker/*.Dockerfile) or the
+// Computer image's builder stage. It needs only Node, rustup with the pinned
+// toolchain, a C toolchain and network access to the pinned Codex release.
+//
+//   node compile.mjs --out <dir> [--target <platform>] [--scratch <dir>]
+//                    [--require-glibc <version>]
+//
+// It writes <out>/fungi-apply-patch and <out>/build.json (the license and
+// notice texts of every crate compiled into it).
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { access, copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { fileURLToPath, URL } from "node:url";
+import console from "node:console";
+import process from "node:process";
+import { parseArgs } from "node:util";
+import { nativeNotices } from "./notices.mjs";
+import { codexPatchPin } from "./pin.mjs";
+import {
+  ensureNativeHostToolchain,
+  selectCargoInvocation,
+} from "./toolchain.mjs";
+
+const { fetch } = globalThis;
+const { values } = parseArgs({
+  options: {
+    target: { type: "string", default: `${process.platform}-${process.arch}` },
+    out: { type: "string" },
+    scratch: { type: "string" },
+    "require-glibc": { type: "string" },
+  },
+});
+if (values.out === undefined) throw new Error("compile.mjs requires --out");
+const platform = values.target;
+const host = `${process.platform}-${process.arch}`;
+const crossLinuxArm = platform === "linux-arm64" && host === "linux-x64";
+const macTarget = {
+  "darwin-arm64": "aarch64-apple-darwin",
+  "darwin-x64": "x86_64-apple-darwin",
+}[platform];
+const crossMac = macTarget !== undefined && process.platform !== "darwin";
+if (platform !== host && !crossMac && !crossLinuxArm)
+  throw new Error(`Unsupported native build target: ${platform} on ${host}`);
+const glibc = values["require-glibc"];
+if (
+  glibc !== undefined &&
+  process.report.getReport().header.glibcVersionRuntime !== glibc
+)
+  throw new Error(`This release builder requires glibc ${glibc}`);
+
+const source = fileURLToPath(new URL("./", import.meta.url));
+const out = resolve(values.out);
+const scratch = resolve(
+  values.scratch ?? resolve(tmpdir(), `fungi-apply-patch-build-${platform}`),
+);
+const archive = resolve(scratch, `codex-${codexPatchPin.version}.tar.gz`);
+const upstream = resolve(scratch, `codex-${codexPatchPin.version}/codex-rs`);
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, { stdio: "inherit", ...options });
+  if (result.error !== undefined) throw result.error;
+  if (result.status !== 0)
+    throw new Error(`${command} failed (${String(result.status)})`);
+}
+
+await mkdir(scratch, { recursive: true });
+try {
+  await access(archive);
+} catch {
+  const response = await fetch(
+    `https://github.com/openai/codex/archive/refs/tags/${codexPatchPin.version}.tar.gz`,
+  );
+  if (!response.ok)
+    throw new Error(`Codex source download failed: ${response.status}`);
+  await writeFile(archive, new Uint8Array(await response.arrayBuffer()));
+}
+if (
+  createHash("sha256")
+    .update(await readFile(archive))
+    .digest("hex") !== codexPatchPin.sourceSha256
+)
+  throw new Error("Pinned Codex source checksum mismatch");
+// Re-extract the verified source so old wrapper or manifest edits cannot survive.
+run("tar", ["-xzf", archive, "-C", scratch]);
+const manifestPath = resolve(upstream, "Cargo.toml");
+const manifest = await readFile(manifestPath, "utf8");
+// The release tag bumps workspace package versions but leaves 0.0.0 in its
+// lockfile. Restore that build-only metadata; all dependency pins stay intact.
+await writeFile(
+  manifestPath,
+  manifest.replace(
+    `version = "${codexPatchPin.version.slice(6)}"`,
+    'version = "0.0.0"',
+  ),
+);
+await copyFile(
+  resolve(source, "main.rs"),
+  resolve(upstream, "apply-patch/src/fungi-main.rs"),
+);
+const patchManifest = resolve(upstream, "apply-patch/Cargo.toml");
+await writeFile(
+  patchManifest,
+  `${await readFile(patchManifest, "utf8")}\n[[bin]]\nname = "fungi-apply-patch"\npath = "src/fungi-main.rs"\n`,
+);
+const cargoHome = process.env.CARGO_HOME ?? resolve(homedir(), ".cargo");
+// Remap build-host paths so the executable carries no checkout or home path.
+const nativePathFlags = [
+  `-ffile-prefix-map=${scratch}=/build`,
+  `-ffile-prefix-map=${cargoHome}=/cargo`,
+]
+  .map((flag) => JSON.stringify(flag))
+  .join(" ");
+ensureNativeHostToolchain({ toolchain: codexPatchPin.rustToolchain });
+const { command: cargoCommand, args: cargoArgs } = selectCargoInvocation({
+  toolchain: codexPatchPin.rustToolchain,
+  cargoArgs: [
+    crossMac ? "zigbuild" : "build",
+    "--release",
+    ...(crossMac
+      ? ["--target", macTarget]
+      : crossLinuxArm
+        ? ["--target", "aarch64-unknown-linux-gnu"]
+        : []),
+    "--message-format=json",
+    "--manifest-path",
+    manifestPath,
+    "--locked",
+    "-p",
+    "codex-apply-patch",
+    "--bin",
+    "fungi-apply-patch",
+  ],
+});
+const cargo = spawnSync(cargoCommand, cargoArgs, {
+  encoding: "utf8",
+  maxBuffer: 64 * 1024 * 1024,
+  env: {
+    ...process.env,
+    CARGO_TARGET_DIR: resolve(scratch, "target"),
+    CARGO_ENCODED_RUSTFLAGS: [
+      `--remap-path-prefix=${scratch}=/build`,
+      `--remap-path-prefix=${cargoHome}=/cargo`,
+    ].join("\x1f"),
+    CFLAGS: nativePathFlags,
+    CXXFLAGS: nativePathFlags,
+    CC_SHELL_ESCAPED_FLAGS: "1",
+    CARGO_PROFILE_RELEASE_DEBUG: "0",
+    CARGO_PROFILE_RELEASE_INCREMENTAL: "false",
+    // Cargo strips debug references during linking, before Mach-O signing.
+    CARGO_PROFILE_RELEASE_STRIP: "debuginfo",
+  },
+});
+if (cargo.error) throw cargo.error;
+process.stderr.write(cargo.stderr);
+const messages = cargo.stdout
+  .trim()
+  .split("\n")
+  .filter(Boolean)
+  .map((line) => JSON.parse(line));
+for (const message of messages) {
+  if (message.reason === "compiler-message" && message.message.rendered)
+    process.stderr.write(message.message.rendered);
+}
+if (cargo.status !== 0) throw new Error("Native patch engine build failed");
+const artifacts = messages
+  .filter((message) => message.reason === "compiler-artifact")
+  .map(({ package_id, manifest_path }) => ({ package_id, manifest_path }));
+const executable = messages.find(
+  (message) =>
+    message.reason === "compiler-artifact" &&
+    message.target.name === "fungi-apply-patch" &&
+    message.executable,
+)?.executable;
+if (!executable) throw new Error("Cargo did not report the patch executable");
+const destination = resolve(out, "fungi-apply-patch");
+await mkdir(dirname(destination), { recursive: true });
+await copyFile(executable, destination);
+// Keep the cross-linker's Mach-O code signature intact; Linux strip cannot
+// re-sign a Mach-O executable. Native Apple builds use Apple's strip.
+if (!crossMac)
+  run(crossLinuxArm ? "aarch64-linux-gnu-strip" : "strip", [
+    process.platform === "darwin" ? "-x" : "--strip-unneeded",
+    destination,
+  ]);
+await writeFile(
+  resolve(out, "build.json"),
+  JSON.stringify(
+    {
+      platform,
+      packages: await nativeNotices(artifacts, dirname(upstream)),
+    },
+    null,
+    2,
+  ) + "\n",
+);
+console.log(`Built pinned Codex patch engine: ${destination}`);

package/dist/apply-patch/docker/darwin.Dockerfile

@@ -0,0 +1,15 @@
+FROM ghcr.io/rust-cross/cargo-zigbuild@sha256:9b4f6b3eb9e8f9fefb3960fe288ddba576627d66d9eff851ce7f62d2455564a5 AS toolchain
+RUN rustup toolchain install 1.98.1 --profile minimal && rustup target add --toolchain 1.98.1 aarch64-apple-darwin x86_64-apple-darwin
+ENV RUSTUP_TOOLCHAIN=1.98.1
+ENV MACOSX_DEPLOYMENT_TARGET=13.5
+
+# Compile from the build context (this directory) and export only the result.
+FROM toolchain AS build
+COPY --from=node:24.20.0-trixie-slim@sha256:a747ad80c8a161b650d79a6da9c422005b91148b18b8d2c669eb5a0b7c07e600 /usr/local/bin/node /usr/local/bin/node
+ARG TARGET=darwin-arm64
+ARG CARGO_BUILD_JOBS=4
+COPY . /source/
+RUN node /source/compile.mjs --target "$TARGET" --out /out --scratch /scratch
+
+FROM scratch
+COPY --from=build /out/ /

package/dist/apply-patch/docker/linux-arm64.Dockerfile

@@ -0,0 +1,38 @@
+# Build arm64 against Ubuntu 22.04's glibc 2.35 from the pinned amd64 host.
+FROM ubuntu:22.04@sha256:08ea48a03a3e78ebc7cd526e6a275053223aadd88bfc09cc49b06d5281525fde AS toolchain
+RUN dpkg --add-architecture arm64 \
+    && sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list \
+    && printf '%s\n' \
+      'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy main universe' \
+      'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main universe' \
+      'deb [arch=arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main universe' \
+      > /etc/apt/sources.list.d/arm64.list \
+    && apt-get update && apt-get install -y --no-install-recommends \
+      build-essential gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \
+      ca-certificates curl git pkg-config libssl-dev:arm64 qemu-user \
+    && rm -rf /var/lib/apt/lists/*
+ENV RUSTUP_HOME=/opt/rustup CARGO_HOME=/opt/cargo
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o /tmp/rustup.sh \
+    && sh /tmp/rustup.sh -y --profile minimal --default-toolchain 1.98.1 \
+    && /opt/cargo/bin/rustup target add --toolchain 1.98.1 aarch64-unknown-linux-gnu \
+    && rm /tmp/rustup.sh \
+    && chmod -R a+rX /opt/rustup /opt/cargo
+ENV PATH=/opt/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ENV RUSTUP_TOOLCHAIN=1.98.1
+ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
+ENV CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc
+ENV CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++
+ENV AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar
+ENV PKG_CONFIG_ALLOW_CROSS=1
+ENV PKG_CONFIG_LIBDIR=/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig
+
+# Compile from the build context (this directory) and export only the result.
+FROM toolchain AS build
+COPY --from=node:24.20.0-trixie-slim@sha256:a747ad80c8a161b650d79a6da9c422005b91148b18b8d2c669eb5a0b7c07e600 /usr/local/bin/node /usr/local/bin/node
+ARG TARGET=linux-arm64
+ARG CARGO_BUILD_JOBS=4
+COPY . /source/
+RUN node /source/compile.mjs --target "$TARGET" --out /out --scratch /scratch --require-glibc 2.35
+
+FROM scratch
+COPY --from=build /out/ /

package/dist/apply-patch/docker/linux-x64.Dockerfile

@@ -0,0 +1,23 @@
+# Ubuntu 22.04 amd64, jammy-20260924.1. Keep the libc floor at 2.35.
+FROM ubuntu:22.04@sha256:08ea48a03a3e78ebc7cd526e6a275053223aadd88bfc09cc49b06d5281525fde AS toolchain
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential ca-certificates curl git pkg-config libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+ENV RUSTUP_HOME=/opt/rustup CARGO_HOME=/opt/cargo
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o /tmp/rustup.sh \
+    && sh /tmp/rustup.sh -y --profile minimal --default-toolchain 1.98.1 \
+    && rm /tmp/rustup.sh \
+    && chmod -R a+rX /opt/rustup /opt/cargo
+ENV PATH=/opt/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ENV RUSTUP_TOOLCHAIN=1.98.1
+
+# Compile from the build context (this directory) and export only the result.
+FROM toolchain AS build
+COPY --from=node:24.20.0-trixie-slim@sha256:a747ad80c8a161b650d79a6da9c422005b91148b18b8d2c669eb5a0b7c07e600 /usr/local/bin/node /usr/local/bin/node
+ARG TARGET=linux-x64
+ARG CARGO_BUILD_JOBS=4
+COPY . /source/
+RUN node /source/compile.mjs --target "$TARGET" --out /out --scratch /scratch --require-glibc 2.35
+
+FROM scratch
+COPY --from=build /out/ /