@rexvane/piweb 0.3.13 → 0.3.15

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rexvane/piweb",
-	"version": "0.3.13",
+	"version": "0.3.15",
 	"license": "MIT",
 	"type": "module",
 	"description": "Modern web UI for the pi coding agent, driven by the official pi SDK without modifying pi",
@@ -28,7 +28,7 @@
 		"src",
 		"scripts",
 		"public",
-		"assets/showcase.png",
+		"assets",
 		"next.config.ts",
 		"tsconfig.json",
 		"postcss.config.mjs",
@@ -39,9 +39,9 @@
 		"build": "node --max-old-space-size=8192 node_modules/next/dist/bin/next build --webpack",
 		"build:release": "node scripts/release.mjs",
 		"postinstall": "node scripts/postinstall.mjs",
+		"prepare:niubash": "node scripts/prepare-niubash-packages.mjs",
 		"prepublishOnly": "npm run typecheck && npm run test",
 		"start": "node bin/piweb.js",
-		"web": "node bin/pi.js web",
 		"typecheck": "tsc --noEmit",
 		"verify:package": "node scripts/verify-package.mjs",
 		"test": "vitest run",
@@ -73,6 +73,10 @@
 		"tailwindcss": "^4.2.2",
 		"typescript": "^7"
 	},
+	"optionalDependencies": {
+		"@rexvane/piweb-niubash-win32-arm64": "1.1.4-piweb.0",
+		"@rexvane/piweb-niubash-win32-x64": "1.1.4-piweb.0"
+	},
 	"devDependencies": {
 		"@testing-library/dom": "^10.4.2",
 		"@testing-library/react": "^16.3.3",

package/scripts/launcher.mjs

@@ -169,7 +169,7 @@ export async function runLauncher({ args = process.argv.slice(2), env = process.
 	const options = parseLauncherArgs(args, env);
 	const log = dependencies.log ?? console.log;
 	if (options.help) {
-		log("Usage: pi web [-p, --port <port>] [-H, --hostname <host>] [--dev] [--no-open]");
+		log("Usage: piweb [-p, --port <port>] [-H, --hostname <host>] [--dev] [--no-open]");
 		log("默认绑定 127.0.0.1:30141；端口被占自动 +1。开发模式仅允许本机监听。");
 		log("对外监听必须使用生产构建与 PI_WEB_PASSWORD。构建/恢复发布：npm run build:release。");
 		return 0;

package/scripts/managed-niubash-assets.mjs

@@ -0,0 +1,146 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+export const NIUBASH_VERSION = "1.1.4";
+export const NIUBASH_TAG = `v${NIUBASH_VERSION}`;
+export const NIUBASH_DISTRIBUTION_VERSION = `${NIUBASH_VERSION}-piweb.0`;
+export const NIUBASH_REPOSITORY = "https://github.com/unixwin/niubash";
+
+export const MANAGED_NIUBASH_ASSETS = Object.freeze({
+	x64: Object.freeze({
+		arch: "x64",
+		machine: 0x8664,
+		packageName: "@rexvane/piweb-niubash-win32-x64",
+		directory: "piweb-niubash-win32-x64",
+		asset: "niubash-v1.1.4-win-x64.zip",
+		sha256: "9f543634288a316f7ed8e5a76ff794eca402cb21e74b8f8a551daffafde162f5",
+	}),
+	arm64: Object.freeze({
+		arch: "arm64",
+		machine: 0xaa64,
+		packageName: "@rexvane/piweb-niubash-win32-arm64",
+		directory: "piweb-niubash-win32-arm64",
+		asset: "niubash-v1.1.4-win-arm64.zip",
+		sha256: "77e98ba8d7f6be70c35388bcc28bdbc883c06bcaafffbe186a88788ad32ccf00",
+	}),
+});
+
+export const NIUBASH_LICENSES = Object.freeze([
+	Object.freeze({
+		filename: "NIUBASH.txt",
+		url: "https://raw.githubusercontent.com/unixwin/niubash/v1.1.4/LICENSE",
+		sha256: "1290aae99e71239ee3154e7847830e49e7a36c758fa6d659d73fa752dc9f81c8",
+	}),
+	Object.freeze({
+		filename: "RUBASH.txt",
+		url: "https://raw.githubusercontent.com/unixwin/rubash/8b81c7501646/LICENSE",
+		sha256: "e426a75a20633f3088da22aef61a5a44d06f1f884c600f6011d00702c3989079",
+	}),
+	Object.freeze({
+		filename: "WINUXCMD.txt",
+		url: "https://raw.githubusercontent.com/unixwin/WinuxCmd/v1.0.8/LICENSE",
+		sha256: "8ffc4ed56f5e6ab8183a7ece2e3aa6ea4800b0a4e8170d11bd60856f2dd760f3",
+	}),
+]);
+
+export function niubashAssetUrl(asset) {
+	return `${NIUBASH_REPOSITORY}/releases/download/${NIUBASH_TAG}/${asset.asset}`;
+}
+
+export function sha256(data) {
+	return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+export function sha256File(filename) {
+	return sha256(fs.readFileSync(filename));
+}
+
+export function listFiles(root) {
+	const files = [];
+	const visit = (directory, prefix = "") => {
+		for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+			const absolute = path.join(directory, entry.name);
+			if (entry.isDirectory()) visit(absolute, relative);
+			else if (entry.isFile()) files.push(relative);
+			else throw new Error(`managed niubash runtime contains an unsupported entry: ${relative}`);
+		}
+	};
+	visit(root);
+	return files;
+}
+
+export function readPeMachine(filename) {
+	const data = fs.readFileSync(filename);
+	if (data.length < 64 || data[0] !== 0x4d || data[1] !== 0x5a) throw new Error(`${filename} is not a PE executable`);
+	const peOffset = data.readUInt32LE(0x3c);
+	if (peOffset + 6 > data.length || data.toString("ascii", peOffset, peOffset + 4) !== "PE\0\0") {
+		throw new Error(`${filename} has an invalid PE header`);
+	}
+	return data.readUInt16LE(peOffset + 4);
+}
+
+function readJson(filename) {
+	return JSON.parse(fs.readFileSync(filename, "utf8"));
+}
+
+function assertEqual(actual, expected, label) {
+	if (actual !== expected) throw new Error(`${label}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+
+/** Validate a prepared source package or an unpacked npm tarball. */
+export function validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles = true } = {}) {
+	const packageInfo = readJson(path.join(packageRoot, "package.json"));
+	assertEqual(packageInfo.name, asset.packageName, "managed niubash package name");
+	assertEqual(packageInfo.version, NIUBASH_DISTRIBUTION_VERSION, "managed niubash package version");
+	if (!Array.isArray(packageInfo.os) || packageInfo.os.length !== 1 || packageInfo.os[0] !== "win32") {
+		throw new Error(`${asset.packageName} must be restricted to os=win32`);
+	}
+	if (!Array.isArray(packageInfo.cpu) || packageInfo.cpu.length !== 1 || packageInfo.cpu[0] !== asset.arch) {
+		throw new Error(`${asset.packageName} must be restricted to cpu=${asset.arch}`);
+	}
+
+	const runtime = path.join(packageRoot, "runtime");
+	if (!fs.existsSync(path.join(runtime, "niu.exe"))) {
+		throw new Error(`${asset.packageName} has no prepared runtime; run \`node scripts/prepare-niubash-packages.mjs\` before packing/publishing`);
+	}
+	const manifest = readJson(path.join(packageRoot, "runtime-manifest.json"));
+	assertEqual(manifest.schema, 1, "managed niubash manifest schema");
+	assertEqual(manifest.source?.repository, NIUBASH_REPOSITORY, "managed niubash source repository");
+	assertEqual(manifest.source?.tag, NIUBASH_TAG, "managed niubash source tag");
+	assertEqual(manifest.source?.asset, asset.asset, "managed niubash source asset");
+	assertEqual(manifest.source?.sha256, asset.sha256, "managed niubash source SHA-256");
+	if (!manifest.files || typeof manifest.files !== "object" || Array.isArray(manifest.files)) {
+		throw new Error(`${asset.packageName} runtime manifest has no file map`);
+	}
+	const expectedFiles = Object.keys(manifest.files);
+	if (expectedFiles.length < 300) throw new Error(`${asset.packageName} runtime is incomplete (${expectedFiles.length} files)`);
+	for (const relative of expectedFiles) {
+		if (!relative || relative.includes("\\") || path.posix.isAbsolute(relative) || relative.split("/").includes("..")) {
+			throw new Error(`${asset.packageName} runtime manifest contains an unsafe path: ${relative}`);
+		}
+		const filename = path.join(runtime, ...relative.split("/"));
+		const stat = fs.statSync(filename);
+		if (!stat.isFile()) throw new Error(`${asset.packageName} runtime entry is not a file: ${relative}`);
+		assertEqual(sha256File(filename), manifest.files[relative], `${asset.packageName} hash for ${relative}`);
+	}
+	const actualFiles = listFiles(runtime);
+	const extra = actualFiles.filter((file) => !(file in manifest.files));
+	if (!allowExtraRuntimeFiles && extra.length > 0) {
+		throw new Error(
+			`${asset.packageName} runtime has ${extra.length} files not in the signed manifest (niubash self-activates command links on first run). Re-run \`node scripts/prepare-niubash-packages.mjs\` before packing. First extra: ${extra[0]}`,
+		);
+	}
+
+	for (const required of ["niu.exe", "winuxcmd/usr/bin/winuxcmd.exe", "bundles/oh-my-niu/bundle.toml"]) {
+		if (!expectedFiles.includes(required)) throw new Error(`${asset.packageName} is missing ${required}`);
+	}
+	for (const executable of ["niu.exe", "winuxcmd/usr/bin/winuxcmd.exe"]) {
+		assertEqual(readPeMachine(path.join(runtime, ...executable.split("/"))), asset.machine, `${asset.packageName} PE machine for ${executable}`);
+	}
+	for (const license of NIUBASH_LICENSES) {
+		assertEqual(sha256File(path.join(packageRoot, "licenses", license.filename)), license.sha256, `${asset.packageName} license ${license.filename}`);
+	}
+	return { files: expectedFiles.length, runtime };
+}

package/scripts/prepare-niubash-packages.mjs

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * Build the Windows-only npm packages from pinned official niubash portable
+ * archives. Nothing is downloaded on macOS/Linux user installs: this runs only
+ * in PiWeb's release workflow (or explicitly by a maintainer).
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+	MANAGED_NIUBASH_ASSETS,
+	NIUBASH_LICENSES,
+	NIUBASH_REPOSITORY,
+	NIUBASH_TAG,
+	listFiles,
+	niubashAssetUrl,
+	sha256,
+	sha256File,
+	validateManagedNiubashPackage,
+} from "./managed-niubash-assets.mjs";
+import { isMainModule } from "./entrypoint.mjs";
+
+const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+async function download(url, expectedSha256) {
+	let lastError;
+	for (let attempt = 1; attempt <= 3; attempt += 1) {
+		try {
+			const response = await fetch(url, {
+				headers: { "user-agent": "PiWeb managed-niubash packager" },
+				signal: AbortSignal.timeout(120_000),
+			});
+			if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText}`);
+			const data = Buffer.from(await response.arrayBuffer());
+			const actual = sha256(data);
+			if (actual !== expectedSha256) throw new Error(`SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
+			return data;
+		} catch (error) {
+			lastError = error;
+			if (attempt < 3) await new Promise((resolve) => setTimeout(resolve, attempt * 1000));
+		}
+	}
+	throw new Error(`failed to download ${url}: ${lastError instanceof Error ? lastError.message : lastError}`);
+}
+
+function extractZip(archive, destination) {
+	fs.mkdirSync(destination, { recursive: true });
+	let result;
+	if (process.platform === "win32") {
+		result = spawnSync("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			"Expand-Archive -LiteralPath $env:PIWEB_NIUBASH_ARCHIVE -DestinationPath $env:PIWEB_NIUBASH_DESTINATION -Force",
+		], {
+			encoding: "utf8",
+			env: { ...process.env, PIWEB_NIUBASH_ARCHIVE: archive, PIWEB_NIUBASH_DESTINATION: destination },
+		});
+	} else {
+		result = spawnSync("unzip", ["-q", "-o", archive, "-d", destination], { encoding: "utf8" });
+		if (result.error?.code === "ENOENT") {
+			result = spawnSync("python3", ["-m", "zipfile", "-e", archive, destination], { encoding: "utf8" });
+		}
+	}
+	if (result.error) throw new Error(`cannot extract ${path.basename(archive)}: ${result.error.message}`);
+	if (result.status !== 0) throw new Error(`cannot extract ${path.basename(archive)}: ${result.stderr || result.stdout}`);
+}
+
+async function replaceDirectory(source, destination) {
+	fs.rmSync(destination, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	for (let attempt = 1; ; attempt += 1) {
+		try {
+			fs.renameSync(source, destination);
+			return;
+		} catch (error) {
+			// Windows：刚写入几百个文件时，Defender/索引器会短暂持有句柄，目录 rename 报 EPERM。
+			// 先退避重试，仍不行就退化成复制（读通常是被允许的）。
+			if (!["EPERM", "EBUSY", "EACCES"].includes(error?.code)) throw error;
+			if (attempt >= 5) {
+				fs.cpSync(source, destination, { recursive: true });
+				fs.rmSync(source, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, attempt * 250));
+		}
+	}
+}
+
+function extractedPortableRoot(destination) {
+	const entries = fs.readdirSync(destination, { withFileTypes: true }).filter((entry) => entry.name !== "__MACOSX");
+	if (entries.length !== 1 || !entries[0].isDirectory()) throw new Error("niubash archive must contain exactly one top-level directory");
+	return path.join(destination, entries[0].name);
+}
+
+async function prepareLicenses(root, packageRoot) {
+	const destination = path.join(packageRoot, "licenses");
+	const staging = path.join(packageRoot, `.licenses-${process.pid}`);
+	fs.rmSync(staging, { recursive: true, force: true });
+	fs.mkdirSync(staging, { recursive: true });
+	try {
+		for (const license of NIUBASH_LICENSES) {
+			const source = path.join(root, "third-party", "managed-niubash", "licenses", license.filename);
+			if (sha256File(source) !== license.sha256) throw new Error(`license source failed integrity check: ${license.filename}`);
+			fs.copyFileSync(source, path.join(staging, license.filename));
+		}
+		await replaceDirectory(staging, destination);
+	} finally {
+		fs.rmSync(staging, { recursive: true, force: true });
+	}
+}
+
+async function prepareAsset(root, asset, log) {
+	const packageRoot = path.join(root, "platform-packages", asset.directory);
+	if (!fs.existsSync(path.join(packageRoot, "package.json"))) throw new Error(`missing platform package skeleton: ${packageRoot}`);
+	const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `piweb-niubash-${asset.arch}-`));
+	const archive = path.join(temporary, asset.asset);
+	const extracted = path.join(temporary, "extracted");
+	const staging = path.join(packageRoot, `.runtime-${process.pid}`);
+	try {
+		log(`[piweb] Downloading ${asset.asset} ...`);
+		fs.writeFileSync(archive, await download(niubashAssetUrl(asset), asset.sha256));
+		extractZip(archive, extracted);
+		const source = extractedPortableRoot(extracted);
+		for (const required of ["niu.exe", "winuxcmd", "bundles"]) {
+			if (!fs.existsSync(path.join(source, required))) throw new Error(`${asset.asset} is missing ${required}`);
+		}
+
+		fs.rmSync(staging, { recursive: true, force: true });
+		fs.cpSync(source, staging, { recursive: true });
+		await replaceDirectory(staging, path.join(packageRoot, "runtime"));
+		const runtime = path.join(packageRoot, "runtime");
+
+		const files = {};
+		for (const relative of listFiles(runtime)) files[relative] = sha256File(path.join(runtime, ...relative.split("/")));
+		fs.writeFileSync(path.join(packageRoot, "runtime-manifest.json"), `${JSON.stringify({
+			schema: 1,
+			source: { repository: NIUBASH_REPOSITORY, tag: NIUBASH_TAG, asset: asset.asset, sha256: asset.sha256 },
+			files,
+		}, null, 2)}\n`);
+		await prepareLicenses(root, packageRoot);
+		const checked = validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles: false });
+		log(`[piweb] Prepared ${asset.packageName}: ${checked.files} runtime files.`);
+		return checked;
+	} finally {
+		fs.rmSync(staging, { recursive: true, force: true });
+		fs.rmSync(temporary, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	}
+}
+
+function selectAssets(args) {
+	if (args.length === 0) return Object.values(MANAGED_NIUBASH_ASSETS);
+	if (args.length === 1 && args[0] === "--current") {
+		if (process.platform !== "win32" || !(process.arch in MANAGED_NIUBASH_ASSETS)) {
+			throw new Error(`--current requires Windows x64/ARM64 (got ${process.platform}/${process.arch})`);
+		}
+		return [MANAGED_NIUBASH_ASSETS[process.arch]];
+	}
+	if (args.length === 1 && args[0].startsWith("--arch=")) {
+		const arch = args[0].slice("--arch=".length);
+		const asset = MANAGED_NIUBASH_ASSETS[arch];
+		if (!asset) throw new Error(`unsupported niubash architecture: ${arch}`);
+		return [asset];
+	}
+	throw new Error("Usage: node scripts/prepare-niubash-packages.mjs [--current|--arch=x64|--arch=arm64]");
+}
+
+export async function prepareManagedNiubashPackages(root = DEFAULT_ROOT, { args = [], log = console.log } = {}) {
+	const results = [];
+	for (const asset of selectAssets(args)) results.push(await prepareAsset(root, asset, log));
+	return results;
+}
+
+if (isMainModule(import.meta.url)) {
+	try {
+		await prepareManagedNiubashPackages(DEFAULT_ROOT, { args: process.argv.slice(2) });
+	} catch (error) {
+		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
+		process.exitCode = 1;
+	}
+}

package/scripts/smoke-managed-niubash.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/** Native smoke test. Run on both windows-latest (x64) and windows-11-arm. */
+import assert from "node:assert/strict";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
+import { MANAGED_NIUBASH_ASSETS, validateManagedNiubashPackage } from "./managed-niubash-assets.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+if (process.platform !== "win32" || !(process.arch in MANAGED_NIUBASH_ASSETS)) {
+	throw new Error(`managed niubash smoke test requires Windows x64/ARM64 (got ${process.platform}/${process.arch})`);
+}
+const asset = MANAGED_NIUBASH_ASSETS[process.arch];
+const packageRoot = path.join(root, "platform-packages", asset.directory);
+validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles: false });
+const require = createRequire(path.join(root, "package.json"));
+const runtime = require(path.join(packageRoot, "index.cjs"));
+assert.equal(runtime.packageName, asset.packageName);
+assert.equal(runtime.arch, process.arch);
+
+const version = spawnSync(runtime.shellPath, ["--version"], { encoding: "utf8", windowsHide: true });
+assert.equal(version.status, 0, version.stderr);
+assert.match(version.stdout, /Niubash 1\.1\.4/);
+assert.match(version.stdout, /rubash\s+git 8b81c7501646/);
+assert.match(version.stdout, /winuxcmd WinuxCmd 1\.0\.8/);
+
+const operations = createLocalBashOperations({ shellPath: runtime.shellPath });
+async function execute(command, options = {}) {
+	const chunks = [];
+	const result = await operations.exec(command, process.cwd(), {
+		onData: (data) => chunks.push(data),
+		...options,
+	});
+	return { exitCode: result.exitCode, output: Buffer.concat(chunks).toString("utf8") };
+}
+
+const empty = await execute("");
+assert.equal(empty.exitCode, 0);
+assert.equal(empty.output, "");
+
+const pwd = await execute("pwd");
+assert.equal(pwd.exitCode, 0);
+assert.equal(path.resolve(pwd.output.trim().replaceAll("/", path.sep)).toLowerCase(), path.resolve(process.cwd()).toLowerCase());
+
+const quoted = await execute(`node -e "console.log(JSON.stringify(process.argv.slice(1)))" 'a b' '' 'c"d' 'e\\f'`);
+assert.equal(quoted.exitCode, 0, quoted.output);
+assert.deepEqual(JSON.parse(quoted.output.trim()), ["a b", "", "c\"d", "e\\f"]);
+
+const shellQuotedCwd = process.cwd().replaceAll("'", `'"'"'`);
+const windowsPath = await execute(`cd '${shellQuotedCwd}' && pwd`);
+assert.equal(windowsPath.exitCode, 0, windowsPath.output);
+assert.equal(path.resolve(windowsPath.output.trim().replaceAll("/", path.sep)).toLowerCase(), path.resolve(process.cwd()).toLowerCase());
+
+await assert.rejects(() => execute("sleep 5", { timeout: 0.1 }), /timeout/);
+const controller = new AbortController();
+const aborted = execute("sleep 5", { signal: controller.signal });
+setTimeout(() => controller.abort(), 100);
+await assert.rejects(() => aborted, /aborted/);
+
+console.log(`[piweb] Managed niubash ${process.arch} smoke test passed (${version.stdout.split(/\r?\n/, 1)[0]}).`);

package/scripts/verify-package.mjs

@@ -13,9 +13,15 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { readProductionBuild } from "./build-output.mjs";
 import { isMainModule } from "./entrypoint.mjs";
+import {
+	MANAGED_NIUBASH_ASSETS,
+	NIUBASH_DISTRIBUTION_VERSION,
+	validateManagedNiubashPackage,
+} from "./managed-niubash-assets.mjs";
 
 const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -66,9 +72,56 @@ export function verifyPackedPackage(root, { log = console.log } = {}) {
 	}
 }
 
+/** Pack and inspect one actual OS/CPU package, including every runtime hash and license. */
+export function verifyPackedManagedNiubashPackage(packageRoot, asset, { log = console.log } = {}) {
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), `piweb-niubash-pack-${asset.arch}-`));
+	try {
+		const packed = JSON.parse(runNpm(["pack", "--json", "--pack-destination", tmp], { cwd: packageRoot }));
+		const entry = Array.isArray(packed) ? packed[0] : packed;
+		if (!entry?.filename) throw new Error(`npm pack produced no tarball for ${asset.packageName}`);
+		const files = (entry.files ?? []).map((file) => String(file.path).replaceAll("\\", "/").replace(/^package\//, ""));
+		for (const required of [
+			"package.json", "index.cjs", "runtime-manifest.json", "runtime/niu.exe",
+			"runtime/winuxcmd/usr/bin/winuxcmd.exe", "runtime/bundles/oh-my-niu/bundle.toml",
+			"licenses/NIUBASH.txt", "licenses/RUBASH.txt", "licenses/WINUXCMD.txt",
+		]) {
+			if (!files.includes(required)) throw new Error(`${asset.packageName} tarball is missing ${required}`);
+		}
+		const unpacked = path.join(tmp, "unpacked");
+		fs.mkdirSync(unpacked, { recursive: true });
+		run("tar", ["-xzf", entry.filename, "-C", "unpacked"], { cwd: tmp });
+		const installedRoot = path.join(unpacked, "package");
+		const checked = validateManagedNiubashPackage(installedRoot, asset, { allowExtraRuntimeFiles: false });
+		const require = createRequire(path.join(installedRoot, "package.json"));
+		const exported = require(path.join(installedRoot, "index.cjs"));
+		if (exported.packageName !== asset.packageName || exported.arch !== asset.arch
+			|| exported.shellPath !== path.join(installedRoot, "runtime", "niu.exe")) {
+			throw new Error(`${asset.packageName} has an invalid runtime export`);
+		}
+		const bytes = fs.statSync(path.join(tmp, entry.filename)).size;
+		log(`[piweb] ${entry.filename}: ${checked.files} runtime files, ${(bytes / 1024 / 1024).toFixed(1)} MB.`);
+		return { filename: entry.filename, files, bytes, runtimeFiles: checked.files };
+	} finally {
+		fs.rmSync(tmp, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	}
+}
+
+export function verifyManagedNiubashPackages(root, { log = console.log } = {}) {
+	const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+	const results = [];
+	for (const asset of Object.values(MANAGED_NIUBASH_ASSETS)) {
+		if (manifest.optionalDependencies?.[asset.packageName] !== NIUBASH_DISTRIBUTION_VERSION) {
+			throw new Error(`PiWeb must use exact optional dependency ${asset.packageName}@${NIUBASH_DISTRIBUTION_VERSION}`);
+		}
+		results.push(verifyPackedManagedNiubashPackage(path.join(root, "platform-packages", asset.directory), asset, { log }));
+	}
+	return results;
+}
+
 if (isMainModule(import.meta.url)) {
 	try {
 		verifyPackedPackage(DEFAULT_ROOT);
+		verifyManagedNiubashPackages(DEFAULT_ROOT);
 	} catch (error) {
 		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
 		process.exitCode = 1;